Standards

The Standards Coordinating Council is developing this resource for identification of, and research on, open standards and standards projects that support data transactions and exchanges useful to our information sharing and safeguarding goals. Additional recommendations are very welcome. If you would like to make recommendations for additions to this list, please contact the Standards Coordinating Council at info@standardscoordination.org


Description: An automated framework for malware analysis and threat intelligence within a secure community.


Host Organization: Georgia Tech Research Institute (GTRI)


Status: Public material available for standardization.


Find out more at: http://apiary.gtri.gatech.edu/


Description: Simple general purpose eXtensible Markup Language (XML) format for capsuling all information required for an alert and/or notification.  It is the core standard used by the NOAA NWS and others in the US for posting alerts to the DHS/FEMA IPAWS for public alerting.  See also CAP IPAWS Also an International Telecommunications Union Telecommunication Standardization Sector (ITU-T) standard X.1303.


Host Organization: OASIS


Status: Stable, international, open industry standard.


Find out more at: http://docs.oasis-open.org/emergency/cap/v1.2/CAP-v1.2-os.html


Description: Focuses on Internet of Things (IoT) vulnerabilities; based on Common Vulnerability Reporting Framework (CVRF) specification originally developed by Industry Consortium for Advancement of Security on the Internet (ICASI).


Host Organization: OASIS


Status: New project.


Find out more at: https://lists.oasis-open.org/archives/tc-announce/201609/msg00012.html 


Description: Formalized list of software vulnerability types.


Host Organization: Dept. of Homeland Security/Natl. Institute of Standards and Technology/MITRE


Status: Public material available for standardization.


Find out more at: https://cwe.mitre.org/about/index.html


Description: Secure gateway for law enforcement, intelligence, and criminal justice entities to share data resources including nationwide criminal justice records, global cyber-complaint data, and information sharing networks.


Host Organization: Federal Bureau of Investigation


Status: Existing government sharing community.


Find out more at: https://www.cjis.gov/CJISEAI/EAIController


Description: A standardized schema for the specification, capture, characterization, and communication of events or stateful properties that are observable in the operational domain, e.g., in event reporting.


Host Organization: OASIS (Contributed by Dept. of Homeland Security/MITRE)


Status: Public material available for standardization.


Find out more at: https://www.oasis-open.org/committees/cti


Description: The ebXML RegRep standards define methods and exchanges for sharing and querying database-type information across a series of federated independent participants. Version 2 also is an ISO Standard; v4 has been submitted for ISO approval.


Host Organization: OASIS


Status: Stable, open industry standard.


Find out more at: http://docs.oasis-open.org/regrep/regrep-core/v4.0/regrep-core-overview-v4.0.html


Description: EDXL Distribution Element (EDXL-DE) v1.0 is a flexible, XML content-based routing standard to specify to whom and under what circumstances data is to be sent or received.


Host Organization: OASIS


Status: Stable, international, open industry standard.


Find out more at: http://docs.oasis-open.org/emergency/edxl-de/v1.0/EDXL-DE_Spec_v1.0.pdf


Description: EDXL Distribution Element (EDXL-DE) v2.0 is a flexible, XML content-based routing committee specification to specify to whom and under what circumstances data is to be sent or received.


Host Organization: OASIS


Status: Stable, international, open industry committee specification.


Find out more at: http://docs.oasis-open.org/emergency/edxl-de/v2.0/edxl-de-v2.0.pdf


Description: EDXL Hospital Availability Exchange (EDXL-HAVE) v1.0 is a flexible standard to specify hospital bed capacity and support services.


Host Organization: OASIS


Find out more at: http://docs.oasis-open.org/emergency/edxl-have/os/emergency_edxl_have-1.0-spec-os.pdf


Description: EDXL Resource Messaging v1.0 is a flexible XML standard to specify resource request and fulfillment messaging during emergency circumstances including scheduling information.


Host Organization: OASIS


Status: Stable, international, open industry standard.


Find out more at: http://docs.oasis-open.org/emergency/edxl-rm/v1.0/EDXL-RM-SPEC-V1.0.pdf


Description: EDXL-TEP is an XML messaging standard primarily for exchange of emergency patient and tracking information from the point of patient encounter through definitive care admission or field release. TEP supports patient tracking across the Emergency Medical Services (EMS) care continuum, as well as hospital evacuations and patient transfers, providing real-time information to responders, emergency management, coordinating organizations, and care facilities in the chain of care and transport.


Host Organization: OASIS


Status: Stable, international, open industry standard.


Find out more at: http://docs.oasis-open.org/emergency/edxl-tep/v1.1/cs01/edxl-tep-v1.1-cs01.pdf


Description: Selective and fine-grained information provisioning via a common access control language. See particularly the XACML profiles for Hierarchical Role Based Access Control (RBAC), and Data Loss Prevention/Network Access Control (DLP/NAC). XACML v3.0 also is an ITU standard.


Host Organization: OASIS


Status: Stable, open industry standard.


Find out more at: http://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html and https://www.oasis-open.org/committees/xacml/


Description: GeoXACML extends the OASIS XACML standard to provide geospatial resource access control security for use cases of data resources bearing mixed classification levels.


Host Organization: Open Geospatial Consortium (OGC)


Status: Stable, open industry standard.


Find out more at: http://www.opengeospatial.org/standards/geoxacml


Description: The OGC Testbed 11 Geo4NIEM initiative is utilizing NIEM and the OGC GeoXACML, GML, and WFS standards to prototype the exchange of security-tagged payloads.


Host Organization: Open Geospatial Consortium (OGC)


Status: Open standards project.


Find out more at: http://www.opengeospatial.org/projects/initiatives/testbed11


Description: The OGC Testbed 10 Geo4NIEM prototyping initiative examined approaches for encapsulation and transformation of geospatial data between NIEM and GML.


Host Organization: Open Geospatial Consortium (OGC)


Status: Open standards project.


Find out more at: http://portal.opengeospatial.org/files/?artifact_id=55342


Description: Multiple specifications and profiles are available from the Bureau of Justice Assistance, covering a wide range of point-to-point justice administration data sharing exchanges. These often re-use existing industry standards; for example, the Global Federated Identity and Privilege Management guidelines profile the OASIS SAML standard for situations where trusted partners in different jurisdictions wish to implement single or simplified sign-on use cases.


Host Organization: Dept. of Justice, Office of Justice Programs, Bureau of Justice Assistance


Status: Existing government standard(s) and practice(s).


Find out more at: http://it.ojp.gov/global and https://it.ojp.gov/gist/Guide/47/Show-me-all-information-sharing-components-contained-in-the-entire-Global-Standards-Package-


Description: Task force focused on providing model driven architecture solutions for government. UML Profile for National Information Exchange Model (NIEM) 3 and Record Management Services (SOX) are two examples.


Host Organization: Object Management Group (OMG)


Status: Open standards community.


Find out more at: http://gov.omg.org/


Description: eXtensible Markup Language (XML) data format for incident response teams exchanging of cyber incident information.


Host Organization: Internet Engineering Task Force (IETF)


Status: Stable, open industry standard.


Find out more at: http://www.ietf.org/rfc/rfc5070.txt


Description: Uses National Information Exchange Model (NIEM) eXtensible Markup Language (XML) schemas and secure web services standards for exchange of court filing and docket administration information.


Host Organization: OASIS


Status: Stable, open industry standard.


Find out more at: https://www.oasis-open.org/committees/legalxml-courtfiling/ and http://docs.oasis-open.org/legalxml-courtfiling/specs/ecf/v4.01/ecf-v4.01-spec/errata01/os/ecf-v4.01-spec-errata01-os-complete.html


Description: LEXS is a comprehensive, National Information Exchange Model (NIEM)-based, framework for the development of information exchanges. Initially developed for the law enforcement information sharing program at US Department of Justice, LEXS is now being widely used in criminal justice community at large, as well as by the homeland security, intelligence and other communities. 


Host Organization: Georgia Tech Research Institute (GTRI) on behalf of the US Department of Justice Chief Information Officer


Status: Stable, open industry standard.


Find out more at: http://lexsdev.icl.gtri.org/


Description: Extensible core and domain data taxonomy and vocabularies, widely used in inter-governmental data exchanges, originally emanating from state and federal justice administration. Includes Naming & Design Rules and Conformance documentation.


Host Organization: Dept. of Justice/Dept. of Homeland Security/Dept. of Health and Human Services


Status: Existing government standard or practice.


Find out more at: https://www.niem.gov/technical/Pages/The-Model.aspx and https://www.niem.gov/technical/Pages/version-3.aspx


Description: The OGC Testbed 9 Security initiative prototyped broad security management capabilities based on the OGC GeoXACML standard and the OASIS WS-Federation standard for web service transactions such as role- and attribute-based authentication and authorization.


Host Organization: Open Geospatial Consortium (OGC)


Status: Open standards project.


Find out more at: http://portal.opengeospatial.org/files/?artifact_id=51806


Description: A set of risk taxonomy (O-RT) and risk analysis (O-RA) specifications for describing and assessing information security risks (including human and business factors).


Host Organization: The Open Group


Status: Stable, open industry standard.


Find out more at: https://www2.opengroup.org/ogsys/catalog/C13G (O-RA) and https://www2.opengroup.org/ogsys/catalog/C13K (O-RT)


Description: Semantic data structures for software delivery, updating, audit and control, using W3C Linked Data Platform specifications.


Host Organization: OASIS


Status: Stable, open industry standard.


Find out more at: https://www.oasis-open.org/committees/oslc-core/ and http://open-services.net/specifications/


Description: O-TTPS provides a set of organizational guidelines, requirements, and recommendations for integrators, providers, and component suppliers to enhance the integrity of data and ICT products throughout their lifecycle by sharing data regarding maliciously tainted or counterfeit components and products. Also has been submitted for PAS approval to ISO/IEC JTC1.


Host Organization: The Open Group


Status: Stable, open industry standard.


Find out more at: http://opengroup.org/standards/trusted-technology-standards


Description: The Object Management Group (OMG) operational threat and risk standards initiative is focused on driving the federation, analytics, and secure sharing of threat, risk, and provenance information across multiple domains, technologies, and data formats. Domains of interest that are being federated include, but are not limited to, cybersecurity, law enforcement and public safety, counterterrorism, critical infrastructure, health, and emergency management. 


Host Organization: Object Management Group (OMG)


Status: Open standards project.


Find out more at: http://www.threatrisk.org


Description: Methodology and model for applying access rules and policies to implemented data services.


Host Organization: OASIS


Status: Stable, open industry standard.


Find out more at: http://docs.oasis-open.org/pmrm/PMRM/v1.0/cs02/PMRM-v1.0-cs02.html


Description: Working group dedicated to coordinating, guiding, and promoting the use and evolution of end-to-end embedded systems security technology.


Host Organization: Object Management Group (OMG)


Status: Open standards community.


Find out more at: http://sfsig.omg.org/index.htm


Description: Methodology and model for applying access rules and policies to implemented data services.


Host Organization: OASIS


Status: Stable, open industry standard.


Find out more at: http://docs.oasis-open.org/pmrm/PMRM/v1.0/cs02/PMRM-v1.0-cs02.html


Description: A structured argument specification that includes a Software Assurance Evidence MetaModel and an Argumentation MetaModel relating claims, evidence, and arguments.


Host Organization: Object Management Group (OMG)


Status: Stable, open industry standard.


Find out more at: http://www.omg.org/spec/SACM/


Description: A community-driven structured language for Cyber Threat Intelligence Information. Schemas in XML with other serializations planned. STIX uses CybOX expressions.


Host Organization: Dept. of Homeland Security/MITRE


Status: Public material available for standardization.


Find out more at: https://www.oasis-open.org/committees/cti and https://www.oasis-open.org/standards#stix1.2.1


Description: Task force dedicated to System and Software Assurance.


Host Organization: Object Management Group (OMG)


Status: Open standards community.


Find out more at: http://sysa.omg.org/


Description: A defined set of services and message exchange patterns for sharing of actionable cyber threat information across organization and product/service boundaries. TAXII can be used as a transport and sharing methods for STIX.Host Organization: Dept. of Homeland Security/MITREStatus: Public material available for standardization.Find out more at: https://www.oasis-open.org/committees/cti and https://www.oasis-open.org/standards#taxii1.1.1


Description: Data governance structure, standardized process models, and best practices for e-government and public-private data cooperation. See particularly Pattern [B5]: Stakeholder Collaboration.


Host Organization: OASIS


Status: Stable open industry standard.


Find out more at: http://docs.oasis-open.org/tgf/TGF/v2.0/cs01/TGF-v2.0-cs01.html 


Description: Web services specification providing mechanisms to allow different security realms to federate, within a secure environment, such that authorized access to resources managed in one realm can be provided to security principals whose identities and attributes are managed in other realms. Includes methods for brokering of identity, attribute, authentication and authorization assertions between realms, and privacy of federated claims.


Host Organization: OASIS


Status: Stable open industry standard.


Find out more at: http://docs.oasis-open.org/wsfed/federation/v1.2/os/ws-federation-1.2-spec-os.html