MITRE ATT&CK v12 mapping

[MaurizioCasciano]

Hi, are there any plans to include the mappings between CIS Controls and MITRE ATT&CK techniques?

Something similar to what has been provided here https://github.com/CISecurity/CISControls_OSCAL/blob/main/src/mappings/SP_800_53MOD_CISControlsv8_Mapping.xml for NIST SP 800-53 Rev 5 Moderate

E.g.

<?xml version="1.0" encoding="UTF-8"?>
<mapping-collection xmlns="http://csrc.nist.gov/ns/oscal/1.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 ../../../xml/schema/oscal_complete_schema.xsd"
	uuid="1c02b862-65b8-4019-b6f6-2cc32dba7c9c">
    <metadata>
        <title>Example of mapping between CIS Controls v8 and MITRE ATTCK v12 Techniques</title>
		<last-modified>2022-08-31T00:00:00.0000001-04:00</last-modified>
        <version>0.0.1</version>
        <oscal-version>1.1.0-alpha</oscal-version>
    </metadata>
	
	<mapping uuid="0327d26a-83bd-443a-9aa4-45198efccdc5">
		<source-resource type="catalog" href="#7f0c0991-54d6-489a-a8d1-30e61b3de4fe"/>
		<target-resource type="catalog" href="#5c01a62a-0912-45dd-9916-ff66656dc602"/>
		<map uuid="7056a072-6c88-4e0f-b28d-2c64a1417605">
			<relationship>subset-of</relationship>
			<source type="control" id-ref="#cis-1.1"/>
			<target type="attack-pattern" id-ref="#T1200">
			</target>
		</map>
		<map uuid="ce1c015d-78f2-4ce3-b392-0cad485189bb">
			<relationship>subset-of</relationship>
			<source type="control" id-ref="#cis-1.2"/>
			<target type="attack-pattern" id-ref="#T1200">
			</target>
		</map>
	<mapping>
</mapping-collection>

[MaurizioCasciano]

Hi @ginger-anderson @aj-stein-nist @david-waltermire-nist, I'd like to ask you how should we provide this mapping using the OSCAL standard?
I have seen that the OSCAL OSCAL Control mapping mainly controls of different frameworks
https://pages.nist.gov/OSCAL/reference/develop/mapping/json-definitions/

The OSCAL Control mapping format can be used to describe how a collection of security controls and related control enhancements relate to another collection of controls. The root of the Control Catalog format is mapping-collection.

On the CIS Controls Navigator https://www.cisecurity.org/controls/cis-controls-navigator/
it is possible to see the mappings between CIS Controls and the MITRE Enterprise ATT&CK v8.2

E.g.
CISC-1.1 --> T1200

We should also include information about the target framework (domain, version, ...) and allow multiple targets mappings from a single controller to multiple targets from different sources.
How could we proceed with this feature, mapping CIS Control --> MITRE ATT&CK Techniques ?

[vbrifo]

Hello,

You should be able to find what you're looking for at https://workbench.cisecurity.org/files/3664

FYI

• Safeguards from v8 are mapped on an older version of MITRE ATT&CK
• The file comes from CIS CDM community https://workbench.cisecurity.org/communities/85