OpenRMF® OSS is an open source application for managing, viewing, and reporting of your DoD STIG checklists, SCAP Scans and Nessus Patch Scans in one web-based interface using your browser. It also generates a compliance listing of all your checklists across a whole system based on NIST 800-53 for your Risk Management Framework (RMF) documentation and process. This tool helps you manage multiple systems going through the RMF process and allows you to structure your data in a clean interface all in one location for your group or program.
You can export your checklists as CKL files and your test plan and POAM as MS Excel properly formatted files as well.
If you need more than the OSS version, check out OpenRMF® Professional.
- custom checklist templates
- CIS scans
- Parsing patch vulnerabilities for hardware, software, PPSM
- history and trends
- deeper level of security on system packages
- full text searching of all checklist content
- live POAM
- journal entries on changes
- bulk editing and locking vulnerabilities and checklists
- Compliance down to the subcontrol level, overlays, tailoring, compliance statements
- Generate SSP, SAR, RAR, CCRI documents
- add in tracking of other vulnerabilities (software, container, infrastructure-as-code, etc.)
- and more...
The OpenRMF® OSS application is a highly advanced alternative to the DISA STIG Viewer.jar and MS Excel hell we go through used for DoD STIG checklist files, SCAP Scans, Nessus ACAS scans, RMF process information, and the like. It is necessary to capture and report on this information, please do not mistake what I say for not agreeing with securing services. However, the DISA Java tool itself is horribly designed and not conducive to today's environment and use. And it is only part of the story. Their Java tool has been like this for a loooooonnnnnngggg time and I have wanted to make something better (IMO) for almost as long. So this tool here is the start!
It is a way (currently) to view, report on, dive into, manage, and export your STIG checklists no matter which checklist you are referring to. All the .CKL files have a common format and htis reads and displays/manages that in a web front end using .NET Core APIs, MongoDB and NATS messaging. View the history of this tool on our website.
OpenRMF® OSS also is a single pane of glass for your DISA SCAP scans (to generate checklists), Nessus SCAP scans, Nessus patch scans (to track patch management), and compliance reporting for your systems going through the RMF process. We know: the RMF process is manual and all inclusive! This tool helps to automate as much as possible on the managing and reporting of data so you can:
- Know your current Risk Profile
- Know your current status
- Know what is left to do
- Know what your Critical and High items are so you can track and attack them
This particular repository is the repo for all the docs as the OpenRMF® OSS project goes along. Documentation on the OpenRMF® OSS application will be here in MD files and reference images and other documents as well as GH markdown. This application idea has been brewing in my head for well over a decade and specifically since July 4th weekend 2018 when I started to put down code. Then in January 2019 when I scrapped all that July stuff and went for web APIs, microservices, eventual consistency, CQRS (command query responsibility segregation to scale separately), using MongoDB and NATS.