Should C2 align more closely with the device capabilities list in draft NISTIR 8259v2? #2
Description
The two baselines materially align. Would it be better to align more, or does it matter?
For examples of "aligning better":
- We could merge the Data At Rest and Data In Transport sections to make a Data Is Protected section like 8259
- We could subsume Data Validation under Secured Access.
...these are just examples...
On the other hand, this may not be necessary. NIST has pointed out that C2 is effectively a "multi-sector core baseline" that enhances the message in 8259v2.