Subject: [saag] SACM report

From: Karen O'Donoghue <[email-masked]>
Date: Thu, 7 Apr 2016 13:00:15 +0000

SACM met on Wednesday to discuss it’s recently adopted vulnerability assessment draft [1], a couple of individual submissions (software identification [2] and endpoint compliance profile [3]), and the SACM information model [4][5].

SACM will meet again on Friday to discuss it’s terminology draft [6], and the work done this week on solidifying the structure of our information model.

Our requirements draft [7] has made it through WGLC and we intend to prepare this for shepherding through the IESG.

During the Wednesday meeting there was consensus, which will be verified on the list, to adopt the software identification I-D [2] as a WG draft.

The endpoint compliance profile draft will be updated at least once more to make some clarifications before the WG is willing to consider adoption.

[1] https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/
[2] https://datatracker.ietf.org/doc/draft-birkholz-sacm-coswid/
[3] https://datatracker.ietf.org/doc/draft-haynes-sacm-ecp/
[4] https://datatracker.ietf.org/doc/draft-ietf-sacm-information-model/
[5] https://tools.ietf.org/html/draft-cam-winget-sacm-information-model-00
[6] https://datatracker.ietf.org/doc/draft-ietf-sacm-terminology/
[7] https://datatracker.ietf.org/doc/draft-ietf-sacm-requirements/