I'm not a fan of using the string "disa" to reference the CCI controls. From my understanding CCI's are unique identifiers which can map back to several different policies. For example CCI-000370 maps to:
- DISA SRG-OS-00022
- DISA Group V-30388
- DISA OS SRG Rule SV-40055r1
- NIST 800-53 CM-6 (1)
- NIST 800-53 CM-6 (1).1
Not exactly. The actual CCI only maps back to the NIST 800-53 rules.
The other thing(s) (which are all redundant labels for the OS SRG item) are in fact derived from the CCI. The OS SRG is a selection of CCIs relevant to operating systems, with their language adjusted to make their applicability to operating systems more apparent. (Note that the CCI list and the OS SRG are separate documents.)
(The redundant labels for an SRG item are a result of the implementation of DISA's VMS, which seems peculiar in many ways.) I chose to use only the CCI number (notated as "disa=") as I believe it to be a longer-term identifier, and DISA's primary identifier.
You can think of the relationship between the different documents like this, with each one becoming more class/product specific:
800-53 => CCI List => SRG => STIG
If we start tagging the CCI's as <ref disa..> I think it will get very confusing. Objections to a patch naming them CCI instead of DISA? This would allow a tag such as below which I think is cleaner.
<ref nist="CM-6 (1).1, CM-6" cci="000370" ossrg="00022">
I don't object to renaming "disa=" as "cci=". Such a renaming would largely be for aesthetic purposes (though this conversation reveals that there may be some value in comprehensibility/disambiguation). That said, I do object to this particular tag since the "ossrg=" attribute is redundant to what you are calling "cci". It provides no value so long as there is a one-to-one function from OS SRG identifiers to CCIs.