Inherited Controls
OpenRMF® Professional also allows inheriting other system packages’ controls. When inheriting controls (sometimes referred to common controls) you can specify 1, several or all of the controls from another system package withing your OpenRMF® Professional installation as inherited into your system package. There is no limit to the number of system packages you can inherit from, as well as no limit to the number that can inherit from your package.
When you click Inherited Controls in your system package you will see the list (if any) of controls as well as their title, status and owning system package. You can also click the green plus icon to view the vulnerability listing for that control as well.
Note: You cannot view the system package’s checklists, compliance, patch scan information or other data even if you inherit from them. You only get a glimpse into the controls you inherit. Anyone in the system package can view inherited controls. Only certain individuals with the right permissions can view another package’s controls and add them into your system package.
Adding Inherited Controls
To add inherited controls, you must be a System Owner of your system package. And you must be a part of the “InheritSecurityControls” permission set in the system package whose controls you wish to inherit. And that system package must have a saved compliance listing to pull from for inherited controls. That combination of things must happen or you will not be able to add any inherited controls.
To Add inherited controls click the Add Inherited Controls button from the Inherited Security Controls page. Then choose one of the Available Control Sets from the drop down and the list of controls and status appears. Click one or more checklists to select those controls and then Add Inherited Controls. If you truly want to add all controls just click the Add All Controls button and all will be added for that system package.
Repeat this process for all system packages you wish you inherit. When done you can click the View Inherited Controls menu button to view the controls selected. If you add a control already in the listing, the new control will just overwrite the existing control record.
When you add inherited controls, a notification for the inheriting system package members (those inheriting form you) is generated as well under Notifications to make sure they know. It is up to them to generate and save a new compliance listing.
Note that any time you add a control you may want to generate and save the new compliance with a description explaining what you just did.
Deleting Inherited Controls
If you wish to remove an inherited control, from the Inherited Security Controls page click the checkbox next to the control. Then click the Delete Inherited Controls button that appears.
Note that any time you delete a control you may want to generate and save the new compliance with a description explaining what you just did.
Inherited Control Automation
All controls you inherited are tied and linked to the underlying compliance of the inherited system package. As that system package updates and saves a NEW compliance listing, behind the scenes all controls inherited are updated for those other system packages inheriting the controls. And a notification of “Updated Inherited Controls” is generated for every system package that inherits from you.
Additionally, any inherited control listed whose status is not “Not a Finding” is added as an inherited control to the POAM automatically. Any update to the control status when updated is also reviewd. Any change to “Not a Finding” is marked completed in the POAM. And any control whose status is not “Not a Finding” is added or reopened to In Process.
