Taxonomy

We defined the following DRAFT KSI Taxonomy to align with CR26 terminology and Security Decision Record (SDR) schema fields. We expanded on this where necessary, but avoided deviations. After understanding this Taxonomy, see Guiding Principles.

Taxonomy elements are named in the singular; a KSI's Design may reference more than one instance of any element (e.g., multiple Data Sources reconciled by a single Data Analysis rubric).

The taxonomy of a KSI includes:

• Requirement: The required KSI as defined by the PMO in CR26.
• Definition (What): Explanation of measures and objectives demonstrating KSIs. Consistent with SDR-CSX-KSI, this content is provided by the CSP in the SDR. The definition includes:
  • Subject: The capability the KSI's claim is about.
  • Attribute: The specific observable property of that Subject being examined.
  • Cycle: The timing pattern governing when data is collected. Expressed either as a frequency, trigger or both.
  • Rationale: Why the measurement supports the KSI.
• Acquisition and Analysis (How):
  • Data Source: Where Evidence of an attribute is found.
    • Acquisition Basis: Categorizes the nature of the Evidence as received, before Data Analysis is performed. See Guiding Principles: Measurement Basis below for details.
    • Provenance Agent: Categorizes the actor that makes the data available ahead of its acquisition by the Collection Mechanism. See Guiding Principles: Agent Basis below for details.
  • Data Characteristics: The format, units of other characteristics of the Evidence that impact Data Analysis.
  • Data Analysis: The correlation logic, thresholds, or other rubric applied to Telemetry to produce a Finding. See Guiding Principles: Measurement Basis below for details.
    • Analysis Basis: Categorizes the nature of the logic applied to produce the Finding.
    • Analysis Agent: Categorizes the mechanism that performs the analysis. See Guiding Principles: Agent Basis below for details.
  • Collection Mechanism: A description of an automated mechanism performing data acquisition, including the technical method used to acquire the evidence, such as an API call.
  • Analysis Mechanism: A description of the mechanism performing Data Analysis.
• Evidence:
  • Telemetry: The actual data acquired by a Collection Mechanism from its Data Source, per the defined Cycle.
  • Finding: The conclusion reached by applying the Data Analysis to the actual Telemetry. This is the KSI-aligned determination of the subject's performance.