The Common Platform Enumeration (CPE) is an initiative to create an enumeration of different platform types. In short, CPE is a community driven initiative, sponsored by the US Government, and moderated by a third party. This document outlines the governance structure of this initiative and outlines the different roles and responsibilities of each interested party.
Roles and Responsibilities
There are a number of roles within CPE, each with a specific set of responsibilities. This section outlines each role and defines the responsibilities of each.
CPE Community
The CPE Community is a public forum (built around a discussion list) with open membership and includes representatives from tool vendors, service providers, primary-source vendors, user communities, academia, and government. The CPE Community forms the technical core of any CPE development. The responsibilities of the community are defined below.
- The CPE Community is responsible for providing a body of technical expertise representing the entirety of the security standards community for the Government Sponsor and CPE Moderator to draw on.
- The CPE Community should participate in ongoing technical discussion.
- The CPE Community is encouraged to submit items for discussion to the CPE Moderator.
Government Sponsor
CPE oversight is provided by the agency or other government organization that funds the moderation and development of the initiative. The responsibilities of the CPE Government Sponsor are defined below.
- The CPE Government Sponsor is responsible for monitoring the CPE Community and providing oversight for the CPE Moderator.
- The CPE Government Sponsor is responsible for making final decisions on any issues that could not be resolved by consensus within the CPE Community.
- The CPE Government Sponsor shall accept and hear appeals from the CPE Community regarding decisions proposed by the CPE Moderator.
CPE Moderator
Moderation of a community driven initiative like CPE is vital to the success and well being of the initiative. The CPE Community will often have multiple conflicting views and an unbiased arbitrator is needed to determine the correct approach to take. Moderation makes sure everyone's voice is heard and that progress is based on an assessment of everyone's needs. It is important that the moderator be separate from the CPE Community and that the moderator does not have an interest in the use of CPE due to internal development of an implementation. Such an implementation would create a conflict of interest and would interfere with the CPE Moderator's job. The responsibilities of the CPE Moderator are defined below.
- The CPE Moderator is responsible for developing and maintaining (at the direction of the CPE Government Sponsor) the specification that defines the CPE initiative.
- The CPE Moderator is responsible for providing strategic and technical input to help keep the CPE Government Sponsor updated regarding the status of the initiative.
- The CPE Moderator shall define and document requirements for correct usage of CPE based on consensus within the CPE Community.
- The CPE Moderator is responsible for monitoring discussions within the CPE Community. This includes working to build consensus within the CPE Community on individual issues.
- The CPE Moderator is responsible for ensuring that information on all issues or proposals submitted for resolution are posted and available to all on the group discussion site.
- The CPE Moderator shall maintain a public list of open and resolved issues.
- The CPE Moderator is responsible for providing the CPE Community with insight and guidance for implementing the processes used to evolve of the standards.
- The CPE Moderator shall operate education, outreach, and adoption programs for CPE, consistent with funding and authorization by the government sponsor.
Consensus Process
One of the responsibilities of the CPE Moderator is to monitor the on-line discussion list and/or group meetings and to build consensus among members of the CPE Community. This section helps guide this process and establishes some expectations.
Decisions
The CPE Moderator shall ensure that issues brought forward by the CPE Community, whether major or minor, are open to the community for discussion for a minimum of two weeks. Based on the intensity and frequency of discussion on certain issues, the CPE Moderator may extend discussion by up to two weeks over the required minimum. Once an issue has been open for discussion for the minimum time period or has reached the maximum allowed, the CPE Moderator will summarize the issue, and advise the CPE Government Sponsor whether a consensus has been reached or whether a vote is required.
If a vote is required, the CPE Moderator shall distribute a summary issue paper to the CPE Community for discussion for an additional week. At the end of that week, the moderator shall organize a vote within the CPE Community to be held over a three-day period. All members within the CPE Community can participate in the vote, but each vote should include a justification or explanation. The CPE Moderator will tally votes and forward a recommendation to the CPE Government Sponsor. The CPE Government Sponsor will review the original summary issue paper and the results vote, and then publish a final decision to the CPE Community describing the issue and explaining the decision. The decision will be open to appeal for three days following the publication of the finding. If no appeals are filed, then the decision is final as of the start of the fourth business day following publication.
Right of Appeal
Government stakeholders as well as members of the CPE Community may appeal a decision, whether reached by consensus or vote, directly to the ISAP Working Group . If an appeal is made, the Government Sponsor and the CPE Moderator each explain the issue and justification for the decision to the ISAP Working Group co-chairs, whose vote will decide the issue.
overview | faqs | governance | contact us
|
