cyber (26mar15)

git-svn-id: svn://tug.org/texlive/trunk@36633 c570f23f-e606-0410-a88d-b1316a301751

1 files changed, 1111 insertions, 0 deletions

diff --git a/Master/texmf-dist/source/latex/cyber/cyber.dtx b/Master/texmf-dist/source/latex/cyber/cyber.dtx
new file mode 100644
index 00000000000..ddda419843e
--- /dev/null
+++ b/Master/texmf-dist/source/latex/cyber/cyber.dtx
@@ -0,0 +1,1111 @@
+% \iffalse meta-comment
+% Copyright (c) 2015 Jared Jennings <jjennings@fastmail.fm>
+%
+% Permission is hereby granted, free of charge, to any person
+% obtaining a copy of this software and associated documentation
+% files (the "Software"), to deal in the Software without
+% restriction, including without limitation the rights to use, copy,
+% modify, merge, publish, distribute, sublicense, and/or sell copies
+% of the Software, and to permit persons to whom the Software is
+% furnished to do so, subject to the following conditions:
+%
+% The above copyright notice and this permission notice shall be
+% included in all copies or substantial portions of the Software.
+%
+% THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+% EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+% MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+% NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+% BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+% ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+% CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+% SOFTWARE.
+% \fi
+%
+% ^^A We cannot \usepackage{cyber}, because it pulls in index,
+% ^^A which screws up Doc's attempts to index all the macros we use.
+% ^^A Therefore we do not get \filedate and \fileversion for free.
+% \def\filedate{2015/03/21}
+% \def\fileversion{v2.0}
+% \iffalse
+%<package>\NeedsTeXFormat{LaTeX2e}
+%<package>\ProvidesPackage{cyber}
+%<package>   [2015/03/21 v2.0 Use index package instead of multind]
+%
+%<*driver>
+\documentclass{ltxdoc}
+
+\usepackage{fancyvrb}
+\DefineShortVerb{\|}
+
+
+% Make PDF magic happen.
+% Thanks, Patrick Joeckel:
+% http://www.mpch-mainz.mpg.de/~joeckel/pdflatex/
+% Note that I expect always to use pdflatex, not latex+dvipdf
+\usepackage[bookmarks=true,bookmarksnumbered=true,breaklinks=true,pdftex]{hyperref}
+\hypersetup{
+    colorlinks=false,
+    linkbordercolor={0.7 0.7 1.0}
+}
+
+\EnableCrossrefs
+\RecordChanges
+\CodelineIndex
+
+\begin{document}
+  \DocInput{cyber.dtx}
+\end{document}
+%</driver>
+% \fi
+%
+% \CheckSum{0}
+%
+% \CharacterTable
+%  {Upper-case    \A\B\C\D\E\F\G\H\I\J\K\L\M\N\O\P\Q\R\S\T\U\V\W\X\Y\Z
+%   Lower-case    \a\b\c\d\e\f\g\h\i\j\k\l\m\n\o\p\q\r\s\t\u\v\w\x\y\z
+%   Digits        \0\1\2\3\4\5\6\7\8\9
+%   Exclamation   \!     Double quote  \"     Hash (number) \#
+%   Dollar        \$     Percent       \%     Ampersand     \&
+%   Acute accent  \'     Left paren    \(     Right paren   \)
+%   Asterisk      \*     Plus          \+     Comma         \,
+%   Minus         \-     Point         \.     Solidus       \/
+%   Colon         \:     Semicolon     \;     Less than     \<
+%   Equals        \=     Greater than  \>     Question mark \?
+%   Commercial at \@     Left bracket  \[     Backslash     \\
+%   Right bracket \]     Circumflex    \^     Underscore    \_
+%   Grave accent  \`     Left brace    \{     Vertical bar  \|
+%   Right brace   \}     Tilde         \~}
+%
+% \changes{v1.0}{2011/07/18}{Renamed afseocmp to skiadoc}
+% \changes{v1.1}{2012/06/06}{Made skiadoc into a \LaTeX\ package}
+% \changes{v1.2}{2012/12/14}{Added support for other distribution statements
+% besides D; organization logo must now be provided by the document being
+% typeset}
+% \changes{v1.3}{2012/12/17}{Renamed skiadoc to iadoc}
+% \changes{v1.4}{2012/12/31}{Added indexing suppression macros}
+% \changes{v1.5}{2013/02/01}{Flattened all compliance indices into one}
+% \changes{v1.6}{2015/03/07}{Renamed iadoc to cyber: `IA' does not immediately mean anything outside the DoD, and the DoD has stopped using the term in preference to `cyber' anyway}
+% \changes{v2.0}{2015/03/21}{Use index package instead of multind}
+%
+% \title{The \textsf{cyber} package\thanks{This document corresponds to
+%   \textsf{cyber}~\fileversion, dated~\filedate.}}
+% \author{Jared Jennings \\ \texttt{jjennings@fastmail.fm}}
+%
+% \maketitle
+% \tableofcontents
+% \clearpage
+%
+%
+% \section{What \textsf{cyber} is for}
+%
+% This package helps you construct documents that talk about compliance with
+% named requirements.
+%
+% For example, U.S. National Institute of Standards and Technology
+% (NIST) Special Publication (SP) 800-53 sets out \emph{security
+% controls} for U.S. Federal agency information systems, one of which
+% is AC-2c, ``[The organization] establishes conditions for group and
+% role membership.'' You may wish to write a document that says, ``We
+% comply with AC-2c, and here's how.'' This package is for you.
+%
+%
+% \section{Document identifiers}
+%
+% Your document may talk about compliance with named requirements from multiple
+% sources. For example, besides compliance with NIST SP 800-53 you might want to
+% also talk about compliance with the U.S. Defense Information Systems Agency
+% (DISA) UNIX Operating System (OS) Security Requirements Guide (SRG). Now to
+% fully identify a requirement, you need to identify both the requirement and
+% the document it comes from, for example ``IA control IAAC-1,'' or ``UNIX SRG
+% Potential Discrepancy Item (PDI) GEN006480.''
+%
+% At the beginning of your document, you must identify all sources of named
+% requirements; then you can talk about those sources when you are identifying
+% the requirements. As examples here we use NIST SP 800-53, and assign it the
+% document identifier |secctrl|; and we use the UNIX SRG, identifying it by
+% |unixsrg|. See~\S\ref{document_identifiers} for more.
+%
+%
+% \section{Macros used in the body of your document}
+%
+% When you use the macros below to indicate requirements levied by policies
+% handed down from above, or parts of code or documentation that relate to
+% those requirements, you get some style for free, and an entry in an index.
+% Also, other automated document features are made possible which are not
+% strictly based on \LaTeX ; for example, a Puppet manifest annotated using
+% \textsf{cyber} may have a table of compliance which a script constructs
+% automatically by searching the manifest for uses of these macros.
+%
+% \subsection{Mentioning named requirements}
+%
+% Here are macros to use to indicate when you are talking about a specific
+% requirement. These tags do not indicate any compliance posture, just that
+% we're mentioning the requirement. So use these to refer to requirements in
+% passing. Just like the names of celebrities are sometimes set in bold type in
+% magazines, so that you can skip around and look for your favorite famous
+% person, we want to make it easy to find all mentions of a given named
+% requirement. 
+%
+% \begin{itemize}
+% \item
+% \DescribeMacro{\secctrl}
+% |\secctrl| \marg{control identifier}
+% \item
+% \DescribeMacro{\unixsrg}
+% |\unixsrg| \marg{PDI}
+% \end{itemize}
+%
+% The exact set of these macros depends on the set of requirements documents
+% named at the beginning of your document; see~\S\ref{document_identifiers}.
+%
+% Example:
+% \begin{Verbatim}[gobble=2]
+% Compliance with such and such requirement is similar to compliance with
+% \unixsrg{GEN002600}, \emph{q.v.}.
+% \end{Verbatim}
+%
+%
+% \subsection{Making assertions about compliance posture}
+%
+% Most mentions of named requirements are going to be something like, ``We
+% comply with bla requirement,'' or ``We don't comply with this one, and here's
+% why.'' The following tags make it quick and simple for you to write such
+% assertions.
+%
+%
+% \DescribeMacro{\documents}
+% Use |\documents| for notating some text in your document that says a fact
+% about a system which supports a requirement. It takes two parameters: the
+% type of requirement, and the name of the requirement. Example:
+%
+% \begin{Verbatim}[gobble=2]
+% \documents{secctrl}{SC-18} We use only JavaScript, which is Category I
+% mobile code according to DoD guidelines.
+% \end{Verbatim}
+%
+% Some requirements say something like, ``All \emph{mumble}s must be justified
+% and documented with the Information Assurance Officer (IAO).'' Use
+% |\documents| to assert either that those things are documented, right here,
+% or that you should look in \emph{bla} document to find that documentation.
+%
+% For example, the UNIX SRG requires that UNIX systems unable to require a
+% password to enter single-user mode must be documented with the IAO.
+%
+% \begin{Verbatim}[gobble=2]
+% \documents{unixsrg}{GEN000040} UNIX hosts unable to require a password
+% to enter single-user mode must be documented with the IAO. We administer
+% no such UNIX hosts.
+% \end{Verbatim}
+% (This is written in a document which is produced under the IAO's purview
+% and approval; otherwise it would have to point to another document which is
+% ``with the IAO.'')
+%
+%
+% \DescribeMacro{\notapplicable}
+% Just before some discussion about why a requirement is not applicable in a
+% certain situation, put the |\notapplicable| tag. For example:
+%
+% \begin{Verbatim}[gobble=2]
+% \notapplicable{secctrl}{SC-18(5)} We do not use mobile code at all.
+% \end{Verbatim}
+%
+% \DescribeMacro{\implements}
+% The |\implements| tag notates a section of code or documentation which
+% directly implements a requirement. It's usually used in automated policy. For
+% example, the UNIX SRG says under GEN001362, ``The \Verb!/etc/resolv.conf!
+% file must be owned by root.'' A piece of Puppet policy that implements this
+% requirement may go like:
+%
+% \begin{Verbatim}[gobble=2]
+% # \implements{unixsrg}{GEN001362} Make sure resolv.conf 
+% # is owned by root.
+%     file { '/etc/resolv.conf':
+%         owner => root,
+%     }
+% \end{Verbatim}
+%
+%
+% \DescribeMacro{\doneby}
+% The |\doneby| tag is for requirements that are not fulfilled in an automated
+% fashion: people are responsible for carrying them out on a day-by-day basis.
+% It takes three parameters: who exactly does this thing, the kind of
+% requirement, and the requirement's name. For example, the RHEL5 STIG requires
+% that SELinux be turned on when installing RHEL5. Administrators have to make
+% sure it's enabled during the install process.
+%
+% \begin{Verbatim}[gobble=2]
+% \doneby{admins}{rhel5stig}{GEN000000-LNX00800} Make sure SELinux is
+% enabled when installing RHEL5.
+% \end{Verbatim}
+%
+% \DescribeMacro{\bydefault}
+% Use the |\bydefault| tag to talk about how a product we use implements a
+% given requirement in its default configuration. It takes three parameters:
+% the product we're talking about, the kind of requirement, and the
+% requirement's name.---For example, the UNIX SRG says under GEN001300 that all
+% library files must have mode \Verb!0755! or less permissive. Both RHEL 5 and
+% RHEL 6 systems have this property by default.
+%
+% \begin{Verbatim}[gobble=2]
+% \bydefault{RHEL5, RHEL6}{unixsrg}{GEN001300} All library files under
+% RHEL are mode \Verb!0755! or less permissive by default.
+% \end{Verbatim}
+%
+%
+% \DescribeMacro{\unimplemented}
+% Use the |\unimplemented| tag to talk about a requirement we need to fulfill
+% but haven't yet. (Don't use |\unimplemented| to talk about a requirement
+% we don't intend ever to fulfill: it turns some things red to bring our
+% attention to them; we don't want false alarms.)
+%
+% Note carefully that this tag has three parameters: the kind of
+% requirement, the exact requirement, and \emph{the reason} the requirement
+% is unimplemented. You can't use \Verb!\Verb! in the reason. Stick with plain
+% text.
+%
+% \begin{Verbatim}[gobble=2]
+% \unimplemented{unixsrg}{GEN008380}{Unless root kit checking
+% functionality is provided by the virus scanner, we would likely
+% want to deploy {\tt chkrootkit}. But this software is not yet
+% approved...}
+% \end{Verbatim}
+%
+%
+%
+%
+% \section{Security labels}
+%
+% Some regulations require that documents be marked and labelled. These
+% tags help you do that.
+%
+% \DescribeMacro{\articlesecuritylabel}
+% When you are writing an article (|\documentclass{article}|), this tag helps
+% you label it. It will put the text you give at the top of every page. Put
+% the tag right after |\usepackage{cyber}|, as close to the top of the
+% document source as possible. That way it will be visible to viewers of the
+% document source as well.
+%
+% Most reStructuredText documents use the article class.
+%
+% Example, in \LaTeX :
+% \begin{Verbatim}[gobble=2]
+% \articlesecuritylabel{UNCLASSIFIED//FOUO}
+% \end{Verbatim}
+%
+% \DescribeMacro{\booksecuritylabel}
+% |\booksecuritylabel| acts the same as |\articlesecuritylabel|, but this is
+% the one you should use if you are using the \textsf{book} document class.
+%
+% Part of marking a document properly is writing the distribution statement and
+% statement of disposition on the title page.
+%
+% See \url{http://www.dtic.mil/dtic/submit/guidance/distribstatement.html} on
+% distribution statements and on destruction of limited-distribution
+% unclassified documents.
+%
+% \section{Distribution statements}
+%
+% Write the distribution statement right after the security label. Statements
+% allowed by DoDI 5320.24 as of 23 August 2012 are A through F. Macros for
+% these are provided. Dates are set to |\today|. For guidance on the reasons,
+% see the DoD instruction.
+%
+% Just like you need |\maketitle| to make your |\title| show up, you need to
+% (instead) use |\makedodtitle| to make your distribution statement show up.
+%
+% \DescribeMacro{\distributionA}
+% To mark your document with Distro A (public release), write |\distributionA|
+% \marg{other information}. Local policies may require that you include a
+% reference number, or the name of the organization which cleared the document,
+% or some such. That's ``other information.''
+%
+% \DescribeMacro{\distributionB}
+% To U.S. Government agencies only: |\distributionB| \marg{reason why}
+% \marg{controlling office}.
+%
+% \DescribeMacro{\distributionC}
+% To U.S. Government agencies and their contractors: |\distributionC| \marg{reason
+% why} \marg{controlling office}.
+%
+% \DescribeMacro{\distributionD}
+% To DoD and DoD contractors only: |\distributionD| \marg{reason why}
+% \marg{controlling office}. 
+%
+% \DescribeMacro{\distributionE}
+% To DoD Components only: |\distributionE| \marg{reason why} \marg{controlling
+% office}.
+%
+% \DescribeMacro{\distributionF}
+% Only as directed by the controlling office or higher DoD authority:
+% |\distributionF| \marg{controlling office}.
+%
+% You are responsible for understanding what these statements mean and whether
+% you're allowed to use them.
+%
+%
+% \section{Document formatting aids}
+%
+% \subsection{DoD title page}
+% \DescribeMacro{\makedodtitle} In a book-class document, use
+% |\makedodtitle| instead of \Verb!\maketitle!  and you will get an
+% organization logo on your title page. You'll also get the distribution
+% statement. You must provide the organization logo, as a graphics file of a
+% suitable format (\emph{e.g.}, PNG or PDF if you're using \Verb!pdflatex!, EPS
+% if you're using \Verb!latex!, that sort of thing), entitled \Verb!org_logo!,
+% \emph{e.g.} \Verb!org_logo.png!.
+%
+% \subsection{Narrower margins}
+% \DescribeMacro{\narrowermargins}
+% Nobody appreciates the rules of typography these days. And making a bad
+% impression on auditors by submitting a document that doesn't look how they
+% expect is a needless risk.
+%
+% This macro narrows the margins, while leaving a sizable margin in which to
+% write text. It probably only works on books (not articles). It takes the
+% security label into account.
+%
+% In the top of your document, put |\narrowermargins| to make all of the
+% margins narrower by a half inch, increasing the text area by one inch
+% horizontally and one inch vertically.  You have to put it above the security
+% label.
+%
+% This has not been tested much, and only on a book-class document.
+%
+% \subsection{Change log}
+%
+% Most documents submitted in support of cybersecurity goals must
+% indicate what version they are, and what changes have happened between
+% versions. In software development terminology, these correspond to
+% \emph{releases}, not \emph{revisions} or \emph{changesets}; that is to say,
+% these versions are likely not to change more than once a month, and changes
+% are likely to be, ``Added a new chapter about foo,'' rather than ``Corrected
+% spelling on page 358.''
+%
+% Write a changelog and call it \Verb!changelog.tex!. Include it in your
+% front matter just after the table of contents. Its format is like so:
+%
+% \begin{Verbatim}[gobble=2]
+% \begin{changelog}
+%
+% \change{3 Aug 2011}{Jared Jennings}{Added Backup Plan}
+%
+% \change{2 Aug 2011}{Jared Jennings}{New server purchased; changed Hardware
+% Baseline to match}
+%
+% \end{changelog}
+% \end{Verbatim}
+%
+% Add new entries to the top of the changelog, not the bottom.
+%
+% \subsection{Executive summary}
+% An ``executive summary'' is supported. This is just a section containing a
+% table which lists the larger security controls this document is about.
+% Its format is like so:
+%
+% \begin{Verbatim}[gobble=2]
+% \begin{executivesummary}
+% \executivesummaryiacontrol{IAIA-1}{Individual Authentication}
+% \end{executivesummary}
+% \end{Verbatim}
+%
+% Put it after the changelog, after the ToC.
+%
+%
+% \section{Document identifiers}
+% \label{document_identifiers}
+%
+% To identify a requirement you want to talk about without ambiguity,
+% you need to give a name for both the requirement and the document it
+% came from.  Since document identifiers are written in potentially
+% hundreds of compliance tags across a document, they need to be
+% short, but unique. Here are some example document identifiers:
+%
+% \begin{description}
+% \item[iacontrol] Information Assurance Controls, laid out in DoDI
+% 8500.2, e.g. DCMC-1.
+% \item[secctrl] Security Controls, laid out in NIST SP 800-53, e.g. SC-18c.
+% \item[unixsrg] UNIX Security Requirements Guide (SRG) Potential
+% Discrepancy Identifiers (PDIs), e.g. GEN008520.
+% \item[rhel5stig] Red Hat Enterprise Linux (RHEL) 5 STIG PDIs.
+% \end{description}
+%
+% \subsection{Defining requirements documents}
+%
+% In the preamble of your document, you must tell \textsf{cyber} from which
+% documents your requirements will come. \DescribeMacro{\requirementsdocument}
+% Use the |\requirementsdocument| macro to do this. For example,
+%
+% \begin{Verbatim}[gobble=2]
+% \requirementsdocument{joesaidso}{Joe's Demands}{Demand }
+% \end{Verbatim}
+%
+% The first parameter is the document identifier, which is used in the
+% compliance tags. For example, after this |\requirementsdocument|, in the body
+% of our document we could write
+%
+% \begin{Verbatim}[gobble=2]
+% \documents{joesaidso}{Joe34} We close the door when going outside, because
+% Joe said to. Door-closing logs are kept just inside the door.
+% \end{Verbatim}
+%
+% The second parameter is the header under which all requirements from this
+% document will be placed in the Compliance index. Given the above code, the
+% index might look like:
+%
+% \begin{Verbatim}[gobble=2]
+% Compliance
+%
+%  Joe's Demands
+%    Joe34
+%      documented, 3
+% \end{Verbatim}
+%
+% The third parameter is the prefix with which requirements from this document
+% will be named. For example, if we were to write |\joesaidso{Joe34}| in the
+% body of a document, we would see ``Demand Joe34'' in the rendering of that
+% document.
+%
+%
+% \section{Adding \textsf{cyber} to a document}
+%
+% If you are editing or adding to an existing document which already uses
+% \textsf{cyber}, you need not concern yourself with this section.
+%
+% To use \textsf{cyber} in a new document: you should have the \textsf{cyber} package
+% installed; see
+% \url{http://en.wikibooks.org/wiki/LaTeX/Packages/Installing_Extra_Packages}. 
+%
+% At the top of your document, in its preamble, put the following lines:
+%
+% \begin{Verbatim}[gobble=2]
+% \usepackage{cyber}
+% \end{Verbatim}
+%
+% This makes the indices that the \textsf{cyber} tags put entries into. 
+%
+% Somewhere in the preamble of your document, after you use the \textsf{cyber}
+% package, tell \textsf{cyber} about all your |\requirementsdocument|s.
+%
+% Somewhere at the end of your document, put
+%
+% \begin{Verbatim}[gobble=2]
+% \printindex{cyber_compliance}{Compliance}
+% \end{Verbatim}
+%
+% This grabs the index made and makes it part of the final document.
+%
+%
+% \subsection{Controls in contents}
+%
+% If you want the IA controls covered in a section to be summarized in the
+% section's title written in the table of contents, use this additional
+% package:
+%
+% \begin{Verbatim}[gobble=2]
+% \usepackage{iacic}
+% \end{Verbatim}
+%
+% Write this after the usepackage directive for \textsf{cyber}. If you use the
+% hyperref package, write this statement after the usepackage directive for
+% hyperref.
+%
+% If you use iacic, your section titles cannot contain any formatting, and your
+% document cannot be originally written in reStructuredText. Section titles
+% written in the body text will not change: only the ones in the contents.
+% Section titles written in page headers will vary. In general this is a buggy,
+% wonky feature.  See \url{http://tex.stackexchange.com/questions/29818}. Dive
+% into the wonderful world of \TeX\ and \LaTeX . Learn you a fix for great
+% good!
+%
+%
+% \subsection{Temporarily suppressing index entries}
+%
+% If some part of your document is an auto-summary of another part of your
+% document, to index mentions of requirements in the summarized part may be
+% redundant and undesirable.
+%
+% \DescribeMacro{\Cyberindexingenabledfalse}
+%
+% \DescribeMacro{\Cyberindexingenabledtrue}
+%
+% Use these macros to turn off and on (respectively) indexing of compliance
+% assertions for part of your document. For example:
+%
+% \begin{Verbatim}[gobble=2]
+% \Cyberindexingenabledfalse
+% \include{auto_summary}
+% \Cyberindexingenabledtrue
+% \end{Verbatim}
+%
+%
+% \section{Interactions with other packages}
+% If you use \textsf{hyperref}, do so \emph{before} you use \textsf{cyber}.
+%
+% Because \textsf{cyber} requires \textsf{longtable}, you can't use two
+% columns in a document that uses \textsf{cyber}. The requirement for
+% longtable stems from the executive summary and changelog, which may have
+% enough rows to span pages.
+%
+% Because \textsf{cyber} requires \textsf{index}, any other package which
+% automatically indexes things may not work in conjunction with
+% \textsf{cyber}.
+%
+% \textsf{cyber} also pulls in \textsf{color}, \textsf{fancyhdr} and
+% \textsf{graphicx}.
+%
+%
+%
+%
+% \section{Implementation}
+%
+% \StopEventually{}
+%    \begin{macrocode}
+\makeatletter
+%    \end{macrocode}
+% We require longtable for the changelog and executive summary, which could span pages.
+%    \begin{macrocode}
+\RequirePackage{longtable}
+%    \end{macrocode}
+% We require color so that we can make red some text regarding unimplemented
+% requirements.
+%    \begin{macrocode}
+\RequirePackage{color}
+%    \end{macrocode}
+% There are potentially hundreds of requirements with which to comply. So we
+% want them in their own index.
+%    \begin{macrocode}
+\RequirePackage{index}
+%    \end{macrocode}
+% The \textsf{fancyhdr} package is how we add security labels.
+%    \begin{macrocode}
+\RequirePackage{fancyhdr}
+%    \end{macrocode}
+% And the graphicx package is needed so the organization's logo can be put on
+% the front page.
+%    \begin{macrocode}
+\RequirePackage{graphicx}
+
+%    \end{macrocode}
+% Index entries are written into the compliance index.
+%    \begin{macrocode}
+\newindex{cybercompliance}{cybercompliance.idx}{cybercompliance.ind}{Compliance}
+%    \end{macrocode}
+% Notations of compliance throughout the document are written in compliance.aux
+% and explanations.aux.
+%    \begin{macrocode}
+\AtBeginDocument{
+\newwrite\complianceaux
+\immediate\openout\complianceaux=cyber_compliance.aux
+\newwrite\explanationsaux
+\immediate\openout\explanationsaux=cyber_explanations.aux
+}
+
+\AtEndDocument{
+\immediate\closeout\complianceaux
+\immediate\closeout\explanationsaux
+}
+%    \end{macrocode}
+
+% The foreach code below is from:
+% \url{http://stackoverflow.com/questions/2402354/split-comma-separated-parameters-in-latex}
+% and/or \url{http://maraist.org/comma-separated-lists-in-latex_08-2009/}.
+% Added two extra pass-through parameters.
+%
+% \begin{macro}{\foreach}
+% Functional foreach construct.
+% Usage: |\foreach| \marg{macro} \marg{firstarg} \marg{secondarg}
+% \marg{third1,third2,third3,...}.  Evaluates to
+% |\macro{firstarg}{secondarg}{third1}| |\macro{firstarg}{secondarg}{third2}|
+% etc.
+%
+% Put another way: \meta{\#1} is a function to call once for each
+% comma-separated item in \meta{\#4}. \meta{\#2} and \meta{\#3} are parameters to
+% pass to function in \meta{\#1} as the first parameters.  \meta{\#4} is a
+% comma-separated list of items, each of which to pass as the third parameter
+% to an invocation of function \meta{\#1}.
+%    \begin{macrocode}
+\def\foreach#1#2#3#4{%
+  \@test@foreach{#1}{#2}{#3}#4,\@end@token%
+}
+%    \end{macrocode}
+% \end{macro}
+
+% Internal helper function - Eats one input.
+%    \begin{macrocode}
+\def\@swallow#1{}
+%    \end{macrocode}
+
+% Internal helper function - Checks the next character after \#1 and \#2 and
+% continues loop iteration if |\@end@token| is not found.
+%    \begin{macrocode}
+\def\@test@foreach#1#2#3{%
+  \@ifnextchar\@end@token%
+    {\@swallow}%
+    {\@foreach{#1}{#2}{#3}}%
+}
+%    \end{macrocode}
+
+% Internal helper function - Calls |#1{#2}{#3}{#4}| and recurses.
+% The magic of splitting the third parameter occurs in the pattern matching of
+% the |\def|.
+%    \begin{macrocode}
+\def\@foreach#1#2#3#4,#5\@end@token{%
+  #1{#2}{#3}{#4}%
+  \@test@foreach{#1}{#2}{#3}#5\@end@token%
+}
+%    \end{macrocode}
+
+
+% \begin{macro}{\requirementsdocument}
+% Usage: |\requirementsdocument| \marg{tag} \marg{index heading}
+% \marg{requirement title}. The tag is a one-word lowercase name, like
+% iacontrol or unixsrg or rhel5stig, that you'll use in |\implements|
+% and other tags to say from which document comes the requirement
+% you're talking about.  An index of compliance will be made;
+% |index heading| is the title under which all compliance with this document
+% will be listed in the compliance index, for example ``NIST SP 800-53
+% Security Controls.'' The |requirement title| is how to name a
+% requirement from that document. For example, the DISA UNIX SRG
+% contains many requirements, called Potential Discrepancy Items
+% (PDI). So you may give ``UNIX SRG PDI '' (note the space at the end)
+% as the requirement title, and when a requirement is named using
+% |\requirement| it will be prefixed with the title, e.g. ``UNIX SRG
+% PDI GEN006480.''
+% 
+% Write all |\requirementsdocument|s in the preamble of the document.
+%
+%    \begin{macrocode}
+\newcommand{\requirementsdocument}[3]{%
+    % Say how to name requirements that come from this document.
+    \expandafter\providecommand\csname #1\endcsname[1]{%
+        \namedrequirement{#1}{#3}{##1}}
+    \expandafter\newcommand\csname indexhead#1\endcsname{#2}
+}
+%    \end{macrocode}
+% \end{macro}
+
+% \begin{macro}{\requirement}
+% Usage: |\requirement| \marg{document tag} \marg{requirement name}. Example:
+% |\requirement{unixsrg}{GEN006480}|. Use this macro to mention requirements
+% that come from other documents, without implying a particular compliance
+% posture. For example, ``The check content of
+% |\requirement{unixsrg}{GEN006480}| suggests the following solution.''
+%    \begin{macrocode}
+\newcommand{\requirement}[2]{%
+    \expandafter\csname requirement@#1\endcsname{#2}}
+%    \end{macrocode}
+% \end{macro}
+
+% \begin{macro}{\namedrequirement}
+% Usage: |\namedrequirement| \marg{index name} \marg{official title prefix} \marg{requirement name}.
+% Example: |\namedrequirement{iacontrol}{IA Control }{IAAC-1}| will say ``IA
+% Control IAAC-1'' in the body of the document, and make an index entry in the
+% compliance index under the ``IA Controls'' heading. (``IA Controls'' in this
+% example is the value of a parameter given to |\requirementsdocument|, not to
+% this macro.)
+%
+% This macro exists so it will be possible to redefine it to change how such a
+% thing looks. When referring to a named requirement in a document that you are
+% writing, use |\requirement| above, not this macro.
+%
+% The index macro is the same as in indexhelper below but without the last
+% |!{#2}| for the subhead.
+%    \begin{macrocode}
+\newcommand{\namedrequirement}[3]{%
+    \index[cybercompliance]{\csname indexhead#1\endcsname @\iaindexheadstyle{\csname indexhead#1\endcsname}!{#3}!}%
+    {\small #2\mbox{#3}}%
+}
+%    \end{macrocode}
+% \end{macro}
+%
+% This will be redefined by \textsf{iacic} if that package is included.
+%    \begin{macrocode}
+\def\addtosectionname#1{}
+%    \end{macrocode}
+%
+% This is here so you can turn off indexing for a portion of your document.
+%    \begin{macrocode}
+\newif\ifCyberindexingenabled
+\Cyberindexingenabledtrue
+%    \end{macrocode}
+%
+% Style the text for per-document heads in the compliance index.
+%    \begin{macrocode}
+\newcommand{\iaindexheadstyle}[1]{%
+    \vspace{1em}{\large \textbf{#1}}\vspace{1em}}
+%    \end{macrocode}
+%
+% parameters: index name, implementation status, requirement name
+%    \begin{macrocode}
+\newcommand{\indexhelper}[3]{%
+\ifCyberindexingenabled\index[cybercompliance]{\csname indexhead#1\endcsname @\iaindexheadstyle{\csname indexhead#1\endcsname}!{#3}!{#2}}\fi}
+%    \end{macrocode}
+%
+% parameters: index name, prefix (e.g. {RHEL5: }), requirement name
+%    \begin{macrocode}
+\newcommand{\marginhelper}[3]{#2~\mbox{#3}\\ }
+%    \end{macrocode}
+%
+% parameters: index name, compliance status, requirement name.
+% Compliance status is not necessarily the same as implementation status.
+%    \begin{macrocode}
+\newcommand{\compliancehelper}[3]{%
+\write\complianceaux{#1:#3:#2}}
+%    \end{macrocode}
+%
+% parameters: index name, explanation, requirement name
+%    \begin{macrocode}
+\newcommand{\explanationshelper}[3]{%
+\write\explanationsaux{#1:#3:}%
+\write\explanationsaux{#2}%
+\write\explanationsaux{:}%
+}
+%    \end{macrocode}
+
+% parameters: index name, nothing, requirement name
+%    \begin{macrocode}
+\newcommand{\sectionnamehelper}[3]{%
+    \def\@numberone{#1}%
+    \def\@iacontrol{iacontrol}%
+    \ifx\@numberone\@iacontrol\addtosectionname{#3}\fi}
+%    \end{macrocode}
+%
+%    \begin{macrocode}
+\def\iamarginsize{\footnotesize}
+%    \end{macrocode}
+%
+% These all take two parameters.
+% The first parameter is the identifier of the document from which the
+% requirement comes (e.g. iacontrol, unixstig, spanstig, apachestig,
+% etc)---same names as the indices. The second parameter is which
+% requirement(s) is/are in the given status (e.g. GEN000320). You may supply
+% multiple values for this one, separated by commas.
+%
+% Example: |\implements{unixsrg}{GEN000320,GEN000340}|
+%
+%    \begin{macrocode}
+\newcommand{\implements}[2]{%
+    \@bsphack
+    \hspace{0pt}% this makes sure the marginpar doesn't go with the previous
+                % paragraph
+    \foreach{\indexhelper}{#1}{implemented}{#2}%
+    \marginpar{\iamarginsize \raggedright%
+        \foreach{\marginhelper}{#1}{auto:}{#2}%
+    }%
+    \foreach{\compliancehelper}{#1}{compliant}{#2}%
+    \foreach{\sectionnamehelper}{#1}{}{#2}%
+    \@esphack}
+\newcommand{\unimplemented}[3]{%
+    \@bsphack
+    \hspace{0pt}% this makes sure the marginpar doesn't go with the previous
+                % paragraph
+    \foreach{\indexhelper}{#1}{\textcolor{red}{unimplemented}}{#2}%
+    \marginpar{\iamarginsize \color{red} \raggedright%
+        \foreach{\marginhelper}{#1}{}{#2}%
+    }%
+    \foreach{\compliancehelper}{#1}{non-compliant}{#2}%
+    \foreach{\explanationshelper}{#1}{#3}{#2}%
+    \foreach{\sectionnamehelper}{#1}{}{#2}%
+    {#3}%
+    \@esphack}
+%    \end{macrocode}
+%
+% Except this one takes three parameters: operating system(s),
+% identifier of requiring document, requirement(s).
+%    \begin{macrocode}
+\newcommand{\bydefault}[3]{%
+    \@bsphack
+    \hspace{0pt}% this makes sure the marginpar doesn't go with the previous
+                % paragraph
+    \foreach{\indexhelper}{#2}{default for {#1}}{#3}%
+    \marginpar{\iamarginsize \raggedright%
+        \foreach{\marginhelper}{#2}{#1: }{#3}%
+    }%
+    \foreach{\compliancehelper}{#2}{compliant}{#3}%
+    \foreach{\sectionnamehelper}{#1}{}{#2}%
+    \@esphack}
+%    \end{macrocode}
+%
+%    \begin{macrocode}
+\newcommand{\notapplicable}[2]{%
+    \@bsphack
+    \hspace{0pt}% this makes sure the marginpar doesn't go with the previous
+                % paragraph
+    \foreach{\indexhelper}{#1}{N/A}{#2}%
+    \marginpar{\iamarginsize \raggedright%
+        \foreach{\marginhelper}{#1}{N/A: }{#2}%
+    }%
+    \foreach{\compliancehelper}{#1}{N/A}{#2}%
+    \@esphack}
+%    \end{macrocode}
+
+%    \begin{macrocode}
+\newcommand{\doneby}[3]{%
+    \@bsphack
+    \hspace{0pt}% this makes sure the marginpar doesn't go with the previous
+                % paragraph
+    \foreach{\indexhelper}{#2}{prescribed}{#3}%
+    \marginpar{\iamarginsize \raggedright%
+        \foreach{\marginhelper}{#2}{#1 do }{#3}%
+    }%
+    \foreach{\compliancehelper}{#2}{compliant}{#3}%
+    \foreach{\sectionnamehelper}{#1}{}{#2}%
+    \@esphack}
+%    \end{macrocode}
+
+% deprecated
+%    \begin{macrocode}
+\newcommand{\prescribed}[2]{\doneby{admins}{#1}{#2}}
+%    \end{macrocode}
+
+%    \begin{macrocode}
+\newcommand{\documented}[2]{%
+    \@bsphack
+    \hspace{0pt}% this makes sure the marginpar doesn't go with the previous
+                % paragraph
+    \foreach{\indexhelper}{#1}{documented}{#2}%
+    \marginpar{\iamarginsize \raggedright%
+        \foreach{\marginhelper}{#1}{}{#2}%
+    }%
+    \foreach{\compliancehelper}{#1}{compliant}{#2}%
+    \foreach{\sectionnamehelper}{#1}{}{#2}%
+    \@esphack}
+%    \end{macrocode}
+
+%    \begin{macrocode}
+\newcommand{\documents}[2]{\documented{#1}{#2}}
+%    \end{macrocode}
+
+
+% \begin{macro}{\articlesecuritylabel}
+% Use this to label documents of class \textsl{article}.
+% Use like |\articlesecuritylabel| \marg{thing to write on each page}.
+% The thing will be written as part of the page header.
+%    \begin{macrocode}
+\newcommand{\articlesecuritylabel}[1]{%
+    \pagestyle{fancy}%
+    \renewcommand{\headrulewidth}{0pt}%
+    \fancyhf{}%
+    \chead{#1}%
+    \cfoot{\thepage}%
+    \fancypagestyle{plain}{%
+        \fancyhf{}%
+        \fancyhead[C]{#1}%
+    }%
+}
+%    \end{macrocode}
+% \end{macro}
+%
+% \begin{macro}{\booksecuritylabel}
+% Use this one to label books. Syntax is the same as above.
+%    \begin{macrocode}
+\newcommand{\booksecuritylabel}[1]{%
+    \pagestyle{fancy}%
+    \renewcommand{\headrulewidth}{0.1pt}%
+    \fancyhf{}%
+    \fancyhead[CE,CO]{#1\vspace{2\baselineskip}}%
+    \fancyhead[LE,RO]{\thepage}%
+    \fancyhead[RE]{\nouppercase{\leftmark}}%
+    \fancyhead[LO]{\nouppercase{\rightmark}}%
+    %
+    \fancypagestyle{empty}{%
+        \renewcommand{\headrulewidth}{0pt}%
+        \fancyhf{}%
+        \fancyhead[C]{#1\vspace{2\baselineskip}}%
+    }%
+    \fancypagestyle{plain}{%
+        \renewcommand{\headrulewidth}{0pt}%
+        \fancyhf{}%
+        \fancyhead[C]{#1\vspace{2\baselineskip}}%
+    \fancyfoot[C]{\thepage}%
+    }%
+}
+%    \end{macrocode}
+% \end{macro}
+%
+% See \url{http://www.dtic.mil/dtic/submit/guidance/distribstatement.html} on
+% distribution statements and on destruction of limited-distribution
+% unclassified documents.
+%
+%    \begin{macrocode} 
+\def\@distribution{\@latex@warning@no@line{No distribution statement given}}
+%    \end{macrocode}
+%
+%    \begin{macrocode}
+\def\@destruction{%
+    \textbf{DESTRUCTION NOTICE}: Destroy by any method that will prevent disclosure or reconstruction of the document.}
+%    \end{macrocode}
+%
+% \begin{macro}{\distributionA}
+%    \begin{macrocode}
+\def\distributionA#1{%
+    \gdef\@distribution{%
+        \textbf{DISTRIBUTION STATEMENT A}: Approved for public release. #1}}
+%    \end{macrocode}
+% \end{macro}
+% \begin{macro}{\distributionB}
+%    \begin{macrocode}
+\def\distributionB#1#2{%
+    \gdef\@distribution{%
+        \textbf{DISTRIBUTION STATEMENT B}: Distribution authorized to U.S. Government agencies only #1 \@date. Other requests for this document shall be referred to #2.}}
+%    \end{macrocode}
+% \end{macro}
+% \begin{macro}{\distributionC}
+%    \begin{macrocode}
+\def\distributionC#1#2{%
+    \gdef\@distribution{%
+        \textbf{DISTRIBUTION STATEMENT C}: Distribution authorized to U.S. Government agencies and their contractors #1 \@date. Other requests for this document shall be referred to #2.}}
+%    \end{macrocode}
+% \end{macro}
+% \begin{macro}{\distributionD}
+% Use this macro to indicate that your document uses Distribution Statement D,
+% and why, like so: |\distributionD| \marg{reason why distribution is limited}.
+% Write this in the top of your document, before |\begin{document}|.
+%    \begin{macrocode}
+\def\distributionD#1#2{%
+    \gdef\@distribution{%
+        \textbf{DISTRIBUTION STATEMENT D}: Distribution authorized to the Department of Defense and U.S. DoD contractors only #1 \@date. Other requests shall be referred to #2.}}
+%    \end{macrocode}
+% \end{macro}
+% \begin{macro}{\distributionE}
+%    \begin{macrocode}
+\def\distributionE#1#2{%
+    \gdef\@distribution{%
+        \textbf{DISTRIBUTION STATEMENT E}: Distribution authorized to DoD Components only #1 \@date. Other requests shall be referred to #2.}}
+%    \end{macrocode}
+% \end{macro}
+% \begin{macro}{\distributionF}
+%    \begin{macrocode}
+\def\distributionF#1{%
+    \gdef\@distribution{%
+        \textbf{DISTRIBUTION STATEMENT F}: Further dissemination only as directed by #1 \@date\ or higher DoD authority.}}
+%    \end{macrocode}
+% \end{macro}
+%
+%
+
+%    \begin{macrocode}
+\def\@version{}
+%    \end{macrocode}
+
+% \begin{macro}{\version}
+% Use the |\version| \marg{some indication of version} to indicate the version
+% of the document.
+%    \begin{macrocode}
+\def\version#1{\gdef\@version{#1}}
+%    \end{macrocode}
+% \end{macro}
+
+% \begin{macro}{\today}
+% This redefinition of the |\today| macro formats the date like ``4 Oct 2011,''
+% as military folks are used to. Use it in the |\date| macro.
+%    \begin{macrocode}
+\def\today{\number\day\space\ifcase\month\or Jan\or Feb\or Mar\or Apr\or 
+  May\or Jun\or Jul\or Aug\or Sep\or Oct\or Nov\or Dec\fi
+  \space\number\year}
+%    \end{macrocode}
+% \end{macro}
+
+% \begin{macro}{\narrowermargins}
+%    \begin{macrocode}
+\newcommand{\narrowermargins}{%
+    \addtolength{\hoffset}{-0.5in}%
+    \addtolength{\textwidth}{1in}%
+    \addtolength{\marginparwidth}{-0.5in}%
+    \addtolength{\voffset}{-0.5in}%
+    \addtolength{\textheight}{1in}%
+    % bring up bottom of text to match whitespace at top caused by security
+    % label
+    \addtolength{\textheight}{-2\baselineskip}%
+}
+%    \end{macrocode}
+% \end{macro}
+%
+% \begin{macro}{\makedodtitle}
+% Use this macro instead of |\maketitle|, right after |\begin{document}|.
+%    \begin{macrocode}
+\newcommand{\makedodtitle}[0]{%
+    \begin{titlepage}%
+    \begin{center}%
+    ~\vskip 1.5in%
+    {\LARGE \@title \par}%
+    \vskip 3em%
+    {\large \lineskip .75em \begin{tabular}[t]{c}%
+      \@author%
+     \end{tabular}\par}%
+    {\large \@date \par \large \@version}\vskip 0.5in%
+    \includegraphics[width=0.4\textwidth]{org_logo}
+    \end{center}\par%
+    \@thanks\vskip 0.5in\par%
+    \@distribution\par%
+    \@destruction%
+    \vfil\null
+    \end{titlepage}}
+%    \end{macrocode}
+% \end{macro}
+%
+%
+% \begin{environment}{changelog}
+% \begin{macro}{\change}
+% Usage: |\change| \marg{when} \marg{who} \marg{what}. For example,
+% \begin{Verbatim}[gobble=2]
+% \change{3 Aug 2011}{Jared Jennings}{Added backup plan}
+% \end{Verbatim}
+%
+%    \begin{macrocode}
+\newcommand{\change}[3]{%
+    {#1} & {#2} & {#3}\\
+}
+%    \end{macrocode}
+% \end{macro}
+%
+%    \begin{macrocode}
+\newenvironment{changelog}{
+    \phantomsection
+    \chapter*{Changelog}
+    \addcontentsline{toc}{chapter}{Changelog}
+    \begin{longtable}{@{\extracolsep{\fill}} l l p{4in}}
+    \hline
+    {\bf Date} & {\bf Person} & {\bf Change Description}\\
+    \hline\hline
+    \endhead
+}{\end{longtable}}
+%    \end{macrocode}
+% \end{environment}
+%
+% \begin{environment}{executivesummary}
+% An ``executive summary,'' in the context of documents submitted as
+% information assurance artifacts, means specifically a table of IA controls to
+% which this document applies. Executive summaries can be built automatically
+% by the shaney script, but must be included in the main document by means of
+% the |\include| command.
+%
+% \begin{macro}{\executivesummaryiacontrol}
+% Usage: |\executivesummaryiacontrol| \marg{IA control ID} \marg{IA control
+% name}. Use only inside the executivesummary environment.
+%    \begin{macrocode}
+\newcommand{\executivesummaryiacontrol}[2]{%
+    {#1} & {#2}\\
+}
+%    \end{macrocode}
+% \end{macro}
+%
+%    \begin{macrocode}
+\newenvironment{executivesummary}{
+    \phantomsection
+    \chapter*{Executive Summary}
+    \addcontentsline{toc}{chapter}{Executive Summary}
+    The following table lists the NIST SP 800-53 Security Controls that are satisfied
+    through this artifact.
+
+    \begin{longtable}{@{\extracolsep{\fill}} l p{4in}}
+    \hline
+    {\bf IA Control Number} & {\bf IA Control Name}\\
+    \hline\hline
+    \endhead
+}{\end{longtable}}
+%    \end{macrocode}
+% \end{environment}
+\makeatother
+% \Finale