Claims for Container Security Benchmarks

[PieterKas]

Will this specification define claim values based on container security benchmarks, or is the expectation that those values are defined in the MPS registry?

[KME]

The expectation is that those would be in the registry. The reason being is that if you look at what was needed for the TCG Reference Integrity Metrics, each vendor used that single policy and their defined "Golden values" varied. The reason is that firmware was different for each vendor based on their implementation. They may have varied underlying hardware and they may update versions over time. The types of information checked for each would be the same with variances in the configuration settings and measurements.