Clarify the desire for standardized data models and protocols

[david-waltermire]

In section 3.1.1 the following text is not very clear regarding a Provider:

"However, it must support either one or more standard data models, or one or more standard protocols."

This text can be interpreted as any of the following options:
a) standardized data models
b) standardized protocols
c) standardized data models AND protocols

From an interoperability perspective, I believe we want option C. This should be clarified in the draft. The following text is a starting point for clarifying this issue:

The Provider may only be able to share the Posture Assessment
Information using a specific data model and protocol. It may use a
standard data model and/or protocol, a non-standard data model and/or
protocol, or any combination of standard and non-standard data models
and protocols. To support interoperability, a Provider must minimally support
manditory-to-implement protocol(s) and data model(s) selected by SACM.
Additional standardized and proprietary data models and protocols may also
be implemented to support additional capabilities. The Provider may also
choose to advertise its capabilities through a metadata
abstraction within the data model itself, or through the use of the
registration function of the Controller (see Section 3.1.4).

[djhaynes]

+1 to option C.