%% You should probably cite draft-ietf-sacm-vuln-scenario instead of this I-D.
@techreport{coffin-sacm-vuln-scenario-00,
    number =    {draft-coffin-sacm-vuln-scenario-00},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/00/},
    author =    {Chris Coffin and Brant Cheikes and Charles Schmidt and Daniel Haynes and Jessica Fitzgerald-McKay and David Waltermire},
    title =     {{SACM Vulnerability Assessment Scenario}},
    pagetotal = 23,
    year =      2015,
    month =     oct,
    day =       18,
    abstract =  {This document provides a core narrative that walks through an automated enterprise vulnerability assessment scenario. It is aligned with the SACM "Endpoint Security Posture Assessment: Enterprise Use Cases" {[}RFC7632{]}. It begins with an enterprise ingesting a vulnerability report and ends at the point of identifying affected endpoints. Processes that specifically overlap between this scenario and RFC 7632 will be noted where applicable. Specifically, the relationship between this document and the RFC 7632 use case building block capabilities and the usage scenarios will be covered.},
}