Consider adding a json schema to represent a policy

CERTCC / SSVC

Stakeholder-Specific Vulnerability Categorization

https://certcc.github.io/SSVC/

Other

126 stars 31 forks source link

Consider adding a json schema to represent a policy #591

Open ahouseholder opened 3 months ago

ahouseholder commented 3 months ago

offshoot of #576

Describe the solution you'd like

[ ] Do we need a separate schema for policies?
[ ] Should policies be versioned?
Decision Point Group schema exists
Outcome schema does not, but would be prerequisite for this - see #589
policy schema would describe the mapping of a DPG -> O
similar to Provisioned schema?-

Describe alternatives you've considered

Possibly adapt the Provisioned schema for this

ahouseholder commented 3 months ago

Version might be an optional field in the schema, since we don't intend to version policies, but we want to encourage SSVC users to consider versioning their own policies