ComplianceCow / CAML

Continuous Audit Metrics Catalog
Other
4 stars 6 forks source link

Update AIS-06-M1 to have the same info as the published CAM Catalog v1.0 #47

Closed mosi-k-platt closed 2 years ago

mosi-k-platt commented 2 years ago

Added metricDescription, primaryControlID, relatedControlID, rules, and implementationGuidelines to AIS-06-M1. Kept fields in the same order as the published CAM catalog as much as possible.

Questions:

  1. Should relatedControlID values be listed on the same line and comma separated or should they listed on individual line breaks?
  2. Should the paragraphs in rules be combined onto 1 line or listed on individual line breaks?
  3. Same question for implementationGuidelines.

Also changed "metricChrontabExample" to "metricCrontabExample" (removed letter h typo)

pritikin commented 2 years ago

but 'chronology'... drat! thanks for fixing that and even calling it a typo. :)

pritikin commented 2 years ago

I think using newlines for the relatedControlIDs works well because then yaml interpreters generate a json struct that looks easier to parse:

relatedControlID: 
  - DCS-06
  - GRC-05

becomes:

{
  "relatedControlID": [
    "DCS-06",
    "GRC-05"
  ]
}

rather than

relatedControlID: DCS-06, RC-05
{
  "relatedControlID": "DCS-06, RC-05"
}

(Unless there is an easy way to parse the latter. shrug. not my area).

pritikin commented 2 years ago

Rules and implementation guidelines are for human readability. I'd do them as one big string (e.g. on a single line without paragraph breaks).

A note on these: it looks like the v1.0pdf metric catalog includes editorialized versions of the strings. If we're just cut/pasting we should pull from there as the current source of truth.

mosi-k-platt commented 2 years ago

Rules and implementation guidelines are for human readability. I'd do them as one big string (e.g. on a single line without paragraph breaks).

A note on these: it looks like the v1.0pdf metric catalog includes editorialized versions of the strings. If we're just cut/pasting we should pull from there as the current source of truth.

@pritikin There was an extra paragraph in the Google Sheet version of rules for AIS-06-M1 that was not included in v1 of the catalog. I'm not sure when that paragraph got added, but since the Google Sheet was updated after catalog v1 was published, I was using that as the source of truth. I will update the PR for rules and implementation guidelines to be one big string.

mosi-k-platt commented 2 years ago

@pritikin I changed the rules & implementation guidelines to one big string

pritikin commented 2 years ago

hmm.

I ok’d and merged the pull request. figured it was better to keep things moving than to wait until you had more diffs for the other metrics. I guess i could have waited.

On Mar 16, 2022, at 12:09 PM, mosi-k-platt @.***> wrote:

@pritikin https://github.com/pritikin I changed the rules & implementation guidelines to one big string

— Reply to this email directly, view it on GitHub https://github.com/ContiNube/CAML/pull/47#issuecomment-1069405421, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABU7DC4GQJXTPP5IWWQDRETVAIPUZANCNFSM5Q4GJ3ZQ. Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub. You are receiving this because you were mentioned.