Update new Policy and Guidance Updates page

[pete-gov]

See #850 && https://github.com/GSA/fedramp-gov/tree/pwx-activities

The Policy and Guidance Changes page should reflect all recent, current, and pending policy and guidance changes.

Motivation

A single source of truth to see the current status of our policy and guidance work.

Implementation

Responsible: Experience Branch

1. By Tues Nov 5: Identify all policy and guidance that should be included on the page for initial release
2. By Tues Nov 5: Identify the initial overall phases for policy and guidance tracking
3. By Wed Nov 6: Populate the page with current content

Responsible: Web Team

4. By Wed Nov 6: Complete a formatting review and update for readability. We can launch this with it being a bit clumsy or not mobile friendly at first. It should be as easy to update and maintain as possible. Minimum effort. We will revisit later after feedback/etc.

Content should be ready to launch on Thursday, Nov 7.

[pete-gov]

Policy and Guidance to Include

First crack, looks like at a minimum we need to track:

Completed stuff:

• penetration testing guidance from March 2024?

Current stuff in review:

• metrics
• FIPS-140 cryptographic modules

Upcoming stuff:

• boundary guidance
• program authorization
• 3pao a2la training requirements

@david-waltermire / @rpalmer-gsa what am I missing?

[david-waltermire]

@kscarf1 Can you draft some content for this as a personal PR?

@rpalmer-gsa I'll need you to add some text for some of this tomorrow, once Karen has worked out the basic organization today.

[kscarf1]

@david-waltermire How are we defining/scoping "policy" and "guidance"? Our SOP currently defines "policy," "standard," and "guidelines/guides" here: https://docs.google.com/document/d/1DhN3EqqBtM62vwziZRN2bbwdUZd-R4iTHh4L5jmotyo/edit?tab=t.0#heading=h.n18l9qaezvd0

[pete-gov]

@david-waltermire How are we defining/scoping "policy" and "guidance"? Our SOP currently defines "policy," "standard," and "guidelines/guides" here: https://docs.google.com/document/d/1DhN3EqqBtM62vwziZRN2bbwdUZd-R4iTHh4L5jmotyo/edit?tab=t.0#heading=h.n18l9qaezvd0

This should be specifically for the big picture stuff that we have publicly blogged about, put on our roadmap, or otherwise publicly made some sort of commitment that we are going to do a thing.

[kscarf1]

@david-waltermire How are we defining/scoping "policy" and "guidance"? Our SOP currently defines "policy," "standard," and "guidelines/guides" here: https://docs.google.com/document/d/1DhN3EqqBtM62vwziZRN2bbwdUZd-R4iTHh4L5jmotyo/edit?tab=t.0#heading=h.n18l9qaezvd0

This should be specifically for the big picture stuff that we have publicly blogged about, put on our roadmap, or otherwise publicly made some sort of commitment that we are going to do a thing.

Thanks. I'm trying to be at the desired level of "pedantic" here. Usually I would say that anything containing requirements would be in scope, but it sounds like we're looking for things that we've explicitly labeled and promoted as "policy" or "guidance"...?

[pete-gov]

Thanks. I'm trying to be at the desired level of "pedantic" here. Usually I would say that anything containing requirements would be in scope, but it sounds like we're looking for things that we've explicitly labeled and promoted as "policy" or "guidance"...?

Yes, for now that's the scope here, big ticket items with lots of external promotion. This page is to show the status of those things for partners, separate from other more routine changes. i.e., boundary guidance, fips 140 stuff, scuba stuff, low review stuff, metrics, secure configuration profiles, etc.

This is external facing so it's more about what other people that aren't us see as policy and guidance, not necessarily what we define it as.

[kscarf1]

This is awesome, thank you!

[kscarf1]

Created a first draft (with placeholders) for the page. Shared with @david-waltermire, who reviewed and added comments for @rpalmer-gsa and me to address.

[kscarf1]

Addressed all feedback from @david-waltermire. Will review again after @rpalmer-gsa finishes his additions.

[pete-gov]

I'm merging this and considering it good for launch with a few tweaks - let's make sure to revisit in the near future, especially around look and feel. (but also content)