Open repo-mountie[bot] opened 3 years ago
@repo-mountie update-stra in-progress
@repo-mountie update-pia in-progress
@bluemel-gov I think status should be "not-required" as we won't be creating compliance artifacts for this repo individually.
@sheaphillips, let's chat about this, I had wanted to review the compliance for this next sprint, but would like to hear your point of view. Also it's (a) bluemel-gov, you tagged a stranger:)
maybe create a ticket and it can be reviewed in refinement/planning. My point is that I can say with high confidence that we won't be creating a PIA/STRA/etc. for this repo specifically. I don't know how to reflect that in the compliance audit file, but I also know the compliance audit file is meant to be a nudge for teams to think about these things - it does not create a requirement or provide guidance. The ticket should not be about this repo but about if/how we account for the disparate set of codebased we use/create in compliance artifacts.
and "doh!" re: tagging wrong human. fixed now.
On Wed, Jun 2, 2021 at 8:37 AM Bluemel @.***> wrote:
@sheaphillips https://github.com/sheaphillips, let's chat about this, I had wanted to review the compliance for this next sprint, but would like to hear your point of view. Also it's (a) bluemel-gov, you tagged a stranger:)
— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/bcgov/cloud-custodian-policies/pull/3#issuecomment-853131782, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAFKSIUPU63PEQD5BEF75YLTQZF2PANCNFSM4WQDFX6Q .
Hey, its been 120 days since this PR was last updated. I'm sure everyone is busy, however, it would be appreciated if someone from the team puts this issue to bed. Thanks in Advance.
Hey, its been 120 days since this PR was last updated. I'm sure everyone is busy, however, it would be appreciated if someone from the team puts this issue to bed. Thanks in Advance.
Hey, its been 120 days since this PR was last updated. I'm sure everyone is busy, however, it would be appreciated if someone from the team puts this issue to bed. Thanks in Advance.
Hey, its been 120 days since this PR was last updated. I'm sure everyone is busy, however, it would be appreciated if someone from the team puts this issue to bed. Thanks in Advance.
Hey, its been 121 days since this PR was last updated. I'm sure everyone is busy, however, it would be appreciated if someone from the team puts this issue to bed. Thanks in Advance.
Hey, its been 120 days since this PR was last updated. I'm sure everyone is busy, however, it would be appreciated if someone from the team puts this issue to bed. Thanks in Advance.
Hey, its been 120 days since this PR was last updated. I'm sure everyone is busy, however, it would be appreciated if someone from the team puts this issue to bed. Thanks in Advance.
TL;DR 🏎️
Your repo is missing a compliance audit file so I've created this PR with a template that you can update with the correct PIA and STRA status (status options in the table below). If you'd like me to do this for you, skip to the commands section below.
Compliance
Projects in our organization (bcgov) need to complete a Privacy Impact Assessment (PIA) and Security Threat & Risk Assessment (STRA) before they go live in production. Since every ministry has their own way of doing both the STRA and PIA we don't enforce that projects do them, only that they report on the current status.
To help with reporting, I've added a compliance audit file as part of this pull request. Please checkout this branch and edit update
status
as needed. Here is a table of possible states:Here is what a completed audit file might look like:
For more information check out the BC Policy Framework for GitHub.
Pro Tip 🤓
Commands 🤖
I can update the status of the PIA and STRA for you; you'll just need to merge the PR when I'm done. You can find the available
status
values in the table above. Below are some commands I understand:Examples