Changes to Common Controls Baseline

jkaufman-mitre commented 3 months ago

🗣 Description

The following changes were made within the common controls baseline:

Policy 2.2 was removed
Policy 10.1 was removed
Policy Group 16, Additional Google Services, was created
Policy group 17, Multi-Party Approval, was created
Policy 14.1 implementation was updated.
Change 11.1 to SHALL

💭 Motivation and context

Fixes #240 Fixes #252 Fixes #274 Fixes #276

🧪 Testing

✅ Pre-approval checklist

[x] This PR has an informative and human-readable title.
[ ] Changes are limited to a single goal - eschew scope creep!
[ ] If applicable, All future TODOs are captured in issues, which are referenced in the PR description.
[x] The relevant issues PR resolves are linked preferably via closing keywords.
[x] All relevant type-of-change labels have been added.
[x] I have read and agree to the CONTRIBUTING.md document.
[x] These code changes follow cisagov code standards.
[x] All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
[x] Tests have been added and/or modified to cover the changes in this PR.
[x] All new and existing tests pass.

✅ Pre-merge Checklist

[ ] This PR has been smoke tested to ensure main is in a functional state when this PR is merged.
[ ] Squash all commits into one PR level commit using the Squash and merge button.

✅ Post-merge Checklist

[ ] Delete the branch to clean up.
[ ] Close issues resolved by this PR if the closing keywords did not activate.

jkaufman-mitre commented 3 months ago

Removed Policy 10.1 because there is no implementation for the policy. Agencies will be evaluated on their in-house procedures for items such as this as part of their NIST 800-53 control assessments. The technical implementation steps are already covered within this policy group.

jkaufman-mitre commented 3 months ago

Moved 11.2 to Policy Group 10 (#318)

adhilto commented 3 months ago

Moved 11.2 to Policy Group 10 (#318)

Looks like this change might not have been pushed yet?

jkaufman-mitre commented 2 months ago

Made Common Controls 11.1 a SHALL.

jkaufman-mitre commented 2 months ago

TTP Mappings have been added.

jkaufman-mitre commented 2 months ago

@adhilto @buidav Can you review this. This one is ready for review again.

mdueltgen commented 2 months ago

As discussed, removed Issue 290 for 2.2. Context Aware Access revamp will happen in the next release after Coast.

@adhilto Please review the 2.1 section for Coast release including changes to the implementation steps.

snarve commented 2 months ago

11.2 is unchanged as @adhilto mentioned in the email thread. Since there is a separate issue for this( #318 ), recommend to create a separate branch for this and commit separately as this PR tackles multiple issues already. Having a separate branch and PR (per issue) would ease the tracking and updates. @jkaufman-mitre @mdueltgen @adhilto @buidav any thoughts on this

adhilto commented 2 months ago

11.2 is unchanged as @adhilto mentioned in the email thread. Since there is a separate issue for this( #318 ), recommend to create a separate branch for this and commit separately as this PR tackles multiple issues already. Having a separate branch and PR (per issue) would ease the tracking and updates. @jkaufman-mitre @mdueltgen @adhilto @buidav any thoughts on this

I agree, that's the right call (with the caveat that branch be made after this one is merged in to ease merge conflicts). I just edited the description of this PR to remove that issue so it's accurate and so that that issue won't auto-close once this PR is merged.

mdueltgen commented 2 months ago

11.2 is unchanged as @adhilto mentioned in the email thread. Since there is a separate issue for this( #318 ), recommend to create a separate branch for this and commit separately as this PR tackles multiple issues already. Having a separate branch and PR (per issue) would ease the tracking and updates. @jkaufman-mitre @mdueltgen @adhilto @buidav any thoughts on this

I agree, that's the right call (with the caveat that branch be made after this one is merged in to ease merge conflicts). I just edited the description of this PR to remove that issue so it's accurate and so that that issue won't auto-close once this PR is merged.

Sounds good I will make sure #318 and #290 are in different branches for the next release. I think now that those two have been removed from the description of this PR, I think we should be good to do review of PR as is and merge for Coast.

cisagov / ScubaGoggles