Update our policies and procedures to reflect real life

[brittag]

In order for our cloud.gov SSP to provide helpful and accurate information for compliance reviewers who want to learn about our formally-documented policies and procedures, the cloud.gov team (with assistance from relevant 18F staff) should update the policies and procedures that we refer to in our -1 controls (https://github.com/18F/compliance-docs) to reflect how we work. Updating these documents to reflect how we work will also help cloud.gov stay in compliance with them.

We need to do some research and decision-making before we can take action on this task: we need to figure out what the scope of these documents should be, and then update them to match that defined scope.

Issues I see include:

• These are explained in our -1 controls as 18F policies, but in practice these specific policy documents are important to the cloud.gov team and not broadly distributed outside the cloud.gov team.
• These documents aren't fully consistent with how 18F or cloud.gov work in practice (for example, they refer to roles and groups that we don't call by those names, such as 18F Program Management Office and 18F Information Security Office).

For example, if we re-defined these as cloud.gov team policies, tasks might include the following:

• Describe the GSA and 18F policies that take precedence above them.
• Describe where they line up with cloud.gov operational documentation (procedures).
• Fix names of roles and groups to match our operational structure.
• Integrate these better into cloud.gov team onboarding and operational docs.
• Copyedit to fix confusing statements and to fit our cloud.gov content guide.
• Update the -1 control statements.

Also: in general we need to review any -1 control origination statement that is marked as just corporate instead of hybrid. Most of them should probably be hybrid.

[brittag]

I believe the following are already mentioned in our -1 statements (so you can look there for reference), but in case we need easy access to the actual text when updating these policy docs, here's where to find relevant GSA docs:

• IT Security Policies
• IT Security Procedural Guides
• IT Security Training

[NoahKunin]

I'm on this now. My branch will be up soon.

[brittag]

Noting status: this is getting worked on at https://github.com/18F/compliance-docs/pull/9

[NoahKunin]

Status: 18F/compliance-docs#9 merged, new PR en route.

[NoahKunin]

https://github.com/18F/compliance-docs/pull/10 was closed.

The work continues: https://github.com/18F/compliance-docs/pull/11

[brittag]

This is in progress as part of separately-tracked work.