Address controls list v1.0 feedback

JonZeolla commented 1 year ago

Address the feedback we've received on phase 1.0 of the controls list.

The scope of some controls is not always clear. Sometimes they sound ambiguous
There are redundancies: some controls seem very similar, across sections.
I am a security engineer, but looking at the target audience, I think many of them might have trouble understanding a lot of the controls and what they imply from an implementation perspective. I think a lot more guidance is required.
In general, the list is huge. Maybe there is a way to break this into smaller chunks, e.g. grouped by maturity level. In it's current form, it might be intimidating for people willing to start establishing compliance to this controls catalog.
More details here

stenio123 commented 1 year ago

@stenio123 will take a stab at this

stenio123 commented 1 year ago

Ok, I addressed the feedback here: https://drive.google.com/file/d/1zTmlpXZezjoQJrA7LzYIjO2yFen72SsJ/view?usp=sharing

Having issues with git/excel at work, will create a PR for the few changes I made to the csv later today.

JonZeolla commented 1 year ago

@stenio123 it seems like versioning in the filename is going to quickly get us out of sync; thoughts on using a GitHub release and rename the file to controls/controls_catalog.csv? I can handle the release

JonZeolla commented 1 year ago

https://github.com/cloud-native-security-controls/controls-catalog/releases/tag/v1.0.0

cloud-native-security-controls / controls-catalog

Address controls list v1.0 feedback #6