Sensitive RFC type document location

[little-oddball]

There was conversation in a Team Leader meeting where Security is putting together a RFC but it contains potentially sensitive information. The concern is we don't want to put these types of items out into the public repos so wanted to raise a quick discussion on thoughts of where.

The initial thought was to have a similar path structure for these under va.gov-team-sensitive that we do in the public space.

Acceptance Critieria

• Document guidance on how to handle these types of items
  • [x] Updated guidance in VA.gov Repo: https://github.com/department-of-veterans-affairs/va.gov-team/pull/44463
  • [x] Updated RFC README: https://github.com/department-of-veterans-affairs/va.gov-platform-architecture/pull/37
• [ ] Create tickets for any artifacts that are required to support the guidance
• [ ] Communicate/share the guidance with the Platform Teams

[jjulian]

Should we revisit the decision to make the RFC repo Public vs Internal? I wonder if there is more risk than reward with that repo being public.

[little-oddball]

Should we revisit the decision to make the RFC repo Public vs Internal? I wonder if there is more risk than reward with that repo being public.

Thinking about the potential of RFCs that are more sensitive in nature... definitely makes sense to revisit that option as well.

[little-oddball]

Per our conversation on the topic:

https://github.com/department-of-veterans-affairs/va.gov-team/issues/43775

We should put together some guidance and make it a part of the VA Guidance ( https://github.com/department-of-veterans-affairs/va.gov-team/blob/master/platform/working-with-vsp/policies-work-norms/sensitive-guidance.md ). Will update. In general the thought is to keep sensitive items (pass keys, etc. out of RFC). Try to make items very black and white and be somewhat prescriptive. Would be good to have more description, etc. vs. allowing folks to interpret.