intuitem / ciso-assistant-community

CISO Assistant is a one-stop-shop for GRC, covering Risk, AppSec and Audit Management and supporting +70 frameworks worldwide with auto-mapping: NIST CSF, ISO 27001, SOC2, CIS, PCI DSS, NIS2, CMMC, PSPF, GDPR, HIPAA, Essential Eight, NYDFS-500, DORA, NIST AI RMF, 800-53, 800-171, CyFun, CJIS, AirCyber, NCSC, ECC, SCF and so much more
https://intuitem.com
Other
1.17k stars 159 forks source link

Updates in source project should be reflected in mapped project #1018

Open fastlorenzo opened 2 weeks ago

fastlorenzo commented 2 weeks ago

Problem statement When I make a mapping from a project A (let's say using CCB CyFun, for example), it creates a new project B (in this example, ISO27001). Let's assume I was only at 50% completion of the assessment of project A when I created the mapping, project B will only be partially filled. Afterwards, I complete the assessment of project A at 100%. The changes are not reflected in project B.

Expected behavior I would expect changes to be reflected in project B as this is a mapped project.

Mock Install CCB CyFun, ISO27001:2022 and CCB CyFun -> ISO27001:2022 mapping. Create a project using CCB CyFun as framework. Fill in some data (aka assess some controls of the framework). Assign a mapping to ISO27001:2022 framework, which will create a new project. Fill in additional data in the first project. Corresponding controls in the mapped project are not updated.

Additional context N/A

ab-smith commented 2 weeks ago

Hello @fastlorenzo Thanks for the feedback. It's a good point that we've discussed during the mapping feature design as a matter of fact. The current implementation is a projection of the compliance status when it's triggered and we don't keep the sync because you can end up in a situation where you're updating the projection and a sync will result in a conflict and eventually information loss. for now the easy way is to create a new projection by applying the mapping when you need a fresh sync so that it won't collide. Once we have a better approach for this UX challenge we might revisit this, somthing like a force sync button and asking the user confirmation to override and possibly lose any adjustments.

fastlorenzo commented 2 weeks ago

Hi @ab-smith, thanks for the swift pick-up of this and the insights in the decision behind this feature. I believe the solution to propose a "sync" button might be a good compromise as it would allow the user to make a choice without needing to recreate an entire project each time :wink: Happy to discuss it further if you'd like!

ab-smith commented 2 weeks ago

sure, you can join the Discord server to continue our chat :)