aerwin
commented
2 years ago @enikonovad Thanks for your help. I tried again after reading the Slack, and updated my Jinja to this:
{{ control_writer.write_control_with_sections(
control, group_title,
['statement', 'additional_fs_cloud_guidance', 'guidance', 'table_of_parameters', 'above_the_line_guidance'],
{
'statement':'Requirements',
'additional_fs_cloud_guidance':'Additional FS Cloud Specifications',
'guidance':'Supplemental Guidance',
'table_of_parameters':'Parameters',
'above_the_line_guidance': 'What is the solution and how is it implemented?'
}, label_column=True,
add_group_to_title=False,
param_dict=displayname_param_dict
) | safe
}}Below is the output:
---
copyright:
years: 2020, [{CURRENT_YEAR}]
lastupdated: "[{LAST_UPDATED_DATE}]"
keywords:
subcollection: controls
---
[{site.data.keyword.attribute-definition-list}]
# SC-28 - Protection of Information at Rest
{: #sc-28}
## Requirements
{: #requirements}
The information system protects the [data in all regions and availability zones] of [organization-defined information at rest].
## Control Supplemental Guidance
{: #control-supplemental-guidance}
This control addresses the confidentiality and integrity of information at rest and covers user information and system information. Information at rest refers to the state of information when it is located on storage devices as specific components of information systems. System-related information requiring protection includes, for example, configurations or rule sets for firewalls, gateways, intrusion detection/prevention systems, filtering routers, and authenticator content. Organizations may employ different mechanisms to achieve confidentiality and integrity protections, including the use of cryptographic mechanisms and file share scanning. Integrity protection can be achieved, for example, by implementing Write-Once-Read-Many (WORM) technologies. Organizations may also employ other security controls including, for example, secure off-line storage in lieu of online storage when adequate protection of information at rest cannot otherwise be achieved and/or continuous monitoring to identify malicious code at rest.
## Parameters
| Parameter ID | Values | Label or Choices |
|---|---|---|
| sc-28_prm_1 | data in all regions and availability zones | Choose one or more: confidentiality; integrity |
| sc-28_prm_2 | | organization-defined information at rest |
{: #Parameters for SC-28 caption-side="top"}A few things to notice:
- There is an empty line between the headers and the anchor tag, and there is no empty line after the anchor tag.
## Requirements
{: #requirements}
The information system protects the [data in all regions and availability zones] of [organization-defined information at rest].But, instead should be:
## Requirements
{: #requirements}
The information system protects the [data in all regions and availability zones] of [organization-defined information at rest].- Quotes are missing around the title in the table caption
{: #Parameters for SC-28 caption-side="top"}should be
{: #"Parameters for SC-28" caption-side="top"}- This is no anchor after the Parameters header
## Parameters
{: #parameters} <-- MISSING- It's not bringing in
above_the_line_guidanceeven though it exists in themd_guidance/sc/sc-28.mdfile, and I did the trestle assemble. This was working in the production trestle.
---
x-trestle-set-params:
sc-28_prm_1:
select:
how_many: one_or_more
choice:
- confidentiality
- integrity
values: data in all regions and availability zones
sc-28_prm_2:
label: organization-defined information at rest
sort-id: sc-28
---
# sc-28 - \[System and Communications Protection\] Protection of Information at Rest
## Control Statement
The information system protects the {{ insert: param, sc-28_prm_1 }} of {{ insert: param, sc-28_prm_2 }}.
## Control Objective
Determine if:
- \[SC-28[1]\] the organization defines information at rest requiring one or more of the following:
- \[SC-28[1][a]\] confidentiality protection; and/or
- \[SC-28[1][b]\] integrity protection;
- \[SC-28[2]\] the information system protects:
- \[SC-28[2][a]\] the confidentiality of organization-defined information at rest; and/or
- \[SC-28[2][b]\] the integrity of organization-defined information at rest.
## Control guidance
This control addresses the confidentiality and integrity of information at rest and covers user information and system information. Information at rest refers to the state of information when it is located on storage devices as specific components of information systems. System-related information requiring protection includes, for example, configurations or rule sets for firewalls, gateways, intrusion detection/prevention systems, filtering routers, and authenticator content. Organizations may employ different mechanisms to achieve confidentiality and integrity protections, including the use of cryptographic mechanisms and file share scanning. Integrity protection can be achieved, for example, by implementing Write-Once-Read-Many (WORM) technologies. Organizations may also employ other security controls including, for example, secure off-line storage in lieu of online storage when adequate protection of information at rest cannot otherwise be achieved and/or continuous monitoring to identify malicious code at rest.
# Editable Content
<!-- Make additions and edits below -->
<!-- The above represents the contents of the control as received by the profile, prior to additions. -->
<!-- If the profile makes additions to the control, they will appear below. -->
<!-- The above markdown may not be edited but you may edit the content below, and/or introduce new additions to be made by the profile. -->
<!-- If there is a yaml header at the top, parameter values may be edited. Use --set-parameters to incorporate the changes during assembly. -->
<!-- The content here will then replace what is in the profile for this control, after running profile-assemble. -->
<!-- The added parts in the profile for this control are below. You may edit them and/or add new ones. -->
<!-- Each addition must have a heading of the form ## Control my_addition_name -->
<!-- See https://ibm.github.io/compliance-trestle/tutorials/ssp_profile_catalog_authoring/ssp_profile_catalog_authoring for guidance. -->
## Control implementation_guidance
Encrypt all client data at rest in accordance with PaaS and IaaS System and Communications Protection Policies.
Supplemental Guidance for Cryptography Governance located here: https://pages.github.ibm.com/ibmcloud/Security/guidance/crypto_reqs.html
## Control expected_evidence
Code or configuration showing any service-internal storage of customer or service data is encrypted at rest.
## Control above_the_line_guidance
### Implementation Guidance
Provider is to protect data against unauthorized disclosure, modification or destruction by applying controls according to the data classification as assigned by the consumer, throughout the data lifecycle (i.e., creation, at rest, in transit, in process, archival, and destruction) and consistent with laws and regulations applicable to the data.
Data at rest must always be encrypted. The provider must implement controls to ensure cryptographic controls are in place in all regions and availability zones to protect the confidentiality and integrity of data.
Provider is to ensure the use of unique encryption keys per consumer, for data at rest encryption. Provider must also ensure that they use Keep Your Own Key (KYOK) solution so that the keys are in exclusive control and they have full control of the HSM; and thus, have technical assurance that Cloud provider cannot access the keys. To meet this requirement, the provider must use IBM Hyper Protect Crypto Services (HPCS) to support this requirement. HPCS enables KYOK support and protected with FIPS 140-2 level 4 HSM.
When the consumer is a financial institution, the consumer's key should be used for encrypting consumer data. This means the consumer has full control and authority over the encryption keys so that neither the provider nor IBM can decrypt the consumer's data.
Note: There is currently no Financial Services Validated solution for retrieving the consumer's keys. For the time being provider will need to use their own keys with KYOK.
### Evidence Guidance
Automated mechanisms supporting and/or implementing encryption, confidentiality, and integrity protections for information in all zones and regions, primary and alternate sites.Configurations showing encryption type, size, and level for information at rest. Samples of data at rest showing encryption implementation. System and communications protection policy.
enikonovad
Issue description / feature objectives
This is a general issue to contain known issues in the Markdown Docs.
Issues:
No new line after the tag
Print only sections that were provided in the Jinja. i.e.
Should not print implementation guidance
Override section names entirely, without the "Control.." prefix. i.e.
'guidance':'Supplemental Guidance'should output headerSupplemental Guidanceand notControl Supplemental GuidanceCompletion Criteria
All issues above are fixed.