Create assessment guidance

owaspsamm / samm-suite

This is an issues-only repository.

0 stars 1 forks source link

Create assessment guidance #44

Closed Pat-Duarte closed 4 months ago

Pat-Duarte commented 11 months ago

Based on Rob van der Veer's donated material

https://docs.google.com/document/d/1Lb1NHEdAhUrxCA3sR-m9A1Vlt47fQtnpMQiEOb2PL3s/edit

Pat-Duarte commented 11 months ago

Aram's review.

I would polish the document a bit in three directions:

Readability / structure. There is already quite some structure in place, but I would make it a bit easier to read.
Content readability. Some sentences are too long and should be split. Some typos, etc.
Interview questions. For some questions a one-sentence intro would be good to have (e.g., what is security center of excellence). Other questions need to be polished a bit more. I would also annotate each question with SAMM practice tag.

Pat-Duarte commented 11 months ago

Pat's comments

Where do you see us using the document? IMO, Guidance Is there anything that could be input for stream guidance? Step-by-step guide One of our priorities is the Getting Started section and this is valuable material to use for the Assess step, at least. Assessment This section of the website contains very little information itself. I'd focus on the step-by-step guide but we can also add a bit more content here.

Pat-Duarte commented 11 months ago

here is an additional donation from Ric Campo (ric@galahcyber.com.au) -> https://docs.google.com/spreadsheets/d/1e_sE8f31DZRhVZ0F8vo_TZIp-SC91giJ8YCSG_xhbuA/edit?usp=sharing that might be usable input for the SAMM guidance for doing assessments?