strongdm / comply

Compliance automation framework, focused on SOC2
https://comply.strongdm.com
Apache License 2.0
1.3k stars 246 forks source link

Control keys should be treated unique to their standard #99

Open darkhelmet opened 3 years ago

darkhelmet commented 3 years ago

In a policy, procedure, or narrative, you define the controls that are satisfied, scoped to the standard they are from.

On the standard webpage that is rendered, it just dumps everything together, assuming that if something satisfies standard X, control key Y, then it must also satisfy standard Z, control key Y.

Right now I'm trying to convert our existing stuff from CCM v3 to CCM v4, and many of the control keys overlap in key name but aren't actually the same. I think I'll get around it for now by prefixing the names with CCMv4 or something, but the system really should treat them differently, given that you separate them out in all the other places.

I started to poke around the code a bit to see if there was anything quick and easy I could do, but I didn't see anything I could bang out in 15 minutes.