vendorsec / mvsp

Minimum Viable Secure Product mvsp.dev
https://mvsp.dev
Creative Commons Zero v1.0 Universal
183 stars 28 forks source link

Version Control on the current MVSP “Checklist” #86

Open tedescn opened 4 months ago

tedescn commented 4 months ago

Could I please request the current MVSP “checklist” contains a version number as the listed historical versions do?

The use of the term “Latest Stable release” will not help when the current version becomes legacy.

Practically, an adopter would want to enforce against a named “checklist” version, ensuring that compliance doesn’t compromise other auditable frameworks. If compliance compromises are identified, an organisation may require time to modify activities in adjacent standards areas, before moving to the next version of the MVSP “checklist” version.

See https://mvsp.dev/mvsp.en/

Regards Nigel

acskurucz commented 3 months ago

Hi Nigel,

If I understand the problem correctly there are 2 issues:

There is some level of consciousness here, because we expect companies to do a yearly review (control 1.3) so we expect that the latest is going to be the version measured against.

What would be the expected behavior?

If latest == v3.0-20231109 then redirect to /mvsp.en/v3.0-20231109 and dispay "You're viewing latest (v3.0-...)" somewhere on the page, otherwise "You're viewing v2.0-..." or similar?

Cheers