{"action":"created","issue":{"url":"https://api.github.com/repos/18F/control-masonry/issues/2","labels_url":"https://api.github.com/repos/18F/control-masonry/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/18F/control-masonry/issues/2/comments","events_url":"https://api.github.com/repos/18F/control-masonry/issues/2/events","html_url":"https://github.com/18F/control-masonry/issues/2","id":104715238,"number":2,"title":"Controls are mirroring \"paper\" process too much, doesn't adhere to standards","user":{"login":"NoahKunin","id":565071,"avatar_url":"https://avatars.githubusercontent.com/u/565071?v=3","gravatar_id":"","url":"https://api.github.com/users/NoahKunin","html_url":"https://github.com/NoahKunin","followers_url":"https://api.github.com/users/NoahKunin/followers","following_url":"https://api.github.com/users/NoahKunin/following{/other_user}","gists_url":"https://api.github.com/users/NoahKunin/gists{/gist_id}","starred_url":"https://api.github.com/users/NoahKunin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NoahKunin/subscriptions","organizations_url":"https://api.github.com/users/NoahKunin/orgs","repos_url":"https://api.github.com/users/NoahKunin/repos","events_url":"https://api.github.com/users/NoahKunin/events{/privacy}","received_events_url":"https://api.github.com/users/NoahKunin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":23,"created_at":"2015-09-03T14:58:31Z","updated_at":"2015-09-22T18:19:44Z","closed_at":null,"body":"After seeing many failed attempts to do what we're doing in the past, here's one thing we can intervene on now - the current commits too strongly imitate paper processes that have nothing to do with operational security, how other programs would ingest this data, and create deviations from the NIST 800-53 structure.\r\n\r\nFor example, a single control has sub-sections with arbitrary letters: a, b, c, d, that don't actually mean anything. That's just information overhead. Similarly, keying on `endnote` doesn't make any sense.\r\n\r\nHere's the practical way to look at it - any control like `AC-X` and its subsequent enhancements `AC-X (Y)` per the NIST 800-53 format can either be a technical control, an organizational control, or some blend of the two.\r\n\r\nIf it's a technical control, there should be a space to include a hyperlink to *something* that governs that control - an example being the `UAA` module in Cloud Foundry.\r\n\r\nIf it's an organizational control, similarly there should *still* be a hyperlink to the policy or procedure governing that control. \r\n\r\nThis also points at a potentially more flexible data structure. Instead of driving the hierarchy from NIST 800-53, we can treat each NIST control as a piece of metadata or tag to any particular technical or organizational control we have. As a result, we divorce ourselves from strictly linear inheritances that causes problem when a single technical or organizational \"thing\" actually helps us meet multiple controls. \r\n\r\nFurther, this would allow us ingest the data in a way that better visualizes how the system actually functions, as a layers of interacting security boundaries and surfaces."},"comment":{"url":"https://api.github.com/repos/18F/control-masonry/issues/comments/142370573","html_url":"https://github.com/18F/control-masonry/issues/2#issuecomment-142370573","issue_url":"https://api.github.com/repos/18F/control-masonry/issues/2","id":142370573,"user":{"login":"gregelin","id":24979,"avatar_url":"https://avatars.githubusercontent.com/u/24979?v=3","gravatar_id":"","url":"https://api.github.com/users/gregelin","html_url":"https://github.com/gregelin","followers_url":"https://api.github.com/users/gregelin/followers","following_url":"https://api.github.com/users/gregelin/following{/other_user}","gists_url":"https://api.github.com/users/gregelin/gists{/gist_id}","starred_url":"https://api.github.com/users/gregelin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gregelin/subscriptions","organizations_url":"https://api.github.com/users/gregelin/orgs","repos_url":"https://api.github.com/users/gregelin/repos","events_url":"https://api.github.com/users/gregelin/events{/privacy}","received_events_url":"https://api.github.com/users/gregelin/received_events","type":"User","site_admin":false},"created_at":"2015-09-22T18:19:44Z","updated_at":"2015-09-22T18:19:44Z","body":"This is AWESOME. Like @NoahKunin, I've been dreaming of automating compliance and artifacts, structured data, DRY principles, and sharing control write ups...\r\n\r\nThe term 'control'  seems to get used to refer to both `AC-2` and `UAA`. That got me thinking...\r\n\r\nDoing FISMA is a process of **continually mapping one set of controls onto another set of controls**. What makes this is hard is the many-to-many relationships. We map map Cloud Foundry's UAA module to NIST RMF AC-2; and then we want to figure out what NIST RMF controls maps to which PCI control (or which CCE maps to which NIST RMF).\r\n\r\nMaybe **`nist-800-53:AC-2` can be thought of as the \"abstract\" control and `cloud-foundry:UAA` as the \"instance.\"** To extend the programming metaphor, `AC-2` is the interface and the `UAA` the implementation of the interface)\r\n\r\nThe reason we struggle with the control implementation and the documentation production is because we are constantly fighting the control-to-control, many-to-many hairball.\r\n\r\n![control-hairball](https://cloud.githubusercontent.com/assets/24979/10026835/de23906c-6131-11e5-9768-d98bb1be8068.jpg)\r\n\r\nIf we put all the abstract controls in the repo, and the implementation, then as described in @ramirezg comment https://github.com/18F/control-masonry/issues/2#issuecomment-140161940, we could get generate mappings.\r\n\r\nPerhaps we need something like [Gruntjs](http://gruntjs.com) to lint and generate the mappings, and various other YAML documents and artifacts.\r\n\r\nWould Control-masonry be the Gruntjs for Compliance? Or is Control-masonry a bit larger and the Gruntjs for Compliance is part of it?\r\n\r\nI think @mogul's diagram expresses this at a high level. But it is possible we may find out interim output exists between before the final artifacts can be rendered. "}}