Having all controls be `impact 1.0` or `impact 0.0` makes the data less than useful about cis-docker-benchmark HOT 3 OPEN

@aaronlippold yes i agree, but the CIS Benchmark has just the two things: scored and not scored. that is the reason why i did just impact 0 and 1. Do you have any proposals?

from cis-docker-benchmark.

@atomic111 @rx294 My team and I just had a conversation about this with respect to the cis-aws-foundations-benchmark. My thinking was with respect to the goal or intention of the impact in an InSpec control and CIS, we think that the intention of impactwould be best served with:

• 'Not Scored' == impact 0
• Level 1 == impact: .4 ( roughly a 'low' )
• Level 2 == impact: .7 ( roughly a 'high' )

However, I think that in general we want to keep away from 1 and 0 cases as they should be reserved for special processing cases.

For example, in our work - when a control is 'Not Applicable' in a security control selection sense or a control is 'Inherited' ( the operational responsibility of some other group or system ) we "override" the base control with impact: 0 and change the description: to be the justification for the change.

For impact: 1 this would be a 'critical' control that is a hard stop for the system under evaluation.

from cis-docker-benchmark.

@aaronlippold thanks for the input. but the score should be level 1 == impact 1, because those are the basics and level 2 is a nice add on.

from cis-docker-benchmark.