Documentation and diagrams about discuss HOT 4 CLOSED

I can't speak to what's on opencontrol.xyz... This is the first I was even aware that it existed! 😊

Yes, it's still roughly correct. It's gone even farther than "fork+append" and "fork+amend" now, in that your opencontrol.yaml can assemble "your controls" from multiple repositories, and in fact point at specific revisions in those repositories! I'm happy that the diagram was so helpful! 🎉

from discuss.

Thinking about this a little more: The boxes surrounding the stack of controls, standards, and certifications have essentially coalesced to become the opencontrol.yaml file which specifies what set you're working with in all three cases.

from discuss.

http://opencontrol.xyz/pipelines/ references Spruce and has a notional architecture which includes it. Am I right that that is obsolete?

There's an open issue around spruce here: opencontrol/compliance-masonry#49. Followed up there.

Probably nothing has been so useful to me this week than the sidebar comment "Certifications are just collections of references to standards"

Good to know! Where would be a good place to document that?

from discuss.

Closing as inactive; open new issues if followup is needed!

from discuss.