Set of partials == complete? about discuss HOT 7 OPEN

If I understand what's being asked, I've used hyperGRC to implement partial coverage by multiple components for two recent federal ATOs. I have defined only four components so far - AWS, Drupal, Agency and Contractor - but I will be getting a bit finer grained on my next pass. The hyperGRC example components are already finer grained. I have a goal to publish the AWS and Drupal components and their implementation narratives (all in yaml, of course) - let me know if this would be interesting to you.

from discuss.

Just another thought on this. It seems to me that this would be common. For example, using a cloud provider, the provider covers some parts, the organization covers other parts, and some parts need controls provided by both. If I was in such a situation, I presume I would include the cloud provider's OpenControl file, but I need to be able to augment it, but would rather not completely re-implement it.

from discuss.

This looks close to what I am asking:
opencontrol/schemas#24
Adding this here because it might help others.

from discuss.

There isn't a great way to solve this.

Often the component-level content can use partial, but then an organizational answer could be complete that outlines how each partial adds up.

from discuss.

It's not ideal but if you convert the Customer Responsibility Matrix (CRM), otherwise known as what's left for someone to do to fully implement the control, into an OpenControl certification then you can get this by layering both overlays.

But the logic isn't supported for this in current tooling, that is, there is currently no way to understand the hierarchy of implementation_status between more than one certification, but seems feasible to do.

Example:
https://gist.github.com/JJediny/bd051fefba1ca94d885ebad23d464533

opencontrol/schemas#24 (comment)

from discuss.

@openprivacy I for one am very interested!

from discuss.

I created a diagram of the idea I mentioned above that would be great to get feedback on.

About representing the Customer Responsibilities independently from components as a new schema/yaml file I usedrequirements as a placeholder. Having another standalone file would allow for layering inheritance, allow the IaaS/PaaS/SaaS provider to maintain it independently and vendor it rather than putting it in the system control writeup, and provide a cleaner way to handle implementation_status.

DRAFT - FOR DISCUSSION ONLY

from discuss.