Comments (6)
That is a good summary of the problem at hand. For the proposal, I would recommend the following:
- Use a notation such as GM1, GM2, etc. and GI1, GI2, etc. to represent global measures and global inputs.
- Local measures and local inputs would just be represented with M1, M2, etc. and I1, I2, etc.
- The local measures and inputs would be numbered independently by Sub-Control rather than continuously across Sub-Controls.
- If a change results in a missing entry for a measure or for an input, that is fine. I do not think we should renumber the remaining measures or inputs. For instance, if a Sub-Control has measures M1 through M4 and we convert M1 into a global measure (let's say GM6), then the resulting list of measures would be GM6, M2, M3, and M4. Later, if we decide that M3 is unnecessary, the list would be GM6, M2, and M4.
The rationale for these suggestions:
- Numbering continuously across Sub-Controls would mean that changes to earlier Sub-Controls would ripple through all the later Sub-Controls causing a great deal of renumbering (for example if we added or removed a measure from Sub-Control 2.2). Or, future versions where we added a measure might have numbering like M1, M2, M878.
- Keeping the existing M1, M2, etc. for non-global measures would result in fewer changes. This is both a time-saving measure, and to reduce errors. Changing the name of a measure results in many manual changes since measures are often referenced by operations, other measures, metrics, etc. Changing all of these references manually will be an error prone process and should be kept to a minimum; only those changes that really add value should be undertaken.
- The time-saving and minimizing changes argument in 2) also applies to not updating the numbering due to missing measures and inputs (if we remove some or make a measure a global measure for instance).
Ideally we would have a document writing system that uses variables so one change would also change all the references, but currently, I'm not sure which system that would be.
from controlsassessmentspecification.
Good comments @apiperCIS, and I tend to agree with that approach. Then:
- Standardized inputs will be denoted with
GIx
, wherex
is a positive integer incrementing from1
across all sub-controls - we will call these global inputs - Standardized measures will be denoted with
GMx
, wherex
is a positive integer incrementing from1
across all sub-controls - we will call these local inputs - Inputs specific to a sub-control will be denoted with
Ix
, wherex
is a positive integer within a given sub-control - we will call these local inputs - Measures specific to a sub-control will be denoted with
Mx
, wherex
is a positive integer within a given sub-control - we will call these local measures - Local inputs and local measures may not represent a set of contiguous positive integers, due to potential use of global inputs and global measures
- If we intend to list all required inputs or all required measures in a single table, the local inputs and local measures can be prefixed with their sub-control identifier
- A sub-control identifier could simply be
SCx.y
orx.y
, wherex.y
identifies the sub-control (i.e.SC3.1
or3.1
) - The complete identifier can be the concatenation of the sub-control identifier, a period (
.
) or dash (-
), and the local input or local measure (i.e.SC3.1.M1
or3.1-M1
)
- A sub-control identifier could simply be
from controlsassessmentspecification.
2nd bullet should call them "Global Measures", not "local inputs"
from controlsassessmentspecification.
Thanks, @wmunyan, you're correct. Fixed here:
- Standardized inputs will be denoted with
GIx
, wherex
is a positive integer incrementing from1
across all sub-controls - we will call these global inputs - Standardized measures will be denoted with
GMx
, wherex
is a positive integer incrementing from1
across all sub-controls - we will call these global measures - Inputs specific to a sub-control will be denoted with
Ix
, wherex
is a positive integer within a given sub-control - we will call these local inputs - Measures specific to a sub-control will be denoted with
Mx
, wherex
is a positive integer within a given sub-control - we will call these local measures - Local inputs and local measures may not represent a set of contiguous positive integers, due to potential use of global inputs and global measures
- If we intend to list all required inputs or all required measures in a single table, the local inputs and local measures can be prefixed with their sub-control identifier
- A sub-control identifier could simply be
SCx.y
orx.y
, wherex.y
identifies the sub-control (i.e.SC3.1
or3.1
) - The complete identifier can be the concatenation of the sub-control identifier, a period (
.
) or dash (-
), and the local input or local measure (i.e.SC3.1.M1
or3.1-M1
)
- A sub-control identifier could simply be
from controlsassessmentspecification.
I would suggest dropping the dash within the concatenation specification and just leave the designator with the dot as a field separator.
If you are coding a system then it is easier just to look for a single character field separator within a function rather than having to look for multiple characters.
from controlsassessmentspecification.
@Tonyknz, good suggestion, thank you.
from controlsassessmentspecification.
Related Issues (20)
- 3.2: Perform Authenticated Vulnerability Scanning
- 4.6
- 20.1 Metric Calculation Mis-rendering
- Fix metric calculation for sub-control 6.2
- Controls Assessement Spec v 7.1 Still Available HOT 2
- Non Standard File Encodings
- M1 and M2 on 1.6 occur twice
- Scanning Frequency vs Discovered Timestamp HOT 2
- GV2 AND GV5 are Authorized software inventory
- 4.2: Complication with Salting HOT 1
- 4.3: Per Authentication System? HOT 1
- Hidden Sub-Controls and Wrong names
- 1.1: Utilize an Active Discovery Tool HOT 1
- New build missing
- 14.9: Not in IG1
- 1.2: Use a Passive Asset Discovery Tool
- 1.3: Use DHCP Logging to Update Asset Inventory
- 1.4: Maintain Detailed Asset Inventory
- 3.1: Run Automated Vulnerability Scanning Tools
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from controlsassessmentspecification.