jezcaudle/rails-caf
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Finnaly managed to parse the YAML. Need to aadd the rest and then whip it into a database when we create a CAF for a company.

Browse Source
This commit is contained in:
Jez Caudle
2023-02-07 06:17:08 +00:00
parent 7d699da81c
commit 6c328e8bde
2 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
config/caf_text.yml
View File

@@ -74,7 +74,7 @@ objectives:
name: A2.a Risk Management Process
description: Your organisation has effective internal processes for managing risks to the security of network and information systems related to the operation of essential functions and communicating associated activities.
subprincipleitemgroups:
- subprincipalitemgroup:
- subprincipleitemgroup:
type: Not
condition: At least one
subprincipleitem:
@@ -86,7 +86,7 @@ objectives:
- Systems are assessed in isolation, without consideration of dependencies and interactions with other systems. (e.g. interactions between IT and OT environments).
- Security requirements and mitigation's are arbitrary or are applied from a control catalogue without consideration of how they contribute to the security of the essential function.
- Risks remain unresolved on a register for prolonged periods of time awaiting senior decision-making or resource allocation to resolve.
- subprincipalitemgroup:
- subprincipleitemgroup:
type: Partially
condition: All
subprincipleitem:
@@ -116,7 +116,7 @@ objectives:
- subprincipleitemgroup:
type: Not
condition: At least one
subprincipalitem:
subprincipleitem:
- A particular product or service is seen as a "silver bullet" and vendor claims are taken at face value.
- Assurance methods are applied without appreciation of their strengths and limitations, such as the risks of penetration testing in operational environments.
- Assurance is assumed because there have been no known problems to date.