cloud-gov / cg-compliance-docs

cloud.gov security policies and procedures

Compliance documentation

This repository documents 18F security policies and procedures, which for example are used by the cloud.gov product team.

For cloud.gov compliance documentation, see: https://github.com/cloud-gov/cg-compliance

This is a public repository following 18F's Open Source Policy. See our LICENSE.md and CONTRIBUTING.md files for additional information.

Generating PDFs for assessors

To generate PDFs of all the Markdown files, install pandoc (e.g. brew install pandoc), and basictex (e.g. brew install basictex) then:

make all

Editing documents

We've created the ...Policy.md documents to all include the file, TTS-Common-Control-Policy.md. As Markdown in GitHub, that's simply a linked URL. To generate PDFs, we use the m4 commands changequote and include to make an intermediate tmp file, then pipe that through to sed and pandoc to strip the "magic" comments and generate the final output.

In short, maintain the following snippet in the input files to include the TTS common controls:

<!-- x
changequote(`{{', `}}') 
include({{bq_tts.md}})
x -->

(The changequote is superfluous, we could just do include(`bq_tts.md'))

Public domain

This project is in the worldwide public domain. As stated in CONTRIBUTING:

This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the CC0 1.0 Universal public domain dedication.

All contributions to this project will be released under the CC0 dedication. By submitting a pull request, you are agreeing to comply with this waiver of copyright interest.

cg-compliance-docs's Issues

Update for Github org change from 18F to cloud-gov

The README.md at least links to 18F/cg-compliance, which has now moved to cloud-gov/cg-compliance. This should be updated and any other links and nomenclature updated.

See the list of search results for "18F" in this repository.

non-working links in Physical and Environmental Protection Policy

https://github.com/18F/compliance-docs/blob/master/PE-policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work
• Under Scope, link to GSA IT Security Policy doesn't work

non-working links in System and Information Integrity Policy

https://github.com/18F/compliance-docs/blob/master/SI-Policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work
• Under Scope, link to GSA IT Security Policy doesn't work

non-working links in CA-policy.md

https://github.com/18F/compliance-docs/blob/master/CA-Policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work
• Under Scope, link to GSA IT Security Policy doesn't work

non-working links in Contingency Planning doc

https://github.com/18F/compliance-docs/blob/master/CP-Policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work
• Under Scope, link to GSA IT Security Policy doesn't work

non-working links in Security Planning

https://github.com/18F/compliance-docs/blob/master/PL-Policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work
• Under Scope, link to GSA IT Security Policy doesn't work

consider applying policies across TTS

This repository contains the compliance documentation for cloud.gov, much of which is / could be applicable to TTS. We should consider making these policies and control statements TTS-wide.

Part of GSA-TTS/tts-tech-operations#152. Similar to GSA-TTS/tts-tech-operations#77.

non-working links in Identification and Authentication Policy

https://github.com/18F/compliance-docs/blob/master/IA-Policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work
• Under Scope, link to GSA IT Security Policy doesn't work

non-working links in Systems and Services Acquisition Policy

https://github.com/18F/compliance-docs/blob/master/SA-Policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work; mentions "See SA-x" which I'm assuming refers to the CIO doc
• Under Scope, link to GSA IT Security Policy doesn't work

non-working links in Incident Response Policy

https://github.com/18F/compliance-docs/blob/master/IR-Policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work
• Under Scope, link to GSA IT Security Policy doesn't work

non-working links in Risk Assessment Policy

https://github.com/18F/compliance-docs/blob/master/RA-Policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work. Contains a number of mentions to "see RA-x" which, I assume, refer to the CIO document?
• Under Scope, link to GSA IT Security Policy doesn't work

non-working link in Audit and accountability management policy

See https://github.com/18F/compliance-docs/blob/master/AU-Policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work
• Under Scope, link to GSA IT Security Policy doesn't work

non-working links in Maintenance Policy

https://github.com/18F/compliance-docs/blob/master/MA-Policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work
• Under Scope, link to GSA IT Security Policy doesn't work

offer in OpenControl format

This folder only contains Markdown, which is useful for referencing from OpenControl component. There could, however, be OpenControl files in this repository that are inheritable for 18F systems, which would save the step of needing to rewrite them.

/cc opencontrol/schemas#47 @JJediny

non-working links in Personnel Security

https://github.com/18F/compliance-docs/blob/master/PS-Policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work. There are also a number of references to "See PS-x" — do they refer to sections within the CIO P 2100.1J – GSA IT Security Policy?
• Under Scope, link to GSA IT Security Policy doesn't work

compliance-docs master branch should be protected

This is a compliance-relevant repository, so it should probably have a protected master branch to prevent people from accepting their own pull-requests.

non-working links in Systems and Communications Protection Policy

https://github.com/18F/compliance-docs/blob/master/SC-Policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work
• Under Scope, link to GSA IT Security Policy doesn't work

non-working links in Media Policy

https://github.com/18F/compliance-docs/blob/master/MP-Policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work
• Under Scope, link to GSA IT Security Policy doesn't work

non-working links in Security awareness and training policy

https://github.com/18F/compliance-docs/blob/master/AT-Policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work
• Under Scope, link to GSA IT Security Policy doesn't work

AC update for details, leave, extended absence

Per AC-2(H) we should take action when there are “reassignments, terminations, need-to-know, or clearance changes” and I drafted a policy that we remove key access for absences over 30 days. This is in line with principle of least privilege. To avoid rework, I think we only need yank admin access to AWS, cloud foundry and GitHub, and keep most other system access around until they come back (or leave permanently).

We should update the AC procedure to reflect this, and timelines for acting on this.

---

Security considerations

This clarifies a gap in our written procedures.

Implementation sketch

• Update the AC-policy
• Make a PR
• Make sure it gets approved by System Owner
• Merge
• Notify team
• Create a new ticket type for this - maybe?

non-working links in Configuration Management policy

https://github.com/18F/compliance-docs/blob/master/CM-Policy.md

• link to CIO P 2100.1J – GSA IT Security Policy doesn't work
• Under Scope, link to GSA IT Security Policy doesn't work