Description
The Gemara schemas are already used to express Control Catalogs, Threat Catalogs, and Guidance Catalogs across the FINOS CCC & OSPS Baseline projects. The procedure for proposing reusable catalogs is not documented. Therefore, it's difficult for contributors to essentially "donate" catalogs to the ecosystem because there isn't a centralized place for finding reusable catalogs.
Expected Solution
Create a guide and set of criteria for contributors to share reusable catalogs to the Gemara ecosystem.
Things to Consider
- What makes a Catalog within the 7-layer architecture "reusable?"
- What level of review must be completed to ensure the proposed Catalog(s) are accurate apart from schema-validation?
- What is the maintenance cycle for the Catalog(s)?
Supporting Resources
- Discussion in the community looking to donate catalogs
Description
The Gemara schemas are already used to express Control Catalogs, Threat Catalogs, and Guidance Catalogs across the FINOS CCC & OSPS Baseline projects. The procedure for proposing reusable catalogs is not documented. Therefore, it's difficult for contributors to essentially "donate" catalogs to the ecosystem because there isn't a centralized place for finding reusable catalogs.
Expected Solution
Create a guide and set of criteria for contributors to share reusable catalogs to the Gemara ecosystem.
Things to Consider
Supporting Resources