-
Story
-
Resolution: Won't Do
-
Major
-
None
-
None
-
None
-
None
-
8
-
False
-
False
-
- Description
- 12. Maintain a policy that addresses information security for all personnel
- Acceptance Criteria
- The Compliance Operator ships with a PCI-DSS profile.
- The profile contains the appropriate existing implemented OpenSCAP checks from NIST SP800-53 as defined in the mapping spreadsheet
- We have the appropriate Remediations for checks that can be auto-remediated (where already implemented).
- Added controls based on the following list https://docs.google.com/spreadsheets/d/1YujTrDp-f2YHni5n1ssyJdsMrbkiTAgb5iqSp49dBPg/edit#gid=1070290052
- We have successfully running automated testing / CI for the profile
- Compliance Operator documentation is updated to indicate that we provide a profile for PCI-DSS, along with a basic description of the profile.
- Progress tracking tooling is created to track coverage for profile development
- Note
- From Coalfire document on section 12 :
- When integrating or adding new systems, payment entities should evaluate the policies and procedures to ensure that coverage is sufficient to address the nuances of the system being implemented. It is also important for personnel to understand the policies and procedures with respect to the new technology. This helps to increase awareness of potential risk, validate proper implementation of technology according to required compliance standards, and facilitate assignment and accountability for new roles and responsibilities. External to Openshift - not applicable
- From Coalfire document on section 12 :
- Tasks
- Req-12.1
- Req-12.1.1
- Req-12.2
- Req-12.3
- Req-12.3.1
- Req-12.3.2
- Req-12.3.3
- Req-12.3.4
- Req-12.3.5
- Req-12.3.6
- Req-12.3.7
- Req-12.3.8
- Req-12.3.9
- Req-12.3.10
- Req-12.4
- Req-12.5
- Req-12.5.1
- Req-12.5.2
- Req-12.5.3
- Req-12.5.4
- Req-12.5.5
- Req-12.6
- Req-12.6.1
- Req-12.6.2
- Req-12.7
- Req-12.8
- Req-12.8.1
- Req-12.8.2
- Req-12.8.3
- Req-12.8.4
- Req-12.8.5
- Req-12.9
- Req-12.10
- Req-12.10.1
- Req-12.10.2
- Req-12.10.3
- Req-12.10.4
- Req-12.10.5
- Req-12.10.6
- clones
-
-
- Closed
-
- is cloned by
-
-
- Closed
-