feat!: move baselines and evaluation planning to Layer 3 #204
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jpower432
changed the title
8 tasks
jpower432
force-pushed
the
layer3-redesign
branch
from
dbe91ac to
9248656
Compare
jpower432
force-pushed
the
layer3-redesign
branch
3 times, most recently
from
aebec9a to
2dbe256
Compare
Contributor
Author
|
Temporarily putting this back in draft to fix the |
Moves baseline creation and evaluation planning into Layer 3 (Policy). Adds Severity and ResolutionStrategy types, updates schemas, and removes separate evaluation plan documents. Moves checklist logic to a new package and updates it to use Layer 3 (Policy). BREAKING CHANGE: Baselines now in Layer 3, evaluation planning embedded in Policy documents, evaluation plan documents removed. Assisted by: Composer (Cursor AI) Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
jpower432
force-pushed
the
layer3-redesign
branch
from
2fe0b54 to
7664dbe
Compare
Only requirement one function call to create a Markdown Checklist Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
jpower432
force-pushed
the
layer3-redesign
branch
from
7664dbe to
8947b9e
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR implements an architectural redesign of Layer 3 (Policy) to support policy inheritance and embed evaluation planning directly within policy documents.
Key Changes
Policy Inheritance: Policies can now import other policies (including baseline policies) through the new
imported-policiesfield, enabling organizations to build policy hierarchies (suggested baseline → organizational → department → project).Baseline Creation in Layer 3: Baseline creation has been moved from Layer 1 (Guidance) to Layer 3 (Policy), where it belongs as a risk-informed organizational decision. Baselines are now created as Layer 3 Policy documents that reference Layer 1 Guidance and Layer 2 Controls with modifications.
Embedded Evaluation Planning: Evaluation planning is now embedded directly in Policy documents through
ImplementationPlan.evaluatorsandAssessmentRequirementExtensions, eliminating the need for separate Layer 4 evaluation plan documents.Schema Changes
Schema Changes Made
schemas/layer-1.cue) changesschemas/layer-2.cue) changesschemas/layer-3.cue) changesschemas/layer-4.cue) changesSchema Change Details
Layer 1 (Guidance) Changes:
#GuidanceDocumentto#Guidancefor consistency#Guidelinestructure: removedguideline-partsfield, replaced withstatementsfield#Partto#Statementto better reflect its purpose#Rationalestructure: changed fromrisks/outcomestoimportance/goalsextendsfield to#Guidelinefor control enhancements and supplemental guidancesee-alsoto use#SingleMappinginstead of plain stringsLayer 3 (Policy) Changes:
#PolicyDocumentto#Policyfor consistencyimported-policiesfield: Enables policy-to-policy inheritance, allowing policies to import baseline policies and other organizational policiesguidance-referencesandcontrol-referencesare now optional, as policies can be built entirely throughimported-policies#PolicyMapping: Removedin-scope/out-of-scopefields, addedstatement-modificationsfor fine-grained control#ControlModifier: Replaced inline fields withoverridesandextensionspattern#ControlExtensions: New structure for control-specific metadata (severity,auto-remediation-allowed,deployment-gate-allowed)#Severitytype: New enum type (Critical,High,Medium,Low,Info,Unknown) for policy-driven severity assignment#AssessmentRequirementModifier: Replaced inline fields withoverridesandextensionspattern#AssessmentRequirementExtensions: New structure for evaluation planning metadata (required-evaluators,optional-evaluators,evaluation-points,resolution-strategy,evidence-requirements)#ResolutionStrategytype: New enum type (MostSevere,ManualOverride,AuthoritativeConfirmation) for resolving conflicts between multiple evaluators#GuidelineModifier: Now usesoverridespattern instead of inline fields#ImplementationPlan:evaluationtoevaluation-timelineandenforcementtoenforcement-timelineevaluatorsfield (replacing separate evaluation plan documents)noncompliance-plantononcompliance-consequencenotesoptional in#ImplementationDetailsLayer 4 (Evaluation) Changes:
#EvaluationPlan: Evaluation plans are no longer separate documents#AssessmentPlan,#Assessment, and#AssessmentProcedure: These structures are no longer needed as evaluation planning is embedded in Layer 3#AssessmentLog: Removedprocedurefield as procedures are now defined in Layer 3 policy extensionsTesting
Related Issues
Blocked by #200
Partial closes #170
Reviewer Hints