{"action":"closed","issue":{"url":"https://api.github.com/repos/18F/cg-product/issues/273","repository_url":"https://api.github.com/repos/18F/cg-product","labels_url":"https://api.github.com/repos/18F/cg-product/issues/273/labels{/name}","comments_url":"https://api.github.com/repos/18F/cg-product/issues/273/comments","events_url":"https://api.github.com/repos/18F/cg-product/issues/273/events","html_url":"https://github.com/18F/cg-product/issues/273","id":174398345,"number":273,"title":"Adequately document SI controls in SSP","user":{"login":"mogul","id":47762,"avatar_url":"https://avatars.githubusercontent.com/u/47762?v=3","gravatar_id":"","url":"https://api.github.com/users/mogul","html_url":"https://github.com/mogul","followers_url":"https://api.github.com/users/mogul/followers","following_url":"https://api.github.com/users/mogul/following{/other_user}","gists_url":"https://api.github.com/users/mogul/gists{/gist_id}","starred_url":"https://api.github.com/users/mogul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mogul/subscriptions","organizations_url":"https://api.github.com/users/mogul/orgs","repos_url":"https://api.github.com/users/mogul/repos","events_url":"https://api.github.com/users/mogul/events{/privacy}","received_events_url":"https://api.github.com/users/mogul/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/18F/cg-product/labels/HighBar","name":"HighBar","color":"006b75"}],"state":"closed","locked":false,"assignee":{"login":"sharms","id":95657,"avatar_url":"https://avatars.githubusercontent.com/u/95657?v=3","gravatar_id":"","url":"https://api.github.com/users/sharms","html_url":"https://github.com/sharms","followers_url":"https://api.github.com/users/sharms/followers","following_url":"https://api.github.com/users/sharms/following{/other_user}","gists_url":"https://api.github.com/users/sharms/gists{/gist_id}","starred_url":"https://api.github.com/users/sharms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sharms/subscriptions","organizations_url":"https://api.github.com/users/sharms/orgs","repos_url":"https://api.github.com/users/sharms/repos","events_url":"https://api.github.com/users/sharms/events{/privacy}","received_events_url":"https://api.github.com/users/sharms/received_events","type":"User","site_admin":false},"assignees":[{"login":"sharms","id":95657,"avatar_url":"https://avatars.githubusercontent.com/u/95657?v=3","gravatar_id":"","url":"https://api.github.com/users/sharms","html_url":"https://github.com/sharms","followers_url":"https://api.github.com/users/sharms/followers","following_url":"https://api.github.com/users/sharms/following{/other_user}","gists_url":"https://api.github.com/users/sharms/gists{/gist_id}","starred_url":"https://api.github.com/users/sharms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sharms/subscriptions","organizations_url":"https://api.github.com/users/sharms/orgs","repos_url":"https://api.github.com/users/sharms/repos","events_url":"https://api.github.com/users/sharms/events{/privacy}","received_events_url":"https://api.github.com/users/sharms/received_events","type":"User","site_admin":false},{"login":"NoahKunin","id":565071,"avatar_url":"https://avatars.githubusercontent.com/u/565071?v=3","gravatar_id":"","url":"https://api.github.com/users/NoahKunin","html_url":"https://github.com/NoahKunin","followers_url":"https://api.github.com/users/NoahKunin/followers","following_url":"https://api.github.com/users/NoahKunin/following{/other_user}","gists_url":"https://api.github.com/users/NoahKunin/gists{/gist_id}","starred_url":"https://api.github.com/users/NoahKunin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NoahKunin/subscriptions","organizations_url":"https://api.github.com/users/NoahKunin/orgs","repos_url":"https://api.github.com/users/NoahKunin/repos","events_url":"https://api.github.com/users/NoahKunin/events{/privacy}","received_events_url":"https://api.github.com/users/NoahKunin/received_events","type":"User","site_admin":false},{"login":"jmcarp","id":1633460,"avatar_url":"https://avatars.githubusercontent.com/u/1633460?v=3","gravatar_id":"","url":"https://api.github.com/users/jmcarp","html_url":"https://github.com/jmcarp","followers_url":"https://api.github.com/users/jmcarp/followers","following_url":"https://api.github.com/users/jmcarp/following{/other_user}","gists_url":"https://api.github.com/users/jmcarp/gists{/gist_id}","starred_url":"https://api.github.com/users/jmcarp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jmcarp/subscriptions","organizations_url":"https://api.github.com/users/jmcarp/orgs","repos_url":"https://api.github.com/users/jmcarp/repos","events_url":"https://api.github.com/users/jmcarp/events{/privacy}","received_events_url":"https://api.github.com/users/jmcarp/received_events","type":"User","site_admin":false},{"login":"rjbator","id":22246201,"avatar_url":"https://avatars.githubusercontent.com/u/22246201?v=3","gravatar_id":"","url":"https://api.github.com/users/rjbator","html_url":"https://github.com/rjbator","followers_url":"https://api.github.com/users/rjbator/followers","following_url":"https://api.github.com/users/rjbator/following{/other_user}","gists_url":"https://api.github.com/users/rjbator/gists{/gist_id}","starred_url":"https://api.github.com/users/rjbator/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rjbator/subscriptions","organizations_url":"https://api.github.com/users/rjbator/orgs","repos_url":"https://api.github.com/users/rjbator/repos","events_url":"https://api.github.com/users/rjbator/events{/privacy}","received_events_url":"https://api.github.com/users/rjbator/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/18F/cg-product/milestones/5","html_url":"https://github.com/18F/cg-product/milestones/FedRAMP%20JAB%20review%20remediations","labels_url":"https://api.github.com/repos/18F/cg-product/milestones/5/labels","id":1989888,"number":5,"title":"FedRAMP JAB review remediations","description":"This is the set of issues to be addressed before the JAB Technical Reviewers are content for cloud.gov to enter the Review phase. \r\n\r\nFeatures included:\r\nInstall [ZenHub](https://www.zenhub.com/) and look at [the burndown view](https://github.com/18F/cg-product/milestone/5#burndown?milestoneId=5) to get a sense of how stories are progressing. We also provide a [view of this work as it progresses across our kanban board](https://github.com/18F/cg-product#boards?notFullScreen=false&epic=55727091,243&showPRs=false).","creator":{"login":"mogul","id":47762,"avatar_url":"https://avatars.githubusercontent.com/u/47762?v=3","gravatar_id":"","url":"https://api.github.com/users/mogul","html_url":"https://github.com/mogul","followers_url":"https://api.github.com/users/mogul/followers","following_url":"https://api.github.com/users/mogul/following{/other_user}","gists_url":"https://api.github.com/users/mogul/gists{/gist_id}","starred_url":"https://api.github.com/users/mogul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mogul/subscriptions","organizations_url":"https://api.github.com/users/mogul/orgs","repos_url":"https://api.github.com/users/mogul/repos","events_url":"https://api.github.com/users/mogul/events{/privacy}","received_events_url":"https://api.github.com/users/mogul/received_events","type":"User","site_admin":false},"open_issues":23,"closed_issues":1,"state":"open","created_at":"2016-09-07T21:42:40Z","updated_at":"2016-09-20T18:52:58Z","due_on":"2016-09-30T00:00:00Z","closed_at":null},"comments":11,"created_at":"2016-08-31T22:54:13Z","updated_at":"2016-09-20T18:52:58Z","closed_at":"2016-09-20T18:52:57Z","body":"In order for compliance reviewers to understand our system, we need to update this family of control statements to explain our system (and policies and procedures) in more precise and thorough detail.\r\n\r\n**Setup**\r\n\r\nRead the guidance in [HOWTO update the SSP](https://docs.google.com/document/d/1ltS7Lh8tdWeaDyABEupvHQDCpdaDMNlerrMcvrR5bio/edit) before working on this.\r\n\r\n* [SI Google Doc](https://docs.google.com/document/d/1suPHrUZUps1mWctbTXBK7qsMTEDw0envn10A9scOEPA/edit)\r\n\r\n**Acceptance criteria**\r\n\r\nModerate SRTM items:\r\n\r\nSI-3 (7):\r\n- [x] This control statement is updated to reflect our system. Comment: \"Update to partially implemented; ask team whether we've implemented this (I suspect Snort may qualify) - if not, just match SRTM notes.\" [SRTM]\r\n\r\nLow SRTM items:\r\n\r\nSI-1:\r\n- [x] control statement is either updated to point out 18F/cloud.gov procedures or else marks procedures as a planned task. [SRTM] [see [Issue cg-compliance #179](https://github.com/18F/cg-compliance/issues/179)]\r\n\r\nSI-2:\r\n- [x] fill our SI-2(3) to explain that 18F plans to do this with a few details about how we'll do it: \"measures the time between flaw identification and flaw remediation.\" Find out if we are doing this already. If not, coordinate w Atlas team to get this in the backlog. (See SRTM interview note for more details). [SRTM]\r\n\r\nSI-3.d.1:\r\n- [x] check whether we conduct \"false positive analysis\" on weaknesses identified by malicious code scan. If so, update control to reflect this. Might require update to  Cloud.gov Security Incident Response Guide (https://docs.cloud.gov/ops/security-ir/). (See SRTM interview note for more details). [SRTM] \r\n\r\nSI-3.d.2:\r\n- [x] update control so that it includes \"supporting documentation to demonstrate that analysis of malicious code includes identifying potential impact to the system.\" (See SRTM interview note for more details). [SRTM]\r\n\r\nSI-6.d.2:\r\n- [x] determine whether we have a plan to implement processes to restart or shutdown Cloud.gov virtual machines in the event an anomaly is detected. If so, update control statement to reflect this. If not, coordinate with team to get that in the backlog (and update control statement to reflect plan). (See SRTM interview note for more details). [SRTM]\r\n\r\nSI-11.b.2:\r\n- [x] determine whether \"Cloud.gov error messages are properly generated [through Riemann] and distributed to the 18F DevOps team [via PagerDuty alert].\" If so, update control statement. If not, coordinate with team to get that in the backlog (and update control statement to reflect plan). (See SRTM interview note for more details). [SRTM]\r\n\r\n  \r\n**Implementation guidance**\r\n\r\nDuring grooming, take items from the following and list them as specific tasks above.\r\n\r\n- [x] [Required JAB reviewer items](https://docs.google.com/spreadsheets/d/1DrijIZDu0tltgKR8q36dnk00Z86b2yoQ_wO0kSIq1sM/edit#gid=622192705) ([additional notes here](https://docs.google.com/document/d/1xIt84KHrmcOvymfoK-Tzz-_uahIgfL6tGGVdHnAESuo/edit))\r\n- [x] [SRTM](https://docs.google.com/spreadsheets/d/1R4B0IM3PMUgxvUywYwSq5aSFifQGrD7bYe9qGJJ4iho/edit#gid=31728390) items identified by our 3PAO as \"moderate\" differential (if not already marked green there).\r\n- [x] [SRTM](https://docs.google.com/spreadsheets/d/1R4B0IM3PMUgxvUywYwSq5aSFifQGrD7bYe9qGJJ4iho/edit#gid=31728390) items identified by our 3PAO as \"low\" differential (if not already marked done there).\r\n- [x] Word doc comments ([in Google Drive](https://drive.google.com/drive/u/0/folders/0B6fPl5s12igNX3JwR2xFZVpmek0)) from our ISSO (which provide a helpful reader perspective on confusing bits). They don't all need to be addressed, but useful as guidance.\r\n- [x] Word doc comments ([in Google Drive](https://drive.google.com/drive/u/0/folders/0B6fPl5s12igNX3JwR2xFZVpmek0)) from our PMO (which provide a helpful reader perspective on confusing bits). They don't all need to be addressed, but useful as guidance.\r\n- [x] Any relevant notes in the [SSP check working space](https://docs.google.com/document/d/1k-qiOF66o4ssBr6kEO_akaGNsku2zt2jrcawZGg7ZsA/edit#)\r\n- [x] Check that control origination statements make sense (look for [notes here](https://docs.google.com/spreadsheets/d/1Yxt1mMZAdSyKt2OGY1qdkkfZhBiKV6ZuD7sZPKxikuQ/edit#gid=600210940) and look through the controls); if you change a checkbox, make a note in that spreadsheet."}}
{"actor":{"display_login":"brittag"}}