{"action":"created","issue":{"url":"https://api.github.com/repos/18F/cg-compliance/issues/136","repository_url":"https://api.github.com/repos/18F/cg-compliance","labels_url":"https://api.github.com/repos/18F/cg-compliance/issues/136/labels{/name}","comments_url":"https://api.github.com/repos/18F/cg-compliance/issues/136/comments","events_url":"https://api.github.com/repos/18F/cg-compliance/issues/136/events","html_url":"https://github.com/18F/cg-compliance/pull/136","id":160734555,"number":136,"title":"Update SA policy","user":{"login":"frsfx","id":19393230,"avatar_url":"https://avatars.githubusercontent.com/u/19393230?v=3","gravatar_id":"","url":"https://api.github.com/users/frsfx","html_url":"https://github.com/frsfx","followers_url":"https://api.github.com/users/frsfx/followers","following_url":"https://api.github.com/users/frsfx/following{/other_user}","gists_url":"https://api.github.com/users/frsfx/gists{/gist_id}","starred_url":"https://api.github.com/users/frsfx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/frsfx/subscriptions","organizations_url":"https://api.github.com/users/frsfx/orgs","repos_url":"https://api.github.com/users/frsfx/repos","events_url":"https://api.github.com/users/frsfx/events{/privacy}","received_events_url":"https://api.github.com/users/frsfx/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-06-16T18:57:24Z","updated_at":"2016-06-16T20:56:40Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/18F/cg-compliance/pulls/136","html_url":"https://github.com/18F/cg-compliance/pull/136","diff_url":"https://github.com/18F/cg-compliance/pull/136.diff","patch_url":"https://github.com/18F/cg-compliance/pull/136.patch"},"body":"#83 Finishing up the work in this issue.\r\n\r\nPairing with @rogeruiz @jbarnicle "},"comment":{"url":"https://api.github.com/repos/18F/cg-compliance/issues/comments/226611408","html_url":"https://github.com/18F/cg-compliance/pull/136#issuecomment-226611408","issue_url":"https://api.github.com/repos/18F/cg-compliance/issues/136","id":226611408,"user":{"login":"rogeruiz","id":706004,"avatar_url":"https://avatars.githubusercontent.com/u/706004?v=3","gravatar_id":"","url":"https://api.github.com/users/rogeruiz","html_url":"https://github.com/rogeruiz","followers_url":"https://api.github.com/users/rogeruiz/followers","following_url":"https://api.github.com/users/rogeruiz/following{/other_user}","gists_url":"https://api.github.com/users/rogeruiz/gists{/gist_id}","starred_url":"https://api.github.com/users/rogeruiz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rogeruiz/subscriptions","organizations_url":"https://api.github.com/users/rogeruiz/orgs","repos_url":"https://api.github.com/users/rogeruiz/repos","events_url":"https://api.github.com/users/rogeruiz/events{/privacy}","received_events_url":"https://api.github.com/users/rogeruiz/received_events","type":"User","site_admin":false},"created_at":"2016-06-16T20:56:39Z","updated_at":"2016-06-16T20:56:39Z","body":"Hey @frsfx because I can't commit to your fork directly, you can apply this patch using the following command after you download it locally.\r\n\r\n```shell\r\ngit apply ./fix-file.patch\r\n```\r\n\r\nSave this file locally within the project as `fix-file.patch`.\r\n```diff\r\ndiff --git a/SA_Policy/component.yaml b/SA_Policy/component.yaml\r\nindex 348e166..c6210be 100644\r\n--- a/SA_Policy/component.yaml\r\n+++ b/SA_Policy/component.yaml\r\n@@ -99,16 +99,16 @@ satisfies:\r\n   - text: |-\r\n       18F requires the developer of the information system, system component, or information system service to provide design and implementation information for the security controls to be employed that includes: [Selection (one or more): security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; [Assignment: organization-defined design/implementation information]] at [Assignment: organization-defined level of detail].\r\n   parameters:\r\n-  # This parameter can be a reference to the fact that we are complying with the FedRAMP controls.  \r\n+  # This parameter can be a reference to the fact that we are complying with the FedRAMP controls.\r\n   # [Selection (one or more): security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics;]\r\n   - key: SA-4 (2)\r\n     text: |\r\n        [Selection (one or more): security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; [Assignment: organization-defined design/implementation information]\r\n-  # Parameter for  [Assignment: organization-defined design/implementation information]. Need value for this text. \r\n+  # Parameter for  [Assignment: organization-defined design/implementation information]. Need value for this text.\r\n   - key: SA-4 (2)\r\n     text: |\r\n        [Assignment: organization-defined design/implementation information]\r\n-  # This parameter can be a reference to the Configuration Management/GitHub process.    \r\n+  # This parameter can be a reference to the Configuration Management/GitHub process.\r\n   - key: SA-4 (2)\r\n     text: |\r\n       [Assignment: organization-defined design/implementation information]\r\n@@ -125,11 +125,11 @@ satisfies:\r\n   - text: |-\r\n       18F requires the developer of the information system, system component, or information system service to produce a plan for the continuous monitoring of security control effectiveness that contains [Assignment: organization-defined level of detail].\r\n   parameters:\r\n-  # This parameter can be a reference to Configuration Management plan.   \r\n-  # [Assignment: organization-defined level of detail] \r\n+  # This parameter can be a reference to Configuration Management plan.\r\n+  # [Assignment: organization-defined level of detail]\r\n   - key: SA-4 (8)\r\n     text: |\r\n-      clould.gov continous monitoring plan \r\n+      clould.gov continous monitoring plan\r\n   standard_key: NIST-800-53\r\n - control_key: SA-4 (9)\r\n   covered_by:\r\n@@ -144,7 +144,7 @@ satisfies:\r\n   covered_by:\r\n   - verification_key: POLICY_DOC\r\n   implementation_status: none\r\n-  # Possibly covered by GSA identification policies \r\n+  # Possibly covered by GSA identification policies\r\n   narrative:\r\n   - text: |-\r\n       GSA employs only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational information systems.\r\n@@ -214,17 +214,20 @@ satisfies:\r\n   implementation_status: none\r\n   narrative:\r\n     - key: a\r\n-      text: Requires that providers of external information system services comply with organizational information security requirements and employ [Assignment: organization-defined security controls] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. 18F utilizes AWS GovCloud, which is FedRAMP accredited for Federal Agencies.  \r\n+      text: |\r\n+        Requires that providers of external information system services comply with organizational information security requirements and employ [Assignment: organization-defined security controls] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. 18F utilizes AWS GovCloud, which is FedRAMP accredited for Federal Agencies.\r\n     - key: b\r\n-      text: Defines and documents government oversight and user roles and responsibilities with regard to external information system services; and\r\n+      text: |\r\n+        Defines and documents government oversight and user roles and responsibilities with regard to external information system services; and\r\n     - key: c\r\n-      text: Employs [Assignment: organization-defined processes, methods, and techniques] to monitor security control compliance by external service providers on an ongoing basis.\r\n+      text: |\r\n+        Employs [Assignment: organization-defined processes, methods, and techniques] to monitor security control compliance by external service providers on an ongoing basis.\r\n   parameters:\r\n-  # This parameter can be a reference to the fact that we are complying with the FedRAMP controls.    \r\n+  # This parameter can be a reference to the fact that we are complying with the FedRAMP controls.\r\n   - key: SA-9\r\n     text: |\r\n       [Assignment: organization-defined security controls]\r\n-  # This parameter can be a reference to the Configuration Management plan/process.    \r\n+  # This parameter can be a reference to the Configuration Management plan/process.\r\n   - key: SA-9\r\n     text: |\r\n       [Assignment: organization-defined processes, methods, and techniques]\r\n@@ -253,14 +256,14 @@ satisfies:\r\n   - text: |-\r\n         18F employs [Assignment: organization-defined security safeguards] to ensure that the interests of [Assignment: organization-defined external service providers] are consistent with and reflect organizational interests. 18F uses AWS GovCloud, which is FedRAMP certified and reviewed and approved by the FedRAMP JAB.\r\n   parameters:\r\n-  # This can be a reference to the FedRAMP process again since AWS Govcloud is also FedRamp certified.  \r\n+  # This can be a reference to the FedRAMP process again since AWS Govcloud is also FedRamp certified.\r\n   # [Assignment: organization-defined security safeguards]\r\n-- key: SA-9 (4) \r\n+  - key: SA-9 (4)\r\n     text: |\r\n       Tripwire\r\n   # This is a reference to AWS or another CSP we are using for an external service\r\n   #[Assignment: organization-defined external service providers]\r\n-  - key: SA-9 (4) \r\n+  - key: SA-9 (4)\r\n     text: |\r\n       AWS\r\n   standard_key: NIST-800-53\r\n@@ -271,19 +274,19 @@ satisfies:\r\n   narrative:\r\n   - text: |-\r\n       18F restricts the location of [Selection (one or more): information processing; information/data; information system services] to [Assignment: organization-defined locations] based on [Assignment: organization-defined requirements or conditions]. 18F uses AWS GovCloud to deploy the Cloud Foundry platform.  AWS GovCloud is FedRAMP certified and is located in one Availability Zone.  All Cloud Foundry applications are restricted to this location.\r\n-  parameters: \r\n+  parameters:\r\n   # This is a reference to AWS GovCloud\r\n-  - key: SA-9 (5) \r\n+  - key: SA-9 (5)\r\n     text: |\r\n-      [Selection (one or more): information processing; information/data; information system services]  \r\n+      [Selection (one or more): information processing; information/data; information system services]\r\n   # This is a reference to AWS GovCloud Avaliability Zone\r\n-  - key: SA-9 (5) \r\n+  - key: SA-9 (5)\r\n     text: |\r\n-      [Assignment: organization-defined locations]    \r\n-  # This is a reference to FedRAMP \r\n-  - key: SA-9 (5) \r\n+      [Assignment: organization-defined locations]\r\n+  # This is a reference to FedRAMP\r\n+  - key: SA-9 (5)\r\n     text: |\r\n-      [Assignment: organization-defined requirements or conditions]    \r\n+      [Assignment: organization-defined requirements or conditions]\r\n   standard_key: NIST-800-53\r\n - control_key: SA-10\r\n   covered_by:\r\n@@ -329,18 +332,18 @@ satisfies:\r\n   - key: a\r\n     text: |-\r\n       Create and implement a security assessment plan\r\n-  # [Selection (one or more): unit; integration; system; regression] \r\n+  # [Selection (one or more): unit; integration; system; regression]\r\n   # [Assignment: organization-defined depth and coverage]\r\n   - key: b\r\n     text: |-\r\n       Perform [Selection (one or more): unit; integration; system; regression] testing/evaluation at [Assignment: organization-defined depth and coverage];\r\n-    parameters: \r\n+    parameters:\r\n       - key: SA-11\r\n         text: |\r\n-            regession\r\n-       - key: SA-11\r\n+          regression\r\n+      - key: SA-11\r\n         text: |\r\n-            cloud.gov\r\n+          cloud.gov\r\n   - key: c\r\n     text: |-\r\n       Produce evidence of the execution of the security assessment plan and the results of the security testing/evaluation\r\n```"}}
{"actor":{"display_login":"rogeruiz"}}