[DO NOT MERGE] compliance docs for confidential survey tool

[afeld]

First test of https://trello.com/c/I7EujTnt/59-try-creating-masonry-files-for-a-real-application.

Working branch. Comment here when you'd like some 👀 on it!

/cc @harrisj @18F/ato

[harrisj]

I added some records for SA-5 and RA-5, but this is still a very early version. Is this how I am supposed to extend this though?

[mzia]

@harrisj, LGTM. You are on the right track!

[DavidEBest]

This is looking really good. Perhaps add a page like https://compliance.cloud.gov/system_documentation/system-description.html for the readme text and system/data flow diagrams? Other thoughts, @18F/ato ?

[harrisj]

Sounds good to me. How do I add that page?

[DavidEBest]

@harrisj I believe you need to add a markdown file in data/markdowns/gitbook/system_documentation/. That's where the cloud.gov documentation lives.

[harrisj]

Do I want to add a new file? Or do I edit/replace the system-description.md
and system-data.md files in that directory to be for Confidential Survey
instead of cloud.gov?

On Fri, Feb 19, 2016 at 8:44 PM, David Best notifications@github.com
wrote:

@harrisj https://github.com/harrisj I believe you need to add a
markdown file in data/markdowns/gitbook/system_documentation/. That's
where the cloud.gov documentation lives.

—
Reply to this email directly or view it on GitHub
#33 (comment).

[DavidEBest]

Add a new one, @harrisj. The cloud.gov ones are chock full of good info that is still relevant to your application.

[DavidEBest]

@harrisj I committed a few minor fixes. Looks good to me. Any other thoughts, @18F/ato ?

[harrisj]

Thanks!

[afeld]

Maybe this file should be called static-analysis/component.yml?

[geramirez]

That's a good idea, it could be more generic for other applications to apply

[afeld]

I can't speak to whether this meets the Masonry format or whether anything's missing, but aside from my few minor comments, this looks good! I'm assuming we shouldn't try and merge this since this repository is cloud.gov-specific, but am curious on @geramirez's thoughts. Also, does the existence of the Masonry files mean that https://pages.18f.gov/before-you-ship/ato/ssp/ is no longer needed?

[afeld]

Re: the SSP, it seems like we aren't capturing all of the information in the Masonry files that are in the system-security-plan.yml template, e.g. the staff. Is that a problem? Possibly something that still needs to be worked out on the Masonry spec side.

Tangentially, is there somewhere in the Masonry files that need to (essentially) say "this is using cloud.gov under the hood, so inherit from it"? Not seeing the equivalent of the list of controls.

[geramirez]

@afeld - Yeah, I don't think we should try to merge it. All the info in the info system-security-plan.yml is mostly kept in the markdowns.

We don't have anything that deals specifically with a cloud.gov dependency yet. However, I'm thinking we could use the system-security-plan.yml like npm uses package.json. Essentially, Masonry could download the cloud.gov docs and place them in a compliance_moduels directory, which is later merged with the docs in directory above.

Thoughts?

[harrisj]

Thanks for the feedback, @afeld and @DavidEBest! I have tweaked this PR a bit accordingly

[dlapiduz]

@geramirez I think that is the way to go (re: package.json) we have the composability in the tool but no way of describing where to get stuff...

[afeld]

Created a card to convert this to the new format:

https://trello.com/c/0HRG3Tak/142-convert-confidential-survey-ato-documentation-to-new-format

[dlapiduz]

Can we close this?