Adjudicate "substantive changes" to the EXO Baseline Markdown

[ahuynhMITRE]

💡 Summary

This issue captures the high-level tasks required to convert the existing EXO Secure Configuration Baseline document to a new structure based on the existing markdown format. The updates will include reordering and regrouping of existing policy items, additional fields for each policy item, and policy changes to clarify relative to existing implementation guidance.

Motivation and context

The new baseline policy document format will provide additional clarity to readers and support better automated assessment of baseline policy items for EXO.

Implementation notes

In order to make the changes referenced above, the following tasks will need to be accomplished:

• CREATE and NUMBER policy group statements based on existing policy areas using updated markdown files found in Adjudicate "Structural Changes" to All Baseline Markdowns #212 and its associated branch

  • REMOVE “SHALL” and “SHOULD” language from new policy group statements
  • RENAME policy groups to cover associated policies (Naming should be descriptive vice prescriptive)
  • REGROUP baseline policies that are better orientated to the new Group Name if needed
  • CREATE short 1-2 sentence summary for each policy group

• ADD Rationale section and text for each policy
  Note: Suggested format for Rationale

  • 1st sentence: Security risk if policy is not implemented.
  • 2nd sentence: How this policy minimizes this risk.

• UPDATE policy item description to match the desired best practice and synchronize with implementation steps (e.g., setting should be 30 days or less when implementation shows setting days to <= 30)

Acceptance criteria

How do we know when this work is done?

• EXO baseline markdown has been updated with new policy groups and all policy items reordered into those groups
• All EXO baseline policy groups have been numbered
• Each EXO policy group contains a concise and clear 1-2 sentence summary
• Each EXO policy item contains a Rationale section using the suggested format
• Each EXO policy item has been reviewed and updated to synchronize with the implementation steps