clarify that policies are also considered components

[afeld]

This could probably use elaboration, but I think the change will be helpful to help wrap users' minds around what constitutes a "component".

/cc @JJediny

[jcscottiii]

hmm. i’m not sure including policies would be a good idea. while we did it for cg-compliance, it makes it hard to know if a particular component influences multiple control families if components are split by policy.

[afeld]

All this pull request is doing is noting that "components" can be:

• Technical: enforced by code, or
• Policy/operational: enforced by being written down, included in training, etc.

Some cloud.gov examples I had in mind for the latter:

• The Contingency Plan
• The Incident Response Guide

What you're talking about is whether the components should be split up by control family, to which I agree the answer is "no" 😉 --> cloud-gov/cg-compliance#157

[jcscottiii]

Ahh my mistake lol