Dear members,
Below you can find the minutes from our working group call that took place on the 21st of April.
We are in the final phase for the NIST controls implementation to FaaS document to be completed and released for peer review.
Previous action items:
- Vishwas to update SC-10X. - DONE
- Volunteer (instead of Eric Peeters) to help filling in column J of the Shared Responsibility in the AU category. Specifically, for sub-control: AU-1 to AU-3 (1) and AU-6, AU-6 (3), AU-6 (7), AU-7, AU-11- AU-12. - DONE
- Joseph / volunteer to fill in column J (Responsibility) of the CM-8 sub-control. - DONE
- Working group to discuss and decide whether IA-5 (1) is in scope or out of scope since this sub-control is considered Organizational and the policy should be system wide and generic. - PENDING
- Working group to verify comments by Wayne Anderson to the N/A sub-controls of the IA category. All new N/A are highlighted in yellow. - PENDING
New action items:
- Shobhit ( @Shobhit Mehta) to go through the document and check that all sub-controls that have their responsibility marked as CSP (in column J) are referenced correctly as in-scope (if so) or out of scope. (e.g. For the first CSP responsibility in row 6, we should check the name of the sub-control there (AC-1: Policy and Procedures) and that this sub-controls along with its Implementation detail (column G)+Relevance (column H) is relevant to FaaS (and rightly marked so) and not out of scope since it's only the CSP responsibility.)
- Vishwas to check all cells marked in yellow and verify their accuracy. Same for IA-5 (1).
Next working group call: Friday, 5 May.
Time: 09:00 a.n. PST / 12:00 p.m. EST / 17:00 GMT / 19:00 EET.
URL: https://zoom.us/j/98681420926 (Meeting ID: 986 8142 0926)
Kind regards,
Marina
------------------------------
Marina Bregkou,
Senior Research Analyst,
CSA
------------------------------