finos / common-cloud-controls

FINOS Common Cloud Controls

What Is It?

FINOS Common Cloud Controls (FINOS CCC) is an open standard project that describes consistent controls for compliant public cloud deployments in the financial services (FS) sector.

This standard is a collaborative project which aims to develop a unified set of cybersecurity, resiliency, and compliance controls for common services across the major cloud service providers (CSPs).

Download the FINOS CCC Primer Here

What Are The Benefits?

💯 Defining Best Practices Around Cloud Security

CCC aims to standardize cloud security controls for the banking sector, providing a common set of controls that CSPs can implement to meet the requirements of FS firms. As multiple FS firms are involved in the project, effort is shared, the controls will be representative of the sector as a whole, and be more robust than any one firm could develop on its own.

🎯 One Target For CSPs To Conform To

If all FS firms specify their own cloud infrastructure requirements, CSPs will have to conform to multiple standards. CCC aims to provide a single target for CSPs to conform to.

🎒 Sharing The Burden Of A Common Definition

CCC aims to reduce the burden of compliance for CSPs by providing a common definition of controls which they can adopt. As CCC controls are specified in a cloud-agostic way, CSPs can implement them in a way that is consistent with their own infrastructure, while delivering services that FS firms understand and trust.

🧭 A Path Towards Common Implementation

FINOS sister project, Compliant Financial Infrastructure aims to be a downstream implementation of the CCC controls standard. In tandem with CCC, this will provide FS firms with a one-stop shop for secure cloud infrastructure deployment.

🥇 A Path Towards Certification

It is envisaged that eventually, CCC will offer certification for CSPs who conform to the standard.

How Does It Work?

The CCC project is in incubation at the moment but aims to deliver its first standards in 2024. The project is split into 6 working groups, each with a specific focus:

• Communications / All Hands: Focused on the overall project communications and community engagement.
• Security - Working to specify the security controls and threats that will be covered by the standard.
• Community Structure - Focused on the governance and structure of the CCC project.
• Duplication Reduction - Focused on ensuring that the CCC standard does not duplicate existing standards.
• Taxonomy - Focused on defining the taxonomy of cloud services that will be covered by the standard.
• Delivery - Focused on the delivery of the CCC standard for use downstream by FS firms and CSPs.

Work is done in the open, with all meetings and decisions documented in the project GitHub repository.

Get Involved with FINOS Common Cloud Controls

There are several ways to contribute to FINOS Common Cloud Controls.

1. Join FINOS CCC Project Meetings

The CCC project is split into 6 working groups in the CCC project which meet on a fortnightly basis:

Working Group	When	Chair	Mailing List
Security	4PM UK, 1st and 3rd Thursday each month	@mlysaght2017	ccc-security
Delivery	4:30PM UK, 1st and 3rd Thursday each month	@damienjburks	ccc-delivery
Communications / All Hands	5PM UK, 1st and 3rd Thursday each month	@Alexstpierrework	ccc-communications
Taxonomy	4:30PM UK, 2nd and 4th Thursday each month	@smendis-scottlogic	ccc-taxonomy
Community Structure	5PM UK, 2nd and 4th Thursday each month	@sshiells-scottlogic	ccc-structure
Duplication Reduction	5:30PM UK, 2nd and 4th Thursday each month	@jared-lambert	ccc-duplication

Find the next meeting on the FINOS Community Calendar and browse Past Meeting Minutes in GitHub.

2. Join the FINOS Common Cloud Controls Mailing Lists

FINOS Common Cloud Controls communications are conducted through the [email protected] mailing list. Simply email [[email protected]](mailto: [email protected]) to join.

3. Raise a FINOS Common Cloud Controls GitHub Issue

FINOS Common Cloud Controls is maintained and run through GitHub. Simply Raise a GitHub Issue to ask questions or make suggestions.

FINOS CSLA Needed to Participate in Common Cloud Controls

All FINOS Common Cloud Controls participants are required to sign a FINOS Community Specification Contributor License Agreement before joining project calls and collaborating in working groups.

Please visit participants.md and raise a Pull Request by adding your name, organisation and enrollment date to the markdown file.

Raising a Pull Request on participants.md will automatically take you through the Linux Foundation EasyCLA process for signing the FINOS CSCLA.

Email [email protected] if you require further help.

FINOS Code of Conduct

Participants of FINOS standards projects should follow the FINOS Code of Conduct, which can be found at: https://community.finos.org/docs/governance/code-of-conduct

Governance

FINOS CCC Steering Committee

The CCC Steering Committee is the governing body of the CCC project, providing decision-making and oversight pertaining to the CCC project bylaws, sub-organizations, and financial planning. The Steering Committee also defines the project values and structure. Documented here.

Name	Representing	Seat
Jon Meadows	Citi	FSI
Oli Bage	LSEG	FSI
Simon Zhang	BMO	FSI
Paul Stevenson	Morgan Stanley	FSI
Robert Griffiths	Scott Logic	Community
Eddie Knight	Sonatype	Community
Adrian Hammond	Red Hat	Community

@robmoffat is the current FINOS Point of Contact for the CCC project.

License

This project uses the Community Specification License 1.0; you can read more in the LICENSE file.

The source code included in this repository is subject to the Apache-2.0 License.

common-cloud-controls's Issues

MITRE WG: Formulate Simulated Cloud Tenants for testing

Formulate Simulated Cloud Tenant stereotypes for testing

Referencable cloud tenants

A set of simulated cloud tenant stereotypes will be defined for automated deployment of test environments. Each tenant stereotype will be defined with a set of attributes that represent a unique business unit/deployment. Examples of simulated tenants include:

• Retail Banking Apps in EU
• Speed Trading FinTech Platform in US
• Global FinTech Platform

These stereotypes will be used as targets for evaluating the effectiveness of Cloud Controls. The Control tests can be configured to be evaluated in any number of these pre defined tenant stereotypes.

White House RFI : Question 4 Response

Shared Google Doc for White House RFI Response

Please find the shared Google Doc for White House RFI response below ...
-https://docs.google.com/document/d/1qIgjIVQtQgNd-DdhzVia_VKhWa_gsV5maPDQG-KzyXI/edit?usp=sharing

Question 4 : Whitehouse RFI

Third-Party Frameworks – Both the government (for example, through the NIST Cybersecurity Framework) and non-government third parties have developed frameworks and related resources that map cybersecurity standards and controls to cybersecurity outcomes. These frameworks and related resources have also been applied to map controls to regulatory requirements, including where requirements are leveled by multiple agencies.

a. Please identify such frameworks and related resources, both governmental and nongovernmental, currently in use with respect to mitigating cybersecurity risk.

b. How well do such frameworks and related resources work in practice to address disparate cybersecurity requirements?

October 5th 2023 Common Cloud Controls - Project Meeting - All Working Groups

Date

October 5th 2023 - 12pm EST / 5pm BST

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide
• Review Meeting Notices (see above)
• Approve past meeting minutes
• Signing CLA by Money2020 Panel on 24th October - https://github.com/finos/common-cloud-controls/blob/main/participants.md
• Announcing Project Name 🔥 #6 (comment)
• Nominate and Approve CCC Leads 🚀 #18
• Publishing Working Group Roadmaps 🚗 #52
• Working Group Rename OSCAL Representation of CCC - #47
• White House RFI Update and Moving Forward - #9
• #57
• Getting ready for Open Source in Finance Forum on 1st November in NYC 🎶📣
  • #20
  • #19
  • #48
• Update - Engage with NIST on Controls - @jonmuk
• Update - Engage with MITRE Threat Catalogue - @git-hub-forwork1
• Update - Define Cloud Services Taxonomy - @moematar / @mark-rushing
• AOB, Q&A & Adjourn (5mins)

Join the CCC Zoom meetings below

• Engage with NIST on Controls - October 12th at 12pm EST / 5pm BST (second Thursday of each month)
• Engage with MITRE Threat Catalogue - October 19st at 10am EST / 3pm BST (third Thursday of each month)
• Define Cloud Services Taxonomy - October 28th at 26pm EST / 5pm BST (fourth Thursday of each month)
• Common Cloud Controls - Project Meeting - November 9th at 12pm EST / 5pm BST (first Thursday of each month)

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

Officially Naming the Common Cloud Controls Project

Officially Naming the Common Cloud Controls Project

Now Common Cloud Controls is up and running, we'd like to get your names, thoughts and feedback on the Official Live Name of the CCC Project as discussed during the project kick off here #1.

We're targeting 1st September 2023 for the official project name change, so please use this GitHub issue to add your ideas over the next few days so we can also engage legal checks.

All names and ideas are welcome and remember to +1 positive suggestions 😸

Taxonomy Working Group to Evaluate FOCUS Synergies with Common Cloud Controls

Description

The Taxonomy Working Group should evaluate the FinOps FOCUS project to determine synergices with Common Cloud Controls as discussed during #25 (comment)

The FOCUS resources provided by @udam-f2 are below ...

FOCUS Resources

FOCUS stands for FinOps Open Cost and Usage Specification - which aims to normalize cost and usage data across cloud, Saas and other areas (licensing, internal cloud, labor etc.) from a cost and usage data perspective. FOCUS is an open-source project under the Linux Foundation (similar to CCC). We have a v1.0 planned for Mid November 2023.

FOCUS mappings for Service Categories:
Spec: https://github.com/FinOps-Open-Cost-and-Usage-Spec/FOCUS_Spec/blob/working_draft/specification/dimensions/servicecategory.md

Supporting content: https://github.com/FinOps-Open-Cost-and-Usage-Spec/FOCUS_Spec/blob/working_draft/supporting_content/dimensions/servicecategory.md

Service mapping work done as a part of FOCUS data converters:
https://docs.google.com/spreadsheets/d/1s8FYVxAkDs2aeHPckEJrjA36Vpn4HKXpkXU0L-O8IAY/edit#gid=2123051243

Collaborate to define the initial common cloud services, first common service taxonomy and top level taxonomy

Description

The following questions and next steps were raised during the Define Cloud Services Taxonomy group call - #7

• What are the common CSPs and CSP service types that should be initially targeted by CCC?
• Propose a taxonomy for the first common service.
  • @mark-rushing proposed an S3 compatible Object Store
• Proposal for the top level of the taxonomies
  • Compute
  • Network
  • Storage
  • etc

@mark-rushing (Citi), @njwilliams (Morgan Stanley), @simonzhangbmo (BMO), Gary Butler (Fidelity) and David Stone (Google) initially agreed to collaborate on this issue.

Please also see GitHub Discussion by @vicenteherrera - #29

cc @eddie-knight (SonaType)

The creation of a Common Cloud Controls 30, 60, 90 day plan

Description

Target date for first draft - 14th September 2023

The creation of the 30, 60, 90 day plan was requested to include the project announcement at the end of October.

• The plan should be coordinated across all CCC working groups
• What can be achieved by CCC leading to the live project announcement around Nov 1st?
• Includes FINOS announcement and conference milestones.

First Major Milestone

• Project live announcement on 1st November in NYC - https://www.finos.org/hosted-events/2023-11-01-open-source-in-finance-forum-new-york

Incremental Milestones

• To be defined

December 7th 2023 Common Cloud Controls - Project All Hands - All Working Groups

Date

December 7th 2023 - 12pm EST / 5pm GMT

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide
• Review Meeting Notices (see above)
• Approve past meeting minutes
• Citi contributed FINOS CCC white paper merged into project
• MITRE Engagement in FINOS CCC - @crawfordchanel
• FINOS CCC Steering Committee Approval and Update - @mcleo-d
  • Project approve @l1ttlej1m, Citi CTO, as first member of the FINOS CCC Steering Committee
  • First Steering Committee Meeting - #106
    • FINOS CCC FSI maintainers will represent their working groups
    • Maintainers to agree Q1 2024 roadmap and objectives
    • The objective is to keep working groups tightly aligned to the deliverables and scope of FINOS CCC
  • The FINOS CCC Steering Committee is recruiting senior FSI peers & will expand in early 2024
• FINOS CCC Q1 2024 objectives discussion - Maintainers with FINOS CCC Participants
  • Define the working principles of the steering committee, maintainer time commitments and how the steering committee should engage with the project
  • Make decision on partnerships between mutually beneficial taxonomies - FOCUS and CDMC
  • Harden First FINOS CCC Service against FINOS CCC Working Group expectations
  • Use First FINOS CCC Service as template for additional services to follow
  • Take First FINOS CCC Service to CSP for adoption roadmap & planning
• Kanban review and working group updates - https://github.com/orgs/finos/projects/78
• AOB, Q&A & Adjourn (5mins)
  • @mcleo-d FINOS update and introduction to @robmoffat

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

MITRE WG: Establish alignment with CCC Cloud Taxonomy Working Group for capturing Controls Testing Requirements

Establish alignment with CCC Cloud Taxonomy Working Group for capturing Controls Testing Requirements

Assumptions

1. The CCC Cloud Taxonomy working group will be responsible for defining controls and their corresponding testing requirements.
2. The controls defined as part of the CCC Control Catalog will include clearly defined testing requirements.

Objective

The objective is to establish a comprehensive set of Control Testing Requirements for each Control, enabling a thorough assessment of the effectiveness of these controls. The Controls Testing requirements will be articulated in plain English and translated into corresponding MITRE TTPs and abstract testing language like Gherkins.

September 14th 2023 Common Cloud Controls - Engage with NIST on Controls

Common Cloud Controls - Engage with NIST on Controls

Date

September 14th 2023 - 12pm EST / 5pm BST

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide
• Review Meeting Notices (see above)
• Approve past meeting minutes
• #18
• #13
• #10
• Review Project Kanban - https://github.com/orgs/finos/projects/78
  • Review GitHub Issues, Move Forward or Close - https://github.com/finos/common-cloud-controls/issues
  • Review Discussion, Move Forward or Close - https://github.com/finos/common-cloud-controls/discussions
• AOB, Q&A & Adjourn (5mins)

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

September 28th 2023 Common Cloud Controls - Define Cloud Services Taxonomy

Common Cloud Controls - Define Cloud Services Taxonomy

Date

September 28th 2023 - 12pm EST / 5pm BST

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide
• Review Meeting Notices (see above)
• Approve past meeting minutes
• Help Wanted - Get involved with Compliant Financial Infrastructure request below ... 🎶 📣
  • #48
• Taxonomy Collaboration 👀
  • #15
  • #29
  • #39
• Move Forward #13 (comment)
• Review Project Kanban - https://github.com/orgs/finos/projects/78
• AOB, Q&A & Adjourn (5mins)

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

August 24th 2023 Common Cloud Controls - Define Cloud Services Taxonomy

Common Cloud Controls - Define Cloud Services Taxonomy

Date

August 24th 2023 - 12pm EST / 5pm BST

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene, Introduce James and Mark, & roll call (5 min)
• Display FINOS Antitrust Policy summary slide (2 min)
• Introduce Common Cloud Controls project and Problem Statement (~10 min)
• Discuss project objectives and 30/60/90 timeline (~10 min)
• Present example taxonomy (~5 min)
• Discussion time (~10 min)
• Identify volunteers to lead outcomes and assign work (~10 min)
• AOB, Q&A, Adjourn (5 min)

Notes

Common Cloud Controls Project

The proposed Common Cloud Controls project would be an industry standard that describes consistent controls for a subset of CSP services common across CSPs and fundamental to most solutions with the intention to help address risks: vendor lock-in; inconsistency of controls; scarcity of skilled workforce; and fragmentation and complexity of regulatory landscape.

Overall project meets 1st Thursday of each month - #1

Initial 3 working groups

• Engage with NIST on Controls (2nd Thursday)
• Engage with MITRE Threat Catalogue (3rd Thursday)
• Define Cloud Services Taxonomy (4th Thursday)

Problem Statement

A foundational need when looking to build these common controls is an ability to define common services across CSP and a taxonomy in which to describe them as well as the underlying common capabilities and features of those services.

Project Objectives

1. Create a proposed taxonomy for common cloud services including an ontology for common features and capabilities.
2. Taxonomy should be CSP Agnostic, consistent, hierarchical.
3. Propose a set of CSP agnostic iconography to represent common services.

General timeline

August 24th

• Present initial problem statement and objectives.
• Reference FinOps Foundation and ARC work
• Agree to objectives and timelines.
• Identify volunteer leads.
  • Propose priority services
  • Propose taxonomy of first common service
  • Propose top level of Taxonomy

September 28th

• Agree to priority services (Kubernetes, Object Storage, etc…)
• Discuss taxonomy of first common service
• Discuss top level of Taxonomy
• Identify volunteer leads
  • Finalize priority services
  • Finalize taxonomy of first common service
  • Finalize top level taxonomy
  • Propose second level taxonomy

October 26th

• Approve priority services
• Approve taxonomy of first common service
• Approve top level taxonomy
• Discuss second level taxonomy
• Identify volunteer leads
  • Finalise second level taxonomy
  • Define common capability qualifiers for priority services

Example Taxonomy

Data-At-Rest -> Database -> Relational

Capability Qualifiers

• Field level encryption
• Regional Replication
• Scalability
• Transactions per second

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

Create a sample control catalog and component definition implementing the controls

Due date : 20th October 2023

... add success criteria

November 2nd 2023 Common Cloud Controls - Project Live Retrospective - All Working Groups

Date

November 2nd 2023 - 12pm EST / 4pm GMT

This is your invitation to the hybrid CCC Project All Hands, which will take place over Zoom and at Rise New York, located at 43 W 23rd St, NY 10010.

If attending in person, please register on the first floor with security and then proceed to the Barclays Rise reception on the second floor to be checked in and taken to room 2.2 where the meeting will take place.

Alternatively, please use the Zoom details at the bottom of this issue to join the hybrid session..

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide
• Review Meeting Notices (see above)
• Approve past meeting minutes
• OSFF Celebration 🥇
• FINOS CCC working group updates
• FINOS CCC Retrospective and Future Planning
  • Recap of last 3 months
    • What we did well
    • Where can we improve
    • Next steps?
  • Road ahead planning
• AOB, Q&A & Adjourn (5mins)

Additional Items

• CDMC - What next?
• Regulatory Engagement Update/Plan
• Continuous Control Monitoring (CCM)
• MITRE UPDATE
• CSP Control Plane Failure
• Scope of CCC
  • include CCM?
• Readme project scope
  • spec
  • White paper

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

Post MITRE use cases in the CCC project GitHub issues

Description

Post MITRE use cases in the CCC project GitHub issues so the MITRE working group can start work prior to the next meeting.

Rename `Engage with NIST on Controls` to focus on `OSCAL` as the control delivery mechanism rather than `NIST` as control owners

It was raised on #23 that the working group name Engage with NIST on Controls could be confusing outside the project and should be renamed to reflect OSCAL as the control delivery mechanism rather than NIST as the control owner.

Engage with NIST WG to agree OSCAL versioning strategy when referencing mitigated threats from OSCAL descriptions

Description

It was discussed during August 10th 2023 Common Cloud Controls - Engage with NIST on Controls that the WG should agree the CCC OSCAL versioning strategy when referencing or describing mitigated threats from OSCAL descriptions.

It was raised on the call that the CCC OSCAL should not duplicate threat descriptions, but reference a versioned threat that lives as the authoritative source.

It was also raised in the WG that the MITRE working group should define, reference and version threats that don't appear in the MITRE definitions.

Success Criteria

1. The WG agrees how threats should be referenced or described within the CCC OSCAL.
2. The WG agrees the version control strategy so the OSCAL refers to the threats at a specific point in time until the next CCC OSCAL release.

Contribution Request : OSCAL example that points to MITRE and describes tests using Gherkin

Description

During #5 the following requests were raised by the CCC MITRE working group.

• Can Citi contribute an existing OSCAL example that can be used as a reference by the MITRE working group?

  • This example could be used to inform further MITRE contributions through OSCAL.
  • Can this contribution be raised as a PR into the CCC repo?

• The work related to Storage ( object storage ) [AWS S3, gcp storage, azure object storage] is complete and ready to be contributed into the FINOS CCC repo

  • #11 (comment)

--- Update ---

The following item has been moved into its own separate issue as it creates a larger scope.

• Gherkin should be used as a Behaviour Test rather than a Configuration Test.
  • Can an example of this type of test be expanded upon during a relevant future call?

Implement an initial cloud service example that demonstrates a steel thread across working groups.

Due date : 19th January 2024

This GitHub issues represents part of the roadmap defined by the OSCAL working group on #13

Tasks

Beta Give feedback

1. Implement an initial cloud service example that demonstrates a steel thread across working groups.
2. Pick initial common cloud services to define
3. Allocate MITRE threats and apply OSCAL mitigations
4. Write Gherkin tests to describe service configuration expectations
5. Work with CSPs on how Gherkin should be interpreted via cloud APIs

August 3rd 2023 - Common Cloud Controls Kick Off

Common Cloud Controls - Project Kick Off

Date

August 3rd 2023 - 10am EST / 3pm BST

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Display FINOS Antitrust Policy summary slide
• Review Meeting Notices (see above)
• CCC Project Overview by Jonathan Meadows - Citi Managing Director and Jason Nelson - Citi Director of Cloud Security
  • Participants Q&A
• Join a CCC Working Group Today - Including Maintainer Recruitment
  • Engage with NIST on Controls
  • Engage with MITRE Threat Catalogue
  • Define Cloud Services Taxonomy
• Proposed Meeting and Working Group Cadence
• Collaborating on GitHub and the CCC Email Distribution List
  • Email your GitHub ID to [email protected] to be added to the private FINOS CCC GitHub repo
• Your opportunity to change the CCC project name
• AOB, Q&A & Adjourn (5mins)

Join the CCC Zoom meetings below

• Engage with NIST on Controls - August 10th at 12pm EST / 5pm BST (second Thursday of each month)
• Engage with MITRE Threat Catalogue - August 17th at 10am EST / 3pm BST (third Thursday of each month)
• Define Cloud Services Taxonomy - August 24th at 12pm EST / 5pm BST (fourth Thursday of each month)
• Common Cloud Controls - Project Meeting - September 7th at 12pm EST / 5pm BST (first Thursday of each month)

Appendix

Initial 3 CCC Working Groups

Zoom info

Join Zoom Meeting
https://zoom.us/j/99516284313?pwd=Q1BPc2J2Tmg4cXFHR01RWSt4VDU3Zz09

Meeting ID: 995 1628 4313
Passcode: xMFAJmA3

Dial by your location
• [phone] US (Chicago)
• [phone] US (New York)
• [phone] US
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Houston)
• [phone] US
• [phone] US
• 877 369 0926 US Toll-free
• 855 880 1246 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 995 1628 4313

Find your local number: https://zoom.us/u/abyFWNdPl

White House RFI : Question 7 Response

Shared Google Doc for White House RFI Response

Please find the shared Google Doc for White House RFI response below ...
-https://docs.google.com/document/d/1qIgjIVQtQgNd-DdhzVia_VKhWa_gsV5maPDQG-KzyXI/edit?usp=sharing

Question 7 : Whitehouse RFI

Cloud and Other Service Providers – Information technology, as a sector, is not regulated directly by the Federal government. However, regulated entities’ use of cloud and other service provider infrastructure is often regulated. To date, regulators have typically not directly regulated cloud providers operating in their sector. Rather, regulatory agencies have imposed obligations on their regulated entities that are passed along by contract to the cloud
provider/service provider.

a. Please provide specific examples of conflicting, mutually exclusive, or inconsistent cybersecurity regulatory requirements that are passed along by contract to third-party service providers.

b. Please provide examples of direct cybersecurity regulation of third-party service providers.

c. Please provide information regarding the costs to third-party service providers of conflicting, mutually exclusive, or inconsistent cybersecurity regulatory requirements that are passed on to them through their contracts with regulated customers. Please also provide estimated costs to a regulated customer of using a third-party service provider when conflicting, mutually exclusive, or inconsistent cybersecurity regulatory requirements are passed to the customer through contracts. In either case, please detail the methodology for developing the cost estimate.

d. Describe any two or more conflicting, mutually exclusive, or inconsistent regulation, one of which permits the use of cloud, while another does not. How does this impact your sector? Explain if these requirements also restrict the use of Managed Security Service Providers (MSSPs) and security tools that utilize the cloud.

e. Have any non-U.S. governments instituted effective models for regulating the use of cloud services by regulated entities in a harmonized and consistent manner? Please provide examples and explain why these models are effective.

f. The Department of Defense allows defense industrial base contractors to meet security requirements for the use of the cloud by using FedRAMP-approved infrastructure. Please provide examples of how the FedRAMP process differs, positively or negatively, from other requirements. What, if anything, would need to change about the FedRAMP certification process and requirements for it to be usable to meet other cybersecurity regulatory requirements?

g. To the extent not included in response to any other question, please identify any specific Critical or Emerging Technologies that are subject to conflicting, mutually exclusive, or inconsistent regulation related to cybersecurity.

November 9th 2023 Common Cloud Controls - OSCAL Representation of FINOS CCC

Date

November 9th 2023 - 12pm ET / 5pm GMT

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide
• Review Meeting Notices (see above)
• Approve past meeting minutes
• Introduction to @crawfordchanel from Citi
• Kanban Board Run Through - https://github.com/orgs/finos/projects/78/views/3
• AOB, Q&A & Adjourn (5mins)

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

White House RFI : Question 3 Response

Shared Google Doc for White House RFI Response

Please find the shared Google Doc for White House RFI response below ...
-https://docs.google.com/document/d/1qIgjIVQtQgNd-DdhzVia_VKhWa_gsV5maPDQG-KzyXI/edit?usp=sharing

Question 3 : Whitehouse RFI

Use of Existing Standards or Frameworks – The practice of using existing standards or frameworks in setting regulatory requirements can reduce burdens on regulated entities and help to achieve the goals of regulatory harmonization. Under existing law5F 6, Federal executive agencies use voluntary consensus standards for regulatory activities unless use of such standards is inconsistent with law or otherwise impractical. In a recent report6F 7 from the President’s National Security Telecommunications Advisory Council (NSTAC) that addressed cybersecurity regulatory harmonization, the NSTAC noted that “even though most regulations cite consensus standards as the basis for their requirements, variations in implementations across regulators often result in divergent requirements.”

a. To what extent are cybersecurity requirements applicable to your industry or sector based on, consistent with, or aligned with existing standards or frameworks?

i. Which standards or frameworks have been applied to your industry or sector?

ii. Have these standards or frameworks been adopted in whole, either through the same requirements or incorporation by reference, or have they been modified by regulators?

If modified, how were they modified by particular regulators? Has your entity or have others in your sector provided input that the regulator used to develop or adapt existing standards for your sector? If so, what are the mechanisms, frequency, and nature of the inputs?

b. Is demonstrating conformity with existing standards or frameworks that your industry is
required by regulation to use readily auditable or verifiable and why?

c. What, if any, additional opportunities exist to align requirements to existing standards or
frameworks and, if there are such opportunities, what are they?

August 17th 2023 Common Cloud Controls - Engage with MITRE Threat Catalogue

Common Cloud Controls - Engage with MITRE Threat Catalogue

Date

August 17th 2023 - 10am ET / 3pm BST

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide
• Introduce Problem Statement
• Discuss outcomes necessary for project success
• Identify volunteers to lead each outcome identified and assign work
• #6
• AOB, Q&A & Adjourn (5mins)

Decisions Made

• TBD
• [ ]
• ...

Action Items

• TBD
• [ ]
• ...

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

Define whether the working group wants to create a repo of component definitions

Due date : 17th November 2023

This GitHub issues represents part of the roadmap defined by the OSCAL working group on #13

Tasks

Beta Give feedback

1. Define whether the working group wants to create a repo of component definitions
2. Define whether the working group wants to create an OSCAL catalog?
3. Define whether the group needs a repo that is friendly for managing OSCAL content, catalogs and service definitions?
4. Define whether the repo be a database or a GitHub repo?
5. Potential for GitHub repo(s) that can be contributed via pull request
6. Potential for cloud object storage that can be indexed and displayed.
7. Potential for delivery pipeline from GitHub repo into other hosted service

November 30th 2023 Common Cloud Controls - Define Cloud Services Taxonomy

Date

November 30th 2023 - 12pm ET / 5pm GMT

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide
• Review Meeting Notices (see above)
• Approve past meeting minutes
• Kanban review and milestone planning - https://github.com/orgs/finos/projects/78/views/2
• AOB, Q&A & Adjourn (5mins)

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

Creation of RDMS Service for Compliant Financial Infrastructure

The FINOS Compliant Financial Infrastructure project wants to create a FINOS Common Cloud Controls version of RDMS that's being led by CFI maintainers @eddie-knight of Sonatype and @AdrianHammond of Red Hat.

The objective is to demonstrate an "end to end" working example of RDMS that is described by FINOS CCC and is created by Compliant Financial Infrastructure for demo at the FINOS Open Source in Finance Forum on 1st November 2023.

Piecing the RDMS Requirements Together

FINOS CCC has created taxonomy and service description examples that could be used to deliver the requirements that Compliant Financial Infrastructure is requesting. For example ..

• The following pull request describes a work in progress Taxonomy that's being created by @mark-rushing and the Taxonomy working group - #39

• The following Object Storage service description is being created by @git-hub-forwork1 and the MITRE working group - #11 (comment)

Requirements

Using the examples above, members of the FINOS CCC project should collaborate with @eddie-knight and @AdrianHammond to provide the first MVP description of RDMS in OSCAL that also mitigates x amount of threats from the MITRE Attack Framework.

Tests described in Gherkin are desirable, in the knowledge the approach has not been fully formed by @git-hub-forwork1 and the MITRE working group.

Please Note

This piece of work is a reference example for FINOS CCC and FINOS CFI and will not be deployed in a banking environment unless hardened and tested over time.

Timelines

Please use the issue comments to discuss the requirements for RDMS work to start on Monday 2nd October 2023.

OSCAL Training Material

In the inital NIST WG meeting a question was asked about OSCAL training. In reading up on OSCAL this week I found this NIST Link to OSCAL Instructional Videos, Presentations, and Blogs. So far I have watched this video that I found to be really useful but still need to learn more :-)

Invite MITRE to join the next working group call on September 21st at 12pm EST / 5pm BST

Description

• Invite MITRE to join the next working group call on September 21st at 12pm EST / 5pm BST

Purpose

To understand how the group can contribute back to the MITRE framework.

Recruitment of CCC Working Group and Project Leads from FINOS Membership

This issue captures the names and firms of people who would like to become a Common Cloud Controls maintainer by joining the leadership of one of the following working groups.

• Engage with NIST on Controls.
• Engage with MITRE Threat Catalogue.
• Define Cloud Services Taxonomy.

Please add you Name, Firm, Position and the Reason why you'd make a great CCC working group maintainer to the comments below ... 👇🏻

Deadline for nominations is Friday 22nd September 2023.

Follow up on 7th Sept meeting.

Discussed in #36

^{Originally posted by ianmiell September 21, 2023}
Hi @jonmuk @iMichaela,

As discussed in the meeting of 7th September, I'm introducing you to my colleagues @gusfcarvalho and Onsel (invite pending, https://github.com/onselakin).

As a reminder of the context, Onsel and Gustavo are working with the OSCAL standard as part of an open source project we're working on. They've had some lessons learned as a result and we're keen to discuss them with you, as well as hear from you about your perspectives on it.

If you'd like to continue the discussion by email, my email is: ian.miell [at] container-solutions.com (I don't think I have your mails). Anyone else with an interest in this group is welcome to join us.

Ian

Does CCC want to book an OSFF room for collaboration on 31st October or 2nd November?

Define which cloud service providers are accepting the initial OSCAL definitions

Due date : 19th January 2024

This GitHub issues represents part of the roadmap defined by the OSCAL working group on #13

Tasks

Beta Give feedback

1. Define which cloud service providers are accepting the initial OSCAL definitions
2. Investigate and define how are their services implemented and tested?

NIST Engagement on Common Controls Initiative

Description

This issue contains an email conversation for transparency between NIST and the Engage with NIST on Controls WG who are engaging NIST to extend the OSCAL standard.

---

From @valmihai to NIST
We've been working with the folks at FINOS (on CC here), on the Common Cloud Controls initiative.

The Common Cloud Controls programme has been established within FINOS to provide a mechanism for Financial Institutions to avoid concentration risk between Cloud Service Providers (CSP) by defining a common set of controls that can be implemented in a CSP to allow potential migration between clouds. These controls are designed to specifically mitigate threats identified during threat modelling of the specific risks aimed at cloud services. The aim is to define the controls in a codified form leveraging OSCAL along with codified test cases that validate the efficacy of those controls and mitigation the threat.

We would like to partner with NIST and the OSCAL community to understand where best to add the codified implementation, threat and efficacy test cases within OSCAL. We would be particularly interested if prior art exists or there are existing partners who would be willing to work on this.

Please let us know if this is something you'd be open to engaging with the team, and if so, @mcleo-d can help coordinate a call for everyone.

MITRE WG: Establish collaboration with OSCAL working group on schema

Establish collaboration with OSCAL working group on schema for integrating Controls Testing Requirements and corresponding Gherkin test scenarios into the OSCAL structure

Objectives

1. Define the location within the OSCAL schema for embedding Control Testing Requirements.
2. Define the location within the OSCAL schema for embedding abstract testing language (Gherkins).

October 12th 2023 Common Cloud Controls - OSCAL Representation of CCC

Date

October 12th 2023 - 12pm EST / 5pm BST

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide
• Review Meeting Notices (see above)
• Approve past meeting minutes
• Review Project Kanban - https://github.com/orgs/finos/projects/78
  • Review GitHub Issues, Move Forward or Close - https://github.com/finos/common-cloud-controls/issues
  • Review Discussion, Move Forward or Close - https://github.com/finos/common-cloud-controls/discussions
• AOB, Q&A & Adjourn (5mins)

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

Does CCC want a 30 minute break out session, following the keynotes, at OSFF in NYC on November 1st?

MITRE Cloud Matrix: Assess the effectiveness/coverage of the existing MITRE Cloud Matrix TTPs in addressing the CCC Controls Testing Requirements

Assess the effectiveness/coverage of the existing MITRE Cloud Matrix TTPs in addressing the CCC Controls Testing Requirements

MITRE Enterprise has a Cloud Matrix program that is focused on listing TTPs for Cloud. This Matrix can be used as the baseline of TTPS that addresses controls testing requirements posed by CCC Controls Catalog.

This roadmap items covers the following work streams:

• Collaborate with MITRE on the Cloud Matrix Program, fostering productive cooperation and establishing a designated point of contact.
• Evaluate existing Tactics, Techniques, and Procedures (TTPs), and propose new TTPs based on Controls testing requirements.
• Verify that the MITRE Cloud Matrix Program provides comprehensive coverage for all posed Controls Requirements.

October 19th 2023 Common Cloud Controls - Engage with MITRE Threat Catalogue

Date

October 19th 2023 - 10am ET / 3pm BST

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide
• Review Meeting Notices (see above)
• Approve past meeting minutes
• Taxonomy Working Group RDMS Alignment
• Working Group Collaboration : Contribution Request : OSCAL example that points to MITRE and describes tests using Gherkin
• Review Project Kanban - https://github.com/orgs/finos/projects/78
  • Review GitHub Issues, Move Forward or Close - https://github.com/finos/common-cloud-controls/issues
  • Review Discussion, Move Forward or Close - https://github.com/finos/common-cloud-controls/discussions
• AOB, Q&A & Adjourn (5mins)

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

Determine how to use CMDC to accelerate CCC Taxonomy

At the FinOS CCC meeting last week (#68 ) we agreed to arrange a follow up with the CCC Taxonomy workstream to see how the CDMC information model and controls have be used to accelerate the data section of CCC.

I have done a bit of work to identify the overlaps in advance of a meeting with the Taxonomy maintainers in the near future. Simon Sanger and Mark Rushing I think volunteered to work on this, with Leroy Abikhui, Shuh Alam and Ben Newton from LSEG's Cloud Controls team. This issue is to track that follow up and come up with a proper plan of action.

Context and example follows:

CCC Taxonomy vs CDMC Capabilities
Looking at https://github.com/finos/common-cloud-controls/blob/main/services/database/relational/taxonomy.md
We have a CDMC controls list that overlaps with the RDMS Taxonomy (and will overlap with others in the future). For example:

Taxonomy ID	Feature	Description	CDMC Capability
CCC-RDMS-1	SQL Support	Properly handle queries in the SQL language.
CCC-RDMS-2	Vertical Scaling	Users may increase or decrease resource allocation.
CCC-RDMS-3	Horizontal Scaling	Read replicas of the primary database can be created.
CCC-RDMS-4	Multi-region	Read replicas can be created in multiple user-specified regions.
CCC-RDMS-5	Automated Backups	Backups can be automatically created and stored according to user specification.	CDMC-6.1.3 Backups and point-in-time recovery are supported
CCC-RDMS-6	Point in Time Recovery	Backups can be restored on demand to a specific point in time.	CDMC-6.1.3 Backups and point-in-time recovery are supported
CCC-RDMS-7	Encryption at Rest	Data is encrypted at rest, and can be encrypted with user private keys.	CDMC-4.1.1 Encryption policies are defined and enforced for data at rest, in motion, and in use
CCC-RDMS-8	Encryption in Transit	Data is encrypted in transit, and can be encrypted with user private keys.	CDMC-4.1.1 Encryption policies are defined and enforced for data at rest, in motion, and in use
CCC-RDMS-9	Role Based Access Control	Users can be assigned roles with specific permissions.	CDMC-3.1 Data entitlements are managed, enforced and tracked
CCC-RDMS-10	Logging	Configurable logs are available for user inspection.
CCC-RDMS-11	Monitoring	Configurable metrics are available for user inspection.
CCC-RDMS-12	Alerting	Configurable alerts can be enabled.

CDMC Definitions
CDMC has a range of existing controls documented in the CDMC Spec

• 14 Key controls some of which overlap with the existing RDMS items
• A full list of Capabilities & Sub-Capabilities that have been implemented by AWS, Azure, GCP and Snowflake
• see finos/compliant-financial-infrastructure#174 for all the specs
• see https://github.com/edmcouncil/cdmc/tree/main/ontology for the CDMC taxonomy (based on W3C, Atlas, Egeria and other existing standards)

Testing compliance with the Capabilities
Looking at the script in https://github.com/finos/common-cloud-controls/blob/main/services/database/relational/rdms-taxonomy.feature

• CDMC has a test script that was donated by KPMG of how to test each of the above capabilities. (see finos/compliant-financial-infrastructure#174 for all the specs)
• Example implementation of KMPG’s CDMC test script for Snowflake and Alation: https://github.com/Snowflake-Labs/EDMC-CDMC-v1-14-Control_Mapping
• Codebase implementing CDMC for GCP https://github.com/GoogleCloudPlatform/cdmc

September 21st 2023 Common Cloud Controls - Engage with MITRE Threat Catalogue

Common Cloud Controls - Engage with MITRE Threat Catalogue

Date

September 21st 2023 - 10am ET / 3pm BST

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide
• Review Meeting Notices (see above)
• Approve past meeting minutes
• #14
• #11
• #13
• Review Project Kanban - https://github.com/orgs/finos/projects/78
  • Review GitHub Issues, Move Forward or Close - https://github.com/finos/common-cloud-controls/issues
  • Review Discussion, Move Forward or Close - https://github.com/finos/common-cloud-controls/discussions
• AOB, Q&A & Adjourn (5mins)
  • #18

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

September 7th 2023 Common Cloud Controls - Project Meeting - All Working Groups

Date

September 7th 2023 - 12pm EST / 5pm BST

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide
• Review Meeting Notices (see above)
• Approve past meeting minutes
• #18
• CCC Project Kanban Introduction - https://github.com/orgs/finos/projects/78
• The creation of a CCC 30, 60, 90 day plan - #13
• #9
• #19 - The room fits 300 people.
• #20
• All CCC participants are required to sign a FINOS Community Specification CLA - #17
• Update - Engage with NIST on Controls
• Update - Engage with MITRE Threat Catalogue
• Update - Define Cloud Services Taxonomy
• AOB, Q&A & Adjourn (5mins)

Join the CCC Zoom meetings below

• Engage with NIST on Controls - September 14th at 12pm EST / 5pm BST (second Thursday of each month)
• Engage with MITRE Threat Catalogue - September 21st at 10am EST / 3pm BST (third Thursday of each month)
• Define Cloud Services Taxonomy - September 28th at 12pm EST / 5pm BST (fourth Thursday of each month)
• Common Cloud Controls - Project Meeting - October 5th at 12pm EST / 5pm BST (first Thursday of each month)

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

Formulate taxonomy for MITRE TTPs to be represented in a higher level testing language

MITRE TTPs Taxonomy for higher level testing language

A reference taxonomy is required for mapping MITRE TTPs-based testing scenarios into a higher-level testing language.(Ex: Gherkin)

The reference taxonomy defines the following foundational building blocks that represent a test. Each test can be sequenced to simulate a scenario. The sequencing can be in a series, parallel, tree, or directed graph structure.

Given:

• Object -
• Context -

When

1. Subject -
2. Action -
3. Constraints -

Then

1. Outcome -

And Then

1. Add more as needed -

Outcome

The taxonomy-defined tokens/entities will be used to formulate test scenarios in a higher-level testing language

White House RFI : Office of the National Cyber Director Requests Public Comment on Harmonizing Cybersecurity Regulations

Description

FINOS requests that Common Cloud Controls leads the response to the White House RFI highlighted in this issue and in the attached PDF. Please feedback the project's appetite in the comments so the response can be planned.

Office of the National Cyber Director Requests Public Comment on Harmonizing Cybersecurity Regulations

The White House Office of the National Cyber Director (ONCD) is announcing a request for information (RFI) on cybersecurity regulatory harmonization and regulatory reciprocity. The RFI builds on the commitment the Administration made in the National Cybersecurity Strategy to “harmonize not only regulations and rules, but also assessments and audits of regulated entities.” The RFI advances one of the 69 initiatives that were released last week as part of the National Cybersecurity Strategy Implementation Plan.

When cybersecurity regulations of the same underlying technology are inconsistent or contradictory – or where they are duplicative but enforced differently by different regulators – consumers pay more, and our national security suffers. Duplicative regulation leads to companies focusing more on compliance than on security, which results in their passing higher costs on to customers, working families, and state, local, Tribal, and territorial governments. Harmonizing baseline regulatory requirements can therefore produce better security outcomes at lower costs.

ONCD is seeking input from stakeholders to understand existing challenges with regulatory overlap and inconsistency in order to explore a framework for reciprocal recognition by regulators of compliance with common baseline cybersecurity requirements. Unlike many other fields, at a technical level, the cybersecurity of one sector is inherently similar to the cybersecurity of other sectors. While regulated sectors may engage in distinct activities, they often use the same software, hardware, and information and communications technology and services to enable interconnectivity or automation. The technological commonalities also mean that baseline risk mitigation measures are likely to be common among entities and sectors.

ONCD-Reg-Harm-RFI-Final-July-19.2023.pdf

GitHub Issues for Questions 3, 4 and 7 Response

• #49 - Notes updated and ready for work 👍🏻
• #50 - Notes updated and ready for work 👍🏻
• #51 - Notes updated and ready for work 👍🏻

Shared Google Doc for White House RFI Response

Please find the shared Google Doc for White House RFI response below ...
-https://docs.google.com/document/d/1qIgjIVQtQgNd-DdhzVia_VKhWa_gsV5maPDQG-KzyXI/edit?usp=sharing

August 10th 2023 Common Cloud Controls - Engage with NIST on Controls

Common Cloud Controls - Engage with NIST on Controls

Date

August 10th 2023 - 12pm EST / 5pm BST

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Display FINOS Antitrust Policy summary slide
• Review Meeting Notices (see above)
• Introductions
• Discuss success criteria, aim to produce document to state success criteria
• Identify any contributors currently actively working with NIST / OSCAL
• AOB, Q&A & Adjourn (5mins)

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

Define the tooling that should be used by the group / open source community?

Due date : 15th December 2023

This GitHub issues represents part of the roadmap defined by the OSCAL working group on #13

Tasks

Beta Give feedback

1. Define the tooling that should be used by the group / open source community?
2. Should OSCAL be written by hand?
3. How are the services described as OSCAL?
4. Are there any editorial tools that enable automation of OSCAL?
5. How should contributions be validated and accepted?
6. Maybe other collaboration and editing solutions are better for the team?

Define vision and purpose for OSCAL Representation of CCC working group

Due date : 20th October 2023

This GitHub issues represents part of the roadmap defined by the OSCAL working group on #13

Tasks

Beta Give feedback

1. Define vision and purpose for NIST / OSCAL working group
2. Define the end target for the working group - For example, stop regenerating processes

November 16th 2023 Common Cloud Controls - Engage with MITRE Threat Catalogue

Date

November 16th 2023 - 10am ET / 3pm GMT

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide
• Review Meeting Notices (see above)
• Approve past meeting minutes
• Kanban review and milestone planning - https://github.com/orgs/finos/projects/78/views/4
• AOB, Q&A & Adjourn (5mins)

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

October 26th 2023 Common Cloud Controls - Define Cloud Services Taxonomy

Date

October 26th 2023 - 12pm EST / 5pm BST

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact [email protected] with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide
• Review Meeting Notices (see above)
• Approve past meeting minutes
• 🥂🍾 Review Merged PR - #82
• #57
• #15
• Hybrid meeting from Rise New York - #68
• AOB, Q&A & Adjourn (5mins)

Zoom info

Join Zoom Meeting
https://zoom.us/j/98254617376?pwd=aGV6VzZQOTg3MHptY0tkZHRVSUsxUT09

Meeting ID: 982 5461 7376
Passcode: 305874

---

Dial by your location
• [phone] US
• [phone] US
• [phone] US (Tacoma)
• [phone] US (Washington DC)
• [phone] US
• [phone] US
• [phone] US (Chicago)
• [phone] US (Houston)
• [phone] US
• [phone] US
• [phone] US
• [phone] US
• [phone] US (New York)
• [phone] US
• [phone] US
• [phone] US (San Jose)
• [phone] US
• 855 880 1246 US Toll-free
• 877 369 0926 US Toll-free
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• [phone] Canada
• 855 703 8985 Canada Toll-free

Meeting ID: 982 5461 7376

Find your local number: https://zoom.us/u/acPjHdY2IO

Identify where to add test cases and threats within OSCAL. Working in collaboration with NIST.

Issue closed as a duplication of #75