As a user, I should be able to use CM to get a current gap analysis about compliance-masonry

[afeld]

Right...but doesn't a control being listed in the certification make it implicitly "required"? I'm not understanding why any new fields would be required in the YAML.

https://github.com/opencontrol/schemas#certifications

[afeld]

CM can specify and consume RequiredControls

Mind explaining this? @jcscottiii @ctro and I saw that added to the schema in #112 but weren't sure why it actually needs to be present in the YAML. What constitutes a non-required control?

[ctro]

I think that these requirements came from Gabe, specifically "specify and consume Required Controls".

This is why the one commit I made to gap analysis added that YAML. Gabe envisioned adding all "required" controls to the project's yaml. Then, you can check for the existence of those requiredControls in your actual documentation.

Is this because projects don't want/need to implement ALL of the controls for some Certification?? In this case diffing against all controls wouldn't be too useful.

I am also unsure of what makes a control required or not.

Maybe defining your list of requiredControls is the first step of using CM. How many controls are usually required for a project though? 10? 30? 400?

[afeld]

All good questions. Maybe this is related to some controls being partially fulfilled by the different layers, e.g. that the platform itself has monitoring, but that is not the same thing as an application having monitoring. @mogul @dlapiduz Any guesses?

[mogul]

The required controls are determined by the baseline you're shooting for. So if you're trying to document a FISMA Moderate system, that will imply a certain set of controls need to be satisfied, which means that you should have something showing up under each of them in your assembled docs. The gap report should say "To get FISMA Moderate, there should be something here, here, and here". If it were FISMA Low, it'd be a smaller set. If it was PCI or HIPAA, it would be a different set. Make sense?