diff --git a/.cards/local/calculations/defaultTitles/calculation.lp b/.cards/local/calculations/defaultTitles/calculation.lp index a98c363f..0e279764 100644 --- a/.cards/local/calculations/defaultTitles/calculation.lp +++ b/.cards/local/calculations/defaultTitles/calculation.lp @@ -35,7 +35,7 @@ secdeva_defaultTitle("secdeva_review_project-role-assignments", "Role assignment secdeva_defaultTitleWithDate("secdeva_review_project-structure", "Review of project structure - "). secdeva_defaultTitleWithDate("secdeva_review_competence", "Competence review - "). secdeva_defaultTitleWithDate("secdeva_review_periodic", "Periodic review - "). -secdeva_defaultTitleWithDate("secdeva_review_3rd-party-technologies", "Review of 3rd party technologies - "). +secdeva_defaultTitleWithDate("secdeva_review_3rd-party-technologies", "Review of third-party technologies - "). secdeva_defaultTitleWithDate("secdeva_review_risk-management", "Review of risk management - "). secdeva_defaultTitleWithDate("secdeva_review_interfaces", "Review of interfaces - "). % Legacy secdeva_defaultTitleWithDate("secdeva_review_process-scoping", "Review of process scoping - "). diff --git a/.cards/local/calculations/evidence/calculation.lp b/.cards/local/calculations/evidence/calculation.lp index 24ea9744..81a073fa 100644 --- a/.cards/local/calculations/evidence/calculation.lp +++ b/.cards/local/calculations/evidence/calculation.lp @@ -45,9 +45,9 @@ secdeva_evidence("secdeva_control_security-requirements", "secdeva_register_secu secdeva_legacyEvidence("secdeva_control_security-requirement-testing", "secdeva_test_security-requirements", "Review of \nsecurity requirement testing"). secdeva_evidence("secdeva_control_security-requirement-testing", "secdeva_review_security-requirement-testing", "Review of \nsecurity requirement testing"). secdeva_evidence("secdeva_control_3rd-party-technologies", "secdeva_register_technology-assessments", "Technology assessments"). -secdeva_evidence("secdeva_control_3rd-party-technologies", "secdeva_review_3rd-party-technologies", "Review of 3rd party technologies"). -secdeva_evidence("secdeva_control_vulnerability-management", "secdeva_review_vulnerability-management", "Review of 3rd party \nvulnerability management"). -secdeva_evidence("secdeva_control_software-update-management", "secdeva_review_software-update-management", "Review of 3rd party \nsoftware update management"). +secdeva_evidence("secdeva_control_3rd-party-technologies", "secdeva_review_3rd-party-technologies", "Review of third-party technologies"). +secdeva_evidence("secdeva_control_vulnerability-management", "secdeva_review_vulnerability-management", "Review of third-party \nvulnerability management"). +secdeva_evidence("secdeva_control_software-update-management", "secdeva_review_software-update-management", "Review of third-party \nsoftware update management"). secdeva_legacyEvidence("secdeva_control_use-of-cryptography", "secdeva_review_use-of-cryptography", "Review of \nthe use of cryptograpy"). secdeva_evidence("secdeva_control_use-of-cryptography", "secdeva_document_use-of-cryptography", "Use of cryptograpy document"). secdeva_evidence("secdeva_control_protect-environments", "secdeva_review_protect-environments", "Review of\nprotecting environments"). diff --git a/.cards/local/calculations/product.json b/.cards/local/calculations/product.json new file mode 100644 index 00000000..aa9d3854 --- /dev/null +++ b/.cards/local/calculations/product.json @@ -0,0 +1,7 @@ +{ + "name": "secdeva/calculations/product", + "displayName": "Products", + "description": "Normalises the CSAF relationships between products and derives the planned supply chain role", + "calculation": "calculation.lp", + "category": "Solution structure" +} diff --git a/.cards/local/calculations/product/calculation.lp b/.cards/local/calculations/product/calculation.lp new file mode 100644 index 00000000..8c782e34 --- /dev/null +++ b/.cards/local/calculations/product/calculation.lp @@ -0,0 +1,236 @@ +% The solution structure records what the solution is made of. Relationships between +% products are links, never parent and child cards: product composition is a graph, +% and a component that belongs to two products cannot have two parents. + +% secdeva_csafRelationship(Component, Product, Kind, Label) means that Component relates +% to Product in the way named by Kind. Label is the human-readable form used in reports. + +secdeva_csafRelationship(A, B, "defaultComponentOf", "built-in component of") :- + link(A, B, "secdeva/linkTypes/defaultComponentOf"). +secdeva_csafRelationship(A, B, "externalComponentOf", "external dependency of") :- + link(A, B, "secdeva/linkTypes/externalComponentOf"). +secdeva_csafRelationship(A, B, "installedOn", "installed on") :- + link(A, B, "secdeva/linkTypes/installedOn"). +secdeva_csafRelationship(A, B, "installedWith", "installed alongside") :- + link(A, B, "secdeva/linkTypes/installedWith"). +secdeva_csafRelationship(A, B, "optionalComponentOf", "optional add-on of") :- + link(A, B, "secdeva/linkTypes/optionalComponentOf"). + +% The same relationship reads differently from each end. The label in +% secdeva_csafRelationship describes the part ("optional add-on of X"); this one names +% what the part *is*, for tables that list the components of a product. + +secdeva_csafPartLabel("defaultComponentOf", "built-in component"). +secdeva_csafPartLabel("externalComponentOf", "external dependency"). +secdeva_csafPartLabel("installedOn", "installed on this product"). +secdeva_csafPartLabel("installedWith", "bundled alongside"). +secdeva_csafPartLabel("optionalComponentOf", "optional add-on"). + +% A relationship that makes us responsible for placing a distinct product on the market. +% A default component is absorbed into the product that contains it, so it is excluded. + +secdeva_distributableRelationship(P) :- + secdeva_csafRelationship(P, _, Kind, _), + Kind != "defaultComponentOf". + +% +% The planned supply chain role +% + +secdeva_placedOnMarketByUs(P) :- + base_projectCardType(P, "secdeva/cardTypes/product"), + not field(P, "secdeva/fieldTypes/productOrigin", "own"), + secdeva_distributableRelationship(P), + not link(P, _, "secdeva/linkTypes/defaultComponentOf"). + +% Both the role and its justification are calculated fields with an override, so they are +% emitted as fieldCalculated and the runtime suppresses either one as soon as the user +% sets it by hand. + +secdeva_supplyChainRoleIsCalculated(P) :- + base_projectCardType(P, CardType), + calculatedField(CardType, "secdeva/fieldTypes/supplyChainRole"), + overridableField(CardType, "secdeva/fieldTypes/supplyChainRole"). + +secdeva_supplyChainRoleJustificationIsCalculated(P) :- + base_projectCardType(P, CardType), + calculatedField(CardType, "secdeva/fieldTypes/supplyChainRoleJustification"), + overridableField(CardType, "secdeva/fieldTypes/supplyChainRoleJustification"). + +% Each delivery model that places the product on the market names the role it produces +% and the reason for it. + +secdeva_roleForDelivery("weDeliver", "distributor", + "We deliver a product that is already available on the market, which makes us its distributor."). +secdeva_roleForDelivery("weImportAndDeliver", "importer", + "We are the first to place this product on the market, from a manufacturer established outside it, which makes us its importer."). +secdeva_roleForDelivery("weRebrandAndDeliver", "manufacturer", + "We place this product on the market under our own name, or substantially modified, which makes us its manufacturer."). + +% Delivery models under which the product is never placed on the market, so no supply +% chain role arises. weOperateAsService and weConsumeAsService differ in who runs the +% software, which matters a great deal for security management but does not change +% whether the product is placed on the market. + +secdeva_notPlacedOnMarketReason("customerProvides", + "The customer provides this product. We depend on it but never place it on the market, so no supply chain role arises."). +secdeva_notPlacedOnMarketReason("weOperateAsService", + "We run this product ourselves to operate a service rather than shipping it to anyone, so it is not placed on the market and no supply chain role arises."). +secdeva_notPlacedOnMarketReason("weConsumeAsService", + "A third party operates this product and we use it over the network. We never run or ship it, so it is not placed on the market and no supply chain role arises."). + +secdeva_notPlacedOnMarket(Delivery) :- secdeva_notPlacedOnMarketReason(Delivery, _). + +% Developing a product ourselves makes us its manufacturer only if we actually place it +% on the market. A service we host is not placed on the market and carries no supply +% chain role. The role follows from the delivery model, so an own product with none +% recorded has no role yet, and the policy check below asks for one. + +secdeva_ownProductNotPlacedOnMarket(P) :- + base_projectCardType(P, "secdeva/cardTypes/product"), + field(P, "secdeva/fieldTypes/productOrigin", "own"), + field(P, "secdeva/fieldTypes/deliveryModel", Delivery), + secdeva_notPlacedOnMarket(Delivery). + +% secdeva_derivedRole(P, Role, Reason) pairs every derived role with the reason for it, so +% that the role and the justification shown beside it can never drift apart. + +secdeva_derivedRole(P, Role, Reason) :- + secdeva_placedOnMarketByUs(P), + field(P, "secdeva/fieldTypes/deliveryModel", Delivery), + secdeva_roleForDelivery(Delivery, Role, Reason). + +secdeva_derivedRole(P, "manufacturer", + "We develop this product ourselves and place it on the market, which makes us its manufacturer.") :- + base_projectCardType(P, "secdeva/cardTypes/product"), + field(P, "secdeva/fieldTypes/productOrigin", "own"), + field(P, "secdeva/fieldTypes/deliveryModel", _), + not secdeva_ownProductNotPlacedOnMarket(P). + +secdeva_derivedRole(P, "none", Reason) :- + secdeva_ownProductNotPlacedOnMarket(P), + field(P, "secdeva/fieldTypes/deliveryModel", Delivery), + secdeva_notPlacedOnMarketReason(Delivery, Reason). + +secdeva_derivedRole(P, "integratedComponent", + "This third-party component is built into one of our own products, so our manufacturer obligations for that product cover it and no separate supply chain role arises.") :- + base_projectCardType(P, "secdeva/cardTypes/product"), + not field(P, "secdeva/fieldTypes/productOrigin", "own"), + link(P, _, "secdeva/linkTypes/defaultComponentOf"). + +% A third-party product we neither run nor ship. Being a built-in component of one of our +% products takes precedence, so that case is excluded here rather than deriving two roles. + +secdeva_derivedRole(P, "none", Reason) :- + base_projectCardType(P, "secdeva/cardTypes/product"), + not field(P, "secdeva/fieldTypes/productOrigin", "own"), + not link(P, _, "secdeva/linkTypes/defaultComponentOf"), + field(P, "secdeva/fieldTypes/deliveryModel", Delivery), + secdeva_notPlacedOnMarketReason(Delivery, Reason). + +fieldCalculated(P, "secdeva/fieldTypes/supplyChainRole", Role) :- + secdeva_supplyChainRoleIsCalculated(P), + secdeva_derivedRole(P, Role, _). + +fieldCalculated(P, "secdeva/fieldTypes/supplyChainRoleJustification", Reason) :- + secdeva_supplyChainRoleJustificationIsCalculated(P), + secdeva_derivedRole(P, _, Reason). + +% Which group a product belongs to follows from its origin field, not from where the +% card happens to sit in the tree. The grouping cards are browsing containers and a +% target for the create buttons; they are not what decides anything. + +secdeva_productGroup(Product, "secdeva_group_own-products") :- + base_projectCardType(Product, "secdeva/cardTypes/product"), + field(Product, "secdeva/fieldTypes/productOrigin", "own"). + +secdeva_productGroup(Product, "secdeva_group_third-party-products") :- + base_projectCardType(Product, "secdeva/cardTypes/product"), + field(Product, "secdeva/fieldTypes/productOrigin", Origin), + Origin != "own". + +% +% Policy checks +% + +policyCheckFailure( + P, "Solution structure", "Origin is a required field", + "Record whether this is an own product or a third-party product.") :- + base_projectCardType(P, "secdeva/cardTypes/product"), + not field(P, "workflowStateCategory", "initial"), + not field(P, "secdeva/fieldTypes/productOrigin", _). + +policyCheckFailure( + P, "Solution structure", "Delivery model is a required field", + "Record what we do with this product, including who is responsible for operating it. The planned supply chain role is derived from it.") :- + base_projectCardType(P, "secdeva/cardTypes/product"), + not field(P, "workflowStateCategory", "initial"), + not field(P, "secdeva/fieldTypes/deliveryModel", _). + +policyCheckFailure( + P, "Solution structure", + "Justification not given for an overridden supply chain role", + "The supply chain role has been set by hand, so the derived justification no longer describes it. Explain the role by overriding the supply chain role justification field.", + "secdeva/fieldTypes/supplyChainRoleJustification") :- + base_projectCardType(P, "secdeva/cardTypes/product"), + fieldOverride(P, "secdeva/fieldTypes/supplyChainRole", _), + not fieldOverride(P, "secdeva/fieldTypes/supplyChainRoleJustification", _). + +% +% Policy checks: the delivery model and the product relationships must agree +% + +% A product that we never hold as an artefact cannot be packaged into our delivery. The +% customer's own copy and a service that someone else operates are both outside our +% hands, so neither can be built into a product we ship or bundled alongside one. +% weOperateAsService is deliberately absent: we do run that software, we just never ship it. + +secdeva_neverInOurHands("customerProvides"). +secdeva_neverInOurHands("weConsumeAsService"). + +secdeva_packagedRelationship("defaultComponentOf", "a built-in component of another product"). +secdeva_packagedRelationship("installedWith", "bundled alongside another product"). + +policyCheckFailure( + A, "Solution structure", + "The delivery model contradicts a product relationship", + @concatenate( + "This product is recorded as ", RelationText, + ", which means we ship it, but its delivery model says \"", Display, + "\". Correct the delivery model, or record the relationship as an external dependency instead."), + "secdeva/fieldTypes/deliveryModel") :- + base_projectCardType(A, "secdeva/cardTypes/product"), + secdeva_csafRelationship(A, _, Kind, _), + secdeva_packagedRelationship(Kind, RelationText), + field(A, "secdeva/fieldTypes/deliveryModel", Delivery), + secdeva_neverInOurHands(Delivery), + field(("secdeva/fieldTypes/deliveryModel", Delivery), "enumDisplayValue", Display). + +% A service that a third party operates is not installed by us onto anything. The reverse +% is the ordinary platform-as-a-service case and must not be flagged: our own product +% installed on a platform that somebody else runs is exactly right. + +policyCheckFailure( + A, "Solution structure", + "A service we consume cannot be installed on a platform", + "This product is recorded as installed on another product, but a third party operates it and we only use it over the network. Record it as an external dependency, or reverse the platform relationship.", + "secdeva/fieldTypes/deliveryModel") :- + base_projectCardType(A, "secdeva/cardTypes/product"), + link(A, _, "secdeva/linkTypes/installedOn"), + field(A, "secdeva/fieldTypes/deliveryModel", "weConsumeAsService"). + +% Developing a product is something only our own organisation does. + +policyCheckFailure( + P, "Solution structure", + "Only an own product can be developed by us", + "The delivery model says we develop this product and place it on the market, but its origin says it comes from a third party. Correct the origin, or choose the delivery model that describes what we do with it.", + "secdeva/fieldTypes/deliveryModel") :- + base_projectCardType(P, "secdeva/cardTypes/product"), + field(P, "secdeva/fieldTypes/deliveryModel", "weDevelopAndDeliver"), + not field(P, "secdeva/fieldTypes/productOrigin", "own"). + +% Products are assets of the project. + +ismsa_asset(P, "Product") :- base_projectCardType(P, "secdeva/cardTypes/product"). +ismsa_disableAssetControl(P) :- base_projectCardType(P, "secdeva/cardTypes/product"). diff --git a/.cards/local/calculations/registers/calculation.lp b/.cards/local/calculations/registers/calculation.lp index 699e1d1b..3d61de52 100644 --- a/.cards/local/calculations/registers/calculation.lp +++ b/.cards/local/calculations/registers/calculation.lp @@ -34,6 +34,26 @@ secdeva_registerMember(Asset, Register) :- secdeva_closestProject(Asset, Project), base_projectCardType(Asset, "secdeva/cardTypes/interface"). +% members of the solution structure register + +secdeva_registerMember(Product, Register) :- + secdeva_closestProject(Register, Project), + field(Register, "base/fieldTypes/identifier", "secdeva_register_solution-structure"), + secdeva_closestProject(Product, Project), + base_projectCardType(Product, "secdeva/cardTypes/product"). + +% members of the own and third-party product groups +% +% These are grouping cards inside the solution structure register. Membership follows +% the origin of the product rather than the position of the card, so a product filed +% under the wrong group still counts towards the right one. + +secdeva_registerMember(Product, Group) :- + secdeva_closestProject(Group, Project), + field(Group, "base/fieldTypes/identifier", GroupIdentifier), + secdeva_closestProject(Product, Project), + secdeva_productGroup(Product, GroupIdentifier). + % members of the risk register secdeva_registerMember(Risk, Register) :- diff --git a/.cards/local/cardTypes/dataflowModel.json b/.cards/local/cardTypes/dataflowModel.json index 32b3bf6e..f56d7df8 100644 --- a/.cards/local/cardTypes/dataflowModel.json +++ b/.cards/local/cardTypes/dataflowModel.json @@ -11,6 +11,7 @@ "secdeva/fieldTypes/description" ], "optionallyVisibleFields": [], - "displayName": "Dataflow model", - "description": "Top-level container for dataflow model elements" + "displayName": "Dataflow model (deprecated)", + "description": "Top-level container for dataflow model elements", + "category": "Deprecated" } \ No newline at end of file diff --git a/.cards/local/cardTypes/product.json b/.cards/local/cardTypes/product.json new file mode 100644 index 00000000..24dc581e --- /dev/null +++ b/.cards/local/cardTypes/product.json @@ -0,0 +1,94 @@ +{ + "name": "secdeva/cardTypes/product", + "displayName": "Product", + "workflow": "ismsa/workflows/asset", + "customFields": [ + { + "name": "base/fieldTypes/owner", + "displayName": "", + "isCalculated": true, + "enableOverride": true + }, + { + "name": "secdeva/fieldTypes/productOrigin", + "displayName": "", + "isCalculated": false + }, + { + "name": "secdeva/fieldTypes/productVendor", + "displayName": "", + "isCalculated": false + }, + { + "name": "secdeva/fieldTypes/deliveryModel", + "displayName": "", + "isCalculated": false + }, + { + "name": "secdeva/fieldTypes/supplyChainRole", + "displayName": "", + "isCalculated": true, + "enableOverride": true + }, + { + "name": "secdeva/fieldTypes/supplyChainRoleJustification", + "displayName": "", + "isCalculated": true, + "enableOverride": true + }, + { + "name": "base/fieldTypes/informationClassification", + "displayName": "", + "isCalculated": false + }, + { + "name": "secdeva/fieldTypes/sbomComponentType", + "displayName": "", + "isCalculated": false + }, + { + "name": "secdeva/fieldTypes/sbomComponentGroup", + "displayName": "", + "isCalculated": false + }, + { + "name": "secdeva/fieldTypes/sbomComponentName", + "displayName": "", + "isCalculated": false + }, + { + "name": "secdeva/fieldTypes/sbomComponentCpe", + "displayName": "", + "isCalculated": false + }, + { + "name": "secdeva/fieldTypes/sbomComponentPurl", + "displayName": "", + "isCalculated": false + }, + { + "name": "base/fieldTypes/identifier", + "displayName": "", + "isCalculated": false + } + ], + "alwaysVisibleFields": [ + "base/fieldTypes/owner", + "secdeva/fieldTypes/productOrigin", + "secdeva/fieldTypes/productVendor", + "secdeva/fieldTypes/deliveryModel", + "secdeva/fieldTypes/supplyChainRole", + "secdeva/fieldTypes/supplyChainRoleJustification" + ], + "optionallyVisibleFields": [ + "base/fieldTypes/informationClassification", + "secdeva/fieldTypes/sbomComponentType", + "secdeva/fieldTypes/sbomComponentGroup", + "secdeva/fieldTypes/sbomComponentName", + "secdeva/fieldTypes/sbomComponentCpe", + "secdeva/fieldTypes/sbomComponentPurl", + "base/fieldTypes/identifier" + ], + "description": "A product or component that is part of the solution, whether developed in-house or obtained from a third party", + "category": "Solution structure" +} \ No newline at end of file diff --git a/.cards/local/cardTypes/technology.json b/.cards/local/cardTypes/technology.json index 197ad3f4..fda30200 100644 --- a/.cards/local/cardTypes/technology.json +++ b/.cards/local/cardTypes/technology.json @@ -12,26 +12,6 @@ "name": "base/fieldTypes/informationClassification", "isCalculated": false }, - { - "name": "secdeva/fieldTypes/sbomComponentType", - "isCalculated": false - }, - { - "name": "secdeva/fieldTypes/sbomComponentGroup", - "isCalculated": false - }, - { - "name": "secdeva/fieldTypes/sbomComponentName", - "isCalculated": false - }, - { - "name": "secdeva/fieldTypes/sbomComponentCpe", - "isCalculated": false - }, - { - "name": "secdeva/fieldTypes/sbomComponentPurl", - "isCalculated": false - }, { "name": "base/fieldTypes/identifier", "displayName": "", @@ -52,11 +32,6 @@ } ], "optionallyVisibleFields": [ - "secdeva/fieldTypes/sbomComponentType", - "secdeva/fieldTypes/sbomComponentGroup", - "secdeva/fieldTypes/sbomComponentName", - "secdeva/fieldTypes/sbomComponentCpe", - "secdeva/fieldTypes/sbomComponentPurl", "base/fieldTypes/identifier", "base/fieldTypes/informationClassification" ], diff --git a/.cards/local/cardTypes/trustBoundary.json b/.cards/local/cardTypes/trustBoundary.json index 8abf34d4..eb866414 100644 --- a/.cards/local/cardTypes/trustBoundary.json +++ b/.cards/local/cardTypes/trustBoundary.json @@ -15,10 +15,16 @@ "displayName": "", "isCalculated": true, "enableOverride": true + }, + { + "name": "secdeva/fieldTypes/trustBoundaryType", + "displayName": "", + "isCalculated": false } ], "alwaysVisibleFields": [ "secdeva/fieldTypes/description", + "secdeva/fieldTypes/trustBoundaryType", "secdeva/fieldTypes/technology" ], "optionallyVisibleFields": [ diff --git a/.cards/local/fieldTypes/deliveryModel.json b/.cards/local/fieldTypes/deliveryModel.json new file mode 100644 index 00000000..13bca228 --- /dev/null +++ b/.cards/local/fieldTypes/deliveryModel.json @@ -0,0 +1,44 @@ +{ + "name": "secdeva/fieldTypes/deliveryModel", + "displayName": "Delivery model", + "dataType": "enum", + "enumValues": [ + { + "enumValue": "weDevelopAndDeliver", + "enumDisplayValue": "We develop it and place it on the market", + "enumDescription": "We develop this product ourselves and place it on the market under our own name, which makes us its manufacturer." + }, + { + "enumValue": "weDeliver", + "enumDisplayValue": "We deliver it (already on the market)", + "enumDescription": "We include a product that is already available on the market" + }, + { + "enumValue": "weImportAndDeliver", + "enumDisplayValue": "We import it into the market and deliver it", + "enumDescription": "We are the first to place this product on the market, from a manufacturer established outside the market." + }, + { + "enumValue": "weRebrandAndDeliver", + "enumDisplayValue": "We deliver it under our own name, or substantially modified", + "enumDescription": "Placing a product on the market under your own name or trademark, or modifying it substantially, makes you its manufacturer." + }, + { + "enumValue": "customerProvides", + "enumDisplayValue": "The customer provides it", + "enumDescription": "We depend on it but never ship it. Part of the environment rather than of the delivery." + }, + { + "enumValue": "weOperateAsService", + "enumDisplayValue": "We use it to operate a service", + "enumDescription": "We run it ourselves, on infrastructure we are responsible for, rather than shipping it to anyone, so it is not placed on the market." + }, + { + "enumValue": "weConsumeAsService", + "enumDisplayValue": "We consume it as a service", + "enumDescription": "A third party operates it and we use it over the network, such as a managed database, an identity provider or a payment API. We depend on it but never run or ship it, so it is not placed on the market." + } + ], + "description": "What we actually do with this product, including who is responsible for operating it. Determines the planned supply chain role.", + "category": "Solution structure" +} \ No newline at end of file diff --git a/.cards/local/fieldTypes/productOrigin.json b/.cards/local/fieldTypes/productOrigin.json new file mode 100644 index 00000000..f93384c7 --- /dev/null +++ b/.cards/local/fieldTypes/productOrigin.json @@ -0,0 +1,24 @@ +{ + "name": "secdeva/fieldTypes/productOrigin", + "displayName": "Origin", + "dataType": "enum", + "enumValues": [ + { + "enumValue": "own", + "enumDisplayValue": "Own product", + "enumDescription": "A product developed by your own organisation." + }, + { + "enumValue": "thirdPartyCommercial", + "enumDisplayValue": "Third-party commercial", + "enumDescription": "A commercial product from another manufacturer." + }, + { + "enumValue": "thirdPartyOpenSource", + "enumDisplayValue": "Third-party open source", + "enumDescription": "An open source product or component maintained outside your organisation." + } + ], + "description": "Whether the product is developed by your own organisation or comes from a third party", + "category": "Solution structure" +} \ No newline at end of file diff --git a/.cards/local/fieldTypes/productVendor.json b/.cards/local/fieldTypes/productVendor.json new file mode 100644 index 00000000..f05f3af4 --- /dev/null +++ b/.cards/local/fieldTypes/productVendor.json @@ -0,0 +1,7 @@ +{ + "name": "secdeva/fieldTypes/productVendor", + "displayName": "Vendor", + "dataType": "shortText", + "description": "The manufacturer or supplier of the product, used as the vendor branch in CSAF documents", + "category": "Solution structure" +} \ No newline at end of file diff --git a/.cards/local/fieldTypes/supplyChainRole.json b/.cards/local/fieldTypes/supplyChainRole.json new file mode 100644 index 00000000..ae9d9c65 --- /dev/null +++ b/.cards/local/fieldTypes/supplyChainRole.json @@ -0,0 +1,30 @@ +{ + "name": "secdeva/fieldTypes/supplyChainRole", + "displayName": "Planned supply chain role", + "dataType": "enum", + "enumValues": [ + { + "enumValue": "manufacturer", + "enumDisplayValue": "Manufacturer" + }, + { + "enumValue": "importer", + "enumDisplayValue": "Importer" + }, + { + "enumValue": "distributor", + "enumDisplayValue": "Distributor" + }, + { + "enumValue": "integratedComponent", + "enumDisplayValue": "Integrated component", + "enumDescription": "Absorbed into one of our products as a built-in component, so our responsibilities for that product cover it and no separate supply chain role arises." + }, + { + "enumValue": "none", + "enumDisplayValue": "No role" + } + ], + "description": "The role we plan to take for this product in its supply chain. A statement of intent, not a verified conclusion.", + "category": "Solution structure" +} \ No newline at end of file diff --git a/.cards/local/fieldTypes/supplyChainRoleJustification.json b/.cards/local/fieldTypes/supplyChainRoleJustification.json new file mode 100644 index 00000000..299b454a --- /dev/null +++ b/.cards/local/fieldTypes/supplyChainRoleJustification.json @@ -0,0 +1,7 @@ +{ + "name": "secdeva/fieldTypes/supplyChainRoleJustification", + "displayName": "Supply chain role justification", + "dataType": "longText", + "description": "Why this supply chain role applies. Derived together with the role, and overridden whenever the role is set by hand.", + "category": "Solution structure" +} diff --git a/.cards/local/fieldTypes/trustBoundaryType.json b/.cards/local/fieldTypes/trustBoundaryType.json new file mode 100644 index 00000000..025c0dd0 --- /dev/null +++ b/.cards/local/fieldTypes/trustBoundaryType.json @@ -0,0 +1,59 @@ +{ + "name": "secdeva/fieldTypes/trustBoundaryType", + "displayName": "Trust boundary type", + "dataType": "enum", + "enumValues": [ + { + "enumValue": "networkFiltered", + "enumDisplayValue": "Network segment, filtered", + "enumDescription": "A VLAN, subnet or security group where traffic to and from neighbouring segments is filtered by a firewall, an access control list, or a security group." + }, + { + "enumValue": "networkUnfiltered", + "enumDisplayValue": "Network segment, unfiltered", + "enumDescription": "Segments separated by routing or addressing alone, with nothing filtering the traffic between them. Crossing this boundary requires no privilege." + }, + { + "enumValue": "cloudTenant", + "enumDisplayValue": "Cloud account or tenant", + "enumDescription": "An administrative isolation boundary at a cloud provider, such as an account, a subscription, a project, or a Kubernetes namespace." + }, + { + "enumValue": "host", + "enumDisplayValue": "Host or machine", + "enumDescription": "A physical or virtual machine. Crossing this boundary means leaving the machine." + }, + { + "enumValue": "executionEnvironmentConfined", + "enumDisplayValue": "Execution environment, confined", + "enumDescription": "A container, sandbox, hypervisor guest or trusted execution environment that runs with restricted privileges." + }, + { + "enumValue": "executionEnvironmentPrivileged", + "enumDisplayValue": "Execution environment, privileged", + "enumDescription": "An execution environment that runs privileged, or with host resources mounted, so that escaping it is a realistic step for an attacker." + }, + { + "enumValue": "process", + "enumDisplayValue": "Operating system process or privilege level", + "enumDescription": "Operating system process isolation, or a change of privilege such as unprivileged to administrator, or user space to kernel." + }, + { + "enumValue": "logical", + "enumDisplayValue": "Logical separation", + "enumDescription": "Separation that exists only within one running program, such as tenant separation in a multi-tenant application. Nothing in the infrastructure marks this boundary." + }, + { + "enumValue": "physical", + "enumDisplayValue": "Physical site or enclosure", + "enumDescription": "A data centre, a room, a cabinet, or a tamper-resistant enclosure." + }, + { + "enumValue": "organisational", + "enumDisplayValue": "Organisational boundary", + "enumDescription": "The edge of your organisation's control, such as the line between you and a supplier, a customer, or a contractor." + } + ], + "description": "What kind of separation this trust boundary represents", + "category": "Threat model" +} \ No newline at end of file diff --git a/.cards/local/graphModels/productStructure.json b/.cards/local/graphModels/productStructure.json new file mode 100644 index 00000000..d17bffbd --- /dev/null +++ b/.cards/local/graphModels/productStructure.json @@ -0,0 +1,5 @@ +{ + "name": "secdeva/graphModels/productStructure", + "displayName": "Product structure", + "description": "A model for diagrams of the products that make up a solution" +} diff --git a/.cards/local/graphModels/productStructure/model.lp b/.cards/local/graphModels/productStructure/model.lp new file mode 100644 index 00000000..a46f12a6 --- /dev/null +++ b/.cards/local/graphModels/productStructure/model.lp @@ -0,0 +1,94 @@ +% +% Definitions for product structure diagrams +% +% Composition between products is recorded with links, never with parent and child +% cards, because a component can belong to more than one product. The diagram is +% therefore drawn entirely from the CSAF relationship links. + +product(X) :- field(X, "cardType", "secdeva/cardTypes/product"). + +% attributes + +title(X, Title) :- product(X), field(X, "title", Title). +origin(X, Origin) :- product(X), field(X, "secdeva/fieldTypes/productOrigin", Origin). +% Show the display name of the planned role rather than the stored enum value. +role(X, Display) :- + product(X), + field(X, "secdeva/fieldTypes/supplyChainRole", Role), + field(("secdeva/fieldTypes/supplyChainRole", Role), "enumDisplayValue", Display). + +% composition +% +% A CSAF link runs from the part to the whole. The diagram is drawn the other way +% round, from the whole to the part, so that a product appears above the things it +% is made of. contains(Whole, Part, Label) carries the label for that direction. + +contains(Whole, Part, "contains by default") :- + link(Part, Whole, "secdeva/linkTypes/defaultComponentOf"). +contains(Whole, Part, "uses an external component") :- + link(Part, Whole, "secdeva/linkTypes/externalComponentOf"). +contains(Whole, Part, "contains optionally") :- + link(Part, Whole, "secdeva/linkTypes/optionalComponentOf"). +contains(Whole, Part, "installed alongside") :- + link(Part, Whole, "secdeva/linkTypes/installedWith"). +contains(Whole, Part, "platform for") :- + link(Part, Whole, "secdeva/linkTypes/installedOn"). + +% transitive reach in both directions, used by the views to decide what to show + +reaches(A, B) :- contains(A, B, _). +reaches(A, C) :- contains(A, B, _), reaches(B, C). + +% +% Conversion to clingraph format +% + +graph(toplevelGraph). + +node(X, toplevelGraph) :- visible(X), product(X). + +edge((A, B, Label), toplevelGraph) :- + contains(A, B, Label), + visible(A), + visible(B). + +title((A, B, Label), Label) :- edge((A, B, Label), _). + +% labels + +attr(node, X, label, @concatenate( + "< ", @wrap(Title), "
>")) :- + node(X, _), title(X, Title), + not role(X, _). + +attr(node, X, label, @concatenate( + "< ", @wrap(Title), "
", + "[", Role, "]>")) :- + node(X, _), title(X, Title), role(X, Role). + +attr(edge, (A, B, Label), label, @concatenate( + "< ", Label, " >")) :- edge((A, B, Label), _). + +% shapes: own products are drawn solid, third-party products dashed, so the +% boundary of what we manufacture is visible at a glance + +attr(node, X, shape, rectangle) :- node(X, _). +attr(node, X, style, rounded) :- node(X, _), origin(X, "own"). +attr(node, X, style, "rounded,dashed") :- node(X, _), not origin(X, "own"). + +% the product the diagram was opened from is drawn heavier +attr(node, X, penwidth, "5") :- node(X, _), focus(X). +attr(node, X, penwidth, "2") :- node(X, _), not focus(X). + +attr(node, X, margin, "0.3") :- node(X, _). +attr(edge, (A, B, N), penwidth, "2") :- edge((A, B, N), _). +attr(edge, (A, B, N), arrowsize, "1.5") :- edge((A, B, N), _). + +attr(node, X, href, @concatenate("/cards/", X)) :- node(X, _). + +attr(graph, toplevelGraph, pad, "0.2"). +attr(graph, toplevelGraph, nodesep, "1"). +attr(graph, toplevelGraph, ranksep, "1.5"). +attr(graph, G, fontname, "helvetica") :- graph(G). +attr(node, N, fontname, "helvetica") :- node(N, _). +attr(edge, (A, B, N), fontname, "helvetica") :- edge((A, B, N), _). diff --git a/.cards/local/graphViews/product.json b/.cards/local/graphViews/product.json new file mode 100644 index 00000000..9fccae68 --- /dev/null +++ b/.cards/local/graphViews/product.json @@ -0,0 +1,5 @@ +{ + "name": "secdeva/graphViews/product", + "displayName": "Product", + "description": "A product structure diagram from the point of view of a single product" +} diff --git a/.cards/local/graphViews/product/view.lp.hbs b/.cards/local/graphViews/product/view.lp.hbs new file mode 100644 index 00000000..9c49be6b --- /dev/null +++ b/.cards/local/graphViews/product/view.lp.hbs @@ -0,0 +1,13 @@ +{{#if layout}} +attr(graph, toplevelGraph, rankdir, "{{layout}}"). +{{/if}} + +% The diagram is drawn around one product: the product itself, everything it is +% transitively part of, and everything transitively part of it. Siblings and their +% subtrees are left out, so the picture stays the chain this product sits in. + +focus({{cardKey}}). + +visible({{cardKey}}). +visible(Whole) :- reaches(Whole, {{cardKey}}). +visible(Part) :- reaches({{cardKey}}, Part). diff --git a/.cards/local/linkTypes/defaultComponentOf.json b/.cards/local/linkTypes/defaultComponentOf.json new file mode 100644 index 00000000..a73190e7 --- /dev/null +++ b/.cards/local/linkTypes/defaultComponentOf.json @@ -0,0 +1,15 @@ +{ + "name": "secdeva/linkTypes/defaultComponentOf", + "outboundDisplayName": "default component of", + "inboundDisplayName": "contains by default", + "sourceCardTypes": [ + "secdeva/cardTypes/product" + ], + "destinationCardTypes": [ + "secdeva/cardTypes/product" + ], + "enableLinkDescription": false, + "displayName": "Default component of", + "description": "The first product is a standard, default part or built-in component of the second product. Corresponds to the CSAF relationship category of the same name.", + "category": "Solution structure" +} \ No newline at end of file diff --git a/.cards/local/linkTypes/externalComponentOf.json b/.cards/local/linkTypes/externalComponentOf.json new file mode 100644 index 00000000..15cef678 --- /dev/null +++ b/.cards/local/linkTypes/externalComponentOf.json @@ -0,0 +1,15 @@ +{ + "name": "secdeva/linkTypes/externalComponentOf", + "outboundDisplayName": "external component of", + "inboundDisplayName": "uses an external component", + "sourceCardTypes": [ + "secdeva/cardTypes/product" + ], + "destinationCardTypes": [ + "secdeva/cardTypes/product" + ], + "enableLinkDescription": false, + "displayName": "External component of", + "description": "The first product functions as an external dependency or external library for the second product. Corresponds to the CSAF relationship category of the same name.", + "category": "Solution structure" +} \ No newline at end of file diff --git a/.cards/local/linkTypes/implementedBy.json b/.cards/local/linkTypes/implementedBy.json new file mode 100644 index 00000000..64174705 --- /dev/null +++ b/.cards/local/linkTypes/implementedBy.json @@ -0,0 +1,18 @@ +{ + "name": "secdeva/linkTypes/implementedBy", + "outboundDisplayName": "is implemented by", + "inboundDisplayName": "implements", + "sourceCardTypes": [ + "secdeva/cardTypes/process", + "secdeva/cardTypes/dataStore", + "secdeva/cardTypes/trustBoundary", + "secdeva/cardTypes/interface" + ], + "destinationCardTypes": [ + "secdeva/cardTypes/product" + ], + "enableLinkDescription": false, + "displayName": "Implemented by", + "description": "Links an element of a dataflow model to the product or component that implements it", + "category": "Solution structure" +} \ No newline at end of file diff --git a/.cards/local/linkTypes/installedOn.json b/.cards/local/linkTypes/installedOn.json new file mode 100644 index 00000000..875e6c54 --- /dev/null +++ b/.cards/local/linkTypes/installedOn.json @@ -0,0 +1,15 @@ +{ + "name": "secdeva/linkTypes/installedOn", + "outboundDisplayName": "installed on", + "inboundDisplayName": "platform for", + "sourceCardTypes": [ + "secdeva/cardTypes/product" + ], + "destinationCardTypes": [ + "secdeva/cardTypes/product" + ], + "enableLinkDescription": false, + "displayName": "Installed on", + "description": "The first product is installed directly on top of the second product, such as software running on a specific operating system or hardware platform. Corresponds to the CSAF relationship category of the same name.", + "category": "Solution structure" +} \ No newline at end of file diff --git a/.cards/local/linkTypes/installedWith.json b/.cards/local/linkTypes/installedWith.json new file mode 100644 index 00000000..31e3c5c4 --- /dev/null +++ b/.cards/local/linkTypes/installedWith.json @@ -0,0 +1,15 @@ +{ + "name": "secdeva/linkTypes/installedWith", + "outboundDisplayName": "installed with", + "inboundDisplayName": "installed alongside", + "sourceCardTypes": [ + "secdeva/cardTypes/product" + ], + "destinationCardTypes": [ + "secdeva/cardTypes/product" + ], + "enableLinkDescription": false, + "displayName": "Installed with", + "description": "The first product is bundled and installed alongside the second product during setup. Corresponds to the CSAF relationship category of the same name.", + "category": "Solution structure" +} \ No newline at end of file diff --git a/.cards/local/linkTypes/optionalComponentOf.json b/.cards/local/linkTypes/optionalComponentOf.json new file mode 100644 index 00000000..d9b04b40 --- /dev/null +++ b/.cards/local/linkTypes/optionalComponentOf.json @@ -0,0 +1,15 @@ +{ + "name": "secdeva/linkTypes/optionalComponentOf", + "outboundDisplayName": "optional component of", + "inboundDisplayName": "contains optionally", + "sourceCardTypes": [ + "secdeva/cardTypes/product" + ], + "destinationCardTypes": [ + "secdeva/cardTypes/product" + ], + "enableLinkDescription": false, + "displayName": "Optional component of", + "description": "The first product is an optional feature, add-on, or plug-in that can be added to the second product. Corresponds to the CSAF relationship category of the same name.", + "category": "Solution structure" +} \ No newline at end of file diff --git a/.cards/local/migrations/current/migrationLog.jsonl b/.cards/local/migrations/current/migrationLog.jsonl index 77edce57..32ae1abe 100644 --- a/.cards/local/migrations/current/migrationLog.jsonl +++ b/.cards/local/migrations/current/migrationLog.jsonl @@ -1 +1,5 @@ {"timestamp":"2026-08-24T18:35:19.613Z","operation":"resource_delete","target":"secdeva/fieldTypes/dataCategories","parameters":{"type":"fieldTypes"}} +{"timestamp":"2026-08-25T03:58:40.508Z","operation":"resource_rename","target":"secdeva/reports/threatModelProduct","parameters":{"type":"reports","operation":{"name":"change","target":"secdeva/reports/threatModelProduct","to":"secdeva/reports/product"}}} +{"timestamp":"2026-08-26T19:20:06.726Z","operation":"resource_delete","target":"secdeva/fieldTypes/supportPeriodEnd","parameters":{"type":"fieldTypes"}} +{"timestamp":"2026-08-26T19:21:19.217Z","operation":"resource_delete","target":"secdeva/fieldTypes/productVersion","parameters":{"type":"fieldTypes"}} +{"timestamp":"2026-08-26T21:09:50.411Z","operation":"resource_delete","target":"secdeva/fieldTypes/craProductCategory","parameters":{"type":"fieldTypes"}} diff --git a/.cards/local/reports/controlManage3rdPartySoftwareUpdates.json b/.cards/local/reports/controlManage3rdPartySoftwareUpdates.json index ad7e44fe..cacafdba 100644 --- a/.cards/local/reports/controlManage3rdPartySoftwareUpdates.json +++ b/.cards/local/reports/controlManage3rdPartySoftwareUpdates.json @@ -1,6 +1,6 @@ { "name": "secdeva/reports/controlManage3rdPartySoftwareUpdates", - "displayName": "Control - Manage 3rd party software updates", - "description": "The content of the internal control 'Manage 3rd party software updates'", + "displayName": "Control - Manage third-party software updates", + "description": "The content of the internal control 'Manage third-party software updates'", "category": "Secure development" } diff --git a/.cards/local/reports/controlManage3rdPartySoftwareUpdates/index.adoc.hbs b/.cards/local/reports/controlManage3rdPartySoftwareUpdates/index.adoc.hbs index 4eb3f841..7a8c0392 100644 --- a/.cards/local/reports/controlManage3rdPartySoftwareUpdates/index.adoc.hbs +++ b/.cards/local/reports/controlManage3rdPartySoftwareUpdates/index.adoc.hbs @@ -7,23 +7,23 @@ {{/graph}} ==== -Managing 3rd party software updates refers to keeping track of and characterizing the security updates from suppliers of dependent 3rd party components and operating systems. When applicable, 3rd party software updates are applied to the product or distributed to product users. +Managing third-party software updates refers to keeping track of and characterizing the security updates from suppliers of dependent third-party components and operating systems. When applicable, third-party software updates are applied to the product or distributed to product users. == How to decide if this control is required -For libraries and packages, security updates can often be managed as a part vulnerability management. In these cases there is no need for managing 3rd party software updates separately. +For libraries and packages, security updates can often be managed as a part vulnerability management. In these cases there is no need for managing third-party software updates separately. However, in some cases such as with some commercial-off-the-shelf technology, it can be necessary to manage security updates separately. == How to implement -Identify the communications channels of the 3rd party product supplier and ensure that you will be notified when the supplier makes new security updates available. +Identify the communications channels of the third-party product supplier and ensure that you will be notified when the supplier makes new security updates available. When a new security update is published, then qualify the update for applicability, suitability and compatibility. -Notice that 3rd party software update management shall continue even after active development has ended. 3rd party software update management shall continue also for previously released product versions during their support period. +Notice that third-party software update management shall continue even after active development has ended. third-party software update management shall continue also for previously released product versions during their support period. -If the supplier of a 3rd party component has published information about their security updates, then ensure that this information is taken into account. Update the threat model, other possible technical documentation and product documentation when applicable. +If the supplier of a third-party component has published information about their security updates, then ensure that this information is taken into account. Update the threat model, other possible technical documentation and product documentation when applicable. {{#report}} "name": "secdeva/reports/createReview", diff --git a/.cards/local/reports/controlManage3rdPartyTechnologies.json b/.cards/local/reports/controlManage3rdPartyTechnologies.json index 52bbacea..2a855f8e 100644 --- a/.cards/local/reports/controlManage3rdPartyTechnologies.json +++ b/.cards/local/reports/controlManage3rdPartyTechnologies.json @@ -1,6 +1,6 @@ { "name": "secdeva/reports/controlManage3rdPartyTechnologies", - "displayName": "Control - Manage 3rd party technologies", - "description": "The content of the internal control 'Manage 3rd party technologies'", + "displayName": "Control - Manage third-party technologies", + "description": "The content of the internal control 'Manage third-party technologies'", "category": "Secure development" } diff --git a/.cards/local/reports/controlManage3rdPartyTechnologies/index.adoc.hbs b/.cards/local/reports/controlManage3rdPartyTechnologies/index.adoc.hbs index 8685dfed..7372473c 100644 --- a/.cards/local/reports/controlManage3rdPartyTechnologies/index.adoc.hbs +++ b/.cards/local/reports/controlManage3rdPartyTechnologies/index.adoc.hbs @@ -7,28 +7,28 @@ {{/graph}} ==== -Digital products and solutions typically use many 3rd party technologies, which range from small libraries and packages to major dependencies such as toolkits, frameworks or applications. These technologies may introduce cybersecurity risks that must be managed and periodically reviewed, as the risks change over time. +Digital products and solutions typically use many third-party technologies, which range from small libraries and packages to major dependencies such as toolkits, frameworks or applications. These technologies may introduce cybersecurity risks that must be managed and periodically reviewed, as the risks change over time. == How to decide if this control is required -Managing the risks related to all 3rd party technologies is required. This control is required, if 3rd party technologies are in use. +Managing the risks related to all third-party technologies is required. This control is required, if third-party technologies are in use. -Reusing components from other internal projects may also introduce risks. Therefore, the risks related internal technologies shall be managed with the same process as the risks related to 3rd party technologies. +Reusing components from other internal projects may also introduce risks. Therefore, the risks related internal technologies shall be managed with the same process as the risks related to third-party technologies. == How to implement -1. For libraries and packages, the code reviewer shall consider the license, security and quality risks before approving a pull request that adds a new 3rd party dependency. Vulnerability management shall be in place. The development team should review the used 3rd party libraries and packages periodically, to remove unnecessary dependencies and to consider the risks that may have changed over time. +1. For libraries and packages, the code reviewer shall consider the license, security and quality risks before approving a pull request that adds a new third-party dependency. Vulnerability management shall be in place. The development team should review the used third-party libraries and packages periodically, to remove unnecessary dependencies and to consider the risks that may have changed over time. -2. For applications, frameworks, databases, toolkits and other significant 3rd party technologies, create a technology assessment document and follow the instructions from the template. The developent team should review the used significant 3rd party technologies periodically, to remove unnecessary dependencies and to consider the risks that may have changed over time. See {{#report}}"name": "secdeva/reports/xref", "identifier": "secdeva_register_technology-assessments"{{/report}} for how to create technology assessments. +2. For applications, frameworks, databases, toolkits and other significant third-party technologies, create a technology assessment document and follow the instructions from the template. The developent team should review the used significant third-party technologies periodically, to remove unnecessary dependencies and to consider the risks that may have changed over time. See {{#report}}"name": "secdeva/reports/xref", "identifier": "secdeva_register_technology-assessments"{{/report}} for how to create technology assessments. -3. In general, the development team must ensure that all 3rd party libraries, packages and significant dependencies are documented in a software bill of material (SBOM). +3. In general, the development team must ensure that all third-party libraries, packages and significant dependencies are documented in a software bill of material (SBOM). -4. Conduct a review of 3rd party technologies to ensure that 3rd party technologies have been identified and assessed. This review focuses on the identification and selection of the technolgies, vulnerability management is reviewed separately. +4. Conduct a review of third-party technologies to ensure that third-party technologies have been identified and assessed. This review focuses on the identification and selection of the technolgies, vulnerability management is reviewed separately. {{#report}} "name": "secdeva/reports/createReview", "template": "secdeva/templates/reviewOf3rdPartyTechnologies", - "buttonLabel": "Create a review of 3rd party technologies management", + "buttonLabel": "Create a review of third-party technologies management", "phase": "secdeva_phase_design" {{/report}} diff --git a/.cards/local/reports/controlManage3rdPartyVulnerabilities.json b/.cards/local/reports/controlManage3rdPartyVulnerabilities.json index 351eb6d6..dfebb3e9 100644 --- a/.cards/local/reports/controlManage3rdPartyVulnerabilities.json +++ b/.cards/local/reports/controlManage3rdPartyVulnerabilities.json @@ -1,6 +1,6 @@ { "name": "secdeva/reports/controlManage3rdPartyVulnerabilities", - "displayName": "Control - Manage 3rd party vulnerabilities", - "description": "The content of the internal control 'Manage 3rd party vulnerabilities'", + "displayName": "Control - Manage third-party vulnerabilities", + "description": "The content of the internal control 'Manage third-party vulnerabilities'", "category": "Secure development" } diff --git a/.cards/local/reports/controlManage3rdPartyVulnerabilities/index.adoc.hbs b/.cards/local/reports/controlManage3rdPartyVulnerabilities/index.adoc.hbs index 3ada9b48..2f4fe203 100644 --- a/.cards/local/reports/controlManage3rdPartyVulnerabilities/index.adoc.hbs +++ b/.cards/local/reports/controlManage3rdPartyVulnerabilities/index.adoc.hbs @@ -7,11 +7,11 @@ {{/graph}} ==== -The goal of the vulnerability management is to identify, characterize, address, and communicate potential security vulnerabilities in 3rd party technology. +The goal of the vulnerability management is to identify, characterize, address, and communicate potential security vulnerabilities in third-party technology. == How to decide if this control is required -Vulnerability management is required for all 3rd party technology. +Vulnerability management is required for all third-party technology. This analysis must be performed on all executable files. @@ -25,11 +25,11 @@ Notice that vulnerability management shall continue even after active developmen For interpreted code and binary executable files compiled by the development team, the analysis can be done by creating an SBOM and analysing vulnerabilities based on the SBOM with a dependency tracking tool. -For binary executable files that are compiled by a 3rd party organization, the analysis shall be done by analysing the binary with a software composition analysis tool. +For binary executable files that are compiled by a third-party organization, the analysis shall be done by analysing the binary with a software composition analysis tool. The source for the known vulnerabilities should be the recent contents of an established, industry-recognized public vulnerability database. -If the supplier of a 3rd party component has published information about their vulnerabilities, then ensure that this information is taken into account. Update the threat model, other possible technical documentation and product documentation when applicable. +If the supplier of a third-party component has published information about their vulnerabilities, then ensure that this information is taken into account. Update the threat model, other possible technical documentation and product documentation when applicable. {{#report}} "name": "secdeva/reports/createReview", diff --git a/.cards/local/reports/entityInterfaces/query.lp.hbs b/.cards/local/reports/entityInterfaces/query.lp.hbs index 331a7592..3ba58941 100644 --- a/.cards/local/reports/entityInterfaces/query.lp.hbs +++ b/.cards/local/reports/entityInterfaces/query.lp.hbs @@ -9,79 +9,79 @@ secdeva_ancestorOrSelf(Card, Card) :- result(result). % outbound external dataflow -childResult(result, @concatenate(A, B, Title), "externalDataflows") :- +childResult(result, (A, B, Title), "externalDataflows") :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_ancestorOrSelf(A, {{cardKey}}), not secdeva_ancestorOrSelf(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/direction", "Outbound") :- +field((A, B, Title), "secdeva/fieldTypes/direction", "Outbound") :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_ancestorOrSelf(A, {{cardKey}}), not secdeva_ancestorOrSelf(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/title", Title) :- +field((A, B, Title), "secdeva/fieldTypes/title", Title) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_ancestorOrSelf(A, {{cardKey}}), not secdeva_ancestorOrSelf(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- +field((A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_ancestorOrSelf(A, {{cardKey}}), not secdeva_ancestorOrSelf(B, {{cardKey}}), field(B, "title", External). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalCardKey", B) :- +field((A, B, Title), "secdeva/fieldTypes/externalCardKey", B) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_ancestorOrSelf(A, {{cardKey}}), not secdeva_ancestorOrSelf(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- +field((A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_ancestorOrSelf(A, {{cardKey}}), not secdeva_ancestorOrSelf(B, {{cardKey}}), field(A, "title", Internal). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalCardKey", A) :- +field((A, B, Title), "secdeva/fieldTypes/internalCardKey", A) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_ancestorOrSelf(A, {{cardKey}}), not secdeva_ancestorOrSelf(B, {{cardKey}}). % inbound external dataflow -childResult(result, @concatenate(A, B, Title), "externalDataflows") :- +childResult(result, (A, B, Title), "externalDataflows") :- link(A, B, "secdeva/linkTypes/dataflow", Title), not secdeva_ancestorOrSelf(A, {{cardKey}}), secdeva_ancestorOrSelf(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/direction", "Inbound") :- +field((A, B, Title), "secdeva/fieldTypes/direction", "Inbound") :- link(A, B, "secdeva/linkTypes/dataflow", Title), not secdeva_ancestorOrSelf(A, {{cardKey}}), secdeva_ancestorOrSelf(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/title", Title) :- +field((A, B, Title), "secdeva/fieldTypes/title", Title) :- link(A, B, "secdeva/linkTypes/dataflow", Title), not secdeva_ancestorOrSelf(A, {{cardKey}}), secdeva_ancestorOrSelf(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- +field((A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- link(A, B, "secdeva/linkTypes/dataflow", Title), not secdeva_ancestorOrSelf(A, {{cardKey}}), secdeva_ancestorOrSelf(B, {{cardKey}}), field(A, "title", External). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalCardKey", A) :- +field((A, B, Title), "secdeva/fieldTypes/externalCardKey", A) :- link(A, B, "secdeva/linkTypes/dataflow", Title), not secdeva_ancestorOrSelf(A, {{cardKey}}), secdeva_ancestorOrSelf(B, {{cardKey}}), field(B, "title", External). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- +field((A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- link(A, B, "secdeva/linkTypes/dataflow", Title), not secdeva_ancestorOrSelf(A, {{cardKey}}), secdeva_ancestorOrSelf(B, {{cardKey}}), field(B, "title", Internal). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalCardKey", B) :- +field((A, B, Title), "secdeva/fieldTypes/internalCardKey", B) :- link(A, B, "secdeva/linkTypes/dataflow", Title), not secdeva_ancestorOrSelf(A, {{cardKey}}), secdeva_ancestorOrSelf(B, {{cardKey}}). diff --git a/.cards/local/reports/modelInterfaces/query.lp.hbs b/.cards/local/reports/modelInterfaces/query.lp.hbs index d9434090..16e6e737 100644 --- a/.cards/local/reports/modelInterfaces/query.lp.hbs +++ b/.cards/local/reports/modelInterfaces/query.lp.hbs @@ -16,112 +16,112 @@ result(result). % external dataflows % outbound external dataflow -childResult(result, @concatenate(A, B, Title), "externalDataflows") :- +childResult(result, (A, B, Title), "externalDataflows") :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityOutsideTrustBoundaries(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/direction", "Outbound") :- +field((A, B, Title), "secdeva/fieldTypes/direction", "Outbound") :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityOutsideTrustBoundaries(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/title", Title) :- +field((A, B, Title), "secdeva/fieldTypes/title", Title) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityOutsideTrustBoundaries(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- +field((A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityOutsideTrustBoundaries(B, {{cardKey}}), field(B, "title", External). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalCardKey", B) :- +field((A, B, Title), "secdeva/fieldTypes/externalCardKey", B) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityOutsideTrustBoundaries(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- +field((A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityOutsideTrustBoundaries(B, {{cardKey}}), field(A, "title", Internal). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalCardKey", A) :- +field((A, B, Title), "secdeva/fieldTypes/internalCardKey", A) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityOutsideTrustBoundaries(B, {{cardKey}}). % inbound external dataflow -childResult(result, @concatenate(A, B, Title), "externalDataflows") :- +childResult(result, (A, B, Title), "externalDataflows") :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityOutsideTrustBoundaries(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/direction", "Inbound") :- +field((A, B, Title), "secdeva/fieldTypes/direction", "Inbound") :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityOutsideTrustBoundaries(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/title", Title) :- +field((A, B, Title), "secdeva/fieldTypes/title", Title) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityOutsideTrustBoundaries(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- +field((A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityOutsideTrustBoundaries(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}), field(A, "title", External). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalCardKey", A) :- +field((A, B, Title), "secdeva/fieldTypes/externalCardKey", A) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityOutsideTrustBoundaries(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}), field(B, "title", External). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- +field((A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityOutsideTrustBoundaries(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}), field(B, "title", Internal). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalCardKey", B) :- +field((A, B, Title), "secdeva/fieldTypes/internalCardKey", B) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityOutsideTrustBoundaries(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). % Internal dataflows -childResult(result, @concatenate(A, B, Title), "internalDataflows") :- +childResult(result, (A, B, Title), "internalDataflows") :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/title", Title) :- +field((A, B, Title), "secdeva/fieldTypes/title", Title) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/source", Source) :- +field((A, B, Title), "secdeva/fieldTypes/source", Source) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}), field(A, "title", Source). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/destination", Destination) :- +field((A, B, Title), "secdeva/fieldTypes/destination", Destination) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}), field(B, "title", Destination). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/destinationCardKey", B) :- +field((A, B, Title), "secdeva/fieldTypes/destinationCardKey", B) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/sourceCardKey", A) :- +field((A, B, Title), "secdeva/fieldTypes/sourceCardKey", A) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). diff --git a/.cards/local/reports/product.json b/.cards/local/reports/product.json new file mode 100644 index 00000000..882b0e60 --- /dev/null +++ b/.cards/local/reports/product.json @@ -0,0 +1,6 @@ +{ + "name": "secdeva/reports/product", + "displayName": "Product", + "category": "Solution structure", + "description": "The content of a product card: its structure diagram, its components, where it is used, and the threat model elements it implements" +} \ No newline at end of file diff --git a/.cards/local/reports/product/.schema b/.cards/local/reports/product/.schema new file mode 100644 index 00000000..06de66cb --- /dev/null +++ b/.cards/local/reports/product/.schema @@ -0,0 +1,7 @@ +[ + { + "version": 1, + "id": "jsonSchema", + "file": "parameterSchema.json" + } +] diff --git a/.cards/local/reports/product/index.adoc.hbs b/.cards/local/reports/product/index.adoc.hbs new file mode 100644 index 00000000..530b6bbb --- /dev/null +++ b/.cards/local/reports/product/index.adoc.hbs @@ -0,0 +1,94 @@ +.Product structure +[%collapsible] +==== +{{#graph}} + "model": "secdeva/graphModels/productStructure", + "view": "secdeva/graphViews/product" +{{/graph}} +==== + +{{#each results}} +== Relationships to other products + +[TIP] +==== +Record how this product relates to the others in the solution by linking it with the link symbol in the top level tool bar. Link *from the part to the whole*: open the component and link it to the product it belongs to. + +Choose the link type that matches how this product relates to the other one: + +* *default component of* — it ships as a built-in part of the other product, not as a distinct product +* *external component of* — the other product needs it as an external dependency or library +* *installed on* — it runs on top of the other product, such as an operating system or hardware platform +* *installed with* — it is bundled and installed alongside the other product during setup +* *optional component of* — it is an add-on, plug-in or licensed extra for the other product + +==== + +{{#if components}} + +.What this product is made of +[cols="3,5"] +|=== +| Relationship | Product + +{{#each components}} +| {{this.[secdeva/fieldTypes/relationshipLabel]}} +| xref:{{this.[secdeva/fieldTypes/relatedKey]}}.adoc[{{this.[secdeva/fieldTypes/relatedTitle]}}] +{{/each}} + +|=== + +{{else}} + +No other product is recorded as a component of this one. + +{{/if}} +{{#if usedBy}} + +.Where this product is used +[cols="3,5"] +|=== +| Relationship | Product + +{{#each usedBy}} +| {{this.[secdeva/fieldTypes/relationshipLabel]}} +| xref:{{this.[secdeva/fieldTypes/relatedKey]}}.adoc[{{this.[secdeva/fieldTypes/relatedTitle]}}] +{{/each}} + +|=== + +{{else}} + +This product is not recorded as part of any other product. + +{{/if}} + +== Where this product appears in the threat model + +[TIP] +==== +Link this product to the elements of the threat model that it implements: the processes, data stores and trust boundaries that it is the software or hardware behind. + +The easiest way is from the element itself, where the products that implement it are listed together with buttons for adding one. You can also do it from here, with the link symbol in the top level tool bar: choose *implements* and pick the element. +==== + +{{#if implements}} + +Threat model elements: + +{{#each implements}} +* {{#xref}}"cardKey":"{{this.key}}"{{/xref}} +{{/each}} + +{{else}} + +*This product is not linked to the threat model.* No element is recorded as implemented by it. + +{{/if}} +{{/each}} + +== Technology assessment + +{{#report}} + "name": "secdeva/reports/createTechnologyAssessment" +{{/report}} diff --git a/.cards/local/reports/product/parameterSchema.json b/.cards/local/reports/product/parameterSchema.json new file mode 100644 index 00000000..fab2125e --- /dev/null +++ b/.cards/local/reports/product/parameterSchema.json @@ -0,0 +1,18 @@ +{ + "$id": "reportMacroDefaultSchema", + "additionalProperties": false, + "description": "A report object provides supplemental information about a report", + "properties": { + "name": { + "description": "The name of the report", + "type": "string" + }, + "cardKey": { + "description": "Used to override the default cardKey, which is the cardKey of the card, in which the report macro is used", + "type": "string" + } + }, + "required": ["name"], + "title": "Report", + "type": "object" +} diff --git a/.cards/local/reports/product/query.lp.hbs b/.cards/local/reports/product/query.lp.hbs new file mode 100644 index 00000000..8b63a0ef --- /dev/null +++ b/.cards/local/reports/product/query.lp.hbs @@ -0,0 +1,38 @@ +selectAll. + +result(result). + +% Components of this product, and the platforms it runs on. +childResult(result, (Other, {{cardKey}}, Label), "components") :- + secdeva_csafRelationship(Other, {{cardKey}}, _, Label). +childResult(result, ({{cardKey}}, Other, Label), "components") :- + secdeva_csafRelationship({{cardKey}}, Other, "installedOn", Label). + +% Products this one is a part of. +childResult(result, ({{cardKey}}, Other, Label), "usedBy") :- + secdeva_csafRelationship({{cardKey}}, Other, Kind, Label), + Kind != "installedOn". + +field((A, B, Label), "secdeva/fieldTypes/relationshipLabel", Label) :- + secdeva_csafRelationship(A, B, _, Label), + A = {{cardKey}}. + +field((A, B, Label), "secdeva/fieldTypes/relationshipLabel", PartLabel) :- + secdeva_csafRelationship(A, B, Kind, Label), + B = {{cardKey}}, + secdeva_csafPartLabel(Kind, PartLabel). +field((A, B, Label), "secdeva/fieldTypes/relatedKey", A) :- + secdeva_csafRelationship(A, B, _, Label), B = {{cardKey}}. +field((A, B, Label), "secdeva/fieldTypes/relatedKey", B) :- + secdeva_csafRelationship(A, B, _, Label), A = {{cardKey}}. +field((A, B, Label), "secdeva/fieldTypes/relatedTitle", Title) :- + secdeva_csafRelationship(A, B, _, Label), B = {{cardKey}}, field(A, "title", Title). +field((A, B, Label), "secdeva/fieldTypes/relatedTitle", Title) :- + secdeva_csafRelationship(A, B, _, Label), A = {{cardKey}}, field(B, "title", Title). + +childResult(result, Element, "implements") :- + link(Element, {{cardKey}}, "secdeva/linkTypes/implementedBy"). + +order(2, "components", 1, "secdeva/fieldTypes/relationshipLabel", "ASC"). +order(2, "usedBy", 1, "secdeva/fieldTypes/relationshipLabel", "ASC"). +order(2, "implements", 1, "title", "ASC"). diff --git a/.cards/local/reports/productStructure.json b/.cards/local/reports/productStructure.json new file mode 100644 index 00000000..e0a9205f --- /dev/null +++ b/.cards/local/reports/productStructure.json @@ -0,0 +1,6 @@ +{ + "name": "secdeva/reports/productStructure", + "displayName": "Product structure", + "category": "Solution structure", + "description": "Lists the products of a solution, with their origin, planned supply chain role and relationships" +} \ No newline at end of file diff --git a/.cards/local/reports/productStructure/.schema b/.cards/local/reports/productStructure/.schema new file mode 100644 index 00000000..06de66cb --- /dev/null +++ b/.cards/local/reports/productStructure/.schema @@ -0,0 +1,7 @@ +[ + { + "version": 1, + "id": "jsonSchema", + "file": "parameterSchema.json" + } +] diff --git a/.cards/local/reports/productStructure/index.adoc.hbs b/.cards/local/reports/productStructure/index.adoc.hbs new file mode 100644 index 00000000..2adcc11f --- /dev/null +++ b/.cards/local/reports/productStructure/index.adoc.hbs @@ -0,0 +1,29 @@ +{{#each results}} +{{#if products}} + +[cols="3,2,3,2"] +|=== +| Product | Origin | Planned supply chain role | Part of + +{{#each products}} +| xref:{{this.key}}.adoc[{{this.title}}] [*{{this.workflowState}}*] +| {{this.[secdeva/fieldTypes/productOrigin].displayValue}} +| {{this.[secdeva/fieldTypes/supplyChainRole].displayValue}} +{{#if this.partOf}} +a| +{{#each this.partOf}} +* {{this.[secdeva/fieldTypes/relationshipLabel]}} xref:{{this.[secdeva/fieldTypes/relatedKey]}}.adoc[{{this.[secdeva/fieldTypes/relatedTitle]}}] +{{/each}} +{{else}} +| +{{/if}} +{{/each}} + +|=== + +{{else}} + +There are no products here yet. + +{{/if}} +{{/each}} diff --git a/.cards/local/reports/productStructure/parameterSchema.json b/.cards/local/reports/productStructure/parameterSchema.json new file mode 100644 index 00000000..fab2125e --- /dev/null +++ b/.cards/local/reports/productStructure/parameterSchema.json @@ -0,0 +1,18 @@ +{ + "$id": "reportMacroDefaultSchema", + "additionalProperties": false, + "description": "A report object provides supplemental information about a report", + "properties": { + "name": { + "description": "The name of the report", + "type": "string" + }, + "cardKey": { + "description": "Used to override the default cardKey, which is the cardKey of the card, in which the report macro is used", + "type": "string" + } + }, + "required": ["name"], + "title": "Report", + "type": "object" +} diff --git a/.cards/local/reports/productStructure/query.lp.hbs b/.cards/local/reports/productStructure/query.lp.hbs new file mode 100644 index 00000000..f57f0b1d --- /dev/null +++ b/.cards/local/reports/productStructure/query.lp.hbs @@ -0,0 +1,40 @@ +selectAll. +select(2, "products", "policyChecks"). + +result(result). + +childResult(result, Product, "products") :- + base_projectCardType(Product, "secdeva/cardTypes/product"), + secdeva_closestProject(Product, Project), + secdeva_closestProject({{cardKey}}, Project), + secdeva_productInScope(Product). + +% When the report is placed on a grouping card, show the products that belong to that +% group by origin. Anywhere else, show every product of the project. Grouping follows +% the origin field rather than the position of the card, so this listing and the +% assessment of the group card can never disagree. + +secdeva_productInScope(Product) :- + field({{cardKey}}, "base/fieldTypes/identifier", GroupIdentifier), + secdeva_productGroup(Product, GroupIdentifier). + +secdeva_productInScope(Product) :- + base_projectCardType(Product, "secdeva/cardTypes/product"), + not secdeva_groupingCard({{cardKey}}). + +secdeva_groupingCard(Card) :- field(Card, "base/fieldTypes/identifier", "secdeva_group_own-products"). +secdeva_groupingCard(Card) :- field(Card, "base/fieldTypes/identifier", "secdeva_group_third-party-products"). + +childResult(Product, (Product, Parent, Label), "partOf") :- + childResult(result, Product, "products"), + secdeva_csafRelationship(Product, Parent, _, Label). + +field((Product, Parent, Label), "secdeva/fieldTypes/relationshipLabel", Label) :- + secdeva_csafRelationship(Product, Parent, _, Label). +field((Product, Parent, Label), "secdeva/fieldTypes/relatedKey", Parent) :- + secdeva_csafRelationship(Product, Parent, _, Label). +field((Product, Parent, Label), "secdeva/fieldTypes/relatedTitle", Title) :- + secdeva_csafRelationship(Product, Parent, _, Label), + field(Parent, "title", Title). + +orderBy("title", "ASC"). diff --git a/.cards/local/reports/registerSolutionStructure.json b/.cards/local/reports/registerSolutionStructure.json new file mode 100644 index 00000000..31e4e61f --- /dev/null +++ b/.cards/local/reports/registerSolutionStructure.json @@ -0,0 +1,6 @@ +{ + "name": "secdeva/reports/registerSolutionStructure", + "displayName": "Register - Solution structure", + "category": "Secure development", + "description": "Produces the contents for the solution structure register" +} \ No newline at end of file diff --git a/.cards/local/reports/registerSolutionStructure/.schema b/.cards/local/reports/registerSolutionStructure/.schema new file mode 100644 index 00000000..06de66cb --- /dev/null +++ b/.cards/local/reports/registerSolutionStructure/.schema @@ -0,0 +1,7 @@ +[ + { + "version": 1, + "id": "jsonSchema", + "file": "parameterSchema.json" + } +] diff --git a/.cards/local/reports/registerSolutionStructure/index.adoc.hbs b/.cards/local/reports/registerSolutionStructure/index.adoc.hbs new file mode 100644 index 00000000..d328de24 --- /dev/null +++ b/.cards/local/reports/registerSolutionStructure/index.adoc.hbs @@ -0,0 +1,41 @@ +This register describes what the solution is made of: your own products, and the third-party products you integrate, bundle, install on, resell, or depend on as a service. + +[TIP] +==== +The grouping into own and third-party products is for browsing only. The relationships between products are recorded as links, not as parent and child cards. +==== + +{{#each results}} +{{#if ownGroup}} + +== Own products + +{{#createCards}} + "template": "secdeva/templates/ownProduct", + "buttonLabel": "Create an own product", + "cardKey": "{{ownGroup.key}}" +{{/createCards}} + +{{#report}} + "name": "secdeva/reports/productStructure", + "cardKey": "{{ownGroup.key}}" +{{/report}} + +{{/if}} +{{#if thirdPartyGroup}} + +== Third-party products + +{{#createCards}} + "template": "secdeva/templates/thirdPartyProduct", + "buttonLabel": "Create a third-party product", + "cardKey": "{{thirdPartyGroup.key}}" +{{/createCards}} + +{{#report}} + "name": "secdeva/reports/productStructure", + "cardKey": "{{thirdPartyGroup.key}}" +{{/report}} + +{{/if}} +{{/each}} diff --git a/.cards/local/reports/registerSolutionStructure/parameterSchema.json b/.cards/local/reports/registerSolutionStructure/parameterSchema.json new file mode 100644 index 00000000..fab2125e --- /dev/null +++ b/.cards/local/reports/registerSolutionStructure/parameterSchema.json @@ -0,0 +1,18 @@ +{ + "$id": "reportMacroDefaultSchema", + "additionalProperties": false, + "description": "A report object provides supplemental information about a report", + "properties": { + "name": { + "description": "The name of the report", + "type": "string" + }, + "cardKey": { + "description": "Used to override the default cardKey, which is the cardKey of the card, in which the report macro is used", + "type": "string" + } + }, + "required": ["name"], + "title": "Report", + "type": "object" +} diff --git a/.cards/local/reports/registerSolutionStructure/query.lp.hbs b/.cards/local/reports/registerSolutionStructure/query.lp.hbs new file mode 100644 index 00000000..61a88bf0 --- /dev/null +++ b/.cards/local/reports/registerSolutionStructure/query.lp.hbs @@ -0,0 +1,13 @@ +selectAll. + +result(result). + +childObject(result, Group, "ownGroup") :- + field(Group, "base/fieldTypes/identifier", "secdeva_group_own-products"), + secdeva_closestProject(Group, Project), + secdeva_closestProject({{cardKey}}, Project). + +childObject(result, Group, "thirdPartyGroup") :- + field(Group, "base/fieldTypes/identifier", "secdeva_group_third-party-products"), + secdeva_closestProject(Group, Project), + secdeva_closestProject({{cardKey}}, Project). diff --git a/.cards/local/reports/sbom/query.lp.hbs b/.cards/local/reports/sbom/query.lp.hbs index 911ae347..8990a564 100644 --- a/.cards/local/reports/sbom/query.lp.hbs +++ b/.cards/local/reports/sbom/query.lp.hbs @@ -1,4 +1,26 @@ selectAll. -result(Card) :- - ancestor(Card, {{cardKey}}), - field(Card, "cardType", "secdeva/cardTypes/technology"). \ No newline at end of file + +% The SBOM is generated from the solution structure. The root component of the document +% is the own product that nothing else contains; every other product is a component. + +result(Product) :- + base_projectCardType(Product, "secdeva/cardTypes/product"), + secdeva_closestProject(Product, Project), + secdeva_closestProject({{cardKey}}, Project). + +field(Product, "secdeva/fieldTypes/isRootComponent", "yes") :- + result(Product), + field(Product, "secdeva/fieldTypes/productOrigin", "own"), + not secdeva_csafRelationship(Product, _, _, _). + +field(Product, "secdeva/fieldTypes/dependsOn", Other) :- + result(Product), + secdeva_csafRelationship(Other, Product, Kind, _), + secdeva_dependencyKind(Kind). + +secdeva_dependencyKind("defaultComponentOf"). +secdeva_dependencyKind("externalComponentOf"). +secdeva_dependencyKind("optionalComponentOf"). +secdeva_dependencyKind("installedWith"). + +orderBy("title", "ASC"). diff --git a/.cards/local/reports/testingSolutionStructure.json b/.cards/local/reports/testingSolutionStructure.json new file mode 100644 index 00000000..100f5231 --- /dev/null +++ b/.cards/local/reports/testingSolutionStructure.json @@ -0,0 +1,6 @@ +{ + "name": "secdeva/reports/testingSolutionStructure", + "displayName": "Testing - solution structure", + "description": "Runs the solution structure test fixture under Test content and compares the derived supply chain roles and policy check failures against the expected results", + "category": "Test content" +} diff --git a/.cards/local/reports/testingSolutionStructure/.schema b/.cards/local/reports/testingSolutionStructure/.schema new file mode 100644 index 00000000..06de66cb --- /dev/null +++ b/.cards/local/reports/testingSolutionStructure/.schema @@ -0,0 +1,7 @@ +[ + { + "version": 1, + "id": "jsonSchema", + "file": "parameterSchema.json" + } +] diff --git a/.cards/local/reports/testingSolutionStructure/index.adoc.hbs b/.cards/local/reports/testingSolutionStructure/index.adoc.hbs new file mode 100644 index 00000000..fcddffc8 --- /dev/null +++ b/.cards/local/reports/testingSolutionStructure/index.adoc.hbs @@ -0,0 +1,46 @@ +{{#each results}} + +Fixture: *{{this.total}}* test cases, *{{this.passed}}* passed, *{{this.failed}}* failed{{#if this.missing}}, *{{this.missing}}* expected test cards not found{{/if}}. + +{{#if this.tests}} + +.Solution structure test cases +[cols="4,1,2,2,1,2,2,1"] +|=== +| Test case | State | Expected role | Actual role | Roles | Failure expected | Failure raised | Verdict + +{{#each this.tests}} +| xref:{{this.key}}.adoc[{{this.title}}] +| {{this.state}} +| {{this.expectedRole}} +| {{this.actualRole}} +| {{this.roleCount}} +| {{this.expectedFailure}} +| {{this.actualFailure}} +| {{this.verdict}} +{{/each}} + +|=== + +{{else}} + +No test cards found. The fixture is identified by the `base/fieldTypes/identifier` values listed in the report query. + +{{/if}} + +{{#if this.failures}} + +.Policy check failures raised on test cards +[cols="4,4"] +|=== +| Test case | Policy check + +{{#each this.failures}} +| {{this.onCard}} +| {{this.checkTitle}} +{{/each}} + +|=== + +{{/if}} +{{/each}} diff --git a/.cards/local/reports/testingSolutionStructure/parameterSchema.json b/.cards/local/reports/testingSolutionStructure/parameterSchema.json new file mode 100644 index 00000000..fab2125e --- /dev/null +++ b/.cards/local/reports/testingSolutionStructure/parameterSchema.json @@ -0,0 +1,18 @@ +{ + "$id": "reportMacroDefaultSchema", + "additionalProperties": false, + "description": "A report object provides supplemental information about a report", + "properties": { + "name": { + "description": "The name of the report", + "type": "string" + }, + "cardKey": { + "description": "Used to override the default cardKey, which is the cardKey of the card, in which the report macro is used", + "type": "string" + } + }, + "required": ["name"], + "title": "Report", + "type": "object" +} diff --git a/.cards/local/reports/testingSolutionStructure/query.lp.hbs b/.cards/local/reports/testingSolutionStructure/query.lp.hbs new file mode 100644 index 00000000..7184d21a --- /dev/null +++ b/.cards/local/reports/testingSolutionStructure/query.lp.hbs @@ -0,0 +1,120 @@ +% Expectations for the solution structure test fixture under Test content. +% +% secdeva_expect(Identifier, ExpectedRole, ExpectedFailure) where ExpectedRole is the +% supply chain role the rules should derive, or "-" when no role should be derived +% at all, and ExpectedFailure is "yes" or "no" for policy check failures on the card. +% +% Test cards are matched by their identifier, never by card key, so the fixture survives +% being recreated. + +secdeva_expect("secdeva_test_ss_umbrella", "manufacturer", "no"). +secdeva_expect("secdeva_test_ss_own_operated", "none", "no"). +secdeva_expect("secdeva_test_ss_own_nodelivery", "-", "no"). +secdeva_expect("secdeva_test_ss_delivered", "distributor", "no"). +secdeva_expect("secdeva_test_ss_imported", "importer", "no"). +secdeva_expect("secdeva_test_ss_rebranded", "manufacturer", "no"). +secdeva_expect("secdeva_test_ss_builtin", "integratedComponent","no"). +secdeva_expect("secdeva_test_ss_customer", "none", "no"). +secdeva_expect("secdeva_test_ss_consumed", "none", "no"). +secdeva_expect("secdeva_test_ss_nodelivery", "-", "no"). +secdeva_expect("secdeva_test_ss_bad_customer_builtin", "integratedComponent","yes"). +secdeva_expect("secdeva_test_ss_bad_consumed_bundled", "none", "yes"). +secdeva_expect("secdeva_test_ss_bad_consumed_installed", "none", "yes"). +secdeva_expect("secdeva_test_ss_bad_thirdparty_developed", "-", "yes"). +secdeva_expect("secdeva_test_ss_neg_operated_builtin", "integratedComponent","no"). +secdeva_expect("secdeva_test_ss_neg_installed_on_consumed", "none", "no"). + +% State-dependent cases. The required-field checks are gated on the card leaving the +% initial workflow state, so these four are Active where every other case is Draft. + +secdeva_expect("secdeva_test_ss_active_bare", "-", "yes"). +secdeva_expect("secdeva_test_ss_active_nodelivery", "-", "yes"). +secdeva_expect("secdeva_test_ss_active_complete_own", "manufacturer", "no"). +secdeva_expect("secdeva_test_ss_active_complete_third", "distributor", "no"). + +secdeva_testCard(Id, Card) :- + secdeva_expect(Id, _, _), + field(Card, "base/fieldTypes/identifier", Id). + +secdeva_actualRole(Card, Role) :- + secdeva_testCard(_, Card), + fieldCalculated(Card, "secdeva/fieldTypes/supplyChainRole", Role). + +secdeva_roleCount(Card, N) :- + secdeva_testCard(_, Card), + N = #count { Role : secdeva_actualRole(Card, Role) }. + +secdeva_actualFailure(Card) :- + secdeva_testCard(_, Card), + base_policyCheckFailure(Card, _, _, _). + +% A role expectation passes only when exactly one role is derived. Deriving two roles +% is the failure mode a card cannot show, because the field displays only one of them. + +secdeva_roleOk(Card) :- + secdeva_testCard(Id, Card), + secdeva_expect(Id, "-", _), + secdeva_roleCount(Card, 0). + +secdeva_roleOk(Card) :- + secdeva_testCard(Id, Card), + secdeva_expect(Id, Expected, _), + Expected != "-", + secdeva_actualRole(Card, Expected), + secdeva_roleCount(Card, 1). + +secdeva_failureOk(Card) :- + secdeva_testCard(Id, Card), + secdeva_expect(Id, _, "yes"), + secdeva_actualFailure(Card). + +secdeva_failureOk(Card) :- + secdeva_testCard(Id, Card), + secdeva_expect(Id, _, "no"), + not secdeva_actualFailure(Card). + +secdeva_pass(Card) :- secdeva_roleOk(Card), secdeva_failureOk(Card). + +% +% Report output +% + +selectAll. +select(2, "tests", "policyChecks"). +select(2, "failures", "policyChecks"). + +result(result). + +childResult(result, Card, "tests") :- secdeva_testCard(_, Card). + +field(Card, "expectedRole", R) :- secdeva_testCard(Id, Card), secdeva_expect(Id, R, _). +field(Card, "actualRole", R) :- secdeva_actualRole(Card, R). +field(Card, "actualRole", "-") :- secdeva_testCard(_, Card), secdeva_roleCount(Card, 0). +field(Card, "roleCount", N) :- secdeva_roleCount(Card, N). +field(Card, "expectedFailure", F) :- secdeva_testCard(Id, Card), secdeva_expect(Id, _, F). +field(Card, "actualFailure", "yes") :- secdeva_actualFailure(Card). +field(Card, "actualFailure", "no") :- secdeva_testCard(_, Card), not secdeva_actualFailure(Card). +field(Card, "state", S) :- secdeva_testCard(_, Card), field(Card, "workflowState", S). +field(Card, "verdict", "PASS") :- secdeva_pass(Card). +field(Card, "verdict", "FAIL") :- secdeva_testCard(_, Card), not secdeva_pass(Card). + +% Every policy check failure raised on a test card, as its own row, because a card can +% raise more than one and a single field would show only the first. + +childResult(result, (Card, Title), "failures") :- + secdeva_testCard(_, Card), + base_policyCheckFailure(Card, _, Title, _). +field((Card, Title), "onCard", CardTitle) :- + secdeva_testCard(_, Card), + base_policyCheckFailure(Card, _, Title, _), + field(Card, "title", CardTitle). +field((Card, Title), "checkTitle", Title) :- + secdeva_testCard(_, Card), + base_policyCheckFailure(Card, _, Title, _). + +field(result, "total", N) :- N = #count { C : secdeva_testCard(_, C) }. +field(result, "passed", N) :- N = #count { C : secdeva_pass(C) }. +field(result, "failed", N) :- N = #count { C : secdeva_testCard(_, C), not secdeva_pass(C) }. +field(result, "missing", N) :- N = #count { Id : secdeva_expect(Id,_,_), not secdeva_testCard(Id, _) }. + +orderBy("title", "ASC"). diff --git a/.cards/local/reports/threatModel/query.lp.hbs b/.cards/local/reports/threatModel/query.lp.hbs index d5e07c7c..a10a61a2 100644 --- a/.cards/local/reports/threatModel/query.lp.hbs +++ b/.cards/local/reports/threatModel/query.lp.hbs @@ -91,111 +91,111 @@ childResult(result, Technology, "technologies") :- % ---------------------------------------------------------------------------- % outbound external dataflow -childResult(result, @concatenate(A, B, Title), "externalDataflows") :- +childResult(result, (A, B, Title), "externalDataflows") :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityOutsideTrustBoundaries(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/direction", "Outbound") :- +field((A, B, Title), "secdeva/fieldTypes/direction", "Outbound") :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityOutsideTrustBoundaries(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/title", Title) :- +field((A, B, Title), "secdeva/fieldTypes/title", Title) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityOutsideTrustBoundaries(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- +field((A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityOutsideTrustBoundaries(B, {{cardKey}}), field(B, "title", External). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalCardKey", B) :- +field((A, B, Title), "secdeva/fieldTypes/externalCardKey", B) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityOutsideTrustBoundaries(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- +field((A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityOutsideTrustBoundaries(B, {{cardKey}}), field(A, "title", Internal). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalCardKey", A) :- +field((A, B, Title), "secdeva/fieldTypes/internalCardKey", A) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityOutsideTrustBoundaries(B, {{cardKey}}). % inbound external dataflow -childResult(result, @concatenate(A, B, Title), "externalDataflows") :- +childResult(result, (A, B, Title), "externalDataflows") :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityOutsideTrustBoundaries(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/direction", "Inbound") :- +field((A, B, Title), "secdeva/fieldTypes/direction", "Inbound") :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityOutsideTrustBoundaries(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/title", Title) :- +field((A, B, Title), "secdeva/fieldTypes/title", Title) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityOutsideTrustBoundaries(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- +field((A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityOutsideTrustBoundaries(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}), field(A, "title", External). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalCardKey", A) :- +field((A, B, Title), "secdeva/fieldTypes/externalCardKey", A) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityOutsideTrustBoundaries(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}), field(B, "title", _). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- +field((A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityOutsideTrustBoundaries(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}), field(B, "title", Internal). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalCardKey", B) :- +field((A, B, Title), "secdeva/fieldTypes/internalCardKey", B) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityOutsideTrustBoundaries(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). % internal dataflows -childResult(result, @concatenate(A, B, Title), "internalDataflows") :- +childResult(result, (A, B, Title), "internalDataflows") :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/title", Title) :- +field((A, B, Title), "secdeva/fieldTypes/title", Title) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/source", Source) :- +field((A, B, Title), "secdeva/fieldTypes/source", Source) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}), field(A, "title", Source). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/destination", Destination) :- +field((A, B, Title), "secdeva/fieldTypes/destination", Destination) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}), field(B, "title", Destination). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/destinationCardKey", B) :- +field((A, B, Title), "secdeva/fieldTypes/destinationCardKey", B) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/sourceCardKey", A) :- +field((A, B, Title), "secdeva/fieldTypes/sourceCardKey", A) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_entityWithinTrustBoundary(A, {{cardKey}}), secdeva_entityWithinTrustBoundary(B, {{cardKey}}). diff --git a/.cards/local/reports/threatModelEntity.json b/.cards/local/reports/threatModelEntity.json index e69a1e95..892a4006 100644 --- a/.cards/local/reports/threatModelEntity.json +++ b/.cards/local/reports/threatModelEntity.json @@ -2,5 +2,5 @@ "name": "secdeva/reports/threatModelEntity", "displayName": "Entity in a threat model", "category": "Threat model", - "description": "The full content of a dataflow model entity: entity graph, composite element buttons, interfaces and physical connections, and related risks, security issues, security requirements, technology assessments, decisions and design specifications. The variant parameter selects the entity type: process, dataStore, trustBoundary or external." -} \ No newline at end of file + "description": "The full content of a dataflow model entity: entity graph, composite element buttons, dataflows, interfaces and physical connections, and related risks, security issues, security requirements, products, decisions and design specifications. The variant parameter selects the entity type — process, dataStore, trustBoundary or external — the entity specific wording and which of these sections are shown." +} diff --git a/.cards/local/reports/threatModelEntity/index.adoc.hbs b/.cards/local/reports/threatModelEntity/index.adoc.hbs index c2cd304a..56d615eb 100644 --- a/.cards/local/reports/threatModelEntity/index.adoc.hbs +++ b/.cards/local/reports/threatModelEntity/index.adoc.hbs @@ -6,23 +6,6 @@ {{#unless (eq variant "external")}} == Composite elements -[TIP] -==== -To add a dataflow to or from this {{#if (eq variant "process")}}process{{/if}}{{#if (eq variant "dataStore")}}data store{{/if}}{{#if (eq variant "trustBoundary")}}trust boundary{{/if}}, click the link symbol in the top level tool bar.{{#unless (eq variant "trustBoundary")}} Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface.{{/unless}} -==== - -{{#unless (eq variant "trustBoundary")}} -{{#createCards}} - "buttonLabel": "Create an interface", - "template": "secdeva/templates/interface2" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a physical port or connection", - "template": "secdeva/templates/physicalConnection" -{{/createCards}} - -{{/unless}} {{#createCards}} "buttonLabel": "Create a trust boundary", "template": "secdeva/templates/trustBoundary2" @@ -51,15 +34,14 @@ To add a dataflow to or from this {{#if (eq variant "process")}}process{{/if}}{{ {{/unless}} {{#each results}} -== Interfaces and physical connections +{{#unless (eq ../variant "trustBoundary")}} +== Dataflows -{{#if (eq ../variant "external")}} [TIP] ==== -To add a dataflow to or from this external entity, click the link symbol in the top level tool bar. +To add a dataflow to or from this {{#if (eq ../variant "process")}}process{{/if}}{{#if (eq ../variant "dataStore")}}data store{{/if}}{{#if (eq ../variant "external")}}external entity{{/if}}, click the link symbol in the top level tool bar.{{#unless (eq ../variant "external")}} Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface.{{/unless}} ==== -{{/if}} {{#if externalDataflows}} .Dataflows to and from this entity @@ -82,6 +64,9 @@ There are no dataflows to or from this entity. {{/if}} +{{#unless (eq ../variant "external")}} +== Interfaces and physical connections + {{#if interfaces}} .Interfaces @@ -128,6 +113,19 @@ There are no physical connections. {{/if}} +{{#createCards}} + "buttonLabel": "Create an interface", + "template": "secdeva/templates/interface2" +{{/createCards}} + +{{#createCards}} + "buttonLabel": "Create a physical port or connection", + "template": "secdeva/templates/physicalConnection" +{{/createCards}} + +{{/unless}} +{{/unless}} + == Related risks [TIP] @@ -237,47 +235,62 @@ You have not yet created or linked any requirements. "cardKey": "{{../cardKey}}" } {{/createCards}} +{{/unless}} -== Related technology assessments +== Related products [TIP] ==== -Create a technology assessment for significant 3rd party technologies such as databases, frameworks, or toolkits. -You do not need to create assessments for smaller libraries and packages, as they are assessed as part of code review. +Record what implements this element: your own products, commercial or open source third-party products, and services someone else operates. Link a product that is already in the solution structure register; create one only if it is not there yet, so the same component does not end up as two cards. ==== -{{#if technologies}} +{{#if products}} [caption=] -.Existing technology assessments -[cols="5,2"] +.Products that implement this element +[cols="4,2"] |=== -| Technology | Workflow State +| Product | Origin -{{#each technologies}} +{{#each products}} |xref:{{this.key}}.adoc[{{this.title}}] -|{{this.workflowState}} +|{{this.[secdeva/fieldTypes/productOrigin].displayValue}} {{/each}} |=== -Create another technology assessment, if needed: +Link or create another product, if needed: {{else}} -You have not yet created or linked any technology assessments. +You have not yet linked any products to this element. {{/if}} +{{#if thirdPartyGroup}} {{#createCards}} - "template": "secdeva/templates/technology", - "buttonLabel": "Create a technology assessment", - "cardKey": "{{technologyAssessmentRegister.key}}", + "template": "secdeva/templates/thirdPartyProduct", + "buttonLabel": "Create a third-party product", + "cardKey": "{{thirdPartyGroup.key}}", "link": { - "linkType": "base/linkTypes/relatesTo", + "linkType": "secdeva/linkTypes/implementedBy", "direction": "outbound", "cardKey": "{{../cardKey}}" } {{/createCards}} -{{/unless}} +{{#createCards}} + "template": "secdeva/templates/ownProduct", + "buttonLabel": "Create an own product", + "cardKey": "{{ownGroup.key}}", + "link": { + "linkType": "secdeva/linkTypes/implementedBy", + "direction": "outbound", + "cardKey": "{{../cardKey}}" + } +{{/createCards}} + +{{else}} +NOTE: This project has no solution structure register yet, so there is nowhere to put a product. Add one to the project before recording which products implement this element. + +{{/if}} == Related decisions {{#if decisions}} diff --git a/.cards/local/reports/threatModelEntity/query.lp.hbs b/.cards/local/reports/threatModelEntity/query.lp.hbs index 44a3fa4a..720a648f 100644 --- a/.cards/local/reports/threatModelEntity/query.lp.hbs +++ b/.cards/local/reports/threatModelEntity/query.lp.hbs @@ -13,79 +13,79 @@ secdeva_ancestorOrSelf(Card, Card) :- % ---------------------------------------------------------------------------- % outbound external dataflow -childResult(result, @concatenate(A, B, Title), "externalDataflows") :- +childResult(result, (A, B, Title), "externalDataflows") :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_ancestorOrSelf(A, {{cardKey}}), not secdeva_ancestorOrSelf(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/direction", "Outbound") :- +field((A, B, Title), "secdeva/fieldTypes/direction", "Outbound") :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_ancestorOrSelf(A, {{cardKey}}), not secdeva_ancestorOrSelf(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/title", Title) :- +field((A, B, Title), "secdeva/fieldTypes/title", Title) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_ancestorOrSelf(A, {{cardKey}}), not secdeva_ancestorOrSelf(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- +field((A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_ancestorOrSelf(A, {{cardKey}}), not secdeva_ancestorOrSelf(B, {{cardKey}}), field(B, "title", External). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalCardKey", B) :- +field((A, B, Title), "secdeva/fieldTypes/externalCardKey", B) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_ancestorOrSelf(A, {{cardKey}}), not secdeva_ancestorOrSelf(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- +field((A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_ancestorOrSelf(A, {{cardKey}}), not secdeva_ancestorOrSelf(B, {{cardKey}}), field(A, "title", Internal). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalCardKey", A) :- +field((A, B, Title), "secdeva/fieldTypes/internalCardKey", A) :- link(A, B, "secdeva/linkTypes/dataflow", Title), secdeva_ancestorOrSelf(A, {{cardKey}}), not secdeva_ancestorOrSelf(B, {{cardKey}}). % inbound external dataflow -childResult(result, @concatenate(A, B, Title), "externalDataflows") :- +childResult(result, (A, B, Title), "externalDataflows") :- link(A, B, "secdeva/linkTypes/dataflow", Title), not secdeva_ancestorOrSelf(A, {{cardKey}}), secdeva_ancestorOrSelf(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/direction", "Inbound") :- +field((A, B, Title), "secdeva/fieldTypes/direction", "Inbound") :- link(A, B, "secdeva/linkTypes/dataflow", Title), not secdeva_ancestorOrSelf(A, {{cardKey}}), secdeva_ancestorOrSelf(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/title", Title) :- +field((A, B, Title), "secdeva/fieldTypes/title", Title) :- link(A, B, "secdeva/linkTypes/dataflow", Title), not secdeva_ancestorOrSelf(A, {{cardKey}}), secdeva_ancestorOrSelf(B, {{cardKey}}). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- +field((A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- link(A, B, "secdeva/linkTypes/dataflow", Title), not secdeva_ancestorOrSelf(A, {{cardKey}}), secdeva_ancestorOrSelf(B, {{cardKey}}), field(A, "title", External). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/externalCardKey", A) :- +field((A, B, Title), "secdeva/fieldTypes/externalCardKey", A) :- link(A, B, "secdeva/linkTypes/dataflow", Title), not secdeva_ancestorOrSelf(A, {{cardKey}}), secdeva_ancestorOrSelf(B, {{cardKey}}), field(B, "title", _). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- +field((A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- link(A, B, "secdeva/linkTypes/dataflow", Title), not secdeva_ancestorOrSelf(A, {{cardKey}}), secdeva_ancestorOrSelf(B, {{cardKey}}), field(B, "title", Internal). -field(@concatenate(A, B, Title), "secdeva/fieldTypes/internalCardKey", B) :- +field((A, B, Title), "secdeva/fieldTypes/internalCardKey", B) :- link(A, B, "secdeva/linkTypes/dataflow", Title), not secdeva_ancestorOrSelf(A, {{cardKey}}), secdeva_ancestorOrSelf(B, {{cardKey}}). @@ -162,21 +162,22 @@ childObject(result, Register, "securityRequirementRegister") :- secdeva_closestProject(Register, Project). % ---------------------------------------------------------------------------- -% Related technology assessments +% Related products % ---------------------------------------------------------------------------- -childResult(result, Technology, "technologies") :- - link({{cardKey}}, Technology, "base/linkTypes/relatesTo"), - field(Technology, "cardType", "secdeva/cardTypes/technology"). +childResult(result, Product, "products") :- + link({{cardKey}}, Product, "secdeva/linkTypes/implementedBy"), + field(Product, "cardType", "secdeva/cardTypes/product"). -childResult(result, Technology, "technologies") :- - link(Technology, {{cardKey}}, "base/linkTypes/relatesTo"), - field(Technology, "cardType", "secdeva/cardTypes/technology"). +childObject(result, Group, "ownGroup") :- + secdeva_closestProject({{cardKey}}, Project), + field(Group, "base/fieldTypes/identifier", "secdeva_group_own-products"), + secdeva_closestProject(Group, Project). -childObject(result, Register, "technologyAssessmentRegister") :- +childObject(result, Group, "thirdPartyGroup") :- secdeva_closestProject({{cardKey}}, Project), - field(Register, "base/fieldTypes/identifier", "secdeva_register_technology-assessments"), - secdeva_closestProject(Register, Project). + field(Group, "base/fieldTypes/identifier", "secdeva_group_third-party-products"), + secdeva_closestProject(Group, Project). % ---------------------------------------------------------------------------- % Related decisions @@ -228,6 +229,6 @@ order(2, "physicalConnections", 2, "title", "ASC"). order(2, "risks", 1, "rank", "ASC"). order(2, "issues", 1, "rank", "ASC"). order(2, "requirements", 1, "rank", "ASC"). -order(2, "technologies", 1, "rank", "ASC"). +order(2, "products", 1, "title", "ASC"). order(2, "decisions", 1, "rank", "ASC"). order(2, "specifications", 1, "rank", "ASC"). diff --git a/.cards/local/reports/threatModelPerson.json b/.cards/local/reports/threatModelPerson.json index 18832e51..95a024f5 100644 --- a/.cards/local/reports/threatModelPerson.json +++ b/.cards/local/reports/threatModelPerson.json @@ -2,5 +2,5 @@ "name": "secdeva/reports/threatModelPerson", "displayName": "Person in a threat model", "category": "Threat model", - "description": "The full content of a person entity in a threat model: entity graph and related risks and security issues." -} \ No newline at end of file + "description": "The full content of a person entity in a threat model: entity graph, dataflows and related risks and security issues." +} diff --git a/.cards/local/reports/threatModelPerson/index.adoc.hbs b/.cards/local/reports/threatModelPerson/index.adoc.hbs index a71b1974..901688bf 100644 --- a/.cards/local/reports/threatModelPerson/index.adoc.hbs +++ b/.cards/local/reports/threatModelPerson/index.adoc.hbs @@ -3,12 +3,36 @@ "view": "secdeva/graphViews/entity" {{/graph}} +{{#each results}} + +== Dataflows + [TIP] ==== To add a dataflow to or from this person, click the link symbol in the top level tool bar. ==== -{{#each results}} +{{#if externalDataflows}} + +.Dataflows to and from this person +[cols="2,2,2,4"] +|=== +|Direction | Inside element | Outside element | Dataflow + +{{#each externalDataflows}} +|{{this.[secdeva/fieldTypes/direction]}} +|xref:{{this.[secdeva/fieldTypes/internalCardKey]}}.adoc[{{this.[secdeva/fieldTypes/internalTitle]}}] +|xref:{{this.[secdeva/fieldTypes/externalCardKey]}}.adoc[{{this.[secdeva/fieldTypes/externalTitle]}}] +|{{this.[secdeva/fieldTypes/title]}} +{{/each}} + +|=== + +{{else}} + +There are no dataflows to or from this person. + +{{/if}} == Related risks diff --git a/.cards/local/reports/threatModelPerson/query.lp.hbs b/.cards/local/reports/threatModelPerson/query.lp.hbs index 1ab5026a..73fc6012 100644 --- a/.cards/local/reports/threatModelPerson/query.lp.hbs +++ b/.cards/local/reports/threatModelPerson/query.lp.hbs @@ -2,6 +2,94 @@ selectAll. result(result). +secdeva_ancestorOrSelf(Ancestor, Card) :- + ancestor(Ancestor, Card). + +secdeva_ancestorOrSelf(Card, Card) :- + card(Card). + +% ---------------------------------------------------------------------------- +% Dataflows +% ---------------------------------------------------------------------------- + +% outbound external dataflow +childResult(result, (A, B, Title), "externalDataflows") :- + link(A, B, "secdeva/linkTypes/dataflow", Title), + secdeva_ancestorOrSelf(A, {{cardKey}}), + not secdeva_ancestorOrSelf(B, {{cardKey}}). + +field((A, B, Title), "secdeva/fieldTypes/direction", "Outbound") :- + link(A, B, "secdeva/linkTypes/dataflow", Title), + secdeva_ancestorOrSelf(A, {{cardKey}}), + not secdeva_ancestorOrSelf(B, {{cardKey}}). + +field((A, B, Title), "secdeva/fieldTypes/title", Title) :- + link(A, B, "secdeva/linkTypes/dataflow", Title), + secdeva_ancestorOrSelf(A, {{cardKey}}), + not secdeva_ancestorOrSelf(B, {{cardKey}}). + +field((A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- + link(A, B, "secdeva/linkTypes/dataflow", Title), + secdeva_ancestorOrSelf(A, {{cardKey}}), + not secdeva_ancestorOrSelf(B, {{cardKey}}), + field(B, "title", External). + +field((A, B, Title), "secdeva/fieldTypes/externalCardKey", B) :- + link(A, B, "secdeva/linkTypes/dataflow", Title), + secdeva_ancestorOrSelf(A, {{cardKey}}), + not secdeva_ancestorOrSelf(B, {{cardKey}}). + +field((A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- + link(A, B, "secdeva/linkTypes/dataflow", Title), + secdeva_ancestorOrSelf(A, {{cardKey}}), + not secdeva_ancestorOrSelf(B, {{cardKey}}), + field(A, "title", Internal). + +field((A, B, Title), "secdeva/fieldTypes/internalCardKey", A) :- + link(A, B, "secdeva/linkTypes/dataflow", Title), + secdeva_ancestorOrSelf(A, {{cardKey}}), + not secdeva_ancestorOrSelf(B, {{cardKey}}). + +% inbound external dataflow + +childResult(result, (A, B, Title), "externalDataflows") :- + link(A, B, "secdeva/linkTypes/dataflow", Title), + not secdeva_ancestorOrSelf(A, {{cardKey}}), + secdeva_ancestorOrSelf(B, {{cardKey}}). + +field((A, B, Title), "secdeva/fieldTypes/direction", "Inbound") :- + link(A, B, "secdeva/linkTypes/dataflow", Title), + not secdeva_ancestorOrSelf(A, {{cardKey}}), + secdeva_ancestorOrSelf(B, {{cardKey}}). + +field((A, B, Title), "secdeva/fieldTypes/title", Title) :- + link(A, B, "secdeva/linkTypes/dataflow", Title), + not secdeva_ancestorOrSelf(A, {{cardKey}}), + secdeva_ancestorOrSelf(B, {{cardKey}}). + +field((A, B, Title), "secdeva/fieldTypes/externalTitle", External) :- + link(A, B, "secdeva/linkTypes/dataflow", Title), + not secdeva_ancestorOrSelf(A, {{cardKey}}), + secdeva_ancestorOrSelf(B, {{cardKey}}), + field(A, "title", External). + +field((A, B, Title), "secdeva/fieldTypes/externalCardKey", A) :- + link(A, B, "secdeva/linkTypes/dataflow", Title), + not secdeva_ancestorOrSelf(A, {{cardKey}}), + secdeva_ancestorOrSelf(B, {{cardKey}}), + field(B, "title", _). + +field((A, B, Title), "secdeva/fieldTypes/internalTitle", Internal) :- + link(A, B, "secdeva/linkTypes/dataflow", Title), + not secdeva_ancestorOrSelf(A, {{cardKey}}), + secdeva_ancestorOrSelf(B, {{cardKey}}), + field(B, "title", Internal). + +field((A, B, Title), "secdeva/fieldTypes/internalCardKey", B) :- + link(A, B, "secdeva/linkTypes/dataflow", Title), + not secdeva_ancestorOrSelf(A, {{cardKey}}), + secdeva_ancestorOrSelf(B, {{cardKey}}). + % ---------------------------------------------------------------------------- % Related risks % ---------------------------------------------------------------------------- @@ -32,5 +120,8 @@ childObject(result, Register, "securityIssueRegister") :- % Ordering % ---------------------------------------------------------------------------- +order(2, "externalDataflows", 1, "secdeva/fieldTypes/direction", "ASC"). +order(2, "externalDataflows", 2, "secdeva/fieldTypes/internalTitle", "ASC"). + order(2, "risks", 1, "rank", "ASC"). order(2, "issues", 1, "rank", "ASC"). diff --git a/.cards/local/templates/ownProduct.json b/.cards/local/templates/ownProduct.json new file mode 100644 index 00000000..1d521889 --- /dev/null +++ b/.cards/local/templates/ownProduct.json @@ -0,0 +1,6 @@ +{ + "name": "secdeva/templates/ownProduct", + "displayName": "Own product", + "description": "A product or component developed by your own organisation", + "category": "Solution structure" +} \ No newline at end of file diff --git a/.cards/local/templates/ownProduct/c/.schema b/.cards/local/templates/ownProduct/c/.schema new file mode 100644 index 00000000..8839598d --- /dev/null +++ b/.cards/local/templates/ownProduct/c/.schema @@ -0,0 +1,6 @@ +[ + { + "id": "cardBaseSchema", + "version": 1 + } +] \ No newline at end of file diff --git a/.cards/local/templates/ownProduct/c/secdeva_ownprodu01/index.adoc b/.cards/local/templates/ownProduct/c/secdeva_ownprodu01/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/.cards/local/templates/ownProduct/c/secdeva_ownprodu01/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/.cards/local/templates/ownProduct/c/secdeva_ownprodu01/index.json b/.cards/local/templates/ownProduct/c/secdeva_ownprodu01/index.json new file mode 100644 index 00000000..d06ce878 --- /dev/null +++ b/.cards/local/templates/ownProduct/c/secdeva_ownprodu01/index.json @@ -0,0 +1,10 @@ +{ + "title": "Untitled own product", + "cardType": "secdeva/cardTypes/product", + "workflowState": "", + "rank": "0|a", + "links": [], + "secdeva/fieldTypes/productOrigin": "own", + "lastUpdated": "2026-08-26T11:38:34.917Z", + "base/fieldTypes/informationClassification": "internal" +} \ No newline at end of file diff --git a/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_5efhfhtv/c/secdeva_1011/index.adoc b/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_5efhfhtv/c/secdeva_1011/index.adoc index f5a47065..8437b09a 100644 --- a/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_5efhfhtv/c/secdeva_1011/index.adoc +++ b/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_5efhfhtv/c/secdeva_1011/index.adoc @@ -7,26 +7,26 @@ {{/graph}} ==== -Digital products and solutions typically use many 3rd party technologies, which range from small libraries and packages to major dependencies such as toolkits, frameworks or applications. These technologies may introduce cybersecurity risks that must be managed and periodically reviewed, as the risks change over time. +Digital products and solutions typically use many third-party technologies, which range from small libraries and packages to major dependencies such as toolkits, frameworks or applications. These technologies may introduce cybersecurity risks that must be managed and periodically reviewed, as the risks change over time. == How to decide if this secure development task is required -Managing the risks related to all 3rd party technologies is required. This control is required, if 3rd party technologies are in use. +Managing the risks related to all third-party technologies is required. This control is required, if third-party technologies are in use. -Reusing components from other internal projects may also introduce risks. Therefore, the risks related internal technologies shall be managed with the same process as the risks related to 3rd party technologies. +Reusing components from other internal projects may also introduce risks. Therefore, the risks related internal technologies shall be managed with the same process as the risks related to third-party technologies. == How to implement -For libraries and packages, the code reviewer shall consider the license, security and quality risks before approving a pull request that adds a new 3rd party dependency. Vulnerability management shall be in place. The development team should review the used 3rd party libraries and packages periodically, to remove unnecessary dependencies and to consider the risks that may have changed over time. +For libraries and packages, the code reviewer shall consider the license, security and quality risks before approving a pull request that adds a new third-party dependency. Vulnerability management shall be in place. The development team should review the used third-party libraries and packages periodically, to remove unnecessary dependencies and to consider the risks that may have changed over time. -For applications, frameworks, databases, toolkits and other significant 3rd party technologies, create a technology selection document and follow the instructions from the template. The developent team should review the used significant 3rd party technologies periodically, to remove unnecessary dependencies and to consider the risks that may have changed over time. +For applications, frameworks, databases, toolkits and other significant third-party technologies, create a technology selection document and follow the instructions from the template. The developent team should review the used significant third-party technologies periodically, to remove unnecessary dependencies and to consider the risks that may have changed over time. {{#createCards}} "template": "secdeva/templates/technology", - "buttonLabel": "Create a 3rd party technology document" + "buttonLabel": "Create a third-party technology document" {{/createCards}} -In general, the development team must ensure that all 3rd party libraries, packages and significant dependencies are documented. Typically, libraries and packages are documented using a package manager or a package declaration as part of the source code. Other 3rd party technologies may be documented by creating a technology selection document for each technology. +In general, the development team must ensure that all third-party libraries, packages and significant dependencies are documented. Typically, libraries and packages are documented using a package manager or a package declaration as part of the source code. Other third-party technologies may be documented by creating a technology selection document for each technology. {{#report}} "name": "secdeva/reports/projectTechnologies" @@ -34,7 +34,7 @@ In general, the development team must ensure that all 3rd party libraries, packa == How to review this task -For libraries and packages, check that the team's code review practice includes review of new 3rd party dependencies. Notice that there are separate secure development tasks for vulnerability management and open source license compliance. +For libraries and packages, check that the team's code review practice includes review of new third-party dependencies. Notice that there are separate secure development tasks for vulnerability management and open source license compliance. Check that significant technology selections have been documented and the technology selection documents have been approved. diff --git a/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_5efhfhtv/c/secdeva_1011/index.json b/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_5efhfhtv/c/secdeva_1011/index.json index 787c25e6..fb3d5e30 100644 --- a/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_5efhfhtv/c/secdeva_1011/index.json +++ b/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_5efhfhtv/c/secdeva_1011/index.json @@ -1,6 +1,6 @@ { "cardType": "base/cardTypes/annualTask", - "title": "Manage 3rd party technologies", + "title": "Manage third-party technologies", "workflowState": "", "rank": "0|p", "lastUpdated": "2026-08-16T20:28:21.154Z", diff --git a/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1012/index.adoc b/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1012/index.adoc index ec1056e3..f4af9a4b 100644 --- a/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1012/index.adoc +++ b/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1012/index.adoc @@ -7,11 +7,11 @@ {{/graph}} ==== -The goal of the vulnerability management is to identify, characterize, address, and communicate potential security vulnerabilities in 3rd party technology. +The goal of the vulnerability management is to identify, characterize, address, and communicate potential security vulnerabilities in third-party technology. == How to decide if this secure development task is required -Vulnerability management is required for all 3rd party technology. +Vulnerability management is required for all third-party technology. This analysis must be performed on all executable files. @@ -25,11 +25,11 @@ Notice that vulnerability management shall continue even after active developmen For interpreted code and binary executable files compiled by the development team, the analysis can be done by creating an SBOM and analysing vulnerabilities based on the SBOM with a dependency tracking tool. -For binary executable files that are compiled by a 3rd party organization, the analysis shall be done by analysing the binary with a software composition analysis tool. +For binary executable files that are compiled by a third-party organization, the analysis shall be done by analysing the binary with a software composition analysis tool. The source for the known vulnerabilities should be the recent contents of an established, industry-recognized public vulnerability database. -If the supplier of a 3rd party component has published information about their vulnerabilities, then ensure that this information is taken into account. Update the threat model, other possible technical documentation and product documentation when applicable. +If the supplier of a third-party component has published information about their vulnerabilities, then ensure that this information is taken into account. Update the threat model, other possible technical documentation and product documentation when applicable. {{#report}} "name": "secdeva/reports/createChildReview", diff --git a/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1012/index.json b/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1012/index.json index b9b1ef71..d94bbf5e 100644 --- a/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1012/index.json +++ b/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1012/index.json @@ -1,6 +1,6 @@ { "cardType": "base/cardTypes/quarterlyTask", - "title": "Manage 3rd party vulnerabilities", + "title": "Manage third-party vulnerabilities", "workflowState": "", "rank": "0|a", "lastUpdated": "2026-08-16T20:28:21.151Z", diff --git a/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1014/index.adoc b/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1014/index.adoc index 1d7dd910..e0af4298 100644 --- a/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1014/index.adoc +++ b/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1014/index.adoc @@ -7,23 +7,23 @@ {{/graph}} ==== -Managing 3rd party software updates refers to keeping track of and characterizing the security updates from suppliers of dependent 3rd party components and operating systems. When applicable, 3rd party software updates are applied to the product or distributed to product users. +Managing third-party software updates refers to keeping track of and characterizing the security updates from suppliers of dependent third-party components and operating systems. When applicable, third-party software updates are applied to the product or distributed to product users. == How to decide if this secure development task is required -For libraries and packages, security updates can often be managed as a part vulnerability management. In these cases there is no need for managing 3rd party software updates separately. +For libraries and packages, security updates can often be managed as a part vulnerability management. In these cases there is no need for managing third-party software updates separately. However, in some cases such as with some commercial-off-the-shelf technology, it can be necessary to manage security updates separately. == How to implement -Identify the communications channels of the 3rd party product supplier and ensure that you will be notified when the supplier makes new security updates available. +Identify the communications channels of the third-party product supplier and ensure that you will be notified when the supplier makes new security updates available. When a new security update is published, then qualify the update for applicability, suitability and compatibility. -Notice that 3rd party software update management shall continue even after active development has ended. 3rd party software update management shall continue also for previously released product versions during their support period. +Notice that third-party software update management shall continue even after active development has ended. third-party software update management shall continue also for previously released product versions during their support period. -If the supplier of a 3rd party component has published information about their security updates, then ensure that this information is taken into account. Update the threat model, other possible technical documentation and product documentation when applicable. +If the supplier of a third-party component has published information about their security updates, then ensure that this information is taken into account. Update the threat model, other possible technical documentation and product documentation when applicable. {{#report}} "name": "secdeva/reports/createChildReview", diff --git a/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1014/index.json b/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1014/index.json index b8bcc2ff..3e095cb6 100644 --- a/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1014/index.json +++ b/.cards/local/templates/project/c/secdeva_1viupwcw/c/secdeva_y979m80e/c/secdeva_1014/index.json @@ -1,6 +1,6 @@ { "cardType": "base/cardTypes/annualTask", - "title": "Manage 3rd party software updates", + "title": "Manage third-party software updates", "workflowState": "", "rank": "0|b", "lastUpdated": "2026-08-16T20:28:21.151Z", diff --git a/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_mg2ld1fl/c/secdeva_o49jcxhb/c/secdeva_ryzudq5d/index.json b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_mg2ld1fl/c/secdeva_o49jcxhb/c/secdeva_ryzudq5d/index.json index 4eec7545..34fd2509 100644 --- a/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_mg2ld1fl/c/secdeva_o49jcxhb/c/secdeva_ryzudq5d/index.json +++ b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_mg2ld1fl/c/secdeva_o49jcxhb/c/secdeva_ryzudq5d/index.json @@ -1,6 +1,6 @@ { "cardType": "ismsa/cardTypes/internalControl", - "title": "Manage 3rd party software updates", + "title": "Manage third-party software updates", "workflowState": "", "rank": "0|b", "lastUpdated": "2026-08-16T20:28:21.164Z", diff --git a/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_mg2ld1fl/c/secdeva_o49jcxhb/c/secdeva_uv49qtxh/index.json b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_mg2ld1fl/c/secdeva_o49jcxhb/c/secdeva_uv49qtxh/index.json index 034c8e66..157af8c2 100644 --- a/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_mg2ld1fl/c/secdeva_o49jcxhb/c/secdeva_uv49qtxh/index.json +++ b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_mg2ld1fl/c/secdeva_o49jcxhb/c/secdeva_uv49qtxh/index.json @@ -1,6 +1,6 @@ { "cardType": "ismsa/cardTypes/internalControl", - "title": "Manage 3rd party vulnerabilities", + "title": "Manage third-party vulnerabilities", "workflowState": "", "rank": "0|a", "lastUpdated": "2026-08-16T20:28:21.164Z", diff --git a/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_mg2ld1fl/c/secdeva_uyuvsxoo/c/secdeva_k5ny25qj/index.json b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_mg2ld1fl/c/secdeva_uyuvsxoo/c/secdeva_k5ny25qj/index.json index c61b8e98..b9717ff5 100644 --- a/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_mg2ld1fl/c/secdeva_uyuvsxoo/c/secdeva_k5ny25qj/index.json +++ b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_mg2ld1fl/c/secdeva_uyuvsxoo/c/secdeva_k5ny25qj/index.json @@ -1,6 +1,6 @@ { "cardType": "ismsa/cardTypes/internalControl", - "title": "Manage 3rd party technologies", + "title": "Manage third-party technologies", "workflowState": "", "rank": "0|f", "lastUpdated": "2026-08-16T20:28:21.163Z", diff --git a/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/c/secdeva_solstruct2/index.adoc b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/c/secdeva_solstruct2/index.adoc new file mode 100644 index 00000000..cd19256f --- /dev/null +++ b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/c/secdeva_solstruct2/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/productStructure" +{{/report}} diff --git a/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/c/secdeva_solstruct2/index.json b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/c/secdeva_solstruct2/index.json new file mode 100644 index 00000000..2df73d3c --- /dev/null +++ b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/c/secdeva_solstruct2/index.json @@ -0,0 +1,8 @@ +{ + "title": "Own products", + "cardType": "secdeva/cardTypes/register", + "workflowState": "", + "rank": "0|a", + "base/fieldTypes/identifier": "secdeva_group_own-products", + "links": [] +} \ No newline at end of file diff --git a/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/c/secdeva_solstruct3/index.adoc b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/c/secdeva_solstruct3/index.adoc new file mode 100644 index 00000000..cd19256f --- /dev/null +++ b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/c/secdeva_solstruct3/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/productStructure" +{{/report}} diff --git a/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/c/secdeva_solstruct3/index.json b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/c/secdeva_solstruct3/index.json new file mode 100644 index 00000000..f602954f --- /dev/null +++ b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/c/secdeva_solstruct3/index.json @@ -0,0 +1,8 @@ +{ + "title": "Third-party products", + "cardType": "secdeva/cardTypes/register", + "workflowState": "", + "rank": "0|b", + "base/fieldTypes/identifier": "secdeva_group_third-party-products", + "links": [] +} \ No newline at end of file diff --git a/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/index.adoc b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/index.adoc new file mode 100644 index 00000000..329413d6 --- /dev/null +++ b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerSolutionStructure" +{{/report}} diff --git a/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/index.json b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/index.json new file mode 100644 index 00000000..d11a1e53 --- /dev/null +++ b/.cards/local/templates/project2/c/secdeva_hfh3g4u2/c/secdeva_wqydiu8q/c/secdeva_solstruct1/index.json @@ -0,0 +1,8 @@ +{ + "title": "Solution structure", + "cardType": "secdeva/cardTypes/register", + "workflowState": "", + "rank": "0|cn", + "base/fieldTypes/identifier": "secdeva_register_solution-structure", + "links": [] +} \ No newline at end of file diff --git a/.cards/local/templates/reviewOf3rdPartyTechnologies.json b/.cards/local/templates/reviewOf3rdPartyTechnologies.json index 00502785..5370ef5e 100644 --- a/.cards/local/templates/reviewOf3rdPartyTechnologies.json +++ b/.cards/local/templates/reviewOf3rdPartyTechnologies.json @@ -1,6 +1,6 @@ { "name": "secdeva/templates/reviewOf3rdPartyTechnologies", - "displayName": "Review of 3rd party technologies", + "displayName": "Review of third-party technologies", "category": "Secure development reviews", "description": "A review of security requirement management in a development project" } \ No newline at end of file diff --git a/.cards/local/templates/reviewOf3rdPartyTechnologies/c/secdeva_o5f1pka3/index.adoc b/.cards/local/templates/reviewOf3rdPartyTechnologies/c/secdeva_o5f1pka3/index.adoc index 904794c0..a2a51787 100644 --- a/.cards/local/templates/reviewOf3rdPartyTechnologies/c/secdeva_o5f1pka3/index.adoc +++ b/.cards/local/templates/reviewOf3rdPartyTechnologies/c/secdeva_o5f1pka3/index.adoc @@ -1,10 +1,10 @@ == Introduction -This document is a review of 3rd party technologies. This review focuses on the selection and documentation of the technologies. Vulnerabilities are reviewed separately. +This document is a review of third-party technologies. This review focuses on the selection and documentation of the technologies. Vulnerabilities are reviewed separately. == Review -The following major 3rd party technologies have been identified: +The following major third-party technologies have been identified: {{#report}} "name": "secdeva/reports/projectTechnologies" @@ -12,21 +12,21 @@ The following major 3rd party technologies have been identified: == Technology assessments -All major 3rd party technologies have been identified, and the relevant technology assessments have been approved. +All major third-party technologies have been identified, and the relevant technology assessments have been approved. * [ ] Not OK * [ ] OK == Selection of libraries and packages -For libraries and packages, where separate technology assessments are not necessary, check that the team's code review practice includes review of new 3rd party dependencies. +For libraries and packages, where separate technology assessments are not necessary, check that the team's code review practice includes review of new third-party dependencies. * [ ] Not OK * [ ] OK == SBOM -A software bill of materials (SBOM) has been drawn up, all 3rd party dependencies, libraries and packages are included in the software bill of materials (SBOM), and the SBOM is up to date. +A software bill of materials (SBOM) has been drawn up, all third-party dependencies, libraries and packages are included in the software bill of materials (SBOM), and the SBOM is up to date. * [ ] Not OK * [ ] OK diff --git a/.cards/local/templates/reviewOf3rdPartyTechnologies/c/secdeva_o5f1pka3/index.json b/.cards/local/templates/reviewOf3rdPartyTechnologies/c/secdeva_o5f1pka3/index.json index 808ade62..776ad16e 100644 --- a/.cards/local/templates/reviewOf3rdPartyTechnologies/c/secdeva_o5f1pka3/index.json +++ b/.cards/local/templates/reviewOf3rdPartyTechnologies/c/secdeva_o5f1pka3/index.json @@ -1,5 +1,5 @@ { - "title": "Review of 3rd party technologies", + "title": "Review of third-party technologies", "cardType": "base/cardTypes/review", "workflowState": "", "rank": "0|b", diff --git a/.cards/local/templates/softwareUpdateManagement.json b/.cards/local/templates/softwareUpdateManagement.json index cc60a1f4..c81e8933 100644 --- a/.cards/local/templates/softwareUpdateManagement.json +++ b/.cards/local/templates/softwareUpdateManagement.json @@ -1,6 +1,6 @@ { "name": "secdeva/templates/softwareUpdateManagement", "displayName": "Review of software update management", - "description": "Review of the management of 3rd party software updates", + "description": "Review of the management of third-party software updates", "category": "Secure development reviews" } \ No newline at end of file diff --git a/.cards/local/templates/softwareUpdateManagement/c/secdeva_fkd98sie/index.adoc b/.cards/local/templates/softwareUpdateManagement/c/secdeva_fkd98sie/index.adoc index 7d181125..16083a4d 100644 --- a/.cards/local/templates/softwareUpdateManagement/c/secdeva_fkd98sie/index.adoc +++ b/.cards/local/templates/softwareUpdateManagement/c/secdeva_fkd98sie/index.adoc @@ -4,7 +4,7 @@ This document is a review of the management of security updates for #TODO: descr == 3^rd^ party software update management -The goal of the 3rd party software update management of a technology is to identify, qualify and document security-related software updates to 3^rd^ party components that the product depends on. +The goal of the third-party software update management of a technology is to identify, qualify and document security-related software updates to 3^rd^ party components that the product depends on. #TODO: document here, how the 3^rd^ party software update management for the scope is done:# @@ -15,17 +15,17 @@ The goal of the 3rd party software update management of a technology is to ident == Review checklist -Check that the 3rd party software update management covers all such technologies where 3rd party software update management is required. +Check that the third-party software update management covers all such technologies where third-party software update management is required. * [ ] OK * [ ] Not OK -Check that 3rd party software update management has been executed. +Check that third-party software update management has been executed. * [ ] OK * [ ] Not OK -Check that all 3rd party software updates and the information provided by the 3rd party suppliers have been processed. +Check that all third-party software updates and the information provided by the third-party suppliers have been processed. * [ ] OK * [ ] Not OK diff --git a/.cards/local/templates/thirdPartyProduct.json b/.cards/local/templates/thirdPartyProduct.json new file mode 100644 index 00000000..7022ece0 --- /dev/null +++ b/.cards/local/templates/thirdPartyProduct.json @@ -0,0 +1,6 @@ +{ + "name": "secdeva/templates/thirdPartyProduct", + "displayName": "Third-party product", + "description": "A product or component obtained from another manufacturer", + "category": "Solution structure" +} \ No newline at end of file diff --git a/.cards/local/templates/thirdPartyProduct/c/.schema b/.cards/local/templates/thirdPartyProduct/c/.schema new file mode 100644 index 00000000..8839598d --- /dev/null +++ b/.cards/local/templates/thirdPartyProduct/c/.schema @@ -0,0 +1,6 @@ +[ + { + "id": "cardBaseSchema", + "version": 1 + } +] \ No newline at end of file diff --git a/.cards/local/templates/thirdPartyProduct/c/secdeva_thirdpar01/index.adoc b/.cards/local/templates/thirdPartyProduct/c/secdeva_thirdpar01/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/.cards/local/templates/thirdPartyProduct/c/secdeva_thirdpar01/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/.cards/local/templates/thirdPartyProduct/c/secdeva_thirdpar01/index.json b/.cards/local/templates/thirdPartyProduct/c/secdeva_thirdpar01/index.json new file mode 100644 index 00000000..55a29ec4 --- /dev/null +++ b/.cards/local/templates/thirdPartyProduct/c/secdeva_thirdpar01/index.json @@ -0,0 +1,10 @@ +{ + "title": "Untitled third-party product", + "cardType": "secdeva/cardTypes/product", + "workflowState": "", + "rank": "0|a", + "links": [], + "secdeva/fieldTypes/productOrigin": "thirdPartyCommercial", + "lastUpdated": "2026-08-26T11:38:24.710Z", + "base/fieldTypes/informationClassification": "internal" +} \ No newline at end of file diff --git a/.cards/local/templates/vulnerabilityManagement.json b/.cards/local/templates/vulnerabilityManagement.json index a7a8a9fc..eb192b7c 100644 --- a/.cards/local/templates/vulnerabilityManagement.json +++ b/.cards/local/templates/vulnerabilityManagement.json @@ -1,6 +1,6 @@ { "name": "secdeva/templates/vulnerabilityManagement", "displayName": "Review of vulnerability management", - "description": "Review of the 3rd party technology vulnerability management", + "description": "Review of the third-party technology vulnerability management", "category": "Secure development reviews" } \ No newline at end of file diff --git a/.cards/local/templates/vulnerabilityManagement/c/secdeva_42/index.adoc b/.cards/local/templates/vulnerabilityManagement/c/secdeva_42/index.adoc index daecd353..9407bdc3 100644 --- a/.cards/local/templates/vulnerabilityManagement/c/secdeva_42/index.adoc +++ b/.cards/local/templates/vulnerabilityManagement/c/secdeva_42/index.adoc @@ -4,7 +4,7 @@ This document is a review of the vulnerability management for #TODO: describe sc == Vulnerability management -The goal of the vulnerability management of a technology is to identify and characterize potential security vulnerabilities in the used 3rd party technologies. Vulnerability management can be based on forming a Software Bill of Materials (SBOM) of the product and using a tool to track new vulnerabilities based on the SBOM, or on using a tool that tracks vulnerabilities based on the binary of the product. +The goal of the vulnerability management of a technology is to identify and characterize potential security vulnerabilities in the used third-party technologies. Vulnerability management can be based on forming a Software Bill of Materials (SBOM) of the product and using a tool to track new vulnerabilities based on the SBOM, or on using a tool that tracks vulnerabilities based on the binary of the product. #TODO: document here, how the vulnerability management for the scope is done:# @@ -30,7 +30,7 @@ Check that the identified security-related findings have been reported as securi * [ ] OK * [ ] Not OK -Check that the information provided by the 3rd party suppliers regarding their vulnerabilities have been processed. +Check that the information provided by the third-party suppliers regarding their vulnerabilities have been processed. * [ ] OK * [ ] Not OK diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_2zeegcoa/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_2zeegcoa/index.adoc new file mode 100644 index 00000000..ba4860c0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_2zeegcoa/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/verificationPhase" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_2zeegcoa/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_2zeegcoa/index.json new file mode 100644 index 00000000..986cc393 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_2zeegcoa/index.json @@ -0,0 +1,13 @@ +{ + "title": "Verification", + "cardType": "secdeva/cardTypes/phase", + "workflowState": "None", + "rank": "0|f", + "links": [], + "lastUpdated": "2026-08-26T11:18:46.280Z", + "base/fieldTypes/identifier": "secdeva_phase_verification", + "ismsa/fieldTypes/progress": "secdeva_phase-progress", + "base/fieldTypes/adoptionStep": "step1", + "templateCardKey": "secdeva_a5n2f56g", + "createdAt": "2026-08-26T11:18:46.278Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_55ae8k31/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_55ae8k31/index.adoc new file mode 100644 index 00000000..ebd91c37 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_55ae8k31/index.adoc @@ -0,0 +1,45 @@ +This page runs the solution structure test fixture and compares the derived economic +operator roles and policy check failures against the expected results. The expectations +live in the report query, keyed by the `base/fieldTypes/identifier` of each test card, so +the fixture can be deleted and recreated without touching the report. + +== How the fixture stays out of the real project + +The test cards sit under their own *Solution structure test project*, created from the +same `project2` template as a real project. Isolation does not come from the fixture +lacking a project — it comes from every register, policy check and cross-reference query +joining on a *shared* project: + +[source] +---- +secdeva_closestProject(Card, Project), +secdeva_closestProject({{cardKey}}, Project). +---- + +Two different projects never satisfy that join, so the fixture is invisible to the real +project's views while behaving exactly like real content inside its own. Reusing the +project template also means the identifiers it defines, such as +`secdeva_group_own-products`, exist in both projects; every lookup of those identifiers +in this module is project-scoped, so that is safe. + +Because the fixture has a real project, checks gated on the project — the adoption step, +and everything reached through `secdeva_closestProject` — can be exercised here. That was +not possible while the test content sat directly under a plain page. + +== Where the test cards live + +The test products sit under the *Own products* and *Third-party products* groups of this +project's Solution structure register, exactly where a real product would. Placement is +for browsing only: `secdeva_productGroup` derives group membership from the origin field, +not from the tree. TC16 demonstrates this — it has no origin recorded, so it is filed +under Third-party products but appears in neither group listing. + +== Workflow states + +Most cases are in *Draft*. The TC16 to TC19 cases are *Active*, because the required-field +checks are gated on the card leaving the initial workflow state. TC18 and TC19 are the +negative cases that prove being Active does not by itself raise a failure. + +{{#report}} + "name": "secdeva/reports/testingSolutionStructure" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_55ae8k31/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_55ae8k31/index.json new file mode 100644 index 00000000..0a14a83d --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_55ae8k31/index.json @@ -0,0 +1,12 @@ +{ + "title": "Testing - solution structure", + "cardType": "base/cardTypes/page", + "workflowState": "Draft", + "base/fieldTypes/informationClassification": "internal", + "rank": "0|0", + "lastUpdated": "2026-08-26T11:26:16.548Z", + "links": [], + "templateCardKey": "base_2", + "createdAt": "2026-08-26T11:07:42.753Z", + "base/fieldTypes/owner": "test.owner@example.com" +} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/c/secdeva_yjb80fnu/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/c/secdeva_yjb80fnu/index.adoc similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/c/secdeva_yjb80fnu/index.adoc rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/c/secdeva_yjb80fnu/index.adoc diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/c/secdeva_yjb80fnu/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/c/secdeva_yjb80fnu/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/c/secdeva_yjb80fnu/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/c/secdeva_yjb80fnu/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/index.adoc similarity index 74% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/index.adoc rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/index.adoc index bc33777d..9be84421 100644 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/index.adoc +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/index.adoc @@ -2,53 +2,45 @@ This page documents the design of an interface. -== Interface review - -Review instructions +NOTE: Completing interface specifications is required on Adoption Step 3 only. -* Review this document according to the review instructions of each chapter. -* Document the results of the review in the review subtask +TIP: Write your own documentation in the sections below. The classification of the interface and the links to the related cards at the end of this page are generated automatically from the threat model. -== Classification of the interface +== Interface review -[NOTE] .Review instructions +[%collapsible] ==== -Interfaces are classified automatically based on the dataflow model. To review this section: - -. Check that the interface has been correctly classified as an external interface or internal interface. If not, then improve the dataflows of dataflow model. External interfaces have dataflows from external entities or persons. -. Check that the relationship of this interface to the trust boundaries have been correctly classified. If not, then improve the dataflows and trust boundaries of the dataflow model. +* Review this document according to the review instructions of each chapter. +* Document the results of the review in the review subtask ==== -{{#report}} - "name": "secdeva/reports/interfaceClassification" -{{/report}} - == Security context considerations +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== The _security context_ refers to the security that is provided by the deployment environment. To review this section: -. Check what has been documented about the security context of the product. The security context is documented in a security context document: {{#report}} - "name": "secdeva/reports/linkByIdentifier", - "identifier": "secdeva_document_security-context", - "messageIfNoResults": "#TODO# There are no security context documents yet. Create a security context document under *Design* → *Document security context*." -{{/report}} +. Check what has been documented about the security context of the product. The security context documents of the project are listed in *Security context of the product* at the end of this page. . Check that this section describes how the security context has been taken into account for the security of this interface: * How the protections offered by the security context have been used * How the vulnerabilities resulting from the security context have been addressed . Check that this section includes security considerations, assumptions and/or constraints associated with the use of the interface within the security context . Any considerations or constraints that must be taken into account when using this interface ==== +===== == Assets and privileges +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== Consider the following aspects: @@ -74,6 +66,7 @@ For example * Memory resources . Check that the required privileges, rights or access control permissions have been defined in the second column of the table below ==== +===== #TODO: document the reachable assets (both directly and indirectly), and the required privileges. For example, you may use the format of the table below.# @@ -90,10 +83,12 @@ For example == Actors of the interface +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== -. Identify the potential users of the interface and check that they are represented in the dataflow model. See a summary above in *Classification of the interface* +. Identify the potential users of the interface and check that they are represented in the threat model. See the summary in *Classification of the interface* at the end of this page . Group the users into user categories based on similar needs of accessing the assets . Aim at a simple design @@ -102,6 +97,7 @@ To review this section: . Check that this section describes the potential user categories of the interface correctly . Check that the granted privileges have been documented correctly ==== +===== #TODO: Document the actors who may use the interface, and their required privileges, rights or permissions. For example, you may use the format of the table below.# @@ -116,8 +112,10 @@ To review this section: == Protocol description +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== This section is optional. @@ -130,11 +128,14 @@ If applicable, the protocol description may include * Extensibility, versioning and version compatibility * Exceptions and error messages ==== +===== == Security capabilities +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== Consider whether the following aspects are relevant: @@ -156,29 +157,38 @@ To review this section . Check that the described security capabilities are sufficient and proportional to the security context, identified threats and relevant security requirements ==== +===== == 3rd party technologies +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== To review this section: -. Check that a technology selection document has been created for all 3rd party products that are used to implement this interface -. Check that the used 3rd party technologies are listed in this section +. Check that a technology asssessment document has been created for the relevant 3rd party products that are used to implement this interface +. Check that any other used 3rd party technologies are listed in this section. The technology assessments that have been linked to this interface are listed in *Related technology assessments* at the end of this page. ==== +===== The implementation of this interface: (Select one of the following options) * [ ] Does not use 3rd party technologies -* [ ] Uses the following 3rd party technologies: +* [ ] Uses 3rd party technologies -- List the used 3rd party technologies here, or refer to another document +- #TODO# List the used 3rd party technologies here, or add technology assessments at the end of this page, or refer to another document == Design insights -Review instructions: Documenting design insights +.Instructions +[%collapsible] +===== +[NOTE] +==== +Documenting design insights In this optional section, you can specify additional information about the design of this interface: @@ -189,11 +199,15 @@ In this optional section, you can specify additional information about the desig * Dependability considerations * Redundancy considerations * Diagnostics, logging and auditing considerations +==== +===== == Security testing +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== Security testing activities may be applicable to interface. Document the scoping decisions (which of the testing activities are applicable) and the justification of the decisions in the metadata of this card. @@ -207,27 +221,8 @@ Security testing for interface tests fall into the following categories. * Network traffic load tests * Performance and scalability tests ==== - -== Version history - -[cols="1,1,3"] -|=============== -|Version | Date | Changes/Author - -| 0.1 -| 2024-01-01 -| XYZ changed by N.N. - -|=============== - -== Reviews - -{{#createCards}} - "template": "base/templates/reviewTask", - "buttonLabel": "Add new review task" -{{/createCards}} +===== {{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/reviewTask" -{{/report}} \ No newline at end of file + "name": "secdeva/reports/threatModelInterface" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/index.json similarity index 78% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/index.json index 9bd8308c..ecfd892d 100644 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/index.json +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/c/secdeva_w6njc3as/index.json @@ -7,5 +7,6 @@ "links": [], "base/fieldTypes/informationClassification": "internal", "base/fieldTypes/identifier": "secdeva_document_interface", - "templateCardKey": "secdeva_7" + "templateCardKey": "secdeva_7", + "secdeva/fieldTypes/interfaceType": "logical" } \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/index.adoc new file mode 100644 index 00000000..94c33afb --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/index.adoc @@ -0,0 +1,4 @@ +{{#report}} + "name": "secdeva/reports/threatModelEntity", + "variant": "process" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/c/secdeva_d3x9etjm/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/c/secdeva_d3x9etjm/index.adoc similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/c/secdeva_d3x9etjm/index.adoc rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/c/secdeva_d3x9etjm/index.adoc diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/c/secdeva_d3x9etjm/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/c/secdeva_d3x9etjm/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/c/secdeva_d3x9etjm/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/c/secdeva_d3x9etjm/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/index.adoc similarity index 74% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/index.adoc rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/index.adoc index bc33777d..9be84421 100644 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/index.adoc +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/index.adoc @@ -2,53 +2,45 @@ This page documents the design of an interface. -== Interface review - -Review instructions +NOTE: Completing interface specifications is required on Adoption Step 3 only. -* Review this document according to the review instructions of each chapter. -* Document the results of the review in the review subtask +TIP: Write your own documentation in the sections below. The classification of the interface and the links to the related cards at the end of this page are generated automatically from the threat model. -== Classification of the interface +== Interface review -[NOTE] .Review instructions +[%collapsible] ==== -Interfaces are classified automatically based on the dataflow model. To review this section: - -. Check that the interface has been correctly classified as an external interface or internal interface. If not, then improve the dataflows of dataflow model. External interfaces have dataflows from external entities or persons. -. Check that the relationship of this interface to the trust boundaries have been correctly classified. If not, then improve the dataflows and trust boundaries of the dataflow model. +* Review this document according to the review instructions of each chapter. +* Document the results of the review in the review subtask ==== -{{#report}} - "name": "secdeva/reports/interfaceClassification" -{{/report}} - == Security context considerations +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== The _security context_ refers to the security that is provided by the deployment environment. To review this section: -. Check what has been documented about the security context of the product. The security context is documented in a security context document: {{#report}} - "name": "secdeva/reports/linkByIdentifier", - "identifier": "secdeva_document_security-context", - "messageIfNoResults": "#TODO# There are no security context documents yet. Create a security context document under *Design* → *Document security context*." -{{/report}} +. Check what has been documented about the security context of the product. The security context documents of the project are listed in *Security context of the product* at the end of this page. . Check that this section describes how the security context has been taken into account for the security of this interface: * How the protections offered by the security context have been used * How the vulnerabilities resulting from the security context have been addressed . Check that this section includes security considerations, assumptions and/or constraints associated with the use of the interface within the security context . Any considerations or constraints that must be taken into account when using this interface ==== +===== == Assets and privileges +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== Consider the following aspects: @@ -74,6 +66,7 @@ For example * Memory resources . Check that the required privileges, rights or access control permissions have been defined in the second column of the table below ==== +===== #TODO: document the reachable assets (both directly and indirectly), and the required privileges. For example, you may use the format of the table below.# @@ -90,10 +83,12 @@ For example == Actors of the interface +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== -. Identify the potential users of the interface and check that they are represented in the dataflow model. See a summary above in *Classification of the interface* +. Identify the potential users of the interface and check that they are represented in the threat model. See the summary in *Classification of the interface* at the end of this page . Group the users into user categories based on similar needs of accessing the assets . Aim at a simple design @@ -102,6 +97,7 @@ To review this section: . Check that this section describes the potential user categories of the interface correctly . Check that the granted privileges have been documented correctly ==== +===== #TODO: Document the actors who may use the interface, and their required privileges, rights or permissions. For example, you may use the format of the table below.# @@ -116,8 +112,10 @@ To review this section: == Protocol description +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== This section is optional. @@ -130,11 +128,14 @@ If applicable, the protocol description may include * Extensibility, versioning and version compatibility * Exceptions and error messages ==== +===== == Security capabilities +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== Consider whether the following aspects are relevant: @@ -156,29 +157,38 @@ To review this section . Check that the described security capabilities are sufficient and proportional to the security context, identified threats and relevant security requirements ==== +===== == 3rd party technologies +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== To review this section: -. Check that a technology selection document has been created for all 3rd party products that are used to implement this interface -. Check that the used 3rd party technologies are listed in this section +. Check that a technology asssessment document has been created for the relevant 3rd party products that are used to implement this interface +. Check that any other used 3rd party technologies are listed in this section. The technology assessments that have been linked to this interface are listed in *Related technology assessments* at the end of this page. ==== +===== The implementation of this interface: (Select one of the following options) * [ ] Does not use 3rd party technologies -* [ ] Uses the following 3rd party technologies: +* [ ] Uses 3rd party technologies -- List the used 3rd party technologies here, or refer to another document +- #TODO# List the used 3rd party technologies here, or add technology assessments at the end of this page, or refer to another document == Design insights -Review instructions: Documenting design insights +.Instructions +[%collapsible] +===== +[NOTE] +==== +Documenting design insights In this optional section, you can specify additional information about the design of this interface: @@ -189,11 +199,15 @@ In this optional section, you can specify additional information about the desig * Dependability considerations * Redundancy considerations * Diagnostics, logging and auditing considerations +==== +===== == Security testing +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== Security testing activities may be applicable to interface. Document the scoping decisions (which of the testing activities are applicable) and the justification of the decisions in the metadata of this card. @@ -207,27 +221,8 @@ Security testing for interface tests fall into the following categories. * Network traffic load tests * Performance and scalability tests ==== - -== Version history - -[cols="1,1,3"] -|=============== -|Version | Date | Changes/Author - -| 0.1 -| 2024-01-01 -| XYZ changed by N.N. - -|=============== - -== Reviews - -{{#createCards}} - "template": "base/templates/reviewTask", - "buttonLabel": "Add new review task" -{{/createCards}} +===== {{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/reviewTask" -{{/report}} \ No newline at end of file + "name": "secdeva/reports/threatModelInterface" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/index.json similarity index 78% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/index.json index 053f7937..b52b5f94 100644 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/index.json +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/index.json @@ -7,5 +7,6 @@ "links": [], "base/fieldTypes/informationClassification": "internal", "base/fieldTypes/identifier": "secdeva_document_interface", - "templateCardKey": "secdeva_7" + "templateCardKey": "secdeva_7", + "secdeva/fieldTypes/interfaceType": "logical" } \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/index.adoc new file mode 100644 index 00000000..94c33afb --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/index.adoc @@ -0,0 +1,4 @@ +{{#report}} + "name": "secdeva/reports/threatModelEntity", + "variant": "process" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/index.adoc new file mode 100644 index 00000000..94c33afb --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/index.adoc @@ -0,0 +1,4 @@ +{{#report}} + "name": "secdeva/reports/threatModelEntity", + "variant": "process" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_779e4hov/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_ffecyqt6/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_ffecyqt6/index.adoc new file mode 100644 index 00000000..94c33afb --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_ffecyqt6/index.adoc @@ -0,0 +1,4 @@ +{{#report}} + "name": "secdeva/reports/threatModelEntity", + "variant": "process" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_ffecyqt6/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_ffecyqt6/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_ffecyqt6/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_ffecyqt6/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/c/secdeva_xzgbmuu7/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/c/secdeva_xzgbmuu7/index.adoc new file mode 100644 index 00000000..94c33afb --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/c/secdeva_xzgbmuu7/index.adoc @@ -0,0 +1,4 @@ +{{#report}} + "name": "secdeva/reports/threatModelEntity", + "variant": "process" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/c/secdeva_xzgbmuu7/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/c/secdeva_xzgbmuu7/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/c/secdeva_xzgbmuu7/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/c/secdeva_xzgbmuu7/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/index.adoc new file mode 100644 index 00000000..94c33afb --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/index.adoc @@ -0,0 +1,4 @@ +{{#report}} + "name": "secdeva/reports/threatModelEntity", + "variant": "process" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/index.adoc new file mode 100644 index 00000000..30afe990 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/index.adoc @@ -0,0 +1,4 @@ +{{#report}} + "name": "secdeva/reports/threatModelEntity", + "variant": "trustBoundary" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/index.adoc new file mode 100644 index 00000000..94c33afb --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/index.adoc @@ -0,0 +1,4 @@ +{{#report}} + "name": "secdeva/reports/threatModelEntity", + "variant": "process" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/index.adoc new file mode 100644 index 00000000..30afe990 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/index.adoc @@ -0,0 +1,4 @@ +{{#report}} + "name": "secdeva/reports/threatModelEntity", + "variant": "trustBoundary" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/c/secdeva_982a9rkd/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/c/secdeva_982a9rkd/index.adoc similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/c/secdeva_982a9rkd/index.adoc rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/c/secdeva_982a9rkd/index.adoc diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/c/secdeva_982a9rkd/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/c/secdeva_982a9rkd/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/c/secdeva_982a9rkd/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/c/secdeva_982a9rkd/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/index.adoc similarity index 74% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/index.adoc rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/index.adoc index bc33777d..9be84421 100644 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/index.adoc +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/index.adoc @@ -2,53 +2,45 @@ This page documents the design of an interface. -== Interface review - -Review instructions +NOTE: Completing interface specifications is required on Adoption Step 3 only. -* Review this document according to the review instructions of each chapter. -* Document the results of the review in the review subtask +TIP: Write your own documentation in the sections below. The classification of the interface and the links to the related cards at the end of this page are generated automatically from the threat model. -== Classification of the interface +== Interface review -[NOTE] .Review instructions +[%collapsible] ==== -Interfaces are classified automatically based on the dataflow model. To review this section: - -. Check that the interface has been correctly classified as an external interface or internal interface. If not, then improve the dataflows of dataflow model. External interfaces have dataflows from external entities or persons. -. Check that the relationship of this interface to the trust boundaries have been correctly classified. If not, then improve the dataflows and trust boundaries of the dataflow model. +* Review this document according to the review instructions of each chapter. +* Document the results of the review in the review subtask ==== -{{#report}} - "name": "secdeva/reports/interfaceClassification" -{{/report}} - == Security context considerations +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== The _security context_ refers to the security that is provided by the deployment environment. To review this section: -. Check what has been documented about the security context of the product. The security context is documented in a security context document: {{#report}} - "name": "secdeva/reports/linkByIdentifier", - "identifier": "secdeva_document_security-context", - "messageIfNoResults": "#TODO# There are no security context documents yet. Create a security context document under *Design* → *Document security context*." -{{/report}} +. Check what has been documented about the security context of the product. The security context documents of the project are listed in *Security context of the product* at the end of this page. . Check that this section describes how the security context has been taken into account for the security of this interface: * How the protections offered by the security context have been used * How the vulnerabilities resulting from the security context have been addressed . Check that this section includes security considerations, assumptions and/or constraints associated with the use of the interface within the security context . Any considerations or constraints that must be taken into account when using this interface ==== +===== == Assets and privileges +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== Consider the following aspects: @@ -74,6 +66,7 @@ For example * Memory resources . Check that the required privileges, rights or access control permissions have been defined in the second column of the table below ==== +===== #TODO: document the reachable assets (both directly and indirectly), and the required privileges. For example, you may use the format of the table below.# @@ -90,10 +83,12 @@ For example == Actors of the interface +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== -. Identify the potential users of the interface and check that they are represented in the dataflow model. See a summary above in *Classification of the interface* +. Identify the potential users of the interface and check that they are represented in the threat model. See the summary in *Classification of the interface* at the end of this page . Group the users into user categories based on similar needs of accessing the assets . Aim at a simple design @@ -102,6 +97,7 @@ To review this section: . Check that this section describes the potential user categories of the interface correctly . Check that the granted privileges have been documented correctly ==== +===== #TODO: Document the actors who may use the interface, and their required privileges, rights or permissions. For example, you may use the format of the table below.# @@ -116,8 +112,10 @@ To review this section: == Protocol description +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== This section is optional. @@ -130,11 +128,14 @@ If applicable, the protocol description may include * Extensibility, versioning and version compatibility * Exceptions and error messages ==== +===== == Security capabilities +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== Consider whether the following aspects are relevant: @@ -156,29 +157,38 @@ To review this section . Check that the described security capabilities are sufficient and proportional to the security context, identified threats and relevant security requirements ==== +===== == 3rd party technologies +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== To review this section: -. Check that a technology selection document has been created for all 3rd party products that are used to implement this interface -. Check that the used 3rd party technologies are listed in this section +. Check that a technology asssessment document has been created for the relevant 3rd party products that are used to implement this interface +. Check that any other used 3rd party technologies are listed in this section. The technology assessments that have been linked to this interface are listed in *Related technology assessments* at the end of this page. ==== +===== The implementation of this interface: (Select one of the following options) * [ ] Does not use 3rd party technologies -* [ ] Uses the following 3rd party technologies: +* [ ] Uses 3rd party technologies -- List the used 3rd party technologies here, or refer to another document +- #TODO# List the used 3rd party technologies here, or add technology assessments at the end of this page, or refer to another document == Design insights -Review instructions: Documenting design insights +.Instructions +[%collapsible] +===== +[NOTE] +==== +Documenting design insights In this optional section, you can specify additional information about the design of this interface: @@ -189,11 +199,15 @@ In this optional section, you can specify additional information about the desig * Dependability considerations * Redundancy considerations * Diagnostics, logging and auditing considerations +==== +===== == Security testing +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== Security testing activities may be applicable to interface. Document the scoping decisions (which of the testing activities are applicable) and the justification of the decisions in the metadata of this card. @@ -207,27 +221,8 @@ Security testing for interface tests fall into the following categories. * Network traffic load tests * Performance and scalability tests ==== - -== Version history - -[cols="1,1,3"] -|=============== -|Version | Date | Changes/Author - -| 0.1 -| 2024-01-01 -| XYZ changed by N.N. - -|=============== - -== Reviews - -{{#createCards}} - "template": "base/templates/reviewTask", - "buttonLabel": "Add new review task" -{{/createCards}} +===== {{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/reviewTask" -{{/report}} \ No newline at end of file + "name": "secdeva/reports/threatModelInterface" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/index.json similarity index 64% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/index.json index 9d185b48..0301ac73 100644 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/index.json +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/index.json @@ -1,11 +1,13 @@ { "cardType": "secdeva/cardTypes/interface", - "title": "Interface 2.1", + "title": "Interface 2.2", "workflowState": "Draft", "rank": "0|b", "lastUpdated": "2026-08-16T20:28:21.138Z", "links": [], "base/fieldTypes/informationClassification": "internal", "base/fieldTypes/identifier": "secdeva_document_interface", - "templateCardKey": "secdeva_7" + "templateCardKey": "secdeva_7", + "secdeva/fieldTypes/port": "443/tcp", + "secdeva/fieldTypes/interfaceType": "logical" } \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/index.adoc new file mode 100644 index 00000000..94c33afb --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/index.adoc @@ -0,0 +1,4 @@ +{{#report}} + "name": "secdeva/reports/threatModelEntity", + "variant": "process" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/c/secdeva_hmx7yonj/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/c/secdeva_hmx7yonj/index.adoc similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/c/secdeva_hmx7yonj/index.adoc rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/c/secdeva_hmx7yonj/index.adoc diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/c/secdeva_hmx7yonj/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/c/secdeva_hmx7yonj/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/c/secdeva_hmx7yonj/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/c/secdeva_hmx7yonj/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/index.adoc similarity index 74% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/index.adoc rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/index.adoc index bc33777d..9be84421 100644 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/c/secdeva_qll8gguk/index.adoc +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/index.adoc @@ -2,53 +2,45 @@ This page documents the design of an interface. -== Interface review - -Review instructions +NOTE: Completing interface specifications is required on Adoption Step 3 only. -* Review this document according to the review instructions of each chapter. -* Document the results of the review in the review subtask +TIP: Write your own documentation in the sections below. The classification of the interface and the links to the related cards at the end of this page are generated automatically from the threat model. -== Classification of the interface +== Interface review -[NOTE] .Review instructions +[%collapsible] ==== -Interfaces are classified automatically based on the dataflow model. To review this section: - -. Check that the interface has been correctly classified as an external interface or internal interface. If not, then improve the dataflows of dataflow model. External interfaces have dataflows from external entities or persons. -. Check that the relationship of this interface to the trust boundaries have been correctly classified. If not, then improve the dataflows and trust boundaries of the dataflow model. +* Review this document according to the review instructions of each chapter. +* Document the results of the review in the review subtask ==== -{{#report}} - "name": "secdeva/reports/interfaceClassification" -{{/report}} - == Security context considerations +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== The _security context_ refers to the security that is provided by the deployment environment. To review this section: -. Check what has been documented about the security context of the product. The security context is documented in a security context document: {{#report}} - "name": "secdeva/reports/linkByIdentifier", - "identifier": "secdeva_document_security-context", - "messageIfNoResults": "#TODO# There are no security context documents yet. Create a security context document under *Design* → *Document security context*." -{{/report}} +. Check what has been documented about the security context of the product. The security context documents of the project are listed in *Security context of the product* at the end of this page. . Check that this section describes how the security context has been taken into account for the security of this interface: * How the protections offered by the security context have been used * How the vulnerabilities resulting from the security context have been addressed . Check that this section includes security considerations, assumptions and/or constraints associated with the use of the interface within the security context . Any considerations or constraints that must be taken into account when using this interface ==== +===== == Assets and privileges +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== Consider the following aspects: @@ -74,6 +66,7 @@ For example * Memory resources . Check that the required privileges, rights or access control permissions have been defined in the second column of the table below ==== +===== #TODO: document the reachable assets (both directly and indirectly), and the required privileges. For example, you may use the format of the table below.# @@ -90,10 +83,12 @@ For example == Actors of the interface +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== -. Identify the potential users of the interface and check that they are represented in the dataflow model. See a summary above in *Classification of the interface* +. Identify the potential users of the interface and check that they are represented in the threat model. See the summary in *Classification of the interface* at the end of this page . Group the users into user categories based on similar needs of accessing the assets . Aim at a simple design @@ -102,6 +97,7 @@ To review this section: . Check that this section describes the potential user categories of the interface correctly . Check that the granted privileges have been documented correctly ==== +===== #TODO: Document the actors who may use the interface, and their required privileges, rights or permissions. For example, you may use the format of the table below.# @@ -116,8 +112,10 @@ To review this section: == Protocol description +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== This section is optional. @@ -130,11 +128,14 @@ If applicable, the protocol description may include * Extensibility, versioning and version compatibility * Exceptions and error messages ==== +===== == Security capabilities +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== Consider whether the following aspects are relevant: @@ -156,29 +157,38 @@ To review this section . Check that the described security capabilities are sufficient and proportional to the security context, identified threats and relevant security requirements ==== +===== == 3rd party technologies +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== To review this section: -. Check that a technology selection document has been created for all 3rd party products that are used to implement this interface -. Check that the used 3rd party technologies are listed in this section +. Check that a technology asssessment document has been created for the relevant 3rd party products that are used to implement this interface +. Check that any other used 3rd party technologies are listed in this section. The technology assessments that have been linked to this interface are listed in *Related technology assessments* at the end of this page. ==== +===== The implementation of this interface: (Select one of the following options) * [ ] Does not use 3rd party technologies -* [ ] Uses the following 3rd party technologies: +* [ ] Uses 3rd party technologies -- List the used 3rd party technologies here, or refer to another document +- #TODO# List the used 3rd party technologies here, or add technology assessments at the end of this page, or refer to another document == Design insights -Review instructions: Documenting design insights +.Instructions +[%collapsible] +===== +[NOTE] +==== +Documenting design insights In this optional section, you can specify additional information about the design of this interface: @@ -189,11 +199,15 @@ In this optional section, you can specify additional information about the desig * Dependability considerations * Redundancy considerations * Diagnostics, logging and auditing considerations +==== +===== == Security testing +.Instructions +[%collapsible] +===== [NOTE] -.Review instructions ==== Security testing activities may be applicable to interface. Document the scoping decisions (which of the testing activities are applicable) and the justification of the decisions in the metadata of this card. @@ -207,27 +221,8 @@ Security testing for interface tests fall into the following categories. * Network traffic load tests * Performance and scalability tests ==== - -== Version history - -[cols="1,1,3"] -|=============== -|Version | Date | Changes/Author - -| 0.1 -| 2024-01-01 -| XYZ changed by N.N. - -|=============== - -== Reviews - -{{#createCards}} - "template": "base/templates/reviewTask", - "buttonLabel": "Add new review task" -{{/createCards}} +===== {{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/reviewTask" -{{/report}} \ No newline at end of file + "name": "secdeva/reports/threatModelInterface" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/index.json similarity index 80% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/index.json index 08337eb2..130944cd 100644 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/c/secdeva_ls70gm8a/index.json +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/c/secdeva_c1lcwteb/index.json @@ -1,6 +1,6 @@ { "cardType": "secdeva/cardTypes/interface", - "title": "Interface 2.2", + "title": "Interface 2.1", "workflowState": "Draft", "rank": "0|b", "lastUpdated": "2026-08-16T20:28:21.138Z", @@ -8,5 +8,5 @@ "base/fieldTypes/informationClassification": "internal", "base/fieldTypes/identifier": "secdeva_document_interface", "templateCardKey": "secdeva_7", - "secdeva/fieldTypes/port": "443/tcp" + "secdeva/fieldTypes/interfaceType": "logical" } \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/index.adoc new file mode 100644 index 00000000..94c33afb --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/index.adoc @@ -0,0 +1,4 @@ +{{#report}} + "name": "secdeva/reports/threatModelEntity", + "variant": "process" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/index.adoc new file mode 100644 index 00000000..94c33afb --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/index.adoc @@ -0,0 +1,4 @@ +{{#report}} + "name": "secdeva/reports/threatModelEntity", + "variant": "process" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/index.adoc new file mode 100644 index 00000000..30afe990 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/index.adoc @@ -0,0 +1,4 @@ +{{#report}} + "name": "secdeva/reports/threatModelEntity", + "variant": "trustBoundary" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/index.json similarity index 100% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/index.json diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/index.adoc new file mode 100644 index 00000000..30afe990 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/index.adoc @@ -0,0 +1,4 @@ +{{#report}} + "name": "secdeva/reports/threatModelEntity", + "variant": "trustBoundary" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/index.json similarity index 73% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/index.json index 0650a6b1..76973e77 100644 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/index.json +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_2iayoqey/index.json @@ -2,8 +2,8 @@ "title": "Solution trust boundary", "cardType": "secdeva/cardTypes/trustBoundary", "workflowState": "Draft", - "rank": "0|b", + "rank": "0|ag", "links": [], "templateCardKey": "secdeva_bwmez3lr", - "lastUpdated": "2026-08-16T20:28:21.137Z" + "lastUpdated": "2026-08-26T20:45:30.019Z" } \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_8cy67icu/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_8cy67icu/index.adoc new file mode 100644 index 00000000..5c29ca82 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_8cy67icu/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/threatModelPerson" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_8cy67icu/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_8cy67icu/index.json similarity index 93% rename from cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_8cy67icu/index.json rename to cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_8cy67icu/index.json index ee154e00..700260cc 100644 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_8cy67icu/index.json +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_8cy67icu/index.json @@ -2,7 +2,7 @@ "title": "User", "cardType": "secdeva/cardTypes/person", "workflowState": "Draft", - "rank": "0|b", + "rank": "0|ad", "links": [ { "linkType": "secdeva/linkTypes/dataflow", @@ -31,7 +31,7 @@ } ], "templateCardKey": "secdeva_j2q6mk5m", - "lastUpdated": "2026-08-16T20:28:21.137Z", + "lastUpdated": "2026-08-26T20:45:33.982Z", "labels": [ "example" ] diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_xvizc4dp/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_xvizc4dp/index.adoc new file mode 100644 index 00000000..fecfa335 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_xvizc4dp/index.adoc @@ -0,0 +1,5 @@ +== Task description + +Review the threat model. + +**Note**: The reviewer cannot be the same person as the owner or the approver of the document. \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_xvizc4dp/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_xvizc4dp/index.json new file mode 100644 index 00000000..36f049c0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/c/secdeva_xvizc4dp/index.json @@ -0,0 +1,12 @@ +{ + "title": "Document review - Threat model", + "cardType": "base/cardTypes/reviewTask", + "workflowState": "Open", + "rank": "0|a", + "base/fieldTypes/informationClassification": "internal", + "base/fieldTypes/reviewPeriod": 365, + "links": [], + "lastUpdated": "2026-08-26T20:45:33.983Z", + "templateCardKey": "secdeva_ws2c9x0f", + "createdAt": "2026-08-26T20:45:05.302Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/index.adoc new file mode 100644 index 00000000..4e1c3448 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/threatModel" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/index.json new file mode 100644 index 00000000..5bb65e68 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/c/secdeva_27hudqmr/index.json @@ -0,0 +1,12 @@ +{ + "cardType": "secdeva/cardTypes/threatModel", + "title": "Threat model - Test project", + "workflowState": "Draft", + "rank": "0|b", + "lastUpdated": "2026-08-26T20:45:05.405Z", + "links": [], + "base/fieldTypes/informationClassification": "internal", + "base/fieldTypes/identifier": "secdeva_document_threat-model", + "templateCardKey": "secdeva_ncnm6dgu", + "createdAt": "2026-08-26T20:45:05.302Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/index.adoc new file mode 100644 index 00000000..16cab65e --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/designPhase" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/index.json new file mode 100644 index 00000000..1daa2d1f --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_88u7wx1u/index.json @@ -0,0 +1,12 @@ +{ + "title": "Design", + "cardType": "secdeva/cardTypes/phase", + "workflowState": "None", + "rank": "0|d", + "links": [], + "lastUpdated": "2026-08-26T11:18:46.280Z", + "base/fieldTypes/identifier": "secdeva_phase_design", + "ismsa/fieldTypes/progress": "secdeva_phase-progress", + "templateCardKey": "secdeva_e8on5yg4", + "createdAt": "2026-08-26T11:18:46.278Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_ea04wyyr/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_ea04wyyr/index.adoc new file mode 100644 index 00000000..516f8e6b --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_ea04wyyr/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/statusAndNextSteps" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_ea04wyyr/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_ea04wyyr/index.json new file mode 100644 index 00000000..5c5d1a2a --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_ea04wyyr/index.json @@ -0,0 +1,12 @@ +{ + "title": "Status & next steps", + "cardType": "secdeva/cardTypes/page", + "workflowState": "None", + "rank": "0|an", + "base/fieldTypes/adoptionStep": "step1", + "links": [], + "lastUpdated": "2026-08-26T11:18:46.280Z", + "base/fieldTypes/identifier": "secdeva_status-and-next-steps", + "templateCardKey": "secdeva_v44z65xs", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_f6feduoe/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_f6feduoe/index.adoc new file mode 100644 index 00000000..ac70d01e --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_f6feduoe/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/operationsPhase" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_f6feduoe/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_f6feduoe/index.json new file mode 100644 index 00000000..b406326f --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_f6feduoe/index.json @@ -0,0 +1,13 @@ +{ + "title": "Operations", + "cardType": "secdeva/cardTypes/phase", + "workflowState": "None", + "rank": "0|h", + "links": [], + "lastUpdated": "2026-08-26T11:18:46.280Z", + "base/fieldTypes/identifier": "secdeva_phase_operations", + "ismsa/fieldTypes/progress": "secdeva_phase-progress", + "base/fieldTypes/adoptionStep": "step1", + "templateCardKey": "secdeva_a3sp00vm", + "createdAt": "2026-08-26T11:18:46.278Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_91xznbvu/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_91xznbvu/index.adoc new file mode 100644 index 00000000..28fdeff8 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_91xznbvu/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlManageSecurityIssues" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_91xznbvu/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_91xznbvu/index.json new file mode 100644 index 00000000..73a6922f --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_91xznbvu/index.json @@ -0,0 +1,16 @@ +{ + "title": "Manage security issues", + "cardType": "ismsa/cardTypes/internalControl", + "workflowState": "In scope", + "rank": "0|c", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "3months", + "base/fieldTypes/reviewMonth": "february", + "base/fieldTypes/adoptionStep": "step1", + "base/fieldTypes/identifier": "secdeva_control_manage-defects", + "links": [], + "lastUpdated": "2026-08-26T11:18:47.299Z", + "templateCardKey": "secdeva_0sv2tx7l", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastTransitioned": "2026-08-26T11:18:47.299Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_ai33cmpp/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_ai33cmpp/index.adoc new file mode 100644 index 00000000..69feacc7 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_ai33cmpp/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlUseStaticCodeAnalysis" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_ai33cmpp/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_ai33cmpp/index.json new file mode 100644 index 00000000..cb0edeeb --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_ai33cmpp/index.json @@ -0,0 +1,15 @@ +{ + "cardType": "ismsa/cardTypes/internalControl", + "title": "Use static code analysis", + "workflowState": "Open", + "rank": "0|a", + "lastUpdated": "2026-08-26T11:18:46.283Z", + "links": [], + "base/fieldTypes/adoptionStep": "step1", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "august", + "base/fieldTypes/identifier": "secdeva_control_static-code-analysis", + "templateCardKey": "secdeva_c0wtj0ci", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_o5yr6dlf/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_o5yr6dlf/index.adoc new file mode 100644 index 00000000..893e7e36 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_o5yr6dlf/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlReviewCodeChangesManually" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_o5yr6dlf/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_o5yr6dlf/index.json new file mode 100644 index 00000000..404ef885 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_o5yr6dlf/index.json @@ -0,0 +1,15 @@ +{ + "cardType": "ismsa/cardTypes/internalControl", + "title": "Review code changes manually", + "workflowState": "Open", + "rank": "0|b", + "lastUpdated": "2026-08-26T11:18:46.283Z", + "links": [], + "base/fieldTypes/adoptionStep": "step2", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "september", + "base/fieldTypes/identifier": "secdeva_control_manual-code-review", + "templateCardKey": "secdeva_iotqroii", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_p2vbpn80/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_p2vbpn80/index.adoc new file mode 100644 index 00000000..e67c4524 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_p2vbpn80/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlReviewProductDocumentation" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_p2vbpn80/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_p2vbpn80/index.json new file mode 100644 index 00000000..7582eb93 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_p2vbpn80/index.json @@ -0,0 +1,15 @@ +{ + "title": "Review product documentation", + "cardType": "ismsa/cardTypes/internalControl", + "workflowState": "Open", + "rank": "0|e", + "base/fieldTypes/informationClassification": "internal", + "base/fieldTypes/adoptionStep": "step2", + "base/fieldTypes/identifier": "secdeva_control_product-documentation-review", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "may", + "lastUpdated": "2026-08-26T11:18:46.283Z", + "links": [], + "templateCardKey": "secdeva_m6kd6mou", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_xin8io6g/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_xin8io6g/index.adoc new file mode 100644 index 00000000..c1a4a3e3 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_xin8io6g/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlDocumentAttackSurface" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_xin8io6g/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_xin8io6g/index.json new file mode 100644 index 00000000..75c23438 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/c/secdeva_xin8io6g/index.json @@ -0,0 +1,15 @@ +{ + "title": "Document attack surface", + "cardType": "ismsa/cardTypes/internalControl", + "workflowState": "Open", + "rank": "0|d", + "base/fieldTypes/informationClassification": "internal", + "base/fieldTypes/adoptionStep": "step2", + "base/fieldTypes/identifier": "secdeva_control_document-attack-surface", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "april", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "templateCardKey": "secdeva_2e87et35", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/index.adoc new file mode 100644 index 00000000..fe21f52a --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerImplementationControls" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/index.json new file mode 100644 index 00000000..12c9f061 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_5qxk3l13/index.json @@ -0,0 +1,14 @@ +{ + "title": "Implementation", + "cardType": "ismsa/cardTypes/register", + "workflowState": "Draft", + "rank": "0|d", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/adoptionStep": "step1", + "ismsa/fieldTypes/progress": "secdeva_internal-control-progress", + "base/fieldTypes/identifier": "secdeva_register_implementation-controls", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "templateCardKey": "secdeva_4who01zn", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_3ku5vmxu/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_3ku5vmxu/index.adoc new file mode 100644 index 00000000..2bdcea72 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_3ku5vmxu/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlAnalyseTheAttackSurface" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_3ku5vmxu/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_3ku5vmxu/index.json new file mode 100644 index 00000000..3e428dfb --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_3ku5vmxu/index.json @@ -0,0 +1,16 @@ +{ + "title": "Analyse the attack surface", + "cardType": "ismsa/cardTypes/internalControl", + "workflowState": "In scope", + "rank": "0|f", + "base/fieldTypes/informationClassification": "internal", + "base/fieldTypes/adoptionStep": "step2", + "base/fieldTypes/identifier": "secdeva_control_attack-surface-analysis", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "september", + "lastUpdated": "2026-08-26T11:18:47.675Z", + "links": [], + "templateCardKey": "secdeva_0dgfj5bb", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastTransitioned": "2026-08-26T11:18:47.675Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_60ap7iyl/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_60ap7iyl/index.adoc new file mode 100644 index 00000000..450a3606 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_60ap7iyl/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlPerformPenetrationTesting" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_60ap7iyl/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_60ap7iyl/index.json new file mode 100644 index 00000000..ac8b4f6e --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_60ap7iyl/index.json @@ -0,0 +1,15 @@ +{ + "title": "Perform penetration testing", + "cardType": "ismsa/cardTypes/internalControl", + "workflowState": "Open", + "rank": "0|g", + "base/fieldTypes/informationClassification": "internal", + "base/fieldTypes/adoptionStep": "step2", + "base/fieldTypes/identifier": "secdeva_control_penetration-testing", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "october", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "templateCardKey": "secdeva_batir02o", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_696d6b2d/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_696d6b2d/index.adoc new file mode 100644 index 00000000..94d1f3c1 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_696d6b2d/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlTestRiskMitigations" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_696d6b2d/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_696d6b2d/index.json new file mode 100644 index 00000000..cc965030 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_696d6b2d/index.json @@ -0,0 +1,15 @@ +{ + "cardType": "ismsa/cardTypes/internalControl", + "title": "Test risk mitigations", + "workflowState": "Open", + "rank": "0|bn", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "base/fieldTypes/adoptionStep": "step2", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "november", + "base/fieldTypes/identifier": "secdeva_control_risk-mitigation-testing", + "templateCardKey": "secdeva_b7tayct7", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_6wlqpdxa/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_6wlqpdxa/index.adoc new file mode 100644 index 00000000..93107032 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_6wlqpdxa/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlScanForKnownVulnerabilities" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_6wlqpdxa/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_6wlqpdxa/index.json new file mode 100644 index 00000000..76260d90 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_6wlqpdxa/index.json @@ -0,0 +1,15 @@ +{ + "cardType": "ismsa/cardTypes/internalControl", + "title": "Scan for known vulnerabilities", + "workflowState": "Open", + "rank": "0|e", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "base/fieldTypes/adoptionStep": "step1", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "october", + "base/fieldTypes/identifier": "secdeva_control_known-vulnerability-scanning", + "templateCardKey": "secdeva_6ivlxb6t", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_749bw2cr/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_749bw2cr/index.adoc new file mode 100644 index 00000000..27b5f89d --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_749bw2cr/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlTestErrorHandling" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_749bw2cr/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_749bw2cr/index.json new file mode 100644 index 00000000..6ddd3b6a --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_749bw2cr/index.json @@ -0,0 +1,15 @@ +{ + "title": "Test error handling", + "cardType": "ismsa/cardTypes/internalControl", + "workflowState": "In scope", + "rank": "0|d", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/adoptionStep": "step2", + "base/fieldTypes/identifier": "secdeva_control_error-handling-testing", + "links": [], + "lastUpdated": "2026-08-26T11:18:47.550Z", + "templateCardKey": "secdeva_uovbyi17", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastTransitioned": "2026-08-26T11:18:47.550Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_rno8sejy/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_rno8sejy/index.adoc new file mode 100644 index 00000000..99af393b --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_rno8sejy/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlTestInputValidation" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_rno8sejy/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_rno8sejy/index.json new file mode 100644 index 00000000..4244437b --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_rno8sejy/index.json @@ -0,0 +1,16 @@ +{ + "cardType": "ismsa/cardTypes/internalControl", + "title": "Test input validation", + "workflowState": "In scope", + "rank": "0|c", + "lastUpdated": "2026-08-26T11:18:47.423Z", + "links": [], + "base/fieldTypes/adoptionStep": "step2", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "may", + "base/fieldTypes/identifier": "secdeva_control_basic-input-validation-testing", + "templateCardKey": "secdeva_hm5obl63", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastTransitioned": "2026-08-26T11:18:47.423Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_zrm731lr/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_zrm731lr/index.adoc new file mode 100644 index 00000000..925fbf37 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_zrm731lr/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlTestSecurityRequirements" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_zrm731lr/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_zrm731lr/index.json new file mode 100644 index 00000000..4087d52e --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/c/secdeva_zrm731lr/index.json @@ -0,0 +1,15 @@ +{ + "cardType": "ismsa/cardTypes/internalControl", + "title": "Test security requirements", + "workflowState": "Open", + "rank": "0|b", + "lastUpdated": "2026-08-26T11:18:46.283Z", + "links": [], + "base/fieldTypes/adoptionStep": "step2", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "october", + "base/fieldTypes/identifier": "secdeva_control_security-requirement-testing", + "templateCardKey": "secdeva_9zof7p4q", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/index.adoc new file mode 100644 index 00000000..f39f8eda --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerVerificationControls" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/index.json new file mode 100644 index 00000000..aa3dca5f --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_9q8ozv8y/index.json @@ -0,0 +1,14 @@ +{ + "title": "Verification", + "cardType": "ismsa/cardTypes/register", + "workflowState": "Draft", + "rank": "0|e", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/adoptionStep": "step1", + "ismsa/fieldTypes/progress": "secdeva_internal-control-progress", + "base/fieldTypes/identifier": "secdeva_register_verification-controls", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "templateCardKey": "secdeva_yxsgdfh8", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/c/secdeva_3m4t8iyd/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/c/secdeva_3m4t8iyd/index.adoc new file mode 100644 index 00000000..a38de1c5 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/c/secdeva_3m4t8iyd/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlEnsureCompetence" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/c/secdeva_3m4t8iyd/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/c/secdeva_3m4t8iyd/index.json new file mode 100644 index 00000000..57aac2a7 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/c/secdeva_3m4t8iyd/index.json @@ -0,0 +1,15 @@ +{ + "cardType": "ismsa/cardTypes/internalControl", + "title": "Ensure competence", + "workflowState": "Open", + "rank": "0|c", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "base/fieldTypes/adoptionStep": "step1", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "february", + "base/fieldTypes/identifier": "secdeva_control_ensure-competence", + "templateCardKey": "secdeva_318az0br", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/c/secdeva_9fs8u83g/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/c/secdeva_9fs8u83g/index.adoc new file mode 100644 index 00000000..dda9c7b0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/c/secdeva_9fs8u83g/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlAssignPeopleToSecurityRelatedProjectRoles" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/c/secdeva_9fs8u83g/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/c/secdeva_9fs8u83g/index.json new file mode 100644 index 00000000..f4460a76 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/c/secdeva_9fs8u83g/index.json @@ -0,0 +1,16 @@ +{ + "cardType": "ismsa/cardTypes/internalControl", + "title": "Assign people to security-related project roles", + "workflowState": "In scope", + "rank": "0|b", + "lastUpdated": "2026-08-26T11:18:46.422Z", + "links": [], + "base/fieldTypes/adoptionStep": "step1", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "january", + "base/fieldTypes/identifier": "secdeva_control_assign-people-to-project-roles", + "templateCardKey": "secdeva_74ocw13t", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastTransitioned": "2026-08-26T11:18:46.422Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/index.adoc new file mode 100644 index 00000000..a03926a5 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerFoundationControls" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/index.json new file mode 100644 index 00000000..5ff9fc70 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_h776viev/index.json @@ -0,0 +1,14 @@ +{ + "title": "Foundation", + "cardType": "ismsa/cardTypes/register", + "workflowState": "Draft", + "rank": "0|b", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/adoptionStep": "step1", + "ismsa/fieldTypes/progress": "secdeva_internal-control-progress", + "base/fieldTypes/identifier": "secdeva_register_foundation-controls", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "templateCardKey": "secdeva_kbf7dl7e", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_mcvabbs1/c/secdeva_m688wmtu/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_mcvabbs1/c/secdeva_m688wmtu/index.adoc new file mode 100644 index 00000000..6f9a64b4 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_mcvabbs1/c/secdeva_m688wmtu/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlProtectTheIntegrityOfReleases" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_mcvabbs1/c/secdeva_m688wmtu/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_mcvabbs1/c/secdeva_m688wmtu/index.json new file mode 100644 index 00000000..d77bcbf1 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_mcvabbs1/c/secdeva_m688wmtu/index.json @@ -0,0 +1,15 @@ +{ + "title": "Protect the integrity of releases", + "cardType": "ismsa/cardTypes/internalControl", + "workflowState": "Open", + "rank": "0|f", + "base/fieldTypes/informationClassification": "internal", + "base/fieldTypes/adoptionStep": "step2", + "base/fieldTypes/identifier": "secdeva_control_integrity-protection-of-release", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "june", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "templateCardKey": "secdeva_8nil3vzn", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_mcvabbs1/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_mcvabbs1/index.adoc new file mode 100644 index 00000000..f354c104 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_mcvabbs1/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerReleasesControls" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_mcvabbs1/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_mcvabbs1/index.json new file mode 100644 index 00000000..570866dc --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_mcvabbs1/index.json @@ -0,0 +1,14 @@ +{ + "title": "Releases", + "cardType": "ismsa/cardTypes/register", + "workflowState": "Draft", + "rank": "0|ef", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/adoptionStep": "step1", + "ismsa/fieldTypes/progress": "secdeva_internal-control-progress", + "base/fieldTypes/identifier": "secdeva_register_releases-controls", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "templateCardKey": "secdeva_9rlz4k7p", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_25484x5o/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_25484x5o/index.adoc new file mode 100644 index 00000000..60c22b8d --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_25484x5o/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlManageThreatModels" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_25484x5o/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_25484x5o/index.json new file mode 100644 index 00000000..e04eed61 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_25484x5o/index.json @@ -0,0 +1,15 @@ +{ + "cardType": "ismsa/cardTypes/internalControl", + "title": "Manage threat models", + "workflowState": "In scope", + "rank": "0|at", + "lastUpdated": "2026-08-26T11:18:46.674Z", + "links": [], + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "march", + "base/fieldTypes/identifier": "secdeva_control_threat-models", + "templateCardKey": "secdeva_jz9kgg44", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastTransitioned": "2026-08-26T11:18:46.674Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_8mzmtptl/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_8mzmtptl/index.adoc new file mode 100644 index 00000000..12d5a3b9 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_8mzmtptl/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlManage3rdPartyTechnologies" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_8mzmtptl/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_8mzmtptl/index.json new file mode 100644 index 00000000..c49aec6c --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_8mzmtptl/index.json @@ -0,0 +1,16 @@ +{ + "cardType": "ismsa/cardTypes/internalControl", + "title": "Manage third-party technologies", + "workflowState": "In scope", + "rank": "0|f", + "lastUpdated": "2026-08-26T11:18:47.051Z", + "links": [], + "base/fieldTypes/adoptionStep": "step1", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "march", + "base/fieldTypes/identifier": "secdeva_control_3rd-party-technologies", + "templateCardKey": "secdeva_k5ny25qj", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastTransitioned": "2026-08-26T11:18:47.051Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_bopqogvo/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_bopqogvo/index.adoc new file mode 100644 index 00000000..b5dd35d4 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_bopqogvo/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlReviewPrivacyByDesign" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_bopqogvo/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_bopqogvo/index.json new file mode 100644 index 00000000..9bcd7388 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_bopqogvo/index.json @@ -0,0 +1,15 @@ +{ + "title": "Review privacy by design", + "cardType": "ismsa/cardTypes/internalControl", + "workflowState": "Open", + "rank": "0|gi", + "base/fieldTypes/informationClassification": "internal", + "base/fieldTypes/adoptionStep": "step2", + "base/fieldTypes/identifier": "secdeva_control_privacy-by-design-review", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "march", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "templateCardKey": "secdeva_09qgkqs7", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_hrswgtq5/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_hrswgtq5/index.adoc new file mode 100644 index 00000000..3f0b854b --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_hrswgtq5/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlUseCryptographyProperlyAndEffectively" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_hrswgtq5/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_hrswgtq5/index.json new file mode 100644 index 00000000..1d9d449e --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_hrswgtq5/index.json @@ -0,0 +1,14 @@ +{ + "title": "Use cryptography properly and effectively", + "cardType": "ismsa/cardTypes/internalControl", + "workflowState": "Open", + "rank": "0|g", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/adoptionStep": "step2", + "base/fieldTypes/identifier": "secdeva_control_use-of-cryptography", + "links": [], + "lastUpdated": "2026-08-26T11:18:46.282Z", + "templateCardKey": "secdeva_mrpww21s", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_or87l2wr/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_or87l2wr/index.adoc new file mode 100644 index 00000000..a694dd75 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_or87l2wr/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlWriteSecurityRequirements" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_or87l2wr/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_or87l2wr/index.json new file mode 100644 index 00000000..85b60239 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_or87l2wr/index.json @@ -0,0 +1,14 @@ +{ + "cardType": "ismsa/cardTypes/internalControl", + "title": "Write security requirements", + "workflowState": "Open", + "rank": "0|e", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "may", + "base/fieldTypes/identifier": "secdeva_control_security-requirements", + "templateCardKey": "secdeva_6sqftr3m", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_ov9kzuld/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_ov9kzuld/index.adoc new file mode 100644 index 00000000..e42c3148 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_ov9kzuld/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlScopeSecureDevelopmentActivities" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_ov9kzuld/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_ov9kzuld/index.json new file mode 100644 index 00000000..f5e4f9ab --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_ov9kzuld/index.json @@ -0,0 +1,14 @@ +{ + "title": "Scope secure development activities", + "cardType": "ismsa/cardTypes/internalControl", + "workflowState": "In scope", + "rank": "0|en", + "base/fieldTypes/informationClassification": "internal", + "base/fieldTypes/adoptionStep": "step1", + "base/fieldTypes/identifier": "secdeva_control_scope-secure-development-activities", + "lastUpdated": "2026-08-26T11:18:46.924Z", + "links": [], + "templateCardKey": "secdeva_8mbuiznr", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastTransitioned": "2026-08-26T11:18:46.924Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_ttd36u43/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_ttd36u43/index.adoc new file mode 100644 index 00000000..4d986f08 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_ttd36u43/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlManageHighLevelRisks" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_ttd36u43/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_ttd36u43/index.json new file mode 100644 index 00000000..a7a2e985 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_ttd36u43/index.json @@ -0,0 +1,15 @@ +{ + "title": "Manage high-level risks", + "cardType": "ismsa/cardTypes/internalControl", + "workflowState": "In scope", + "rank": "0|b", + "base/fieldTypes/informationClassification": "internal", + "base/fieldTypes/identifier": "secdeva_control_high-level-risks", + "ismsa/fieldTypes/internalControlReviewPeriod": "3months", + "base/fieldTypes/reviewMonth": "january", + "links": [], + "lastUpdated": "2026-08-26T11:18:46.800Z", + "templateCardKey": "secdeva_3ijcq55f", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastTransitioned": "2026-08-26T11:18:46.800Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_v8flkwl4/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_v8flkwl4/index.adoc new file mode 100644 index 00000000..c8106c8b --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_v8flkwl4/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlEnsureSecureDevelopmentInSubprojects" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_v8flkwl4/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_v8flkwl4/index.json new file mode 100644 index 00000000..913ac54b --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_v8flkwl4/index.json @@ -0,0 +1,15 @@ +{ + "cardType": "ismsa/cardTypes/internalControl", + "title": "Ensure secure development in subprojects", + "workflowState": "Open", + "rank": "0|gj", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "base/fieldTypes/adoptionStep": "step2", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "june", + "base/fieldTypes/identifier": "secdeva_control_subprojects", + "templateCardKey": "secdeva_aw7rt8ow", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_vldm3c4z/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_vldm3c4z/index.adoc new file mode 100644 index 00000000..0f7c0c9e --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_vldm3c4z/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlDocumentProductSecurityContext" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_vldm3c4z/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_vldm3c4z/index.json new file mode 100644 index 00000000..b2fea4fc --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_vldm3c4z/index.json @@ -0,0 +1,15 @@ +{ + "cardType": "ismsa/cardTypes/internalControl", + "title": "Document product security context", + "workflowState": "In scope", + "rank": "0|an", + "lastUpdated": "2026-08-26T11:18:46.548Z", + "links": [], + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "april", + "base/fieldTypes/identifier": "secdeva_control_security-context", + "templateCardKey": "secdeva_1l2bv8k8", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastTransitioned": "2026-08-26T11:18:46.548Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_zwaua4ku/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_zwaua4ku/index.adoc new file mode 100644 index 00000000..92cbac46 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_zwaua4ku/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlReviewSecurityDesign" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_zwaua4ku/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_zwaua4ku/index.json new file mode 100644 index 00000000..9d333c8f --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/c/secdeva_zwaua4ku/index.json @@ -0,0 +1,16 @@ +{ + "title": "Review security design", + "cardType": "ismsa/cardTypes/internalControl", + "workflowState": "In scope", + "rank": "0|gh", + "base/fieldTypes/informationClassification": "internal", + "base/fieldTypes/adoptionStep": "step2", + "base/fieldTypes/identifier": "secdeva_control_security-design-review", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "february", + "lastUpdated": "2026-08-26T11:18:47.174Z", + "links": [], + "templateCardKey": "secdeva_2b7juhs8", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastTransitioned": "2026-08-26T11:18:47.174Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/index.adoc new file mode 100644 index 00000000..2f4675e2 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerDesignControls" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/index.json new file mode 100644 index 00000000..486cfb45 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_ovg9ck61/index.json @@ -0,0 +1,13 @@ +{ + "title": "Design", + "cardType": "ismsa/cardTypes/register", + "workflowState": "Draft", + "rank": "0|c", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/progress": "secdeva_internal-control-progress", + "base/fieldTypes/identifier": "secdeva_register_design-controls", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "templateCardKey": "secdeva_uyuvsxoo", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_7uwaqw5f/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_7uwaqw5f/index.adoc new file mode 100644 index 00000000..87289399 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_7uwaqw5f/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlManage3rdPartySoftwareUpdates" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_7uwaqw5f/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_7uwaqw5f/index.json new file mode 100644 index 00000000..25ec8b62 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_7uwaqw5f/index.json @@ -0,0 +1,15 @@ +{ + "cardType": "ismsa/cardTypes/internalControl", + "title": "Manage third-party software updates", + "workflowState": "Open", + "rank": "0|b", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "base/fieldTypes/adoptionStep": "step1", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "august", + "base/fieldTypes/identifier": "secdeva_control_software-update-management", + "templateCardKey": "secdeva_ryzudq5d", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_ipknmhut/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_ipknmhut/index.adoc new file mode 100644 index 00000000..5481603d --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_ipknmhut/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlManage3rdPartyVulnerabilities" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_ipknmhut/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_ipknmhut/index.json new file mode 100644 index 00000000..c1fc32e9 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_ipknmhut/index.json @@ -0,0 +1,16 @@ +{ + "cardType": "ismsa/cardTypes/internalControl", + "title": "Manage third-party vulnerabilities", + "workflowState": "In scope", + "rank": "0|a", + "lastUpdated": "2026-08-26T11:18:47.798Z", + "links": [], + "base/fieldTypes/adoptionStep": "step1", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "3months", + "base/fieldTypes/reviewMonth": "march", + "base/fieldTypes/identifier": "secdeva_control_vulnerability-management", + "templateCardKey": "secdeva_uv49qtxh", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastTransitioned": "2026-08-26T11:18:47.798Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_sedo5106/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_sedo5106/index.adoc new file mode 100644 index 00000000..72edfbb3 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_sedo5106/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/controlProtectEnvironments" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_sedo5106/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_sedo5106/index.json new file mode 100644 index 00000000..cbd7a3ed --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/c/secdeva_sedo5106/index.json @@ -0,0 +1,16 @@ +{ + "title": "Protect environments", + "cardType": "ismsa/cardTypes/internalControl", + "workflowState": "In scope", + "rank": "0|c", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/internalControlReviewPeriod": "12months", + "base/fieldTypes/reviewMonth": "october", + "base/fieldTypes/adoptionStep": "step2", + "base/fieldTypes/identifier": "secdeva_control_protect-environments", + "links": [], + "lastUpdated": "2026-08-26T11:18:47.923Z", + "templateCardKey": "secdeva_xzveu9b2", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastTransitioned": "2026-08-26T11:18:47.923Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/index.adoc new file mode 100644 index 00000000..e461971e --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerOperationsControls" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/index.json new file mode 100644 index 00000000..6e9e1595 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/c/secdeva_sze2zx9x/index.json @@ -0,0 +1,14 @@ +{ + "title": "Operations", + "cardType": "ismsa/cardTypes/register", + "workflowState": "Draft", + "rank": "0|f", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/adoptionStep": "step1", + "ismsa/fieldTypes/progress": "secdeva_internal-control-progress", + "base/fieldTypes/identifier": "secdeva_register_operations-controls", + "lastUpdated": "2026-08-26T11:18:46.282Z", + "links": [], + "templateCardKey": "secdeva_o49jcxhb", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/index.adoc new file mode 100644 index 00000000..755a7a19 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerInternalControls" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/index.json new file mode 100644 index 00000000..70bad6e2 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_16h66z1o/index.json @@ -0,0 +1,13 @@ +{ + "title": "Internal controls", + "cardType": "secdeva/cardTypes/register", + "workflowState": "None", + "rank": "0|eo", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/progress": "secdeva_internal-control-progress", + "base/fieldTypes/identifier": "secdeva_register_internal-controls", + "lastUpdated": "2026-08-26T11:18:46.281Z", + "links": [], + "templateCardKey": "secdeva_mg2ld1fl", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_5jgsdk5d/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_5jgsdk5d/index.adoc new file mode 100644 index 00000000..3bbd180b --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_5jgsdk5d/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerDecisions" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_5jgsdk5d/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_5jgsdk5d/index.json new file mode 100644 index 00000000..be887b52 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_5jgsdk5d/index.json @@ -0,0 +1,12 @@ +{ + "title": "Decisions", + "cardType": "secdeva/cardTypes/register", + "workflowState": "None", + "rank": "0|en", + "base/fieldTypes/informationClassification": "internal", + "base/fieldTypes/identifier": "secdeva_register_decisions", + "lastUpdated": "2026-08-26T11:18:46.281Z", + "links": [], + "templateCardKey": "secdeva_uwdq507z", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_6ulth98i/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_6ulth98i/index.adoc new file mode 100644 index 00000000..e991eb36 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_6ulth98i/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerSecurityIssues" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_6ulth98i/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_6ulth98i/index.json new file mode 100644 index 00000000..b92df997 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_6ulth98i/index.json @@ -0,0 +1,11 @@ +{ + "title": "Security issues", + "cardType": "secdeva/cardTypes/securityIssueRegister", + "workflowState": "None", + "rank": "0|bw", + "lastUpdated": "2026-08-26T11:18:46.281Z", + "links": [], + "base/fieldTypes/identifier": "secdeva_register_security-issues", + "templateCardKey": "secdeva_0tzf7su5", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_8hdqvgc8/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_8hdqvgc8/index.adoc new file mode 100644 index 00000000..e51610c4 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_8hdqvgc8/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerRisks" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_8hdqvgc8/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_8hdqvgc8/index.json new file mode 100644 index 00000000..829b20f8 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_8hdqvgc8/index.json @@ -0,0 +1,13 @@ +{ + "title": "Risks", + "cardType": "secdeva/cardTypes/riskRegister", + "workflowState": "None", + "rank": "0|bn", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/acceptableRiskLevel": "low", + "base/fieldTypes/identifier": "secdeva_register_risks", + "lastUpdated": "2026-08-26T11:18:46.281Z", + "links": [], + "templateCardKey": "secdeva_266nlbuz", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_ijfd396f/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_ijfd396f/index.adoc new file mode 100644 index 00000000..be0b3794 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_ijfd396f/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerAssets" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_ijfd396f/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_ijfd396f/index.json new file mode 100644 index 00000000..8aa4d437 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_ijfd396f/index.json @@ -0,0 +1,13 @@ +{ + "title": "Assets", + "cardType": "secdeva/cardTypes/register", + "workflowState": "None", + "rank": "0|b", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/progress": "asset-progress", + "base/fieldTypes/identifier": "secdeva_register_assets", + "lastUpdated": "2026-08-26T11:18:46.281Z", + "links": [], + "templateCardKey": "secdeva_02tv3hbo", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_ky13uhsz/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_ky13uhsz/index.adoc new file mode 100644 index 00000000..abff2ce0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_ky13uhsz/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerComplianceControls" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_ky13uhsz/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_ky13uhsz/index.json new file mode 100644 index 00000000..8fbfbe7b --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_ky13uhsz/index.json @@ -0,0 +1,13 @@ +{ + "title": "Compliance controls", + "cardType": "secdeva/cardTypes/register", + "workflowState": "None", + "rank": "0|d", + "base/fieldTypes/informationClassification": "internal", + "ismsa/fieldTypes/progress": "compliance-progress", + "base/fieldTypes/identifier": "secdeva_register_compliance-controls", + "lastUpdated": "2026-08-26T11:18:46.281Z", + "links": [], + "templateCardKey": "secdeva_4ltajgyn", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_3pff2j49/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_3pff2j49/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_3pff2j49/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_3pff2j49/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_3pff2j49/index.json new file mode 100644 index 00000000..2c62c205 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_3pff2j49/index.json @@ -0,0 +1,15 @@ +{ + "title": "TC18 Negative: complete active own product", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Active", + "rank": "0|f", + "links": [], + "secdeva/fieldTypes/productOrigin": "own", + "lastUpdated": "2026-08-26T11:26:14.667Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:19:16.804Z", + "base/fieldTypes/identifier": "secdeva_test_ss_active_complete_own", + "secdeva/fieldTypes/deliveryModel": "weDevelopAndDeliver", + "base/fieldTypes/informationClassification": "internal", + "lastTransitioned": "2026-08-26T11:19:20.486Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_7lzviey5/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_7lzviey5/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_7lzviey5/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_7lzviey5/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_7lzviey5/index.json new file mode 100644 index 00000000..570d9640 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_7lzviey5/index.json @@ -0,0 +1,13 @@ +{ + "title": "TC00 Umbrella: own product we develop and deliver", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|a", + "links": [], + "secdeva/fieldTypes/productOrigin": "own", + "lastUpdated": "2026-08-26T11:25:57.792Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:00.093Z", + "base/fieldTypes/identifier": "secdeva_test_ss_umbrella", + "secdeva/fieldTypes/deliveryModel": "weDevelopAndDeliver" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_f6s7z59r/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_f6s7z59r/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_f6s7z59r/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_f6s7z59r/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_f6s7z59r/index.json new file mode 100644 index 00000000..f31760d0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_f6s7z59r/index.json @@ -0,0 +1,13 @@ +{ + "title": "TC01 Own product operated as a service", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|b", + "links": [], + "secdeva/fieldTypes/productOrigin": "own", + "lastUpdated": "2026-08-26T11:25:58.677Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:01.403Z", + "base/fieldTypes/identifier": "secdeva_test_ss_own_operated", + "secdeva/fieldTypes/deliveryModel": "weOperateAsService" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_gm0p6ahf/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_gm0p6ahf/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_gm0p6ahf/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_gm0p6ahf/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_gm0p6ahf/index.json new file mode 100644 index 00000000..6f0fa9db --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_gm0p6ahf/index.json @@ -0,0 +1,14 @@ +{ + "title": "TC17 Active own product with no delivery model", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Active", + "rank": "0|e", + "links": [], + "secdeva/fieldTypes/productOrigin": "own", + "lastUpdated": "2026-08-26T11:26:13.741Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:19:15.909Z", + "base/fieldTypes/identifier": "secdeva_test_ss_active_nodelivery", + "base/fieldTypes/informationClassification": "internal", + "lastTransitioned": "2026-08-26T11:19:19.571Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_qnu1qapl/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_qnu1qapl/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_qnu1qapl/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_qnu1qapl/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_qnu1qapl/index.json new file mode 100644 index 00000000..954c1805 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_qnu1qapl/index.json @@ -0,0 +1,12 @@ +{ + "title": "TC02 Own product with no delivery model", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|c", + "links": [], + "secdeva/fieldTypes/productOrigin": "own", + "lastUpdated": "2026-08-26T11:25:59.576Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:02.689Z", + "base/fieldTypes/identifier": "secdeva_test_ss_own_nodelivery" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_zfhvp2ox/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_zfhvp2ox/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_zfhvp2ox/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_zfhvp2ox/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_zfhvp2ox/index.json new file mode 100644 index 00000000..6d368396 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/c/secdeva_zfhvp2ox/index.json @@ -0,0 +1,18 @@ +{ + "title": "TC15 Negative: our product installed on a consumed service", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|d", + "links": [ + { + "linkType": "secdeva/linkTypes/installedOn", + "cardKey": "secdeva_z55msicw" + } + ], + "secdeva/fieldTypes/productOrigin": "own", + "lastUpdated": "2026-08-26T11:26:11.857Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:19.404Z", + "base/fieldTypes/identifier": "secdeva_test_ss_neg_installed_on_consumed", + "secdeva/fieldTypes/deliveryModel": "weOperateAsService" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/index.adoc new file mode 100644 index 00000000..cd19256f --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/productStructure" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/index.json new file mode 100644 index 00000000..4899a575 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_htb7rlfe/index.json @@ -0,0 +1,11 @@ +{ + "title": "Own products", + "cardType": "secdeva/cardTypes/register", + "workflowState": "None", + "rank": "0|a", + "base/fieldTypes/identifier": "secdeva_group_own-products", + "links": [], + "templateCardKey": "secdeva_solstruct2", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastUpdated": "2026-08-26T11:18:46.281Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_1c5opt9p/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_1c5opt9p/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_1c5opt9p/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_1c5opt9p/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_1c5opt9p/index.json new file mode 100644 index 00000000..32a3c321 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_1c5opt9p/index.json @@ -0,0 +1,19 @@ +{ + "title": "TC12 Contradiction: consumed service installed on a platform", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|j", + "links": [ + { + "linkType": "secdeva/linkTypes/installedOn", + "cardKey": "secdeva_7lzviey5" + } + ], + "secdeva/fieldTypes/productOrigin": "thirdPartyCommercial", + "lastUpdated": "2026-08-26T11:26:08.983Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:15.562Z", + "base/fieldTypes/identifier": "secdeva_test_ss_bad_consumed_installed", + "secdeva/fieldTypes/deliveryModel": "weConsumeAsService", + "secdeva/fieldTypes/productVendor": "Example Vendor Ltd" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_2viyvvw1/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_2viyvvw1/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_2viyvvw1/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_2viyvvw1/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_2viyvvw1/index.json new file mode 100644 index 00000000..d5fefafd --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_2viyvvw1/index.json @@ -0,0 +1,19 @@ +{ + "title": "TC10 Contradiction: customer-provided built-in component", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|h", + "links": [ + { + "linkType": "secdeva/linkTypes/defaultComponentOf", + "cardKey": "secdeva_7lzviey5" + } + ], + "secdeva/fieldTypes/productOrigin": "thirdPartyCommercial", + "lastUpdated": "2026-08-26T11:26:07.101Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:12.979Z", + "base/fieldTypes/identifier": "secdeva_test_ss_bad_customer_builtin", + "secdeva/fieldTypes/deliveryModel": "customerProvides", + "secdeva/fieldTypes/productVendor": "Example Vendor Ltd" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_3c7y3ldd/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_3c7y3ldd/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_3c7y3ldd/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_3c7y3ldd/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_3c7y3ldd/index.json new file mode 100644 index 00000000..5b7ee3c1 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_3c7y3ldd/index.json @@ -0,0 +1,19 @@ +{ + "title": "TC13 Contradiction: third-party product we develop ourselves", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|k", + "links": [ + { + "linkType": "secdeva/linkTypes/externalComponentOf", + "cardKey": "secdeva_7lzviey5" + } + ], + "secdeva/fieldTypes/productOrigin": "thirdPartyCommercial", + "lastUpdated": "2026-08-26T11:26:09.956Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:16.827Z", + "base/fieldTypes/identifier": "secdeva_test_ss_bad_thirdparty_developed", + "secdeva/fieldTypes/deliveryModel": "weDevelopAndDeliver", + "secdeva/fieldTypes/productVendor": "Example Vendor Ltd" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_4uh3g8fx/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_4uh3g8fx/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_4uh3g8fx/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_4uh3g8fx/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_4uh3g8fx/index.json new file mode 100644 index 00000000..3d4a64ac --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_4uh3g8fx/index.json @@ -0,0 +1,19 @@ +{ + "title": "TC04 Third-party product we import and deliver", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|b", + "links": [ + { + "linkType": "secdeva/linkTypes/externalComponentOf", + "cardKey": "secdeva_7lzviey5" + } + ], + "secdeva/fieldTypes/productOrigin": "thirdPartyCommercial", + "lastUpdated": "2026-08-26T11:26:01.449Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:05.286Z", + "base/fieldTypes/identifier": "secdeva_test_ss_imported", + "secdeva/fieldTypes/deliveryModel": "weImportAndDeliver", + "secdeva/fieldTypes/productVendor": "Example Vendor Ltd" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_760cn1b9/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_760cn1b9/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_760cn1b9/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_760cn1b9/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_760cn1b9/index.json new file mode 100644 index 00000000..da6c6858 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_760cn1b9/index.json @@ -0,0 +1,19 @@ +{ + "title": "TC07 Third-party product the customer provides", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|e", + "links": [ + { + "linkType": "secdeva/linkTypes/externalComponentOf", + "cardKey": "secdeva_7lzviey5" + } + ], + "secdeva/fieldTypes/productOrigin": "thirdPartyCommercial", + "lastUpdated": "2026-08-26T11:26:04.298Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:09.116Z", + "base/fieldTypes/identifier": "secdeva_test_ss_customer", + "secdeva/fieldTypes/deliveryModel": "customerProvides", + "secdeva/fieldTypes/productVendor": "Example Vendor Ltd" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_7ysv6b36/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_7ysv6b36/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_7ysv6b36/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_7ysv6b36/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_7ysv6b36/index.json new file mode 100644 index 00000000..5265765f --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_7ysv6b36/index.json @@ -0,0 +1,12 @@ +{ + "title": "TC16 Active product with nothing filled in", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Active", + "rank": "0|m", + "links": [], + "lastUpdated": "2026-08-26T11:26:12.808Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:19:15.044Z", + "base/fieldTypes/identifier": "secdeva_test_ss_active_bare", + "lastTransitioned": "2026-08-26T11:19:18.654Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_bctnjvg0/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_bctnjvg0/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_bctnjvg0/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_bctnjvg0/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_bctnjvg0/index.json new file mode 100644 index 00000000..a6042362 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_bctnjvg0/index.json @@ -0,0 +1,19 @@ +{ + "title": "TC14 Negative: operated service as a built-in component", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|l", + "links": [ + { + "linkType": "secdeva/linkTypes/defaultComponentOf", + "cardKey": "secdeva_7lzviey5" + } + ], + "secdeva/fieldTypes/productOrigin": "thirdPartyCommercial", + "lastUpdated": "2026-08-26T11:26:10.923Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:18.125Z", + "base/fieldTypes/identifier": "secdeva_test_ss_neg_operated_builtin", + "secdeva/fieldTypes/deliveryModel": "weOperateAsService", + "secdeva/fieldTypes/productVendor": "Example Vendor Ltd" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_gpb4tpbn/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_gpb4tpbn/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_gpb4tpbn/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_gpb4tpbn/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_gpb4tpbn/index.json new file mode 100644 index 00000000..ef2ad345 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_gpb4tpbn/index.json @@ -0,0 +1,19 @@ +{ + "title": "TC06 Third-party component built into our product", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|d", + "links": [ + { + "linkType": "secdeva/linkTypes/defaultComponentOf", + "cardKey": "secdeva_7lzviey5" + } + ], + "secdeva/fieldTypes/productOrigin": "thirdPartyOpenSource", + "lastUpdated": "2026-08-26T11:26:03.371Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:07.844Z", + "base/fieldTypes/identifier": "secdeva_test_ss_builtin", + "secdeva/fieldTypes/deliveryModel": "weDeliver", + "secdeva/fieldTypes/productVendor": "Example Vendor Ltd" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_hhy5qiho/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_hhy5qiho/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_hhy5qiho/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_hhy5qiho/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_hhy5qiho/index.json new file mode 100644 index 00000000..ff1c8052 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_hhy5qiho/index.json @@ -0,0 +1,18 @@ +{ + "title": "TC09 Third-party product with no delivery model", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|g", + "links": [ + { + "linkType": "secdeva/linkTypes/externalComponentOf", + "cardKey": "secdeva_7lzviey5" + } + ], + "secdeva/fieldTypes/productOrigin": "thirdPartyCommercial", + "lastUpdated": "2026-08-26T11:26:06.171Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:11.703Z", + "base/fieldTypes/identifier": "secdeva_test_ss_nodelivery", + "secdeva/fieldTypes/productVendor": "Example Vendor Ltd" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_iah8c5m7/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_iah8c5m7/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_iah8c5m7/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_iah8c5m7/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_iah8c5m7/index.json new file mode 100644 index 00000000..c6701580 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_iah8c5m7/index.json @@ -0,0 +1,19 @@ +{ + "title": "TC11 Contradiction: consumed service bundled alongside", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|i", + "links": [ + { + "linkType": "secdeva/linkTypes/installedWith", + "cardKey": "secdeva_7lzviey5" + } + ], + "secdeva/fieldTypes/productOrigin": "thirdPartyCommercial", + "lastUpdated": "2026-08-26T11:26:08.032Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:14.294Z", + "base/fieldTypes/identifier": "secdeva_test_ss_bad_consumed_bundled", + "secdeva/fieldTypes/deliveryModel": "weConsumeAsService", + "secdeva/fieldTypes/productVendor": "Example Vendor Ltd" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_m84wuwsb/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_m84wuwsb/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_m84wuwsb/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_m84wuwsb/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_m84wuwsb/index.json new file mode 100644 index 00000000..418e3f9c --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_m84wuwsb/index.json @@ -0,0 +1,21 @@ +{ + "title": "TC19 Negative: complete active third-party product", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Active", + "rank": "0|n", + "links": [ + { + "linkType": "secdeva/linkTypes/externalComponentOf", + "cardKey": "secdeva_7lzviey5" + } + ], + "secdeva/fieldTypes/productOrigin": "thirdPartyCommercial", + "lastUpdated": "2026-08-26T11:26:15.609Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:19:17.715Z", + "base/fieldTypes/identifier": "secdeva_test_ss_active_complete_third", + "secdeva/fieldTypes/deliveryModel": "weDeliver", + "base/fieldTypes/informationClassification": "internal", + "secdeva/fieldTypes/productVendor": "Example Vendor Ltd", + "lastTransitioned": "2026-08-26T11:19:21.419Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_qdvfbra1/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_qdvfbra1/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_qdvfbra1/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_qdvfbra1/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_qdvfbra1/index.json new file mode 100644 index 00000000..11afa33b --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_qdvfbra1/index.json @@ -0,0 +1,20 @@ +{ + "title": "TC05 Third-party product under our own name", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|c", + "links": [ + { + "linkType": "secdeva/linkTypes/externalComponentOf", + "cardKey": "secdeva_7lzviey5" + } + ], + "secdeva/fieldTypes/productOrigin": "thirdPartyCommercial", + "lastUpdated": "2026-08-26T11:26:02.404Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:06.566Z", + "base/fieldTypes/identifier": "secdeva_test_ss_rebranded", + "secdeva/fieldTypes/deliveryModel": "weRebrandAndDeliver", + "secdeva/fieldTypes/productVendor": "Example Vendor Ltd", + "base/fieldTypes/owner": "test.owner@example.com" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_r6mn0jdm/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_r6mn0jdm/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_r6mn0jdm/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_r6mn0jdm/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_r6mn0jdm/index.json new file mode 100644 index 00000000..cbab7bca --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_r6mn0jdm/index.json @@ -0,0 +1,19 @@ +{ + "title": "TC03 Third-party product we deliver", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|a", + "links": [ + { + "linkType": "secdeva/linkTypes/externalComponentOf", + "cardKey": "secdeva_7lzviey5" + } + ], + "secdeva/fieldTypes/productOrigin": "thirdPartyCommercial", + "lastUpdated": "2026-08-26T11:26:00.495Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:03.971Z", + "base/fieldTypes/identifier": "secdeva_test_ss_delivered", + "secdeva/fieldTypes/deliveryModel": "weDeliver", + "secdeva/fieldTypes/productVendor": "Example Vendor Ltd" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_z55msicw/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_z55msicw/index.adoc new file mode 100644 index 00000000..c4ae4ea0 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_z55msicw/index.adoc @@ -0,0 +1,5 @@ +#TODO: describe what this product is and what part it plays in the solution.# + +{{#report}} + "name": "secdeva/reports/product" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_z55msicw/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_z55msicw/index.json new file mode 100644 index 00000000..c7d8bdfa --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/c/secdeva_z55msicw/index.json @@ -0,0 +1,19 @@ +{ + "title": "TC08 Third-party service we consume", + "cardType": "secdeva/cardTypes/product", + "workflowState": "Draft", + "rank": "0|f", + "links": [ + { + "linkType": "secdeva/linkTypes/externalComponentOf", + "cardKey": "secdeva_7lzviey5" + } + ], + "secdeva/fieldTypes/productOrigin": "thirdPartyCommercial", + "lastUpdated": "2026-08-26T11:26:05.212Z", + "templateCardKey": "secdeva_thirdpar01", + "createdAt": "2026-08-26T11:04:10.438Z", + "base/fieldTypes/identifier": "secdeva_test_ss_consumed", + "secdeva/fieldTypes/deliveryModel": "weConsumeAsService", + "secdeva/fieldTypes/productVendor": "Example Vendor Ltd" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/index.adoc new file mode 100644 index 00000000..cd19256f --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/productStructure" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/index.json new file mode 100644 index 00000000..c44b943f --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/c/secdeva_w09q3h5q/index.json @@ -0,0 +1,11 @@ +{ + "title": "Third-party products", + "cardType": "secdeva/cardTypes/register", + "workflowState": "None", + "rank": "0|b", + "base/fieldTypes/identifier": "secdeva_group_third-party-products", + "links": [], + "templateCardKey": "secdeva_solstruct3", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastUpdated": "2026-08-26T11:18:46.281Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/index.adoc new file mode 100644 index 00000000..329413d6 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerSolutionStructure" +{{/report}} diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/index.json new file mode 100644 index 00000000..260cb56a --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_q3g49gf7/index.json @@ -0,0 +1,11 @@ +{ + "title": "Solution structure", + "cardType": "secdeva/cardTypes/register", + "workflowState": "None", + "rank": "0|cn", + "base/fieldTypes/identifier": "secdeva_register_solution-structure", + "links": [], + "templateCardKey": "secdeva_solstruct1", + "createdAt": "2026-08-26T11:18:46.279Z", + "lastUpdated": "2026-08-26T11:18:46.281Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_toapj4nw/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_toapj4nw/index.adoc new file mode 100644 index 00000000..5111fea3 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_toapj4nw/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerTechnologyAssessments" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_toapj4nw/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_toapj4nw/index.json new file mode 100644 index 00000000..8e415dea --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_toapj4nw/index.json @@ -0,0 +1,11 @@ +{ + "title": "Technology assessments", + "cardType": "secdeva/cardTypes/register", + "workflowState": "None", + "rank": "0|cq", + "base/fieldTypes/identifier": "secdeva_register_technology-assessments", + "lastUpdated": "2026-08-26T11:18:46.281Z", + "links": [], + "templateCardKey": "secdeva_rpvcmv6f", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_uqzwvjkg/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_uqzwvjkg/index.adoc new file mode 100644 index 00000000..82951b99 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_uqzwvjkg/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerPeriodicReviews" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_uqzwvjkg/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_uqzwvjkg/index.json new file mode 100644 index 00000000..76eca4c5 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_uqzwvjkg/index.json @@ -0,0 +1,13 @@ +{ + "title": "Periodic reviews", + "cardType": "secdeva/cardTypes/periodicReviewRegister", + "workflowState": "None", + "rank": "0|dn", + "base/fieldTypes/informationClassification": "internal", + "base/fieldTypes/identifier": "secdeva_register_periodic-reviews", + "base/fieldTypes/reviewPeriod": 90, + "lastUpdated": "2026-08-26T11:18:46.281Z", + "links": [], + "templateCardKey": "secdeva_ggfocfp9", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_zj1uuc6j/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_zj1uuc6j/index.adoc new file mode 100644 index 00000000..35886684 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_zj1uuc6j/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registerSecurityRequirements" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_zj1uuc6j/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_zj1uuc6j/index.json new file mode 100644 index 00000000..b68c76e3 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/c/secdeva_zj1uuc6j/index.json @@ -0,0 +1,12 @@ +{ + "title": "Security requirements", + "cardType": "secdeva/cardTypes/register", + "workflowState": "None", + "rank": "0|cg", + "base/fieldTypes/informationClassification": "internal", + "base/fieldTypes/identifier": "secdeva_register_security-requirements", + "lastUpdated": "2026-08-26T11:18:46.280Z", + "links": [], + "templateCardKey": "secdeva_0jwydi01", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/index.adoc new file mode 100644 index 00000000..0f33cad5 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/registers" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/index.json new file mode 100644 index 00000000..997bd602 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_k4iuhaqw/index.json @@ -0,0 +1,12 @@ +{ + "title": "Registers", + "cardType": "ismsa/cardTypes/register", + "workflowState": "Draft", + "rank": "0|q", + "base/fieldTypes/identifier": "secdeva_registers", + "lastUpdated": "2026-08-26T11:18:46.280Z", + "base/fieldTypes/informationClassification": "internal", + "links": [], + "templateCardKey": "secdeva_wqydiu8q", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_pav6awbn/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_pav6awbn/index.adoc new file mode 100644 index 00000000..6c21a9e6 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_pav6awbn/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/releasesPhase" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_pav6awbn/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_pav6awbn/index.json new file mode 100644 index 00000000..0d89f8d5 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_pav6awbn/index.json @@ -0,0 +1,13 @@ +{ + "title": "Releases", + "cardType": "secdeva/cardTypes/phase", + "workflowState": "None", + "rank": "0|g", + "links": [], + "lastUpdated": "2026-08-26T11:18:46.280Z", + "base/fieldTypes/identifier": "secdeva_phase_releases", + "ismsa/fieldTypes/progress": "secdeva_phase-progress", + "base/fieldTypes/adoptionStep": "step1", + "templateCardKey": "secdeva_tvze3ck0", + "createdAt": "2026-08-26T11:18:46.279Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_sgt3j3zc/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_sgt3j3zc/index.adoc new file mode 100644 index 00000000..df9a23b3 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_sgt3j3zc/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/gettingStarted" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_sgt3j3zc/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_sgt3j3zc/index.json new file mode 100644 index 00000000..bdc9053e --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_sgt3j3zc/index.json @@ -0,0 +1,12 @@ +{ + "title": "Getting started", + "cardType": "secdeva/cardTypes/page", + "workflowState": "None", + "rank": "0|a", + "base/fieldTypes/adoptionStep": "step1", + "base/fieldTypes/identifier": "secdeva_getting-started", + "lastUpdated": "2026-08-26T11:18:46.280Z", + "links": [], + "templateCardKey": "secdeva_1vgbl3hy", + "createdAt": "2026-08-26T11:18:46.278Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_w1a6mjx0/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_w1a6mjx0/index.adoc new file mode 100644 index 00000000..67588f82 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_w1a6mjx0/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/implementationPhase" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_w1a6mjx0/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_w1a6mjx0/index.json new file mode 100644 index 00000000..c31b4f7d --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_w1a6mjx0/index.json @@ -0,0 +1,13 @@ +{ + "title": "Implementation", + "cardType": "secdeva/cardTypes/phase", + "workflowState": "None", + "rank": "0|e", + "links": [], + "lastUpdated": "2026-08-26T11:18:46.280Z", + "base/fieldTypes/identifier": "secdeva_phase_implementation", + "ismsa/fieldTypes/progress": "secdeva_phase-progress", + "base/fieldTypes/adoptionStep": "step1", + "templateCardKey": "secdeva_0czuad5t", + "createdAt": "2026-08-26T11:18:46.278Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_ydf9d0cn/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_ydf9d0cn/index.adoc new file mode 100644 index 00000000..25f04de6 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_ydf9d0cn/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/foundationPhase" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_ydf9d0cn/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_ydf9d0cn/index.json new file mode 100644 index 00000000..19472f1e --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_ydf9d0cn/index.json @@ -0,0 +1,13 @@ +{ + "title": "Foundation", + "cardType": "secdeva/cardTypes/phase", + "workflowState": "None", + "rank": "0|b", + "links": [], + "lastUpdated": "2026-08-26T11:18:46.280Z", + "base/fieldTypes/identifier": "secdeva_phase_foundation", + "ismsa/fieldTypes/progress": "secdeva_phase-progress", + "base/fieldTypes/adoptionStep": "step1", + "templateCardKey": "secdeva_k9stj3fy", + "createdAt": "2026-08-26T11:18:46.278Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_z85xnb05/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_z85xnb05/index.adoc new file mode 100644 index 00000000..4e6c10eb --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_z85xnb05/index.adoc @@ -0,0 +1,3 @@ +{{#report}} + "name": "secdeva/reports/meetings" +{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_z85xnb05/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_z85xnb05/index.json new file mode 100644 index 00000000..bbe3c41a --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/c/secdeva_z85xnb05/index.json @@ -0,0 +1,11 @@ +{ + "cardType": "secdeva/cardTypes/page", + "title": "Meetings", + "workflowState": "None", + "rank": "0|z", + "lastUpdated": "2026-08-26T11:18:46.280Z", + "links": [], + "base/fieldTypes/identifier": "secdeva_phase_meetings", + "templateCardKey": "secdeva_373bqs38", + "createdAt": "2026-08-26T11:18:46.278Z" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/index.adoc new file mode 100644 index 00000000..35f61d1f --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/index.adoc @@ -0,0 +1,49 @@ +== The scope of this secure development project + +#TODO: Briefly describe what the product or solution is, who it serves, and its primary value proposition in 1-3 sentences.# + +== Project security objectives & scope +#TODO: Define what success in cybersecurity looks like# + +Primary security goal: #TODO. e.g., Launch the beta version with core authentication features.# + +Out of scope (currently): #TODO: what cybersecurity topics are we explicitly NOT doing right now?# + +You can see a summary of the scoping of internal controls in {{#report}}"name": "secdeva/reports/xref", "identifier": "secdeva_register_internal-controls"{{/report}}. + +== Target audience & stakeholders +The following stakeholders will use this product and/or care about its security. + +End users: #TODO: Description of the user base# + +Internal stakeholders: #TODO: e.g., Legal, Compliance, CTO# + +NOTE: Set the owner field of this card to denote the person who is responsible for the cybersecurity of this development project. + +== Success metrics (KPIs) +How will we measure if the security integration was successful? + +#TODO: document or link to documentation about how the compliance, cybersecurity management and vulnerability management are measured# + +== Milestones and checkpoints + +.Instructions +[%collapsible] +===== +[TIP] +==== +It is recommended to have 2–6 checkpoints per year to keep secure development work on track. You can integrate secure development checkpoints into practices you already have, such as: + +* Program increment reviews +* Quarterly reviews +* Milestone reviews +* Gate reviews + +==== +===== + +#TODO: Add a description or link showing your general milestone/checkpoint practices and how secure development reviews fit into them# + +== Activation + +Once you have filled in this template, set the owner field and use the "Activate" workflow transition to mark this card ready. \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/index.json new file mode 100644 index 00000000..b4cb8304 --- /dev/null +++ b/cardRoot/secdeva_pdr66cvl/c/secdeva_8i0g4cnt/index.json @@ -0,0 +1,14 @@ +{ + "title": "Test project", + "cardType": "secdeva/cardTypes/project2", + "workflowState": "Draft", + "rank": "0|c", + "base/fieldTypes/adoptionStep": "step1", + "base/fieldTypes/informationClassification": "internal", + "base/fieldTypes/identifier": "secdeva_project", + "links": [], + "lastUpdated": "2026-08-26T20:56:27.771Z", + "templateCardKey": "secdeva_hfh3g4u2", + "createdAt": "2026-08-26T11:18:46.278Z", + "base/fieldTypes/owner": "test.owner@example.com" +} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/index.adoc deleted file mode 100644 index ed268898..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_27gdhhxf/index.adoc +++ /dev/null @@ -1,83 +0,0 @@ -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/entity" -{{/graph}} - -== Composite elements - -[TIP] -==== -To add a dataflow to or from this process, click the link symbol in the top level tool bar. Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface. -==== - -{{#createCards}} - "buttonLabel": "Create an interface", - "template": "secdeva/templates/interface" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a trust boundary", - "template": "secdeva/templates/trustBoundary" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create an external entity", - "template": "secdeva/templates/external" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a person", - "template": "secdeva/templates/person" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a process", - "template": "secdeva/templates/process" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a data store", - "template": "secdeva/templates/dataStore" -{{/createCards}} - -== Interfaces - -{{#report}} - "name": "secdeva/reports/entityInterfaces" -{{/report}} - -== Security issues - -{{#report}} - "name": "secdeva/reports/createThreat" -{{/report}} - -{{#report}} - "name": "secdeva/reports/securityIssueList" -{{/report}} - -== Decisions and design specifications - -Document a technical decision or create a design specification. - -{{#createCards}} - "buttonLabel": "Create a decision", - "template": "base/templates/decision" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a specification", - "template": "secdeva/templates/designSpecification" -{{/createCards}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/decision", - "tableCaption": "Decisions" -{{/report}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/controlledDocument", - "tableCaption": "Specifications" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/index.adoc deleted file mode 100644 index ed268898..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/c/secdeva_kcjuoe88/index.adoc +++ /dev/null @@ -1,83 +0,0 @@ -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/entity" -{{/graph}} - -== Composite elements - -[TIP] -==== -To add a dataflow to or from this process, click the link symbol in the top level tool bar. Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface. -==== - -{{#createCards}} - "buttonLabel": "Create an interface", - "template": "secdeva/templates/interface" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a trust boundary", - "template": "secdeva/templates/trustBoundary" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create an external entity", - "template": "secdeva/templates/external" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a person", - "template": "secdeva/templates/person" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a process", - "template": "secdeva/templates/process" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a data store", - "template": "secdeva/templates/dataStore" -{{/createCards}} - -== Interfaces - -{{#report}} - "name": "secdeva/reports/entityInterfaces" -{{/report}} - -== Security issues - -{{#report}} - "name": "secdeva/reports/createThreat" -{{/report}} - -{{#report}} - "name": "secdeva/reports/securityIssueList" -{{/report}} - -== Decisions and design specifications - -Document a technical decision or create a design specification. - -{{#createCards}} - "buttonLabel": "Create a decision", - "template": "base/templates/decision" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a specification", - "template": "secdeva/templates/designSpecification" -{{/createCards}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/decision", - "tableCaption": "Decisions" -{{/report}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/controlledDocument", - "tableCaption": "Specifications" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/index.adoc deleted file mode 100644 index ed268898..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_779e4hov/index.adoc +++ /dev/null @@ -1,83 +0,0 @@ -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/entity" -{{/graph}} - -== Composite elements - -[TIP] -==== -To add a dataflow to or from this process, click the link symbol in the top level tool bar. Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface. -==== - -{{#createCards}} - "buttonLabel": "Create an interface", - "template": "secdeva/templates/interface" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a trust boundary", - "template": "secdeva/templates/trustBoundary" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create an external entity", - "template": "secdeva/templates/external" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a person", - "template": "secdeva/templates/person" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a process", - "template": "secdeva/templates/process" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a data store", - "template": "secdeva/templates/dataStore" -{{/createCards}} - -== Interfaces - -{{#report}} - "name": "secdeva/reports/entityInterfaces" -{{/report}} - -== Security issues - -{{#report}} - "name": "secdeva/reports/createThreat" -{{/report}} - -{{#report}} - "name": "secdeva/reports/securityIssueList" -{{/report}} - -== Decisions and design specifications - -Document a technical decision or create a design specification. - -{{#createCards}} - "buttonLabel": "Create a decision", - "template": "base/templates/decision" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a specification", - "template": "secdeva/templates/designSpecification" -{{/createCards}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/decision", - "tableCaption": "Decisions" -{{/report}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/controlledDocument", - "tableCaption": "Specifications" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_ffecyqt6/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_ffecyqt6/index.adoc deleted file mode 100644 index ed268898..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_ffecyqt6/index.adoc +++ /dev/null @@ -1,83 +0,0 @@ -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/entity" -{{/graph}} - -== Composite elements - -[TIP] -==== -To add a dataflow to or from this process, click the link symbol in the top level tool bar. Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface. -==== - -{{#createCards}} - "buttonLabel": "Create an interface", - "template": "secdeva/templates/interface" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a trust boundary", - "template": "secdeva/templates/trustBoundary" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create an external entity", - "template": "secdeva/templates/external" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a person", - "template": "secdeva/templates/person" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a process", - "template": "secdeva/templates/process" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a data store", - "template": "secdeva/templates/dataStore" -{{/createCards}} - -== Interfaces - -{{#report}} - "name": "secdeva/reports/entityInterfaces" -{{/report}} - -== Security issues - -{{#report}} - "name": "secdeva/reports/createThreat" -{{/report}} - -{{#report}} - "name": "secdeva/reports/securityIssueList" -{{/report}} - -== Decisions and design specifications - -Document a technical decision or create a design specification. - -{{#createCards}} - "buttonLabel": "Create a decision", - "template": "base/templates/decision" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a specification", - "template": "secdeva/templates/designSpecification" -{{/createCards}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/decision", - "tableCaption": "Decisions" -{{/report}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/controlledDocument", - "tableCaption": "Specifications" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/c/secdeva_xzgbmuu7/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/c/secdeva_xzgbmuu7/index.adoc deleted file mode 100644 index ed268898..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/c/secdeva_xzgbmuu7/index.adoc +++ /dev/null @@ -1,83 +0,0 @@ -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/entity" -{{/graph}} - -== Composite elements - -[TIP] -==== -To add a dataflow to or from this process, click the link symbol in the top level tool bar. Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface. -==== - -{{#createCards}} - "buttonLabel": "Create an interface", - "template": "secdeva/templates/interface" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a trust boundary", - "template": "secdeva/templates/trustBoundary" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create an external entity", - "template": "secdeva/templates/external" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a person", - "template": "secdeva/templates/person" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a process", - "template": "secdeva/templates/process" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a data store", - "template": "secdeva/templates/dataStore" -{{/createCards}} - -== Interfaces - -{{#report}} - "name": "secdeva/reports/entityInterfaces" -{{/report}} - -== Security issues - -{{#report}} - "name": "secdeva/reports/createThreat" -{{/report}} - -{{#report}} - "name": "secdeva/reports/securityIssueList" -{{/report}} - -== Decisions and design specifications - -Document a technical decision or create a design specification. - -{{#createCards}} - "buttonLabel": "Create a decision", - "template": "base/templates/decision" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a specification", - "template": "secdeva/templates/designSpecification" -{{/createCards}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/decision", - "tableCaption": "Decisions" -{{/report}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/controlledDocument", - "tableCaption": "Specifications" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/index.adoc deleted file mode 100644 index ed268898..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/c/secdeva_xicwct7f/index.adoc +++ /dev/null @@ -1,83 +0,0 @@ -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/entity" -{{/graph}} - -== Composite elements - -[TIP] -==== -To add a dataflow to or from this process, click the link symbol in the top level tool bar. Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface. -==== - -{{#createCards}} - "buttonLabel": "Create an interface", - "template": "secdeva/templates/interface" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a trust boundary", - "template": "secdeva/templates/trustBoundary" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create an external entity", - "template": "secdeva/templates/external" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a person", - "template": "secdeva/templates/person" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a process", - "template": "secdeva/templates/process" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a data store", - "template": "secdeva/templates/dataStore" -{{/createCards}} - -== Interfaces - -{{#report}} - "name": "secdeva/reports/entityInterfaces" -{{/report}} - -== Security issues - -{{#report}} - "name": "secdeva/reports/createThreat" -{{/report}} - -{{#report}} - "name": "secdeva/reports/securityIssueList" -{{/report}} - -== Decisions and design specifications - -Document a technical decision or create a design specification. - -{{#createCards}} - "buttonLabel": "Create a decision", - "template": "base/templates/decision" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a specification", - "template": "secdeva/templates/designSpecification" -{{/createCards}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/decision", - "tableCaption": "Decisions" -{{/report}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/controlledDocument", - "tableCaption": "Specifications" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/index.adoc deleted file mode 100644 index bbadcff2..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/c/secdeva_j7g8mg6m/index.adoc +++ /dev/null @@ -1,78 +0,0 @@ -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/entity" -{{/graph}} - -== Composite elements - -[TIP] -==== -To add a dataflow to or from this trust boundary, click the link symbol in the top level tool bar to create a link. Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface. -==== - -{{#createCards}} - "buttonLabel": "Create a trust boundary", - "template": "secdeva/templates/trustBoundary" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create an external entity", - "template": "secdeva/templates/external" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a person", - "template": "secdeva/templates/person" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a process", - "template": "secdeva/templates/process" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a data store", - "template": "secdeva/templates/dataStore" -{{/createCards}} - -== Interfaces - -{{#report}} - "name": "secdeva/reports/entityInterfaces" -{{/report}} - -== Security issues - -{{#report}} - "name": "secdeva/reports/createThreat" -{{/report}} - -{{#report}} - "name": "secdeva/reports/securityIssueList" -{{/report}} - -== Decisions and design specifications - -Document a technical decision or create a design specification. - -{{#createCards}} - "buttonLabel": "Create a decision", - "template": "base/templates/decision" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a specification", - "template": "secdeva/templates/designSpecification" -{{/createCards}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/decision", - "tableCaption": "Decisions" -{{/report}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/controlledDocument", - "tableCaption": "Specifications" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/index.adoc deleted file mode 100644 index ed268898..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/c/secdeva_zapnt6p6/index.adoc +++ /dev/null @@ -1,83 +0,0 @@ -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/entity" -{{/graph}} - -== Composite elements - -[TIP] -==== -To add a dataflow to or from this process, click the link symbol in the top level tool bar. Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface. -==== - -{{#createCards}} - "buttonLabel": "Create an interface", - "template": "secdeva/templates/interface" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a trust boundary", - "template": "secdeva/templates/trustBoundary" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create an external entity", - "template": "secdeva/templates/external" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a person", - "template": "secdeva/templates/person" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a process", - "template": "secdeva/templates/process" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a data store", - "template": "secdeva/templates/dataStore" -{{/createCards}} - -== Interfaces - -{{#report}} - "name": "secdeva/reports/entityInterfaces" -{{/report}} - -== Security issues - -{{#report}} - "name": "secdeva/reports/createThreat" -{{/report}} - -{{#report}} - "name": "secdeva/reports/securityIssueList" -{{/report}} - -== Decisions and design specifications - -Document a technical decision or create a design specification. - -{{#createCards}} - "buttonLabel": "Create a decision", - "template": "base/templates/decision" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a specification", - "template": "secdeva/templates/designSpecification" -{{/createCards}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/decision", - "tableCaption": "Decisions" -{{/report}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/controlledDocument", - "tableCaption": "Specifications" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/index.adoc deleted file mode 100644 index bbadcff2..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_kfcwc4q0/index.adoc +++ /dev/null @@ -1,78 +0,0 @@ -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/entity" -{{/graph}} - -== Composite elements - -[TIP] -==== -To add a dataflow to or from this trust boundary, click the link symbol in the top level tool bar to create a link. Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface. -==== - -{{#createCards}} - "buttonLabel": "Create a trust boundary", - "template": "secdeva/templates/trustBoundary" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create an external entity", - "template": "secdeva/templates/external" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a person", - "template": "secdeva/templates/person" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a process", - "template": "secdeva/templates/process" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a data store", - "template": "secdeva/templates/dataStore" -{{/createCards}} - -== Interfaces - -{{#report}} - "name": "secdeva/reports/entityInterfaces" -{{/report}} - -== Security issues - -{{#report}} - "name": "secdeva/reports/createThreat" -{{/report}} - -{{#report}} - "name": "secdeva/reports/securityIssueList" -{{/report}} - -== Decisions and design specifications - -Document a technical decision or create a design specification. - -{{#createCards}} - "buttonLabel": "Create a decision", - "template": "base/templates/decision" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a specification", - "template": "secdeva/templates/designSpecification" -{{/createCards}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/decision", - "tableCaption": "Decisions" -{{/report}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/controlledDocument", - "tableCaption": "Specifications" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/index.adoc deleted file mode 100644 index ed268898..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_2d5b5kc8/index.adoc +++ /dev/null @@ -1,83 +0,0 @@ -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/entity" -{{/graph}} - -== Composite elements - -[TIP] -==== -To add a dataflow to or from this process, click the link symbol in the top level tool bar. Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface. -==== - -{{#createCards}} - "buttonLabel": "Create an interface", - "template": "secdeva/templates/interface" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a trust boundary", - "template": "secdeva/templates/trustBoundary" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create an external entity", - "template": "secdeva/templates/external" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a person", - "template": "secdeva/templates/person" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a process", - "template": "secdeva/templates/process" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a data store", - "template": "secdeva/templates/dataStore" -{{/createCards}} - -== Interfaces - -{{#report}} - "name": "secdeva/reports/entityInterfaces" -{{/report}} - -== Security issues - -{{#report}} - "name": "secdeva/reports/createThreat" -{{/report}} - -{{#report}} - "name": "secdeva/reports/securityIssueList" -{{/report}} - -== Decisions and design specifications - -Document a technical decision or create a design specification. - -{{#createCards}} - "buttonLabel": "Create a decision", - "template": "base/templates/decision" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a specification", - "template": "secdeva/templates/designSpecification" -{{/createCards}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/decision", - "tableCaption": "Decisions" -{{/report}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/controlledDocument", - "tableCaption": "Specifications" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/index.adoc deleted file mode 100644 index ed268898..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/c/secdeva_7tus2re3/index.adoc +++ /dev/null @@ -1,83 +0,0 @@ -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/entity" -{{/graph}} - -== Composite elements - -[TIP] -==== -To add a dataflow to or from this process, click the link symbol in the top level tool bar. Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface. -==== - -{{#createCards}} - "buttonLabel": "Create an interface", - "template": "secdeva/templates/interface" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a trust boundary", - "template": "secdeva/templates/trustBoundary" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create an external entity", - "template": "secdeva/templates/external" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a person", - "template": "secdeva/templates/person" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a process", - "template": "secdeva/templates/process" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a data store", - "template": "secdeva/templates/dataStore" -{{/createCards}} - -== Interfaces - -{{#report}} - "name": "secdeva/reports/entityInterfaces" -{{/report}} - -== Security issues - -{{#report}} - "name": "secdeva/reports/createThreat" -{{/report}} - -{{#report}} - "name": "secdeva/reports/securityIssueList" -{{/report}} - -== Decisions and design specifications - -Document a technical decision or create a design specification. - -{{#createCards}} - "buttonLabel": "Create a decision", - "template": "base/templates/decision" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a specification", - "template": "secdeva/templates/designSpecification" -{{/createCards}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/decision", - "tableCaption": "Decisions" -{{/report}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/controlledDocument", - "tableCaption": "Specifications" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/index.adoc deleted file mode 100644 index ed268898..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/c/secdeva_x59am033/index.adoc +++ /dev/null @@ -1,83 +0,0 @@ -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/entity" -{{/graph}} - -== Composite elements - -[TIP] -==== -To add a dataflow to or from this process, click the link symbol in the top level tool bar. Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface. -==== - -{{#createCards}} - "buttonLabel": "Create an interface", - "template": "secdeva/templates/interface" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a trust boundary", - "template": "secdeva/templates/trustBoundary" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create an external entity", - "template": "secdeva/templates/external" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a person", - "template": "secdeva/templates/person" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a process", - "template": "secdeva/templates/process" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a data store", - "template": "secdeva/templates/dataStore" -{{/createCards}} - -== Interfaces - -{{#report}} - "name": "secdeva/reports/entityInterfaces" -{{/report}} - -== Security issues - -{{#report}} - "name": "secdeva/reports/createThreat" -{{/report}} - -{{#report}} - "name": "secdeva/reports/securityIssueList" -{{/report}} - -== Decisions and design specifications - -Document a technical decision or create a design specification. - -{{#createCards}} - "buttonLabel": "Create a decision", - "template": "base/templates/decision" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a specification", - "template": "secdeva/templates/designSpecification" -{{/createCards}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/decision", - "tableCaption": "Decisions" -{{/report}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/controlledDocument", - "tableCaption": "Specifications" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/index.adoc deleted file mode 100644 index bbadcff2..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/c/secdeva_oe8v1eu4/index.adoc +++ /dev/null @@ -1,78 +0,0 @@ -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/entity" -{{/graph}} - -== Composite elements - -[TIP] -==== -To add a dataflow to or from this trust boundary, click the link symbol in the top level tool bar to create a link. Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface. -==== - -{{#createCards}} - "buttonLabel": "Create a trust boundary", - "template": "secdeva/templates/trustBoundary" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create an external entity", - "template": "secdeva/templates/external" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a person", - "template": "secdeva/templates/person" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a process", - "template": "secdeva/templates/process" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a data store", - "template": "secdeva/templates/dataStore" -{{/createCards}} - -== Interfaces - -{{#report}} - "name": "secdeva/reports/entityInterfaces" -{{/report}} - -== Security issues - -{{#report}} - "name": "secdeva/reports/createThreat" -{{/report}} - -{{#report}} - "name": "secdeva/reports/securityIssueList" -{{/report}} - -== Decisions and design specifications - -Document a technical decision or create a design specification. - -{{#createCards}} - "buttonLabel": "Create a decision", - "template": "base/templates/decision" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a specification", - "template": "secdeva/templates/designSpecification" -{{/createCards}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/decision", - "tableCaption": "Decisions" -{{/report}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/controlledDocument", - "tableCaption": "Specifications" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/index.adoc deleted file mode 100644 index bbadcff2..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_2iayoqey/index.adoc +++ /dev/null @@ -1,78 +0,0 @@ -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/entity" -{{/graph}} - -== Composite elements - -[TIP] -==== -To add a dataflow to or from this trust boundary, click the link symbol in the top level tool bar to create a link. Optionally, if you want to model interfaces as well, you can create an interface and link any incoming dataflows to the interface. -==== - -{{#createCards}} - "buttonLabel": "Create a trust boundary", - "template": "secdeva/templates/trustBoundary" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create an external entity", - "template": "secdeva/templates/external" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a person", - "template": "secdeva/templates/person" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a process", - "template": "secdeva/templates/process" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a data store", - "template": "secdeva/templates/dataStore" -{{/createCards}} - -== Interfaces - -{{#report}} - "name": "secdeva/reports/entityInterfaces" -{{/report}} - -== Security issues - -{{#report}} - "name": "secdeva/reports/createThreat" -{{/report}} - -{{#report}} - "name": "secdeva/reports/securityIssueList" -{{/report}} - -== Decisions and design specifications - -Document a technical decision or create a design specification. - -{{#createCards}} - "buttonLabel": "Create a decision", - "template": "base/templates/decision" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a specification", - "template": "secdeva/templates/designSpecification" -{{/createCards}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/decision", - "tableCaption": "Decisions" -{{/report}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/controlledDocument", - "tableCaption": "Specifications" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_8cy67icu/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_8cy67icu/index.adoc deleted file mode 100644 index 5b0de217..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/c/secdeva_8cy67icu/index.adoc +++ /dev/null @@ -1,13 +0,0 @@ -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/entity" -{{/graph}} - -[TIP] -==== -To add a dataflow to or from this person, click the link symbol in the top level tool bar. -==== - -{{#report}} - "name": "secdeva/reports/createThreat" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/index.adoc b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/index.adoc deleted file mode 100644 index 2d974d2d..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/index.adoc +++ /dev/null @@ -1,90 +0,0 @@ -== Context diagram - -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/context" -{{/graph}} - -== Detailed diagram - -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/allEntities" -{{/graph}} - -== Label diagram - -{{#graph}} - "model": "secdeva/graphModels/dataflow", - "view": "secdeva/graphViews/label", - "labels": ["example"] -{{/graph}} - -== Interfaces - -{{#report}} - "name": "secdeva/reports/modelInterfaces" -{{/report}} - -== Top-level elements - -Trust boundary:: A trust boundary is a boundary between different trust zone levels. - -{{#createCards}} - "buttonLabel": "Create a trust boundary", - "template": "secdeva/templates/trustBoundary" -{{/createCards}} - -External entity:: An external entity is a source from which information flows into the system, or a recipients of information leaving the system - -{{#createCards}} - "buttonLabel": "Create an external entity", - "template": "secdeva/templates/external" -{{/createCards}} - -Person:: A person is a user, an administrator or another human stakeholder. A special case of an external entity. - -{{#createCards}} - "buttonLabel": "Create a person", - "template": "secdeva/templates/person" -{{/createCards}} - -Process:: A process represents an activity that the system carries out. - -{{#createCards}} - "buttonLabel": "Create a process", - "template": "secdeva/templates/process" -{{/createCards}} - -Data store:: A data store stores information. For example, a database or a file. - -{{#createCards}} - "buttonLabel": "Create a data store", - "template": "secdeva/templates/dataStore" -{{/createCards}} - -== Decisions and design specifications - -Document a technical decision or create a design specification. - -{{#createCards}} - "buttonLabel": "Create a decision", - "template": "base/templates/decision" -{{/createCards}} - -{{#createCards}} - "buttonLabel": "Create a specification", - "template": "secdeva/templates/designSpecification" -{{/createCards}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/decision", - "tableCaption": "Decisions" -{{/report}} - -{{#report}} - "name": "base/reports/childrenTable", - "cardType": "base/cardTypes/controlledDocument", - "tableCaption": "Specifications" -{{/report}} \ No newline at end of file diff --git a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/index.json b/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/index.json deleted file mode 100644 index 76ba1157..00000000 --- a/cardRoot/secdeva_pdr66cvl/c/secdeva_xkmudnfo/index.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "title": "Dataflow model for testing", - "cardType": "secdeva/cardTypes/dataflowModel", - "workflowState": "Draft", - "rank": "0|a", - "links": [], - "templateCardKey": "secdeva_gidk7o4u", - "lastUpdated": "2026-08-16T20:28:21.137Z" -} \ No newline at end of file