Add compliance work to Roadmap about tag-security HOT 3 CLOSED

Just my .02, I actually think of regulatory compliance as a separate domain/concern apart from secure access or technical policy controls/features. It orchestrates and considers all the human activities surrounding and interacting with a software system.

Regulatory compliance can often be accomplished with manual human and paperwork processes (for good or ill) outside the software controls, whereas security is the interaction of various attributes and decisions concretely defined and embodied in the system architecture, design, code and behavior.

They certainly can and should reinforce each other, but I think they should be decoupled explicitly and managed separately. Put another way, I wouldn't want to design the safety and security of software with regulatory requirements as the primary goal; nor would I want to declare regulatory compliance by only mapping a set of security features/configurations to specific regulatory requirements without considering all the human workflows surrounding the system.

A mapping between security features/intents vs specific regulatory compliance requirements is a start and a helpful roadmap. My recommendation for scope would be to provide a common vocabulary of terms across various features and intents that can be cross mapped to all the many different regulatory frameworks (most of which are not container aware today!) That said HITRUST has mapped to CSA and I have done some work to map PCI and HIPAA.

from tag-security.

This issue has been automatically marked as inactive because it has not had recent activity.

from tag-security.

This is reflected on the Roadmap & planning FY21-22, this issue is being closed

from tag-security.