Ensure everything in the cloud.gov SSP .docx is represented in cloud.gov's CM YAML

[mogul]

In order to be able to generate new SSPs based on the .docx cloud.gov SSP in future, we want all cloud.gov SSP content to be captured in Compliance Masonry YAML.

Implementation sketch

• Label which control families are only in the Word .docx and need to be curried back to YAML
• Identify the canonical "implementation state" and "control origination" source (eg the CIS Excel sheet)
• Ensure the CM schema can handle "control origination"
• Pull all of this back into the YAML

[mogul]

@clovett3: Once you've finished filling all the control families in on the Word .docx, please apply the only-in-word tag to the appropriate issues in this list so we can start tracking what needs currying back to YAML.

[ghost]

Understood

[mogul]

(It probably goes without saying, but the label should apply for families where edits to existing YAML only exist in the .docx as well.)

[afeld]

• Document what features are missing from Masonry to allow it to fully generate the SSP

[jbarnicle]

implementation_status and control_origination can potentially have multiple checked values in the .docx, but can only be strings in the .yaml. Need to update .yaml to accept multiple values for these fields.

[mogul]

This is blocked until the two opencontrol issues referenced above are resolved.