fixed merge issue in yaml; added missing ISO 27001:2022 mappings

jonashirner · jonashirner · commit d594e9ea52bf · 2023-04-03T11:09:55.000+02:00
diff --git a/src/assets/YAML/default/CultureAndOrganization/Design.yaml b/src/assets/YAML/default/CultureAndOrganization/Design.yaml
@@ -39,13 +39,13 @@ Culture and Organization:
         samm2:
         - D-TA-2-B
         iso27001-2017:
-        - not explicitly covered by ISO 27001
-        - may be part of risk assessment
+        - Not explicitly covered by ISO 27001
+        - May be part of risk assessment
         - 8.2.1
         - 14.2.1
         iso27001-2022:
-        - not explicitly covered by ISO 27001
-        - may be part of risk assessment
+        - Not explicitly covered by ISO 27001
+        - May be part of risk assessment
         - 5.12
         - 8.25
       isImplemented: false
@@ -67,13 +67,13 @@ Culture and Organization:
         samm2:
         - D-TA-2-B
         iso27001-2017:
-        - not explicitly covered by ISO 27001
-        - may be part of risk assessment
+        - Not explicitly covered by ISO 27001
+        - May be part of risk assessment
         - 8.2.1
         - 14.2.1
         iso27001-2022:
-        - not explicitly covered by ISO 27001
-        - may be part of risk assessment
+        - Not explicitly covered by ISO 27001
+        - May be part of risk assessment
         - 5.12
         - 8.25
       isImplemented: false
@@ -144,13 +144,13 @@ Culture and Organization:
         samm2:
         - D-TA-2-B
         iso27001-2017:
-        - not explicitly covered by ISO 27001
-        - may be part of risk assessment
+        - Not explicitly covered by ISO 27001
+        - May be part of risk assessment
         - 8.2.1
         - 14.2.1
         iso27001-2022:
-        - not explicitly covered by ISO 27001
-        - may be part of risk assessment
+        - Not explicitly covered by ISO 27001
+        - May be part of risk assessment
         - 5.12
         - 8.25
       isImplemented: false
@@ -175,16 +175,16 @@ Culture and Organization:
         samm2:
         - D-TA-2-B
         iso27001-2017:
-        - not explicitly covered by ISO 27001
-        - may be part of project management
+        - Not explicitly covered by ISO 27001
+        - May be part of project management
         - 6.1.5
-        - may be part of risk assessment
+        - May be part of risk assessment
         - 8.1.2
         iso27001-2022:
-        - not explicitly covered by ISO 27001
-        - may be part of project management
+        - Not explicitly covered by ISO 27001
+        - May be part of project management
         - 5.8
-        - may be part of risk assessment
+        - May be part of risk assessment
         - 5.9
       isImplemented: false
       evidence: ""
@@ -208,16 +208,16 @@ Culture and Organization:
         samm2:
         - D-TA-2-B
         iso27001-2017:
-        - not explicitly covered by ISO 27001
-        - may be part of project management
+        - Not explicitly covered by ISO 27001
+        - May be part of project management
         - 6.1.5
-        - may be part of risk assessment
+        - May be part of risk assessment
         - 8.1.2
         iso27001-2022:
-        - not explicitly covered by ISO 27001
-        - may be part of project management
+        - Not explicitly covered by ISO 27001
+        - May be part of project management
         - 5.8
-        - may be part of risk assessment
+        - May be part of risk assessment
         - 5.9
       isImplemented: false
       evidence: ""
@@ -243,13 +243,13 @@ Culture and Organization:
         samm2:
         - D-TA-3-B
         iso27001-2017:
-        - not explicitly covered by ISO 27001
-        - may be part of risk assessment
+        - Not explicitly covered by ISO 27001
+        - May be part of risk assessment
         - 8.2.1
         - 14.2.1
         iso27001-2022:
-        - not explicitly covered by ISO 27001
-        - may be part of risk assessment
+        - Not explicitly covered by ISO 27001
+        - May be part of risk assessment
         - 5.12
         - 8.25
       isImplemented: false
diff --git a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml
@@ -42,6 +42,8 @@ Culture and Organization:
           - G-EG-3-B
         iso27001-2017:
           - 7.1.1
+        iso27001-2022:
+        - 6.1
       isImplemented: false
       evidence: ""
       comments: ""
diff --git a/src/assets/YAML/default/CultureAndOrganization/Process.yaml b/src/assets/YAML/default/CultureAndOrganization/Process.yaml
@@ -22,8 +22,8 @@ Culture and Organization:
         - 14.2.1
         iso27001-2022:
         - Peer review - four eyes principle is not explicitly required by ISO 27001
-        - 5.3
-        - 8.25
+        - "5.3"
+        - "8.25"
       isImplemented: false
       evidence: ""
       comments: ""
diff --git a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml
@@ -11,11 +11,6 @@ Implementation:
         
         in all applications provides a good baseline. Implement 50% of the recommendations.
       difficultyOfImplementation:
-        knowledge: 4
-        time: 4
-        resources: 2
-      usefulness: 4
-      level: 3
         knowledge: 2
         time: 2
         resources: 1
@@ -127,8 +122,11 @@ Implementation:
         samm2:
           - D-SR-2-A
         iso27001-2017:
-          - hardening is not explicitly covered by ISO 27001 - too specific
-          - 13.1.3
+        - Hardening is not explicitly covered by ISO 27001 - too specific
+        - 13.1.3
+        iso27001-2022:
+        - Hardening is not explicitly covered by ISO 27001 - too specific
+        - 8.22
       isImplemented: false
       evidence: ""
       comments: ""
@@ -156,8 +154,11 @@ Implementation:
         samm2:
           - D-SR-2-A
         iso27001-2017:
-          - hardening is not explicitly covered by ISO 27001 - too specific
-          - 13.1.3
+        - Hardening is not explicitly covered by ISO 27001 - too specific
+        - 13.1.3
+        iso27001-2022:
+        - Hardening is not explicitly covered by ISO 27001 - too specific
+        - 8.22
       isImplemented: false
       evidence: ""
       comments: ""
@@ -212,8 +213,11 @@ Implementation:
         samm2:
           - D-SR-3-A
         iso27001-2017:
-          - hardening is not explicitly covered by ISO 27001 - too specific
-          - 13.1.3
+        - Hardening is not explicitly covered by ISO 27001 - too specific
+        - 13.1.3
+        iso27001-2022:
+        - Hardening is not explicitly covered by ISO 27001 - too specific
+        - 8.22
       isImplemented: false
       evidence: ""
       comments: ""
diff --git a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml
@@ -47,9 +47,9 @@ Implementation:
         - 14.2.1  
         - 14.2.5
         iso27001-2022:
-        - 8.25  # Secure development lifecycle
-        - 8.27  # Secure system architecture and engineering principles
-        - 8.28  # Secure coding
+        - "8.25"  # Secure development lifecycle
+        - "8.27"  # Secure system architecture and engineering principles
+        - "8.28"  # Secure coding
       isImplemented: false
       evidence: ""
       comments: ""
diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml
@@ -24,7 +24,7 @@ Implementation:
           - 9.2.4
           - 6.1.2   # Segregation of duties.
           - 14.2.1  # Secure development policies.
-          iso27001-2022:
+        iso27001-2022:
           - 5.17    # Authentication information
           - 5.3
           - 8.25
@@ -58,7 +58,7 @@ Implementation:
           - 9.2.4
           - 6.1.2   # Segregation of duties.
           - 14.2.1  # Secure development policies.
-          iso27001-2022:
+        iso27001-2022:
           - 5.17    # Authentication information
           - 5.3
           - 8.25
@@ -414,8 +414,11 @@ Implementation:
         samm2:
           - O-EM-1-A
         iso27001-2017:
-          - system hardening is not explicitly covered by ISO 27001 - too specific
-          - 13.1.3
+        - Hardening is not explicitly covered by ISO 27001 - too specific
+        - 13.1.3
+        iso27001-2022:
+        - Hardening is not explicitly covered by ISO 27001 - too specific
+        - 8.22
       isImplemented: false
       evidence: ""
       comments: ""
diff --git a/src/assets/YAML/default/InformationGathering/Monitoring.yaml b/src/assets/YAML/default/InformationGathering/Monitoring.yaml
@@ -64,11 +64,11 @@ Information Gathering:
         - $ref: src/assets/YAML/default/implementations.yaml#/implementations/falco
       references:
         samm2:
-          - O-IM-2-A
+        - O-IM-2-A
         iso27001-2017:
-          - 12.6.1
+        - 12.6.1
         iso27001-2022:
-          - 8.8
+        - 8.8
       isImplemented: false
       evidence: ""
       comments: ""
diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml
@@ -81,7 +81,7 @@ Test and Verification:
         iso27001-2017:
         - 16.1.4
         iso27001-2022:
-        - I5.25
+        - 5.25
       isImplemented: false
       evidence: ""
       comments: ""
diff --git a/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml b/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml
@@ -77,8 +77,11 @@ Test and Verification:
       references:
         samm2: []
         iso27001-2017:
-          - 12.5.1
-          - 12.6.1
+        - 12.5.1
+        - 12.6.1
+        iso27001-2022:
+        - 8.19
+        - 8.8
       isImplemented: false
       evidence: ""
       comments: ""
