Skip to content

Update risk assessment format #499

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jboddey merged 1 commit into from
Jun 6, 2024
+32 −8
Merged

Update risk assessment format #499

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 32 additions & 8 deletions resources/risk_assessment.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,8 +59,12 @@
"options": [
"The device collects any Personal Identifiable Information (PII) or Personal Health Information (PHI)",
"The device collects intellectual property and trade secrets, sensitive business data, critical infrastructure data, identity assets",
"The device stream confidential business data in real-time (seconds)?"
]
"The device stream confidential business data in real-time (seconds)?",
"None of the above"
],
"validation": {
"required": true
}
},
{
"question": "Which of the following statements are true about this device?",
Expand All @@ -72,8 +76,12 @@
"A failure in data transmission would likely have a substantial negative impact (https://www.rra.rocks/docs/standard_levels#levels-definitions)",
"A confidentiality breach during transmission would have a substantial negative impact",
"The device encrypts data during transmission",
"The device network protocol is well-established and currently used by Google"
]
"The device network protocol is well-established and currently used by Google",
"None of the above"
],
"validation": {
"required": true
}
},
{
"question": "Does the network protocol assure server-to-client identity verification?",
Expand All @@ -96,8 +104,12 @@
"Unrecoverable actions (e.g. disk wipe) can be performed remotely",
"Authentication is required for remote access",
"The management interface is accessible from the public internet",
"Static credentials are used for administration"
]
"Static credentials are used for administration",
"None of the above"
],
"validation": {
"required": true
}
},
{
"question": "Are any of the following statements true about this device?",
Expand All @@ -109,7 +121,19 @@
"The device controls robotics in human-accessible spaces.",
"The device controls physical access systems.",
"The device is involved in processes required by regulations, or compliance. (ex. privacy, security, safety regulations)",
"The device's failure would cause faults in other high-criticality processes."
]
"The device's failure would cause faults in other high-criticality processes.",
"None of the above"
],
"validation": {
"required": true
}
},
{
"question": "Comments",
"description": "Anything else to share?",
"type": "text-long",
"validation": {
"max": "512"
}
}
]