45 lines
1.4 KiB
Markdown
45 lines
1.4 KiB
Markdown
# Standards Checklist
|
|
|
|
## How To Complete
|
|
|
|
1. Fill metadata and ensure it matches the evidence run folder.
|
|
2. Use one status value per row: `Meets`, `Partially Meets`, `Does Not Meet`, `Not Evaluated`.
|
|
3. Add at least one concrete artifact path for each status decision.
|
|
4. In `Notes`, explain why the evidence is sufficient or insufficient.
|
|
5. Keep `Gap Summary` focused on what still blocks compliance confidence.
|
|
|
|
## Metadata
|
|
|
|
Date (UTC):
|
|
Environment URL:
|
|
Commit:
|
|
Run ID:
|
|
|
|
## OWASP ASVS (selected)
|
|
|
|
| Control | Requirement | Status | Evidence Path | Notes |
|
|
|---|---|---|---|---|
|
|
| V1 | Architecture/design documented | | | |
|
|
| V2 | Authentication controls | | | |
|
|
| V3 | Session management | | | |
|
|
| V4 | Access control enforcement | | | |
|
|
| V5 | Input validation and encoding | | | |
|
|
| V7 | Error handling and logging | | | |
|
|
| V8 | Data protection at rest/in transit | | | |
|
|
| V10 | Malicious code / injection resistance | | | |
|
|
|
|
## NIST SP 800-53 / 800-63-aligned checks (selected)
|
|
|
|
| Control Family | Requirement | Status | Evidence Path | Notes |
|
|
|---|---|---|---|---|
|
|
| AC | Least privilege / access enforcement | | | |
|
|
| AU | Auditable events and retention | | | |
|
|
| IA | Identity proofing and authentication federation | | | |
|
|
| SC | Cryptographic protections and key handling | | | |
|
|
| CM | Configuration and change management | | | |
|
|
| CP | Resilience / single point of failure acknowledgement | | | |
|
|
|
|
## Gap Summary
|
|
|
|
-
|