metrics: Fill in Amoe metric templates

metrics/Assessment Inquireies/MonitoringReviewFrequency/MonitoringReviewFrequency.yaml

@@ -0,0 +1,16 @@
+# ====== Metadata ======
+id: "d0f6a13b-e742-42ff-bf69-9ee077be3b42"
+name: "MonitoringReviewFrequency"
+description: "This rule assesses whether a [Resource] that offers the property [MonitoringProcedure], has [p1:reviewInterval] set correctly."
+implementationGuidelines:
+  AMOE:
+    question: "How often are monitoring procedures reviewed to ensure compliance with legal and internal policies?"
+    keywords: ["monitoring review", "effectiveness", "compliance", "frequency"]
+category: "Assessment Inquireies"
+version: "1.0"
+comments: "This metric assesses the frequency of monitoring procedure reviews for compliance. | Selector: PolicyDocument (Resource Type) [TargetValue is measured in months] [Previous name: MonitoringReviewFrequencyQ3]"
+# ====== Configuration ======
+configuration:
+  p1:
+    operator: "<="
+    targetValue: 12

metrics/Assessment Inquireies/MonitoringReviewFrequency/data.json

@@ -0,0 +1,4 @@
+{
+    "operator": "<=",
+    "target_value": 12
+}

metrics/Assessment Inquireies/MonitoringReviewFrequency/metric.rego

@@ -0,0 +1,23 @@
+package cch.metrics.monitoring_review_frequency_q3
+
+import data.cch.compare
+import rego.v1
+import input as document
+
+default applicable := false
+default compliant := false
+
+applicable if {
+    "PolicyDocument" in document.type
+}
+
+compliant if {
+  compare(data.operator, data.target_value, document.MonitoringProcedure.reviewInterval)
+}
+
+message := "Monitoring procedures are reviewed frequently enough to ensure compliance." if {
+  compliant
+} else := "Monitoring procedures are not reviewed frequently enough to ensure compliance. Review frequency should be within the specified interval." if {
+  not compliant
+}
+

metrics/Asset Management/AssetInventoryAuditFrequency/AssetInventoryAuditFrequency.yaml

@@ -0,0 +1,16 @@
+# ====== Metadata ======
+id: "e6eff50d-2936-4734-9764-c80350383d91"
+name: "AssetInventoryAuditFrequency"
+description: "This rule assesses whether a [Resource] that offers the property [AssetInventory], has [p1:auditInterval] set correctly."
+implementationGuidelines:
+  AMOE:
+    question: "How often is the asset inventory audit done?"
+    keywords: ["audit", "frequency", "inventory"]
+category: "Asset Management"
+version: "1.0"
+comments: "This metric assesses the frequency of asset inventory audits. | Selector: PolicyDocument (Resource Type) [TargetValue is measured in months] [Previous name: AssetInventoryAuditFrequencyQ5]"
+# ====== Configuration ======
+configuration:
+  p1:
+    operator: "<="
+    targetValue: 12

metrics/Asset Management/AssetInventoryAuditFrequency/data.json

@@ -0,0 +1,4 @@
+{
+    "operator": "<=",
+    "target_value": 12
+}

metrics/Asset Management/AssetInventoryAuditFrequency/metric.rego

@@ -0,0 +1,22 @@
+package cch.metrics.asset_inventory_audit_frequency_q5
+
+import data.cch.compare
+import rego.v1
+import input as document
+
+default applicable := false
+default compliant := false
+
+applicable if {
+    "PolicyDocument" in document.type
+}
+
+compliant if {
+  compare(data.operator, data.target_value, document.AssetInventory.auditInterval)
+}
+
+message := "Asset inventory audits are performed frequently enough." if {
+  compliant
+} else := "Asset inventory audits are not performed frequently enough. Audit frequency should be within the specified interval." if {
+  not compliant
+}

metrics/Asset Management/AssetInventoryDigitalAuditFrequency/AssetInventoryDigitalAuditFrequency.yaml

@@ -0,0 +1,16 @@
+# ====== Metadata ======
+id: "50c0d4d5-1780-473d-b7fd-dcd0a159fe60"
+name: "AssetInventoryDigitalAuditFrequency"
+description: "This rule assesses whether a [Resource] that offers the property [AssetInventory.Digital], has [p1:auditInterval] set correctly."
+implementationGuidelines:
+  AMOE:
+    question: "How frequently are security audits done for digital assets?"
+    keywords: ["data backup", "firewalls", "frequency", "compliance"]
+category: "Asset Management"
+version: "1.0"
+comments: "This metric assesses the frequency of digital asset security audits. | Selector: PolicyDocument (Resource Type) [TargetValue is measured in months] [Previous name: AssetInventoryDigitalQ6]"
+# ====== Configuration ======
+configuration:
+  p1:
+    operator: "<="
+    targetValue: 12

metrics/Asset Management/AssetInventoryDigitalAuditFrequency/data.json

@@ -0,0 +1,4 @@
+{
+    "operator": "<=",
+    "target_value": 12
+}

metrics/Asset Management/AssetInventoryDigitalAuditFrequency/metric.rego

@@ -0,0 +1,17 @@
+package cch.metrics.asset_inventory_digital_q6
+
+import data.cch.compare
+import rego.v1
+import input as document
+
+default applicable := false
+
+default compliant := false
+
+applicable if {
+    "PolicyDocument" in document.type
+}
+
+compliant if {
+    compare(data.operator, data.target_value, document:AssetInventory.Digital.auditInteval)
+}

metrics/Asset Management/AssetInventoryFrequency/AssetInventoryFrequency.yaml

@@ -0,0 +1,16 @@
+# ====== Metadata ======
+id: "1d08ba6e-dfb6-4b63-9faf-59fc56286ad2"
+name: "AssetInventoryFrequency"
+description: "This rule assesses whether a [Resource] that offers the property [AssetInventory], has [p1:inventoryInterval] set correctly."
+implementationGuidelines:
+  AMOE:
+    question: "How often is the asset inventory done?"
+    keywords: ["audit", "frequency", "inventory"]
+category: "Asset Management"
+version: "1.0"
+comments: "This metric assesses the frequency of asset inventory updates. | Selector: PolicyDocument (Resource Type) [TargetValue is measured in months] [Previous name: AssetInventoryFrequencyQ2]"
+# ====== Configuration ======
+configuration:
+  p1:
+    operator: "<="
+    targetValue: 12

metrics/Asset Management/AssetInventoryFrequency/data.json

@@ -0,0 +1,4 @@
+{
+    "operator": "<=",
+    "target_value": 12
+}

metrics/Asset Management/AssetInventoryFrequency/metric.rego

@@ -0,0 +1,17 @@
+package cch.metrics.asset_inventory_frequency_q2
+
+import data.cch.compare
+import rego.v1
+import input as document
+
+default applicable := false
+
+default compliant := false
+
+applicable if {
+    "PolicyDocument" in document.type
+}
+
+compliant if {
+    compare(data.operator, data.target_value, document:AssetInventory.inventoryInterval)
+}

metrics/Asset Management/AssetInventoryStatusManagementOptions/AssetInventoryStatusManagementOptions.yaml

@@ -0,0 +1,16 @@
+# ====== Metadata ======
+id: "9ff75498-e0b8-4ffc-b69d-bdaac9233a9d"
+name: "AssetInventoryStatusManagementOptions"
+description: "This rule assesses whether a [Resource] that offers the property [AssetInventory.AssetStatus], has [p1:statusOption] set correctly."
+implementationGuidelines:
+  AMOE:
+    question: "What status do the assets have?"
+    keywords: ["asset status", "coverage", "completeness", "inventory"]
+category: "Asset Management"
+version: "1.0"
+comments: "This metric assesses the current status of assets. | Selector: PolicyDocument (Resource Type) [Previous name: AssetInventoryStatusManagementQ4]"
+# ====== Configuration ======
+configuration:
+  p1:
+    operator: "=="
+    targetValue: "[active, inactive, under repair, disposed, donated, lost]"

metrics/Asset Management/AssetInventoryStatusManagementOptions/data.json

@@ -0,0 +1,4 @@
+{
+    "operator": "==",
+    "target_value": "[active, inactive, under repair, disposed, donated, lost]"
+}

metrics/Asset Management/AssetInventoryStatusManagementOptions/metric.rego

@@ -0,0 +1,17 @@
+package cch.metrics.asset_inventory_status_management_q4
+
+import data.cch.compare
+import rego.v1
+import input as document
+
+default applicable := false
+
+default compliant := false
+
+applicable if {
+    "PolicyDocument" in document.type
+}
+
+compliant if {
+    compare(data.operator, data.target_value, document:AssetInventory.AssetStatus.statusOption)
+}

metrics/Asset Management/AssetInventoryStatusManagementUpdateInterval/AssetInventoryStatusManagementUpdateInterval.yaml

@@ -0,0 +1,16 @@
+# ====== Metadata ======
+id: "9740e1ae-6d64-4b7e-8c26-b9a51d98a192"
+name: "AssetInventoryStatusManagementUpdateInterval"
+description: "This rule assesses whether a [Resource] that offers the property [AssetInventory.AssetStatus], has [p1:updateInterval] set correctly."
+implementationGuidelines:
+  AMOE:
+    question: "Within what timeframe must changes in asset status be recorded in the inventory system?"
+    keywords: ["asset status", "inventory"]
+category: "Asset Management"
+version: "1.0"
+comments: "This metric assesses the required timeframe for recording asset status changes. | Selector: PolicyDocument (Resource Type) [TargetValue is measured in months] [Previous name: AssetInventoryStatusManagementQ3]"
+# ====== Configuration ======
+configuration:
+  p1:
+    operator: "<="
+    targetValue: 12

metrics/Asset Management/AssetInventoryStatusManagementUpdateInterval/data.json

@@ -0,0 +1,4 @@
+{
+    "operator": "<=",
+    "target_value": 12
+}

metrics/Asset Management/AssetInventoryStatusManagementUpdateInterval/metric.rego

@@ -0,0 +1,17 @@
+package cch.metrics.asset_inventory_status_management_q3
+
+import data.cch.compare
+import rego.v1
+import input as document
+
+default applicable := false
+
+default compliant := false
+
+applicable if {
+    "PolicyDocument" in document.type
+}
+
+compliant if {
+    compare(data.operator, data.target_value, document:AssetInventory.AssetStatus.updateInterval)
+}

metrics/Asset Management/AssetInventoryStorageCheck/AssetInventoryStorageCheck.yaml

@@ -0,0 +1,16 @@
+# ====== Metadata ======
+id: "70a7b588-c5bf-4038-8e2a-8b46211ffaa2"
+name: "AssetInventoryStorageCheck"
+description: "This rule assesses whether a [Resource] that offers the property [AssetInventory], has [p1:storage] set correctly."
+implementationGuidelines:
+  AMOE:
+    question: "In which type of facility are asset records stored?"
+    keywords: ["asset records", "facility type", "storage"]
+category: "Asset Management"
+version: "1.0"
+comments: "This metric assesses the facility type used to store asset records. | Selector: PolicyDocument (Resource Type) [Previous name: AssetInventoryStorageCheckQ1]"
+# ====== Configuration ======
+configuration:
+  p1:
+    operator: "isIn"
+    targetValue: "[centrally, decentralized, distributed, central]"

metrics/Asset Management/AssetInventoryStorageCheck/data.json

@@ -0,0 +1,4 @@
+{
+    "operator": "isIn",
+    "target_value": "[centrally, decentralized, distributed, central]"
+}

metrics/Asset Management/AssetInventoryStorageCheck/metric.rego

@@ -0,0 +1,17 @@
+package cch.metrics.asset_inventory_storage_check_q1
+
+import data.cch.compare
+import rego.v1
+import input as document
+
+default applicable := false
+
+default compliant := false
+
+applicable if {
+    "PolicyDocument" in document.type
+}
+
+compliant if {
+    compare(data.operator, data.target_value, document:AssetInventory.storage)
+}

metrics/Change and Configuration Managment/AccessControlType/AccessControlType.yaml

@@ -0,0 +1,16 @@
+# ====== Metadata ======
+id: "7bd89d65-02ad-480a-ad5f-06ba661d15b0"
+name: "AccessControlType"
+description: "This rule assesses whether a [Resource] that offers the property [AccessControl], has [p1:type] set correctly."
+implementationGuidelines:
+  AMOE:
+    question: "Which type of access control is used?"
+    keywords: ["access control", "security model", "permissions", "RBAC", "DAC", "MAC"]
+category: "Change and Configuration Managment"
+version: "1.0"
+comments: "This metric assesses the type of access control implemented. | Selector: PolicyDocument (Resource Type) [Previous name: AccessControlTypeQ1]"
+# ====== Configuration ======
+configuration:
+  p1:
+    operator: "isIn"
+    targetValue: "[RBAC, DAC, MAC]"

metrics/Change and Configuration Managment/AccessControlType/data.json

@@ -0,0 +1,4 @@
+{
+    "operator": "isIn",
+    "target_value": "[RBAC, DAC, MAC]"
+}

metrics/Change and Configuration Managment/AccessControlType/metric.rego

@@ -0,0 +1,17 @@
+package cch.metrics.access_control_type_q1
+
+import data.cch.compare
+import rego.v1
+import input as document
+
+default applicable := false
+
+default compliant := false
+
+applicable if {
+    "PolicyDocument" in document.type
+}
+
+compliant if {
+    compare(data.operator, data.target_value, document:AccessControl.type)
+}

metrics/Communication Security/NetworkSecurityPolicyMitigationScope/NetworkSecurityPolicyMitigationScope.yaml

@@ -0,0 +1,16 @@
+# ====== Metadata ======
+id: "e70bb32d-5313-44df-9668-df5669e764f6"
+name: "NetworkSecurityPolicyMitigationScope"
+description: "This rule assesses whether a [Resource] that offers the property [NetworkSecurity], has [p1:mitigationScope] set correctly."
+implementationGuidelines:
+  AMOE:
+    question: "Which network-level attacks are mitigated by the implemented mechanisms?"
+    keywords: ["network security", "DoS", "DDoS", "proxy", "IDS", "Denial of service protection"]
+category: "Communication Security"
+version: "1.0"
+comments: "This metric assesses the network-level attacks addressed by implemented mechanisms. | Selector: PolicyDocument (Resource Type) [Previous name: NetworkSecurityPolicy01]"
+# ====== Configuration ======
+configuration:
+  p1:
+    operator: "isIn"
+    targetValue: "[dos, denial of service]"

metrics/Communication Security/NetworkSecurityPolicyMitigationScope/data.json

@@ -0,0 +1,4 @@
+{
+    "operator": "isIn",
+    "target_value": "[dos, denial of service]"
+}

metrics/Communication Security/NetworkSecurityPolicyMitigationScope/metric.rego

@@ -0,0 +1,17 @@
+package cch.metrics.network_security_policy01
+
+import data.cch.compare
+import rego.v1
+import input as document
+
+default applicable := false
+
+default compliant := false
+
+applicable if {
+    "PolicyDocument" in document.type
+}
+
+compliant if {
+    compare(data.operator, data.target_value, document:NetworkSecurity.mitigationScope)
+}

metrics/Compliance/ComplianceManagementAuditInterval/ComplianceManagementAuditInterval.yaml

@@ -0,0 +1,16 @@
+# ====== Metadata ======
+id: "df639bbe-64df-406a-87ac-5935fb5a922b"
+name: "ComplianceManagementAuditInterval"
+description: "This rule assesses whether a [Resource] that offers the property [Audit], has [p1:interval] set correctly."
+implementationGuidelines:
+  AMOE:
+    question: "How often are procedures checked and that all requirements are met?"
+    keywords: ["compliance checks", "frequency", "requirements verification"]
+category: "Compliance"
+version: "1.0"
+comments: "This metric assesses the frequency of checks for compliance with requirements. | Selector: PolicyDocument (Resource Type) [TargetValue is measured in months] [Previous name: ComplianceManagementQ2]"
+# ====== Configuration ======
+configuration:
+  p1:
+    operator: "<="
+    targetValue: 12

metrics/Compliance/ComplianceManagementAuditInterval/data.json

@@ -0,0 +1,4 @@
+{
+    "operator": "<=",
+    "target_value": 12
+}