Add Resource Inventory

[anatheka]

I'm not sure if this metric is sufficient. It’s possible that we may not have a discovery for a specific resource. In that case, the metric would appear compliant, but we would be missing that resource, which should classify the metric as non-compliant.

Another possibility is that the CSP or another provider has this inventory. In that scenario, we should consider adding a property to the Ontology and verifying it. This would be my preferred approach. @anatheka

[anatheka]

Recheck in EUCS and C5 which levels of manifestation exist and which are relevant.

[immqu]

Some requirements from the EUCS:

• The CSP shall define and implement policies and procedures for maintaining an inventory of assets.
• The CSP shall record for each asset the information needed to apply the risk management procedure defined in RM-01.
• The CSP shall define and implement policies and procedures for maintaining an inventory of assets, which shall be performed automatically or by the people or teams responsible for the assets to ensure complete, accurate, valid and consistent inventory throughout the asset life cycle.
• The CSP shall record for each asset the information needed to apply the risk management procedure defined in RM-01 and the measures taken to manage the risks associated to the asset through its life cycle.
• The CSP shall define and implement policies and procedures for maintaining an inventory of assets, which shall be performed automatically and/or by the people or teams responsible for the assets to ensure complete, accurate, valid and consistent inventory throughout the asset life cycle.
• The CSP shall record for each asset the information needed to apply the risk management procedure defined in RM-01 and the measures taken to manage the risks associated to the asset through its life cycle.
• The information about assets shall be considered by monitoring applications to identify the impact on cloud services in case of events that could lead to a breach of information security objectives, and to support information provided to affected cloud customers in accordance with contractual agreements.
• The CSP shall automatically monitor the process performing the inventory of assets to guarantee it is up-to-date.

But the first question is how we integrate an "inventory" into the ontology. Do you think it should be an Infrastructure resource @anatheka ? In practice, it could be a commercial inventory software or a cloud service.

[anatheka]

Some requirements from the EUCS:

• The CSP shall define and implement policies and procedures for maintaining an inventory of assets.
• The CSP shall record for each asset the information needed to apply the risk management procedure defined in RM-01.
• The CSP shall define and implement policies and procedures for maintaining an inventory of assets, which shall be performed automatically or by the people or teams responsible for the assets to ensure complete, accurate, valid and consistent inventory throughout the asset life cycle.
• The CSP shall record for each asset the information needed to apply the risk management procedure defined in RM-01 and the measures taken to manage the risks associated to the asset through its life cycle.
• The CSP shall define and implement policies and procedures for maintaining an inventory of assets, which shall be performed automatically and/or by the people or teams responsible for the assets to ensure complete, accurate, valid and consistent inventory throughout the asset life cycle.
• The CSP shall record for each asset the information needed to apply the risk management procedure defined in RM-01 and the measures taken to manage the risks associated to the asset through its life cycle.
• The information about assets shall be considered by monitoring applications to identify the impact on cloud services in case of events that could lead to a breach of information security objectives, and to support information provided to affected cloud customers in accordance with contractual agreements.
• The CSP shall automatically monitor the process performing the inventory of assets to guarantee it is up-to-date.

But the first question is how we integrate an "inventory" into the ontology. Do you think it should be an Infrastructure resource @anatheka ? In practice, it could be a commercial inventory software or a cloud service.

Yes, I believe you’re right—it could be either an infrastructure resource or a third-party tool/service.

[anatheka]

I haven't looked at the ontology file. I do not understand why there are so many changes in one commit.