extracted_sl5_overlay.json

{
  "IR-11": {
    "name": "EXERCISE TOOLING",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IR-12": {
    "name": "EXPLICIT REVOCATION",
    "attributes": {
      "Open Questions": "Should this go in a different family?"
    },
    "selected": false
  },
  "IR-12(1)": {
    "name": "Explicit Revocation | Avoid Self Revoking",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IR-13": {
    "name": "STATE ENCODING",
    "attributes": {
      "Open Questions": "Should I do more to say what is potentially included in state?"
    },
    "selected": false
  },
  "IR-13(1)": {
    "name": "State Encoding | Infrastructure as Code",
    "attributes": {
      "Open Questions": "Should this be its own primary control? Should we specify declarative or imperative, is one better for security?"
    },
    "selected": false
  },
  "IR-14": {
    "name": "KNOWN GOOD COPIES",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IR-14(1)": {
    "name": "Known Good Copies | Disconnected Storage",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IR-15": {
    "name": "QUARANTINE",
    "attributes": {
      "Open Questions": "Should we have an enhancement specifying automatic disconnection? This should be partially enabled by zero trust by default."
    },
    "selected": false
  },
  "IR-16": {
    "name": "DEVICES RESETTING",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IR-16(1)": {
    "name": "Device Resetting | Golden Images",
    "attributes": {
      "Open Questions": "Should this just be combined with the Golden Images control?"
    },
    "selected": false
  },
  "IR-17": {
    "name": "NODE RESETTING",
    "attributes": {
      "Open Questions": "Is “node” the right term to be using, maybe “cluster,” or “group”?"
    },
    "selected": false
  },
  "IR-17(1)": {
    "name": "Node Resetting | Routine Resets",
    "attributes": {
      "Open Questions": "Would we ever want this except in the context of a full network reset?"
    },
    "selected": false
  },
  "IR-18": {
    "name": "FULL NETWORK RESETTING",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IR-18(1)": {
    "name": "Full Network Resetting | Routine Resets",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IR-18(2)": {
    "name": "Full Network Resetting | Credential Rotation",
    "attributes": {
      "Open Questions": "How do these new credentials get created by or distributed to their owners?"
    },
    "selected": false
  },
  "IR-19": {
    "name": "DATA RECOVERY",
    "attributes": {
      "Open Questions": "How is data saved, how do we determine backups predate compromise, how do we sanitize if not?"
    },
    "selected": false
  },
  "IR-20": {
    "name": "MODEL ISOLATION",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IR-21": {
    "name": "SEPARATE COMMUNICATIONS",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IR-22": {
    "name": "BYPASSING REVIEW AND VERSION CONTROL",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IR-23": {
    "name": "TECHNICAL DEBT",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IS-02": {
    "name": "INTERFACE INVENTORY AND CLASSIFICATION",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IS-02(1)": {
    "name": "Interface Inventory and Classification | Automated Discovery",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IS-03": {
    "name": "INTERFACE AUTHENTICATION",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IS-03(1)": {
    "name": "Interface Authentication | Dedicated Devices",
    "attributes": {
      "Open Questions": "Should we add another enhancement about device attestation?"
    },
    "selected": false
  },
  "IS-04": {
    "name": "INTERFACE AUTHORIZATION",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IS-05": {
    "name": "INTERFACE SESSION MANAGEMENT AND TRUST",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IS-05(1)": {
    "name": "Interface Session Management and Trust | Session Anomaly Detection",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IS-06": {
    "name": "INTERFACE LOGGING",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IS-06(1)": {
    "name": "Interface Logging | Log Content",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IS-07": {
    "name": "RATE LIMITS",
    "attributes": {
      "Open Questions": "Will there need to be exceptions for this?"
    },
    "selected": false
  },
  "IS-07(1)": {
    "name": "Rate Limits | Isolate Rate Limiting Mechanism",
    "attributes": {
      "Open Questions": "Is the sort of “rate limiting” this control refers to the same as the parent?"
    },
    "selected": false
  },
  "IS-08": {
    "name": "API INPUT FILTERING",
    "attributes": {
      "Open Questions": "Should requests with suspicious content be filtered and processed rather than rejected? This could allow for a better user experience, and a higher tolerance for false positives."
    },
    "selected": false
  },
  "IS-09": {
    "name": "API OUTPUT FILTERING",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IS-09(1)": {
    "name": "API Output Filtering | Side-Channel Attack Prevention",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "IS-09(2)": {
    "name": "API Output Filtering | Covert Channel Detection and Prevention",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "NS-02": {
    "name": "NETWORK SEPARATION",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "NS-02(1)": {
    "name": "Network Separation | Development and Testing Network",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "NS-02(2)": {
    "name": "Network Separation | Large Experiment Network",
    "attributes": {
      "Open Questions": "Would we even want this ever?"
    },
    "selected": false
  },
  "NS-03": {
    "name": "MINIMAL CUSTOMER INFERENCE NETWORK",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "NS-04": {
    "name": "AIR GAPPING",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "NS-04(1)": {
    "name": "Air Gapping | Verification",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "NS-05": {
    "name": "INTERNAL NETWORK NODES",
    "attributes": {
      "Open Questions": "Is “node” the right term here?"
    },
    "selected": false
  },
  "NS-06": {
    "name": "DATA TRANSFER",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "NS-07": {
    "name": "IMPORT AND EXPORT VALIDATION",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "NS-08": {
    "name": "MODEL TIERING",
    "attributes": {
      "Open Questions": "Should this be in a different family?"
    },
    "selected": false
  },
  "NS-9": {
    "name": "MODEL SANDBOXING",
    "attributes": {
      "Open Questions": "Should this be in a different family?"
    },
    "selected": false
  },
  "NS-10": {
    "name": "BACKUP STORAGE",
    "attributes": {
      "Open Questions": "Should this be in a different family?"
    },
    "selected": false
  },
  "SC-52": {
    "name": "EXPOSED INTERCONNECTIONS",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "SC-52(1)": {
    "name": "Exposed Interconnect | Tamperproofing",
    "attributes": {
      "Open Questions": "Is it feasible or within a reasonable cost to tamperproof this many cables? What about the fact that standard tamperproof enclosures are meant to remain closed permanently, but this sort of enclosure may require occasional access?"
    },
    "selected": false
  },
  "SC-53": {
    "name": "BANDWIDTH LIMITING",
    "attributes": {
      "Open Questions": "Should probably add more here"
    },
    "selected": false
  },
  "SC-54": {
    "name": "SIGNAL PADDING",
    "attributes": {
      "Open Questions": "​ ​"
    },
    "selected": false
  },
  "SC-55": {
    "name": "QUANTUM-RESISTANT CRYPTOGRAPHY",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "SC-56": {
    "name": "PERFECT FORWARD SECRECY",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "SC-57": {
    "name": "TRANSFER MEDIA MULTIPARTY AUTHENTICATION",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "SC-58": {
    "name": "TRANSFER MEDIA CHAIN OF CUSTODY",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "SC-59": {
    "name": "TRANSFER MEDIA CRYPTOGRAPHIC PROTECTION",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "SC-60": {
    "name": "TRANSFER MEDIA SANITATION",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "SC-61": {
    "name": "SIDE-CHANNEL PROTECTION",
    "attributes": {
      "Open Questions": "Should we consider additional side channels?"
    },
    "selected": false
  },
  "SC-61(1)": {
    "name": "Side-Channel Protection | Power Analysis",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "SC-61(2)": {
    "name": "Side-Channel Protection | Cache Timing",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "SC-61(3)": {
    "name": "Side-Channel Protection | Electromagnetic Emanation",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "SC-62": {
    "name": "INLINE NETWORK ENCRYPTORS",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "SC-62(1)": {
    "name": "Inline Network Encryptors | Type 1 Encryptors",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "ZT-02": {
    "name": "ZERO TRUST",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "ZT-03": {
    "name": "PER-SESSION ACCESS",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "ZT-04": {
    "name": "POLICY ENFORCEMENT POINTS",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "ZT-04(1)": {
    "name": "Policy Enforcement Points | Hidden Resources",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "ZT-05": {
    "name": "POLICY ENGINE",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "ZT-06": {
    "name": "POLICY ADMINISTRATOR",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "ZT-07": {
    "name": "POLICY ADMINISTRATOR ACCESS",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "ZT-08": {
    "name": "MANAGED ASSETS",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "ZT-08(1)": {
    "name": "Managed Assets | TPM",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "ZT-08(2)": {
    "name": "Managed Assets | Asset Inventory",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "ZT-08(3)": {
    "name": "Managed Assets | No BYOD",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "ZT-09": {
    "name": "NETWORK TRAFFIC LOGGING",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "ZT-09(1)": {
    "name": "Network Traffic Logging | Dynamic Policy Updates",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "ZT-10": {
    "name": "CONTROL PLANE SEPARATION",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  },
  "ZT-11": {
    "name": "SCALABILITY",
    "attributes": {
      "Open Questions": ""
    },
    "selected": false
  }
}