Submit baseline updates for CISA review and approval

[mitchelbaker-cisa]

💡 Summary

As part of the new continuous baseline update process, we will have to submit Word documents which reflect any additions/revisions/deletions to the baselines.

Planned baseline updates for ScubaGoggles v0.2:

1. Common Controls

• Remove GWS.COMMONCONTROLS.6.1v0.1, GWS.COMMONCONTROLS.9.1, GWS.COMMONCONTROLS.9.3v0.1, GWS.COMMONCONTROLS.9.4v0.1, and GWS.COMMONCONTROLS.12.1v0.1. (PR #150)
• Add additional ATT&CK TTP mappings. (Common Controls - PR #103)
• Swapped Implementation step 2 in GWS.COMMONCONTROLS.11.4v0.1 and GWS.COMMONCONTROLS.11.5v0.1 (PR #144)

2. Gmail

• Various spelling and wording improvements. (Gmail - PR #140)
• Revise GWS.GMAIL.3.2v0.1 (now 3.1) to clarify actions for non-approved addresses. (PR #188)
• Removed Attachment Filtering Policies from Gmail (PR #156)
• Remove GWS.GMAIL.3.1v0.1, GWS.GMAIL.12.1v0.1, GWS.GMAIL.15.2v0.1, GWS.GMAIL.19.1v0.1, GWS.GMAIL.19.2v0.2, GWS.GMAIL.22.1v0.1, GWS.GMAIL.22.2v0.1, GWS.GMAIL.23.1v0.1, GWS.GMAIL.23.2v0.1, GWS.GMAIL.23.3v0.1, and GWS.GMAIL.23.4v0.1. (PR #138)

3. Calendar

• Various spelling and wording improvements. (Calendar - PR #136)
• Remove GWS.CALENDAR.1.2v0.1, GWS.CALENDAR.3.2v0.1. (PR #134)
• Refactor Rationales for Calendar, Classroom, and Sites (PR #218)

4. Chat

• Added Policy Group 7 and changed Policy 1.1 to a SHOULD in Google Chat Baseline (PR #187)
• Combine Chat 4.1 and 4.2 (PR #207)

5. Classroom

• Various spelling and wording improvements. (Classroom - PR #123)

6. Drive

• Various spelling and wording improvements. (Drive/Docs - PR #128)
• Change GWS.DRIVEDOCS.1.3v0.1 to SHALL. (PR #183)
• Remove GWS.DRIVEDOCS.2.1v0.1. (PR #130)
• Changed instructions for GWS.DRIVEDOCS.1.7v0.1 (PR #155)
• Fixed GWS.DRIVEDOCS.6.1v0.1 Implementation Steps (PR #162)

7. Meet

• Various spelling and wording improvements. (Meet - PR #126)
• Meet 1.1 changed to SHOULD (PR #205)

Motivation and context

Get CISA approval of latest baseline updates for Glacier release.

Implementation notes

Please provide details for implementation, such as:

• For each new update, it must be highlighted with a comment. For each comment it must be labeled with “Web Content Update” and a simple description of the update.

Acceptance criteria

How do we know when this work is done?

• Word document versions are updated with comments for each new baseline update
• Documents are forwarded to PMSS to prepare for CISA review
• Track duration of each review step to improve future iterations for conducting baseline review