[Sec Assess WG] Mapping Security Assessments to TOC Process

[lumjjb]

This issue was created from results of the Security Assessment Improvement Working Group (#167 (comment)).

Mapping Security Assessments to TOC Process

Premise

• The security assessment aims to tie into the CNCF project process, but it is not clear how
• There is no current agreed upon requirement for the process for what is asked of a SIG

Ideas

• better document the Due Diligence process and document
• Need more detail on when the SIG recommends for the next CNCF phase
• not tie it too directly to TOC process
• CNCF needs to explicitly define the requirement for projects at each level to go through assessment
• Map security assessment process to process of CNCF
• Are assessments necessary/mandated by the TOC to move from one stage to another ? We need to make projects realize it's in their interest to invest time in going through the assessment process.

Action Items

• Create internal mapping of TOC mapping for SIG-Security (@lumjjb, @itaysk)
• Propose a hard requirement for TOC process (looking at frequency/data of incubating/graduating projects)

Logistics

• Contributors (For multiple contributors, 1 lead to coordinate)
• SIG-Representative

[itaysk]

@lumjjb I'm interested in this one

[lumjjb]

Thanks @itaysk , going to wait till end of week to see who is anyone else wants to get involved and we can set up some time to discuss.

[JustinCappos]

Are assessments necessary/mandated by the TOC to move from one stage to another ? We need to make projects realize it's in their interest to invest time in going through the assessment process.

This has been politically tough in the past. We need to get TOC buy in so doing this in coordination with folks there is key.

[stale]

This issue has been automatically marked as inactive because it has not had recent activity.

[stale]

This issue has been automatically marked as inactive because it has not had recent activity.

[anvega]

While aspirational, something that lies on the TOC and not on the TAG to align on. Closing this out as the issue has been inactive for so long now.