Guidelines

[jlyon]

DOD spreadsheet: https://docs.google.com/spreadsheets/d/1LjOoaIOjgY5U2LCM_bTS0BT-7aanbLz2nULdnuVfMpc/edit#gid=1657269414

Spreadsheet of NIST low-impact stories: https://docs.google.com/a/albatrossdigital.com/spreadsheets/d/1KgLRwNHvjJDOMY7RSj4SCNCUDz5Vhldg_ZCLc9qk6wk/edit?usp=sharing

• focus on P1s

• ignore physical env (PE)

• ignore PS

• ignore MA

• ignore MP

• For Phase I: We only care abut the Control Description, we don't care about the Control Enhancements

• If 2 controls are related, we don't nec need separate stories

• Reason we're doing this: To have this make sense to us as a developer. Try to let dev see that if x is done, there will be a benefit (client will be happy)

• difference btwn knowledge transfer (system documentation) and performance support (stack overflow, GovReady Dashboard)

• GovReady philosophy: We can meet you where you're at

  • Gather the data and transfer it into a useful format

[jlyon]

Resources from http://safecode.org/

• http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf