Draft: Establish a dedicated "NIST Mode" for easing compliance #275
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR introduces a new variable,
nist_mode
, which, when set totrue
overrides other variables within the module to guarantee certain values for compliance purposes.In the context of this module, the changes made can be seen in the updates to the README, which documents both what requirements are being met and what variables are overridden to achieve this.
Motivation and Context
There are some environments, especially those in the government space, where adherence to NIST SP 800-53 standards is required. Rather than creating separate modules that enforce these requirements, this allows users in those environments to continue using these community supported modules by setting a single variable to ensure compliance requirements are met.
Breaking Changes
This should not introduce any breaking changes to uses who do not enable
nist_mode.
The default fornist_mode
is set to false, which means that the module should continue to perform exactly as it currently does for users who have not enablednist_mode.
Enablingnist_mode
overrides certain variables, as documented in the README, which could result in breaking changes for module implementations that would have been out of compliance before settingnist_mode
totrue
.How Has This Been Tested?
examples/*
to demonstrate and validate my change(s)examples/*
projectspre-commit run -a
on my pull request