Skip to content

Layer 2->3->4 schema relationships #157

@eddie-knight

Description

@eddie-knight

After all the recent changes were applied, Layer 4 feels like it needs a big cleanup of how we're managing cross-document references.

I think we're gonna need to remove some mappings to reduce redundancy and focus on the important pivots. And we need to add mapping references. And probably include some connection to the policy in the evaluation plan.

erDiagram

    %% === Core Document Structures ===
    EvaluationPlan {
        Metadata metadata
        AssessmentPlan[] plans
    }

    AssessmentPlan {
        string controlId "<- FK to Layer 2"
        Assessment[] assessments
    }


    Metadata {
        string id "PK"
        string version "optional"
        Evaluator evaluator
    }

    Evaluator {
        string name
        string uri "optional"
        string version "optional"
        Contact contact "optional"
    }

    ControlEvaluation {
        string name
        string controlId "<- FK to Layer 2"
        Result result
        string message
        AssessmentLog[] assessmentLogs
    }

    Assessment {
        string requirementId "<- FK to Layer 2"
        AssessmentProcedure[] procedures
    }

    AssessmentProcedure {
        string id "PK"
        string name
        string description
        string documentation "optional, URL"
    }

    AssessmentLog {
        string requirementId "<- FK to Layer 2"
        string procedureId "<- FK, optional"
        string[] applicability
        string description
        Result result
        string message
        string[] steps
        int stepsExecuted "optional"
        datetime start
        datetime end "optional"
        string recommendation "optional"
    }

    EvaluationLog {
        ControlEvaluation[] evaluations
        Metadata metadata "optional"
    }

    Result {
        string value "Not Run<br>Passed<br>Failed<br>Needs Review<br>Not Applicable<br>Unknown"
    }

    %% === Relationships ===


    EvaluationPlan }o--|{ AssessmentPlan : "contains"
    AssessmentPlan }o--|{ Assessment : "contains"
    Assessment }o--|{ AssessmentProcedure : "defines"

    EvaluationPlan |o--|| Metadata : "contains"
    EvaluationLog |o--|| Metadata : "contains"
    Metadata |o--|| Evaluator : "contains"

    EvaluationLog }o--|{ ControlEvaluation : "contains"

    ControlEvaluation }o--|{ AssessmentLog : "contains"

    AssessmentLog }o--|| AssessmentProcedure : "FK references"
    AssessmentLog ||--|| Result : "type"
    ControlEvaluation ||--|| Result : "type"

    style EvaluationPlan stroke:#6CE3F0,stroke-width:2px
    style EvaluationLog stroke:#6CE3F0,stroke-width:2px



    L3_PolicyDocument {
        L3_Metadata metadata
        L3_Contacts contacts "! duplicate field !"
        L3_Scope scope
        L3_ImplementationPlan implementationPlan "optional"
        L3_Mapping[] guidanceReferences
        L3_Mapping[] controlReferences
    }

    L3_Metadata {
        string id "PK"
        string title
        string objective
        string version
        L3_Contacts contacts "! duplicate field !"
        string lastModified
        string organizationId "optional"
        string authorNotes "optional"
        L3_MappingReference[] mappingReferences "optional"
    }

    L3_Contacts {
        L3_Contact author
        L3_Contact[] responsible
        L3_Contact[] accountable
        L3_Contact[] consulted "optional"
        L3_Contact[] informed "optional"
    }

    L3_ImplementationPlan {
        string notificationProcess "optional"
        L3_NotificationGroup[] notifiedParties "optional"
        L3_ImplementationDetails evaluation
        L3_EvaluationPoint[] evaluationPoints "optional"
        L3_ImplementationDetails enforcement
        L3_EnforcementMethod[] enforcementMethods "optional"
        string noncompliancePlan "optional"
    }

    L3_ImplementationDetails {
        datetime start
        datetime end "optional"
        string notes
    }

    L3_Scope {
        string[] boundaries "optional"
        string[] technologies "optional"
        string[] providers "optional"
    }

    L3_Mapping {
        string referenceId
        L3_Scope inL3_Scope
        L3_Scope outOfL3_Scope
        L3_ControlModifier[] controlModifications
        L3_AssessmentRequirementModifier[] assessmentRequirementModifications
        L3_GuidelineModifier[] guidelineModifications
    }

    L3_ControlModifier {
        string targetId
        L3_ModType modificationType
        string modificationRationale
        string title "optional"
        string objective "optional"
    }

    L3_AssessmentRequirementModifier {
        string targetId
        L3_ModType modificationType
        string modificationRationale
        string text
        string[] applicability
        string recommendation "optional"
    }

    L3_GuidelineModifier {
        string targetId
        L3_ModType modificationType
        string modificationRationale
        string title
        string objective "optional"
        string[] recommendations "optional"
        string baseL3_GuidelineId "optional"
        string rationale "optional"
        L3_Mapping[] guidelineL3_Mappings "optional"
        L3_Mapping[] principleL3_Mappings "optional"
        string[] seeAlso "optional"
        string[] externalReferences "optional"
    }

    L3_Contact {
        string name
        bool primary
        string affiliation "optional"
        string email "optional"
        string social "optional"
    }

    L3_MappingReference {
        string id "PK"
        string title
        string version
        string description "optional"
        string url "optional"
    }

    L3_EvaluationPoint {
        string value "development-tools<br>pre-commit-hook<br>pre-merge<br>pre-build<br>pre-release<br>pre-deploy<br>runtime-adhoc<br>runtime-scheduled<br>runtime-reactive"

    }

    L3_EnforcementMethod {
        string value "Deployment Gate<br>Autoremediation<br>Manual Remediation"
    }

    L3_NotificationGroup {
        string value "Responsible<br>Acccountable<br>Consulted<br>Informed"
    }

    L3_ModType {
        string value "increase-strictness<br>clarify<br>reduce-strictness<br>exclude"
    }

    L3_Mapping {
        string referenceId
        L3_MappingEntry[] entries
        string remarks "optional"
    }

    L3_MappingEntry {
        string referenceId
        int strength
        string remarks "optional"
    }

    L3_PolicyDocument |o--|| L3_Contacts : "contains"
    L3_PolicyDocument |o--|| L3_Metadata : "contains"
    L3_PolicyDocument }o--|{ L3_Mapping : "contains"
    L3_PolicyDocument |o--|| L3_Scope : "contains"
    L3_PolicyDocument |o--|| L3_ImplementationPlan : "contains"

    L3_Metadata |o--|| L3_Contacts : "contains"
    L3_Metadata }o--|{ L3_MappingReference : "contains"

    L3_Contacts }o--|{ L3_Contact : "uses"

    L3_Mapping |o--|{ L3_MappingEntry : "contains"
    L3_MappingEntry }|--|| L3_MappingReference : "references"

    L3_Mapping |o--|{ L3_ControlModifier : "contains"
    L3_Mapping |o--|{ L3_AssessmentRequirementModifier : "contains"
    L3_Mapping |o--|{ L3_GuidelineModifier : "contains"
    
    L3_ControlModifier }|--|| L3_ModType : "type"
    L3_AssessmentRequirementModifier }|--|| L3_ModType : "type"
    L3_GuidelineModifier }|--|| L3_ModType : "type"

    L3_ImplementationPlan |o--|| L3_ImplementationDetails : "contains"
    L3_ImplementationPlan }o--|{ L3_EvaluationPoint : "type"
    L3_ImplementationPlan }o--|{ L3_EnforcementMethod : "type"
    L3_ImplementationPlan }o--|{ L3_NotificationGroup : "type"

    style L3_PolicyDocument stroke:#6CE3F0,stroke-width:2px

    L2_Mapping {
        L2_MappingEntry[] entries
        string referenceId "<- FK"
        string remarks "optional"
    }

    L2_MappingEntry {
        string referenceId "<- FK"
        int strength
        string remarks "optional"
    }

    L2_Catalog {
        L2_CatalogMetadata metadata "optional"
        L2_ControlFamily[] controlFamilies "optional"
        L2_Threat[] threats "optional"
        L2_Capability[] capabilities "optional"
        L2_Mapping[] importedL2_Controls "<- FK implicit, optional"
        L2_Mapping[] importedL2_Threats "<- FK implicit, optional"
        L2_Mapping[] importedCapabilities "<- FK implicit, optional"
    }

    L2_CatalogMetadata {
        string id "PK"
        string title
        string description
        string version "optional"
        string lastModified "optional"
        Category[] applicabilityCategories "optional"
        L2_MappingReference[] mappingReferences "optional"
    }

    maps-to ||--|| L2_Mapping : "represents"
    L2_Mapping |o--|{ L2_MappingEntry : "contains"
    L2_Mapping }|--|| L2_MappingReference : "FK references"

    Category {
        string id "PK"
        string title
        string description
    }

    L2_ControlFamily {
        string id "PK"
        string title
        string description
        L2_Control[] controls
    }

    L2_Control {
        string id "PK"
        string title
        string objective
        L2_AssessmentRequirement[] assessmentRequirements
        L2_Mapping[] guidelineL2_Mappings "<- FK implicit, optional"
        L2_Mapping[] threatL2_Mappings "<- FK implicit, optional"
    }

    L2_Threat {
        string id "PK"
        string title
        string description
        L2_Mapping[] capabilities "<- FK implicit"
        L2_Mapping[] externalL2_Mappings "<- FK implicit, optional"
    }

    L2_Capability {
        string id "PK"
        string title
        string description
    }

    L2_AssessmentRequirement {
        string id "PK"
        string text
        string[] applicability "<- FK"
        string recommendation "optional"
    }

    %% ================================= %%
    %% === L2_Mapping Objects           === %%
    %% ================================= %%
    L2_MappingReference {
        string id "PK"
        string title
        string version
        string description "optional"
        string url "optional"
    }

    ExternalEntry {
        string id "PK"
    }

    %% --- L2_Catalog Relationships ---
    L2_Catalog |o--|| L2_CatalogMetadata : "contains"
    L2_Catalog |o--|{ L2_ControlFamily : "contains"
    L2_Catalog |o--|{ L2_Threat : "contains"
    L2_Catalog |o--|{ L2_Capability : "contains"

    L2_ControlFamily |o--|{ L2_Control : "contains"

    L2_Control |o--|{ L2_AssessmentRequirement : "contains"
    L2_Control }|--|| L2_Threat : maps-to

    L2_Threat }|--|| L2_Capability : maps-to

    L2_AssessmentRequirement }|--|| Category : "FK references"
    L2_CatalogMetadata |o--|{ L2_MappingReference : "contains"
    L2_CatalogMetadata |o--|{ Category : "contains"

    L2_MappingReference |o--|{ ExternalEntry : "Assumed to contain"
    L2_MappingEntry }|--|| ExternalEntry : "FK references"

    style maps-to color:#f9f,stroke:#f9f,stroke-width:2px
    style L2_Catalog stroke:#6CE3F0,stroke-width:2px

    Assessment ||--|| L4_L2_FK : ""
    AssessmentPlan ||--|| L4_L2_FK : ""
    AssessmentLog ||--|| L4_L2_FK : ""
    ControlEvaluation ||--|| L4_L2_FK : ""

    L3_MappingReference ||--|| L3_L2_REF : ""

    L3_L2_REF ||--|| L2_Catalog : ""
    L4_L2_FK ||--|| L2_Catalog : ""
    

Loading

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions