We’ve implemented and adapted an open source compliance framework. Now we're sharing our process and tools so you can adapt and customize it too.

Common control framework mapping

When you download the Adobe CCF you get two PDF documents: a whitepaper on the state of compliance at Adobe and a table of all the generic CCF controls. The first thing we did was to convert the CCF controls PDF to a CSV so we could more easily make changes to the data. Most of these changes were to make the control statements specific to GitLab and our compliance needs.

Unified Compliance Framework

A wheel bearing assembly consists of rolling elements, such as hardened steel ball bearings or roller bearings, that roll on and around hardened steel bearing races. The wheel bearings support the front and rear axle, and all the weight of your car. Wheel bearings are made with a high-precision technique using extremely hard steel in order to withstand all the normal impacts that occur to the wheel and tire assembly as you drive along the road.

Secure Controls Framework

Growling or grinding noise from a wheel. Failed or failing wheel bearings make a very characteristic growling noise which will grow louder as the bearing wear progresses. If you believe the wheel bearing noise is coming from one side of the car, you can self-diagnosis your wheel bearing as you drive the car by loading and unloading vehicle weight You can do this by “swerving” from side-to-side. For example, if the noise markedly increases when you swerve to left, which shifts the vehicle’s weight to the right, then it often indicates the wheel bearing on the right is failing.

Axial or radial play in the wheel or wheel hub. Should the wheel hub move up and down or in and out, the bearing may be worn.

We were careful when making changes to ensure that we weren't changing anything foundational about the statement, as this could break the mapping to underlying requirements. For example, PCI DSS states that an organization must “run internal and external network vulnerability scans at least quarterly and after any significant change in the network (such as new system component installations, changes in network topology, firewall rule modifications, product upgrades).” If you were to make the frequency of the Vulnerability Scans control “annual” instead of “quarterly,” that control would no longer map to PCI DSS control 11.2 since that underlying PCI control requires at least quarterly scanning.

We’re currently working on scripts that turn SOC2 and HIPAA-related controls into individual issues within a GitLab project. We’re also working on a CSV-to-JSON tool that would easily convert the control CSV into a large data blob, making deployment for certain organizations easier.

There are 184 default controls. This number will expand or contract based on your individual needs. For example, if you have a need for FedRamp certification you might have different control requirements than an organization that doesn't. This is a lot of controls to try and roll out all at once, and most organizations don’t need to address all of the underlying control frameworks simultaneously. At GitLab, we knew that a SOC2 certification was the first compliance priority for us and, based on these needs, we started by prioritizing all controls that mapped to SOC2’s Common Criteria. This gave us a list of 63 controls – a much more manageable starting point.

CiscoCCF

In my previous blog post, I talked about how GitLab went about choosing an overarching compliance framework that would optimize satisfying the requirements of underlying regulatory or industry best practice requirements. Today I’m blogging about the next steps in that process, and will walk through how we implemented the Adobe open source compliance framework (CCF) and adapted it to our needs, resulting in the GitLab Control Framework (GCF).

We plan to make these tools available as they are ready but we also want to hear from you. What features would make the adoption of these controls easier? How are you using GitLab to help with your compliance needs? What else can GitLab contribute to the security compliance industry to help companies of all sizes align with security best practices and reduce the effort needed for external security validations/certifications? Leave us a comment below!

The above steps each build on the previous ones, and help to ensure enough baseline context and requirements were established and that we understood the context and scope for each control sufficiently to perform the gap analysis.

Common controls Framework Excel

The complexity of wheel bearing replacement varies greatly depending on the vehicle make, model, year, the wheel position (front versus rear), and the drive type (AWD versus FWD):

No. Wheel bearing failure is usually gradual, although in some cases it starts immediately after the dramatic impact of the wheel and tire assembly with a deep pothole. Wheel bearings can sometimes make noise for quite some time before you experience a catastrophic failure that would result in complete separation of the wheel and tire assembly from the axle. Generally, the risk of sudden failure increases with the noise level. But strictly speaking, once the bearing has started to fail it is impossible to predict exactly when it will fail completely. So it should not continue to be driven. Were a failing bearing to seize or break while you are moving, you could experience loss of control of the vehicle. Once you receive a conclusive diagnostic that a wheel bearing has failed, replace the bearing promptly.

Ccf automationtraining

Our goal in sharing the details behind our compliance framework implementation is to lessen the adoption effort for smaller companies and GitLab customers alike. We’ve created a public repo that has a copy of the csv file we adapted from the Adobe CCF and a link to a view-only Google Sheet with all of these controls and variables in place to make adaptation to your organization as easy as possible.

For these 63 controls we wanted to build out additional content relating to each. In particular, we wanted a Markdown file that addressed each of the following topics for each control:

Adobe Common Controls Framework

We found it helpful to create a prefix for each domain (e.g. AM for Asset Management, BC for Business Continuity, etc.) of controls and use these to create control numbers for each control (e.g. AM.1.01, BC.1.04, etc.). With this information in place, the real fun started.

Most of this information can be seen within the security control pages in our handbook; however, some of these topics contain sensitive information so we have a repo only accessible to GitLab team members.

On average, the cost for a Dodge Dart Wheel Bearings Replacement is $170 with $30 for parts and $140 for labor. Prices may vary depending on your location.

Tire and wheel assembly does not turn smoothly. With the wheel jacked up, and the car not in gear, the wheel should rotate smoothly. Rough or inconsistent movement, which is often accompanied by noise, can signify damaged bearings. Be sure the brakes are not dragging as you perform this check.

Vibration in the steering wheel or vehicle body and/or wandering. Vibration and lack of directional stability could be consequences of loose or worn out wheel bearings.