npm - ccs-digitalmarketplace-frameworks - Versions diffs - 4.11.28 → 4.11.30 - Mend

ccs-digitalmarketplace-frameworks 4.11.28 → 4.11.30

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (69) hide show

package/frameworks/g-cloud-15/manifests/edit_service_as_admin.yml CHANGED Viewed

@@ -152,18 +152,35 @@
 - name: Operational security
   editable: True
   questions:
+    - configurationAndChangeManagementType
     - configurationAndChangeManagementProcesses
+    - vulnerabilityManagementType
     - vulnerabilityManagementApproach
+    - protectiveMonitoringType
     - protectiveMonitoringApproach
+    - incidentManagementType
     - incidentManagementApproach
+- name: Staff security
+  editable: True
+  questions:
+    - staffSecurityClearanceChecks
+    - governmentSecurityClearances
+- name: Secure development
+  editable: True
+  questions:
+    - secureDevelopment
 - name: Identity and authentication
   editable: True
   questions:
+    - multiqUserAuthenticationHosting
     - multiqUserAuthenticationSoftware
     - accessRestrictionManagementAndSupport
     - accessRestrictionTesting
     - multiqManagementAccess
+    - devicesUsersManageTheServiceThrough
 - name: Audit information for users
   editable: True

package/frameworks/g-cloud-15/manifests/edit_submission.yml CHANGED Viewed

@@ -181,19 +181,38 @@
   editable: False
   edit_questions: True
   questions:
+    - configurationAndChangeManagementType
     - configurationAndChangeManagementProcesses
+    - vulnerabilityManagementType
     - vulnerabilityManagementApproach
+    - protectiveMonitoringType
     - protectiveMonitoringApproach
+    - incidentManagementType
     - incidentManagementApproach
+- name: Staff security
+  editable: False
+  edit_questions: True
+  questions:
+    - staffSecurityClearanceChecks
+    - governmentSecurityClearances
+- name: Secure development
+  editable: False
+  edit_questions: True
+  questions:
+    - secureDevelopment
 - name: Identity and authentication
   editable: False
   edit_questions: True
   questions:
+    - multiqUserAuthenticationHosting
     - multiqUserAuthenticationSoftware
     - accessRestrictionManagementAndSupport
     - accessRestrictionTesting
     - multiqManagementAccess
+    - devicesUsersManageTheServiceThrough
 - name: Audit information for users
   editable: False

package/frameworks/g-cloud-15/metadata/copy_services.yml CHANGED Viewed

@@ -3,17 +3,9 @@ questions_to_exclude:
   - APISoftware
   - QAAndTesting
   - QAAndTestingDescription
-  - accessRestrictionManagementAndSupport
-  - accessRestrictionTesting
-  - auditBuyersActions
-  - auditBuyersActionsStorage
-  - auditSuppliersActions
-  - auditSuppliersActionsStorage
   - browsersAccess
   - browsersSupported
   - cloudDeploymentModel
-  - configurationAndChangeManagementProcesses
-  - configurationAndChangeManagementType
   - covid19Recovery
   - customisationAvailable
   - customisationDescription
@@ -24,7 +16,6 @@ questions_to_exclude:
   - dataImportFormatsOther
   - datacentreSecurityStandards
   - dataSanitisationTypeSoftware
-  - devicesUsersManageTheServiceThrough
   - educationPricing
   - emailOrTicketingSupport
   - emailOrTicketingSupportAccessibility
@@ -38,15 +29,9 @@ questions_to_exclude:
   - freeVersionDescription
   - freeVersionLink
   - freeVersionTrialOption
-  - governmentSecurityClearances
   - governmentSecurityClearancesFilter
-  - incidentManagementApproach
-  - incidentManagementType
-  - informationSecurityPoliciesAndProcesses
   - installation
   - installationCompatibleOperatingSystems
-  - managementAccessAuthentication
-  - managementAccessAuthenticationDescription
   - metrics
   - metricsDescription
   - metricsHow
@@ -72,18 +57,11 @@ questions_to_exclude:
   - priceMax
   - priceMin
   - priceUnit
-  - protectiveMonitoringApproach
-  - protectiveMonitoringType
   - publicSectorNetworks
   - publicSectorNetworksOther
   - publicSectorNetworksTypes
   - scaling
   - scalingType
-  - secureDevelopment
-  - securityGovernanceAccreditation
-  - securityGovernanceApproach
-  - securityGovernanceStandards
-  - securityGovernanceStandardsOther
   - securityTesting
   - securityTestingAccreditations
   - securityTestingAccredited
@@ -112,7 +90,6 @@ questions_to_exclude:
   - setupAndMigrationServiceSpecificList
   - sfiaRateDocumentURL
   - socialValue
-  - staffSecurityClearanceChecks
   - standardsISO28000
   - standardsISO28000Exclusions
   - standardsISO28000Who
@@ -125,13 +102,7 @@ questions_to_exclude:
   - trainingServiceSpecific
   - trainingServiceSpecificList
   - userAuthentication
-  - userAuthenticationDescription
-  - userAuthenticationHosting
-  - userAuthenticationNeeded
-  - userAuthenticationSoftware
   - userSupportAccessibility
-  - vulnerabilityManagementApproach
-  - vulnerabilityManagementType
   - webChatSupport
   - webChatSupportAccessibility
   - webChatSupportAccessibilityDescription

package/frameworks/g-cloud-15/questions/services/accessRestrictionManagementAndSupport.yml CHANGED Viewed

@@ -7,6 +7,7 @@ depends:
       - iaas-and-paas
       - iaas-and-paas-above-official
       - isaas
+      - saas
 type: textbox_large
 max_length_in_words: 100

package/frameworks/g-cloud-15/questions/services/accessRestrictionTesting.yml CHANGED Viewed

@@ -7,6 +7,7 @@ depends:
       - iaas-and-paas
       - iaas-and-paas-above-official
       - isaas
+      - saas
 type: radios
 options:

package/frameworks/g-cloud-15/questions/services/accreditationsOther.yml CHANGED Viewed

@@ -8,6 +8,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 followup:
   accreditationsOtherList:

package/frameworks/g-cloud-15/questions/services/accreditationsOtherList.yml CHANGED Viewed

@@ -9,6 +9,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 list_item_name: security certification
 type: list

package/frameworks/g-cloud-15/questions/services/auditBuyersActions.yml CHANGED Viewed

@@ -9,6 +9,7 @@ depends:
   - "on": lot
     being:
       - isaas
+      - saas
 followup:
   auditBuyersActionsStorage:

package/frameworks/g-cloud-15/questions/services/auditBuyersActionsStorage.yml CHANGED Viewed

@@ -6,6 +6,7 @@ depends:
   - "on": lot
     being:
       - isaas
+      - saas
 type: radios
 options:

package/frameworks/g-cloud-15/questions/services/auditSuppliersActions.yml CHANGED Viewed

@@ -5,6 +5,7 @@ depends:
   - "on": lot
     being:
       - isaas
+      - saas
 followup:
   auditSuppliersActionsStorage:

package/frameworks/g-cloud-15/questions/services/auditSuppliersActionsStorage.yml CHANGED Viewed

@@ -6,6 +6,7 @@ depends:
   - "on": lot
     being:
       - isaas
+      - saas
 type: radios
 options:

package/frameworks/g-cloud-15/questions/services/boardLevelServiceSecurity.yml CHANGED Viewed

@@ -12,6 +12,7 @@ depends:
       - iaas-and-paas
       - iaas-and-paas-above-official
       - isaas
+      - saas
 type: boolean

package/frameworks/g-cloud-15/questions/services/configurationAndChangeManagementProcesses.yml CHANGED Viewed

@@ -12,6 +12,7 @@ depends:
       - iaas-and-paas
       - iaas-and-paas-above-official
       - isaas
+      - saas
 type: textbox_large
 max_length_in_words: 100

package/frameworks/g-cloud-15/questions/services/configurationAndChangeManagementType.yml ADDED Viewed

@@ -0,0 +1,22 @@
+name: Configuration and change management standard
+question: Which configuration and change management processes does your organisation comply with?
+question_advice: >
+  Read about the government’s <a
+  href="https://www.ncsc.gov.uk/guidance/cloud-security-principle-5-operational-security#config" target="_blank"
+  rel="noopener noreferrer">5th cloud security principle: ‘Operational security’ (link opens in a new tab)</a>.
+depends:
+  - "on": lot
+    being:
+      - saas
+type: radios
+options:
+  - label: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
+    value: recognised_standard
+  - label: Supplier-defined controls
+    value: supplier_defined
+validations:
+  - name: answer_required
+    message: Select if your organisation conforms to a recognised standard or defines its own controls.

package/frameworks/g-cloud-15/questions/services/devicesUsersManageTheServiceThrough.yml ADDED Viewed

@@ -0,0 +1,32 @@
+name: Devices users manage the service through
+question: Which devices can be used to manage the service?
+question_advice: >
+  Read about the <a href="https://www.ncsc.gov.uk/guidance/systems-administration-architectures" target="_blank" rel="noopener noreferrer">systems administration models (link opens in a new tab)</a>
+  that can be used to design the administration approach for IT systems.
+depends:
+  - "on": lot
+    being:
+      - saas
+type: checkboxes
+options:
+  - label: Dedicated device on a segregated network (providers own provision)
+    value: dedicated_device_on_segregated_network
+  - label: Dedicated device on a government network (for example PSN)
+    value: dedicated_device_on_government_network
+  - label: Dedicated device over multiple services or networks
+    value: dedicated_device_over_multiple_networks
+  - label: >
+      Any device but through a bastion host (a bastion host is a server that provides access to a private network from
+      an external network such as the internet)
+    value: any_device_using_bastion_host
+  - label: >
+      Directly from any device which may also be used for normal business (for example web browsing or viewing external
+      email)
+    value: any_device
+validations:
+  - name: answer_required
+    message: Select a device type.

package/frameworks/g-cloud-15/questions/services/governmentSecurityClearances.yml ADDED Viewed

@@ -0,0 +1,24 @@
+name: Government security clearance
+question: >
+  If the role requires it, what level of security clearance are you prepared to make sure your staff have?
+question_advice: Read the <a href="https://www.gov.uk/government/publications/united-kingdom-security-vetting-clearance-levels/national-security-vetting-clearance-levels" target="_blank" rel="noopener noreferrer">government guidance on security vetting and clearance (link opens in a new tab)</a>.
+depends:
+  - "on": lot
+    being:
+      - saas
+type: radios
+options:
+  - label: Up to Developed Vetting (DV)
+    value: dv
+  - label: Up to Security Clearance (SC)
+    value: sc
+  - label: Up to Baseline Personnel Security Standard (BPSS)
+    value: bpss
+  - label: None
+    value: none
+validations:
+  - name: answer_required
+    message: Select what level of security clearance you are prepared to offer.

package/frameworks/g-cloud-15/questions/services/incidentManagementApproach.yml CHANGED Viewed

@@ -11,6 +11,7 @@ depends:
   - "on": lot
     being:
       - isaas
+      - saas
 type: textbox_large
 max_length_in_words: 100

package/frameworks/g-cloud-15/questions/services/incidentManagementType.yml ADDED Viewed

@@ -0,0 +1,24 @@
+name: Incident management type
+question: Which incident management processes does your organisation comply with?
+question_advice: >
+  Read about the government’s <a
+  href="https://www.ncsc.gov.uk/guidance/cloud-security-principle-5-operational-security#incident" target="_blank"
+  rel="noopener noreferrer">5th cloud security principle: ‘Operational security’ (link opens in a new tab)</a>.
+depends:
+  - "on": lot
+    being:
+      - saas
+type: radios
+options:
+  - label: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
+    value: recognised_standard
+  - label: Supplier-defined controls
+    value: supplier_defined
+  - label: Undisclosed
+    value: undisclosed
+validations:
+  - name: answer_required
+    message: Select which incident management processes your organisation complies with.

package/frameworks/g-cloud-15/questions/services/informationSecurityPoliciesAndProcesses.yml CHANGED Viewed

@@ -8,6 +8,7 @@ depends:
       - iaas-and-paas
       - iaas-and-paas-above-official
       - isaas
+      - saas
 type: textbox_large
 max_length_in_words: 200

package/frameworks/g-cloud-15/questions/services/managementAccessAuthentication.yml CHANGED Viewed

@@ -5,6 +5,7 @@ depends:
   - "on": lot
     being:
       - isaas
+      - saas
 followup:
   managementAccessAuthenticationDescription:

package/frameworks/g-cloud-15/questions/services/managementAccessAuthenticationDescription.yml CHANGED Viewed

@@ -6,6 +6,7 @@ depends:
   - "on": lot
     being:
       - isaas
+      - saas
 type: textbox_large
 max_length_in_words: 100

package/frameworks/g-cloud-15/questions/services/multiqAccessBuyersAudit.yml CHANGED Viewed

@@ -7,6 +7,7 @@ depends:
       - isaas
       - iaas-and-paas
       - iaas-and-paas-above-official
+      - saas
 type: multiquestion
 questions:

package/frameworks/g-cloud-15/questions/services/multiqAccessSuppliersAudit.yml CHANGED Viewed

@@ -7,6 +7,7 @@ depends:
       - isaas
       - iaas-and-paas
       - iaas-and-paas-above-official
+      - saas
 type: multiquestion
 questions:

package/frameworks/g-cloud-15/questions/services/multiqAccreditationsOther.yml CHANGED Viewed

@@ -8,6 +8,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 type: multiquestion
 questions:

package/frameworks/g-cloud-15/questions/services/multiqManagementAccess.yml CHANGED Viewed

@@ -5,6 +5,7 @@ depends:
   - "on": lot
     being:
       - isaas
+      - saas
 type: multiquestion
 questions:

package/frameworks/g-cloud-15/questions/services/multiqSecurityGovernance.yml CHANGED Viewed

@@ -7,6 +7,7 @@ depends:
       - iaas-and-paas
       - iaas-and-paas-above-official
       - isaas
+      - saas
 type: multiquestion
 questions:

package/frameworks/g-cloud-15/questions/services/multiqStandardsCSASTAR.yml CHANGED Viewed

@@ -8,6 +8,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 type: multiquestion
 questions:

package/frameworks/g-cloud-15/questions/services/multiqStandardsCyber.yml CHANGED Viewed

@@ -8,6 +8,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 type: multiquestion
 questions:

package/frameworks/g-cloud-15/questions/services/multiqStandardsISO28000.yml CHANGED Viewed

@@ -8,6 +8,7 @@ depends:
       - iaas-and-paas
       - iaas-and-paas-above-official
       - cloud-support
+      - saas
 type: multiquestion
 questions:

package/frameworks/g-cloud-15/questions/services/multiqStandardsISOIEC27001.yml CHANGED Viewed

@@ -9,6 +9,7 @@ depends:
       - iaas-and-paas
       - iaas-and-paas-above-official
       - cloud-support
+      - saas
 type: multiquestion
 questions:

package/frameworks/g-cloud-15/questions/services/multiqStandardsPCI.yml CHANGED Viewed

@@ -8,6 +8,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 type: multiquestion
 questions:

package/frameworks/g-cloud-15/questions/services/multiqUserAuthenticationHosting.yml ADDED Viewed

@@ -0,0 +1,14 @@
+id: multiqUserAuthentication
+name: User authentication
+question: User authentication
+depends:
+  - "on": lot
+    being:
+      - saas
+type: multiquestion
+questions:
+  - userAuthenticationHosting
+  - userAuthenticationDescription

package/frameworks/g-cloud-15/questions/services/multiqUserAuthenticationSoftware.yml CHANGED Viewed

@@ -6,6 +6,7 @@ depends:
   - "on": lot
     being:
       - isaas
+      - saas
 type: multiquestion
 questions:

package/frameworks/g-cloud-15/questions/services/pricingDocumentURL.yml CHANGED Viewed

@@ -19,6 +19,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 type: upload

package/frameworks/g-cloud-15/questions/services/protectiveMonitoringApproach.yml CHANGED Viewed

@@ -13,6 +13,7 @@ depends:
       - iaas-and-paas
       - iaas-and-paas-above-official
       - isaas
+      - saas
 type: textbox_large
 max_length_in_words: 100

package/frameworks/g-cloud-15/questions/services/protectiveMonitoringType.yml ADDED Viewed

@@ -0,0 +1,24 @@
+name: Protective monitoring type
+question: Which protective monitoring processes does your organisation comply with?
+question_advice: >
+  Read about the government’s <a
+  href="https://www.ncsc.gov.uk/guidance/cloud-security-principle-5-operational-security#protective" target="_blank"
+  rel="noopener noreferrer">5th cloud security principle: ‘Operational security’ (link opens in a new tab)</a>.
+depends:
+  - "on": lot
+    being:
+      - saas
+type: radios
+options:
+  - label: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
+    value: recognised_standard
+  - label: Supplier-defined controls
+    value: supplier_defined
+  - label: Undisclosed
+    value: undisclosed
+validations:
+  - name: answer_required
+    message: Select the type of protective monitoring process you comply with.

package/frameworks/g-cloud-15/questions/services/secureDevelopment.yml ADDED Viewed

@@ -0,0 +1,26 @@
+name: Approach to secure software development best practice
+question: How does your organisation demonstrate that it adheres to best practice in secure software development?
+question_advice: >
+  Read about the government’s <a
+  href="https://www.ncsc.gov.uk/guidance/cloud-security-principle-7-secure-development" target="_blank"
+  rel="noopener noreferrer">7th cloud security principle: ‘Secure development’ (link opens in a new tab)</a>.
+depends:
+  - "on": lot
+    being:
+      - saas
+type: radios
+options:
+  - label: >
+      Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM
+      v3.0)
+    value: independent_review
+  - label: Conforms to a recognised standard, but self-assessed
+    value: recognised_standard
+  - label: Supplier-defined process
+    value: supplier_defined
+validations:
+  - name: answer_required
+    message: Select how you demonstate that you adhere to secure software development best practice.

package/frameworks/g-cloud-15/questions/services/securityGovernanceAccreditation.yml CHANGED Viewed

@@ -7,6 +7,7 @@ depends:
       - iaas-and-paas
       - iaas-and-paas-above-official
       - isaas
+      - saas
 followup:
   securityGovernanceStandards:

package/frameworks/g-cloud-15/questions/services/securityGovernanceApproach.yml CHANGED Viewed

@@ -8,6 +8,7 @@ depends:
       - iaas-and-paas
       - iaas-and-paas-above-official
       - isaas
+      - saas
 type: textbox_large
 max_length_in_words: 100

package/frameworks/g-cloud-15/questions/services/securityGovernanceStandards.yml CHANGED Viewed

@@ -8,6 +8,7 @@ depends:
       - iaas-and-paas
       - iaas-and-paas-above-official
       - isaas
+      - saas
 followup:
   securityGovernanceStandardsOther:

package/frameworks/g-cloud-15/questions/services/securityGovernanceStandardsOther.yml CHANGED Viewed

@@ -8,6 +8,7 @@ depends:
       - iaas-and-paas
       - iaas-and-paas-above-official
       - isaas
+      - saas
 type: textbox_large
 max_length_in_words: 50

package/frameworks/g-cloud-15/questions/services/serviceDefinitionDocumentURL.yml CHANGED Viewed

@@ -21,6 +21,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 type: upload

package/frameworks/g-cloud-15/questions/services/staffSecurityClearanceChecks.yml ADDED Viewed

@@ -0,0 +1,28 @@
+name: Staff security clearance
+question: How do you manage staff security clearance checks?
+question_advice: >
+  Read about the government’s <a
+  href="https://www.ncsc.gov.uk/guidance/cloud-security-principle-6-personnel-security" target="_blank" rel="noopener
+  noreferrer">6th cloud security principle: ‘Personnel security’ (link opens in a new tab)</a>.
+depends:
+  - "on": lot
+    being:
+      - saas
+type: radios
+options:
+  - label: Staff screening performed with conforms to BS7858:2019
+    value: "staff_screening_to_bs7858_2019"
+    filter_label: conforms to BS7858:2019
+  - label: Staff screening performed but doesn’t conform with BS7858:2019
+    value: "staff_screening_not_bs7858_2019"
+    filter_label: other security clearance
+    filter_ignore: true
+  - label: Staff screening not performed
+    value: none
+    filter_ignore: true
+validations:
+  - name: answer_required
+    message: Select how you manage staff security clearance checks.

package/frameworks/g-cloud-15/questions/services/standardsCSASTAR.yml CHANGED Viewed

@@ -10,6 +10,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 followup:
   standardsCSASTARWhen:

package/frameworks/g-cloud-15/questions/services/standardsCSASTARExclusions.yml CHANGED Viewed

@@ -9,6 +9,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 type: textbox_large
 max_length_in_words: 200

package/frameworks/g-cloud-15/questions/services/standardsCSASTARLevel.yml CHANGED Viewed

@@ -9,6 +9,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 type: radios
 options:

package/frameworks/g-cloud-15/questions/services/standardsCSASTARWhen.yml CHANGED Viewed

@@ -10,6 +10,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 type: text

package/frameworks/g-cloud-15/questions/services/standardsCyberEssentials.yml CHANGED Viewed

@@ -8,6 +8,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 type: boolean

package/frameworks/g-cloud-15/questions/services/standardsCyberEssentialsPlus.yml CHANGED Viewed

@@ -8,6 +8,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 type: boolean

package/frameworks/g-cloud-15/questions/services/standardsISO28000.yml CHANGED Viewed

@@ -7,6 +7,7 @@ depends:
     being:
       - isaas
       - cloud-support
+      - saas
 followup:
   standardsISO28000Who:

package/frameworks/g-cloud-15/questions/services/standardsISO28000Exclusions.yml CHANGED Viewed

@@ -7,6 +7,7 @@ depends:
     being:
       - isaas
       - cloud-support
+      - saas
 type: textbox_large
 max_length_in_words: 200

package/frameworks/g-cloud-15/questions/services/standardsISO28000When.yml CHANGED Viewed

@@ -7,6 +7,7 @@ depends:
     being:
       - isaas
       - cloud-support
+      - saas
 type: text

package/frameworks/g-cloud-15/questions/services/standardsISO28000Who.yml CHANGED Viewed

@@ -7,6 +7,7 @@ depends:
     being:
       - isaas
       - cloud-support
+      - saas
 type: text
 max_length_in_words: 10

package/frameworks/g-cloud-15/questions/services/standardsISOIEC27001.yml CHANGED Viewed

@@ -7,6 +7,7 @@ depends:
     being:
       - isaas
       - cloud-support
+      - saas
 followup:
   standardsISOIEC27001Who:

package/frameworks/g-cloud-15/questions/services/standardsISOIEC27001Exclusions.yml CHANGED Viewed

@@ -6,6 +6,7 @@ depends:
     being:
       - isaas
       - cloud-support
+      - saas
 type: textbox_large
 max_length_in_words: 200

package/frameworks/g-cloud-15/questions/services/standardsISOIEC27001When.yml CHANGED Viewed

@@ -7,6 +7,7 @@ depends:
     being:
       - isaas
       - cloud-support
+      - saas
 type: text

package/frameworks/g-cloud-15/questions/services/standardsISOIEC27001Who.yml CHANGED Viewed

@@ -6,6 +6,7 @@ depends:
     being:
       - isaas
       - cloud-support
+      - saas
 type: text
 max_length_in_words: 10

package/frameworks/g-cloud-15/questions/services/standardsPCI.yml CHANGED Viewed

@@ -9,6 +9,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 followup:
   standardsPCIWho:

package/frameworks/g-cloud-15/questions/services/standardsPCIExclusions.yml CHANGED Viewed

@@ -9,6 +9,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 type: textbox_large
 max_length_in_words: 200

package/frameworks/g-cloud-15/questions/services/standardsPCIWhen.yml CHANGED Viewed

@@ -10,6 +10,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 type: text

package/frameworks/g-cloud-15/questions/services/standardsPCIWho.yml CHANGED Viewed

@@ -9,6 +9,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 type: text
 max_length_in_words: 10

package/frameworks/g-cloud-15/questions/services/termsAndConditionsDocumentURL.yml CHANGED Viewed

@@ -19,6 +19,7 @@ depends:
       - iaas-and-paas-above-official
       - isaas
       - cloud-support
+      - saas
 type: upload

package/frameworks/g-cloud-15/questions/services/userAuthenticationDescription.yml CHANGED Viewed

@@ -6,6 +6,7 @@ depends:
   - "on": lot
     being:
       - isaas
+      - saas
 type: textbox_large
 max_length_in_words: 100

package/frameworks/g-cloud-15/questions/services/userAuthenticationHosting.yml ADDED Viewed

@@ -0,0 +1,43 @@
+id: userAuthentication
+name: User authentication
+question: How do you authenticate users when they access the service?
+question_advice: >
+  Read about the government’s <a
+  href="https://www.ncsc.gov.uk/guidance/cloud-security-principle-10-identity-and-authentication" target="_blank"
+  rel="noopener noreferrer">10th cloud security principle ‘Identity and authentication’ (link opens in a new tab)</a>.
+depends:
+  - "on": lot
+    being:
+      - saas
+followup:
+  userAuthenticationDescription:
+    - other
+type: checkboxes
+options:
+  - label: 2-factor authentication
+    value: two_factor
+    filter_label: 2-factor authentication
+  - label: Public key authentication (including by TLS client certificate)
+    value: pka
+    filter_label: public key authentication (including by TLS client certificate)
+  - label: Identity federation with existing provider (for example Google apps)
+    value: identity_federation
+    filter_label: identity federation with existing provider (for example Google apps)
+  - label: Limited access over government network (for example PSN)
+    value: government_network
+    filter_label: limited access network (for example PSN)
+  - label: Dedicated link (for example VPN or bonded fibre)
+    value: dedicated_link
+    filter_label: dedicated link (for example VPN)
+  - label: Username or password
+    value: username_or_password
+    filter_label: username or password
+  - label: Other
+    value: other
+    filter_ignore: true
+validations:
+  - name: answer_required
+    message: Select an authentication method.

package/frameworks/g-cloud-15/questions/services/userAuthenticationNeeded.yml CHANGED Viewed

@@ -5,6 +5,7 @@ depends:
   - "on": lot
     being:
       - isaas
+      - saas
 followup:
   userAuthentication:

package/frameworks/g-cloud-15/questions/services/userAuthenticationSoftware.yml CHANGED Viewed

@@ -11,6 +11,7 @@ depends:
   - "on": lot
     being:
       - isaas
+      - saas
 followup:
   userAuthenticationDescription:

package/frameworks/g-cloud-15/questions/services/vulnerabilityManagementApproach.yml CHANGED Viewed

@@ -13,6 +13,7 @@ depends:
       - iaas-and-paas
       - iaas-and-paas-above-official
       - isaas
+      - saas
 type: textbox_large
 max_length_in_words: 100

package/frameworks/g-cloud-15/questions/services/vulnerabilityManagementType.yml ADDED Viewed

@@ -0,0 +1,24 @@
+name: Vulnerability management type
+question: Which vulnerability management processes does your organisation comply with?
+question_advice: >
+  Read about the government’s <a
+  href="https://www.ncsc.gov.uk/guidance/cloud-security-principle-5-operational-security#vulnerability" target="_blank"
+  rel="noopener noreferrer">5th cloud security principle: ‘Operational security’ (link opens in a new tab)</a>.
+depends:
+  - "on": lot
+    being:
+      - saas
+type: radios
+options:
+  - label: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
+    value: recognised_standard
+  - label: Supplier-defined controls
+    value: supplier_defined
+  - label: Undisclosed
+    value: undisclosed
+validations:
+  - name: answer_required
+    message: Select which vulnerability management process your organisation complies with.

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "ccs-digitalmarketplace-frameworks",
-  "version": "4.11.28",
+  "version": "4.11.30",
   "description": "Data files for Digital Marketplace’s procurement frameworks",
   "repository": {
     "type": "git",