Documentation
¶
Overview ¶
Package soa loads and validates Statements of Applicability.
A Statement of Applicability belongs to one audit cycle and lives at "<audits dir>/<cycle>/soa.yaml", next to that cycle's "audit.yaml" (findings) and "references/" (supporting material that is never rendered).
Index ¶
Constants ¶
const ( StatusDraft = "draft" StatusInReview = "in_review" StatusApproved = "approved" )
Lifecycle states of a statement. Only an approved statement is published; every other state, including a missing or unknown one, is internal.
const ( KindAudit = "audit" KindAssessment = "assessment" )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Applicability ¶
type Applicability string
Applicability is true, false or partial. YAML booleans are accepted.
const ( Applicable Applicability = "true" NotApplicable Applicability = "false" Partial Applicability = "partial" )
func (*Applicability) UnmarshalYAML ¶
func (a *Applicability) UnmarshalYAML(n *yaml.Node) error
UnmarshalYAML accepts a YAML bool or the string "partial".
type Header ¶
type Header struct {
// Status is the review state: draft, in_review or approved. Absent means
// draft, so a statement is never published by omission.
Status string `yaml:"status"`
// ApprovedDate is when the review finished; required once approved.
ApprovedDate string `yaml:"approved_date,omitempty"`
ID string `yaml:"id"`
Title string `yaml:"title"`
ScopeRef string `yaml:"scope_ref"`
Date string `yaml:"date"`
Version string `yaml:"version"`
Assurance string `yaml:"assurance"`
}
Header identifies the statement.
type Loaded ¶
type Loaded struct {
// Kind is KindAudit for a real audit's statement and KindAssessment for an
// internal assessment's. Assessment statements are never public.
Kind string
// Cycle is the audit (or assessment) directory name, e.g.
// "iso27001-devprocess-2026-07".
Cycle string
Path string
SoA SoA
}
Loaded is a statement together with where it came from.
type Requirement ¶
type Requirement struct {
AnnexA string `yaml:"annex_a"`
Title string `yaml:"title"`
Applicable Applicability `yaml:"applicable"`
Status string `yaml:"status"`
Justification string `yaml:"justification"`
Evidence []string `yaml:"evidence,omitempty"`
}
Requirement is one row of the statement.
type SoA ¶
type SoA struct {
Header Header `yaml:"soa"`
Requirements []Requirement `yaml:"requirements"`
}
SoA is a Statement of Applicability.
func (*SoA) Published ¶
Published reports whether the statement may be shown publicly: only once its review is finished. Anything else, including an unrecognized status, is internal.
Source Files