Renive control statements from policies

Author: chris-cmsoft

policies/gh_org_mfa_enabled.rego

@@ -7,41 +7,3 @@ violation[{}] if {
 title := "Two Factor Authentication is required at an organization level"
 description := "Two factor authentication should be enabled and enforced for all users within the Github Organization to make it harder for malicious actors to gain access to the organizations settings and repositories & settings"
 remarks := "More information from Github can be found here: https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
-
-controls := [
-    # SAMA Cyber Security Framework v1.0
-    # https://rulebook.sama.gov.sa/en/cyber-security-framework-2
-    # Class: SAMA_CSF_1.0
-    #
-    # 3.3: Cyber Security Operations and Technology
-    # https://rulebook.sama.gov.sa/en/33-cyber-security-operations-and-technology-0
-    {
-        "class": "SAMA_CSF_1.0",
-        "control-id": "3.3.5",  # Identity and Access Management https://rulebook.sama.gov.sa/en/335-identity-and-access-management-0
-        "statement-ids": [
-            "4.e",
-            "f.1.a",
-        ]
-    },
-
-    # NIST SP 800-53 v5.1.1
-    # https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
-    # Class SP800-53-enhancement
-    # ia: Identification and Authentication
-    {
-        "class": "SP800-53-enhancement",
-        "control-id": "ia-2.1",  # Multi-factor Authentication to Privileged Accounts
-    },
-    {
-        "class": "SP800-53-enhancement",
-        "control-id": "ia-2.2",  # Multi-factor Authentication for Non-privileged Accounts
-    },
-    {
-        "class": "OWASP_DSOMM_3",
-        "control-id": "IM-3.10",
-    },
-    {
-        "class": "OWASP_DSOMM_3",
-        "control-id": "IM-3.11",
-    },
-]

policies/gh_org_public_repos.rego

@@ -15,8 +15,3 @@ violation[{}] if {
 
 title := "No Public Repos or Gists"
 description := "The Organization should not have any public repositories or gists attached to it"
-
-# No direct controls in the frameworks at the moment
-# But will be useful when we are mapping ISO 27001, data privacy or custom 
-# IPR frameworks generated either as a standard or a custom catalog
-controls := []

policies/gh_org_secret_dependabot_alerts.rego

@@ -7,42 +7,3 @@ violation[{}] if {
 title := "Dependabot alerts enabled for new repositories"
 description := "All new repositories should be set up to alert for any dependabot alerts that are coming from the repositories"
 remarks := "Endpoint is closing down at some point and moving to code security configurations: See https://docs.github.com/rest/code-security/configurations"
-
-controls := [
-    {
-        "class": "SP800-53-enhancement",
-        "control-id": "ra-5.4",  # Discoverable Information
-    },
-    {
-        "class": "SP800-218",
-        "control-id": "RV-1.1",
-    },
-    {
-        "class": "SP800-218",
-        "control-id": "PW-1.3"
-    },
-    {
-        "class": "SP800-218",
-        "control-id": "PW-5.1"
-    },
-    {
-        "class": "SP800-218",
-        "control-id": "PW-8.2"
-    },
-    {
-        "class": "OWASP_DSOMM_3",
-        "control-id": "IG-3.3",
-    },
-    {
-        "class": "OWASP_DSOMM_3",
-        "control-id": "IG-3.4",
-    },
-    {
-        "class": "OWASP_DSOMM_3",
-        "control-id": "IG-2.5",
-    },
-    {
-        "class": "OWASP_DSOMM_3",
-        "control-id": "TV-6.3",
-    },
-]

policies/gh_org_secret_scanning_enabled.rego

@@ -7,43 +7,3 @@ violation[{}] if {
 title := "Secret Scanning is enabled for new repositories in the organization"
 description := "All new repositories should be set up for secret scanning as the default."
 remarks := "Endpoint is closing down at some point and moving to code security configurations: See https://docs.github.com/rest/code-security/configurations"
-
-controls := [
-    # OWASP DSOMM v3
-    # https://dsomm.owasp.org/
-    # Class: OWASP_DSOMM_3
-    #
-    # TV: Test and Verification
-    {
-        "class": "SAMA_CSF_1.0",
-        "control-id": "TV-6.8",  # Test for stored secrets https://dsomm.owasp.org/activity-description?uuid=c6e3c812-56e2-41b0-ae01-b7afc41a004c&dimension=Test%20and%20Verification&subDimension=Static%20depth%20for%20infrastructure&level=1&activityName=Test%20for%20stored%20secrets
-
-        "statement-ids": [
-            "TV-6.8_statement"
-        ]
-    },
-    {
-        "class": "SP800-218",
-        "control-id": "RV-1.1"
-    },
-    {
-        "class": "SP800-218",
-        "control-id": "PW-1.3"
-    },
-    {
-        "class": "SP800-218",
-        "control-id": "PW-5.1"
-    },
-    {
-        "class": "SP800-218",
-        "control-id": "PW-8.2"
-    },
-    {
-        "class": "OWASP_DSOMM_3",
-        "control-id": "IG-2.5",
-    },
-    {
-        "class": "OWASP_DSOMM_3",
-        "control-id": "TV-6.8",
-    },
-]