00:00:00:00 - 00:00:02:17 Hi everyone, thank you all for joining here today. 00:00:02:17 - 00:00:06:14 I am Gustavo, a principal engineer at Container Solutions 00:00:06:14 - 00:00:07:24 and I am here to talk 00:00:07:24 - 00:00:11:20 about Continuous Compliance Framework, which is an open source framework. 00:00:11:20 - 00:00:16:21 We’ve being working here at Container Solutions, it is very much OSCAL based. 00:00:16:23 - 00:00:20:21 It is worth to discuss what we're doing here, where we are drifting. 00:00:20:21 - 00:00:23:21 And what is the purpose, why we're building it. 00:00:24:04 - 00:00:27:05 So I am a principal engineer at Container Solutions. 00:00:27:05 - 00:00:31:07 I do a lot of work on open source within continuous compliance framework. 00:00:31:08 - 00:00:32:06 I am one of the lead 00:00:32:06 - 00:00:36:08 developers here, I also maintain a couple of other open source projects. 00:00:36:10 - 00:00:40:02 If you ever have any other questions, or if you want to talk about 00:00:40:02 - 00:00:43:03 how to contribute to CCF, please connect with me on LinkedIn. 00:00:43:06 - 00:00:45:01 That's where this QR code will go. 00:00:45:01 - 00:00:47:15 Before going over CCF, 00:00:47:20 - 00:00:51:11 In Container Solutions, we are not really a products company. 00:00:51:13 - 00:00:54:11 We've built CCF, continuous compliance framework 00:00:54:11 - 00:00:59:12 out of our customer needs, out of talking to the users that we serve for 00:00:59:12 - 00:01:03:05 We are a vendor independent consultancy much focused on engineering, 00:01:03:05 - 00:01:07:15 so we help our customers to build CICD pipelines to enforce 00:01:07:15 - 00:01:11:10 security compliance checks in them, to help them build platform work. 00:01:11:10 - 00:01:16:04 And of course, we have a lot of presence in the open source landscape as well. 00:01:16:06 - 00:01:20:02 And it was on one of these conversations with customers 00:01:20:02 - 00:01:24:12 that the need for a way to move compliance as close 00:01:24:17 - 00:01:28:15 to the developers themselves as possible when we were exploring. 00:01:28:15 - 00:01:30:02 How could we build something 00:01:30:02 - 00:01:33:23 open source to cover this need is when we found about OSCAL 00:01:34:02 - 00:01:37:10 That's when we decided to build continuous compliance framework. 00:01:37:10 - 00:01:40:13 So it is an open source solution, a framework really 00:01:40:13 - 00:01:44:17 that serves to integrate compliance throughout any given system. 00:01:44:22 - 00:01:46:20 Originally we started with IT 00:01:46:20 - 00:01:50:15 development lifecycle, but now we see that it can be extended 00:01:50:18 - 00:01:56:00 to other areas that also need compliance, not only necessarily security compliance. 00:01:56:00 - 00:01:59:22 And our goal here is really to shift compliance left 00:02:00:00 - 00:02:03:08 as close as possible to the implementation, regardless 00:02:03:08 - 00:02:07:04 if we are performing a role, regardless if we are building a system 00:02:07:04 - 00:02:08:24 and shifting it down. 00:02:08:24 - 00:02:11:04 Which means if we prove 00:02:11:04 - 00:02:15:00 that a given service is compliant, any other services that use 00:02:15:00 - 00:02:19:17 it should also be compliant as easily without us needing to really go refresh 00:02:19:18 - 00:02:21:23 every single bit that compose it. 00:02:21:23 - 00:02:24:03 It is pretty much OSCAL-based 00:02:24:03 - 00:02:27:23 A lot of our schemas are standard OSCAL implementation. 00:02:27:23 - 00:02:31:22 There were some times that we needed to do some custom implementations. 00:02:31:22 - 00:02:33:15 I will discuss them here with you. 00:02:33:15 - 00:02:37:17 And we already have a couple of users in different capacities, either 00:02:37:19 - 00:02:41:23 doing some experimentation, some production use, and a lot of what 00:02:41:23 - 00:02:45:10 you will see here today also contains feedback from this user base. 00:02:45:21 - 00:02:49:19 As of today, Continuous Compliance framework is built on a kind of old 00:02:49:20 - 00:02:52:22 OSCAL version already. We are on OSCAL 1.1.3 00:02:52:22 - 00:02:58:17 We are still not fully OSCAL compliant, especially we miss the assessment layer. 00:02:58:17 - 00:03:02:20 That's also because our typical customer, they are engineers. 00:03:02:20 - 00:03:07:22 So the focus is more on how do I prove that I am compliant versus 00:03:07:22 - 00:03:11:08 how does an organization checks its compliance status. 00:03:11:08 - 00:03:15:12 That means that we have mostly the control and the implementation OSCAL layer 00:03:15:12 - 00:03:19:22 implemented, but the assessment layer we really built on as need basis. 00:03:19:22 - 00:03:23:15 So if you think that something is missing on the assessment, you're probably right. 00:03:23:15 - 00:03:25:00 And it's probably in. 00:03:25:00 - 00:03:27:21 And as I said, we did need to add some custom logic 00:03:27:21 - 00:03:31:23 One of them, for instance, was our own control mapping implementation. 00:03:31:23 - 00:03:35:23 We know that became a topic addressed in OSCAL 1.2 00:03:35:23 - 00:03:38:01 it’s part of our roadmap to implement 00:03:38:01 - 00:03:40:10 that should cover that into OSCAL as well. 00:03:40:10 - 00:03:42:00 and one thing that is very curious, 00:03:42:03 - 00:03:46:08 this is a product that we built to make it easy to deal with compliance. 00:03:46:08 - 00:03:50:02 One thing that we noted is that if we just presented 00:03:50:03 - 00:03:54:15 OSCAL terms directly to the users, they wouldn't really understand it all 00:03:54:15 - 00:03:58:11 So a lot of what you'll see here today also contains some naming tweaks, 00:03:58:11 - 00:04:02:17 some UI adjustments, just to make it easy for the user base to consume it. 00:04:02:17 - 00:04:05:18 Before doing the demonstration, I will very quickly describe 00:04:05:18 - 00:04:08:07 CCF’s architecture on a very high level overview 00:04:08:07 - 00:04:10:09 There are really two main components. 00:04:10:10 - 00:04:11:17 On the left side. 00:04:11:17 - 00:04:15:18 Here we have the core components which are a standard web application 00:04:16:01 - 00:04:19:07 deployment, a UI, an API and a database. 00:04:19:07 - 00:04:23:06 And on the right what really makes it composable, 00:04:23:07 - 00:04:26:13 a framework which is a standardized way to gather 00:04:26:16 - 00:04:30:08 evidence, to gather observations across different systems 00:04:30:10 - 00:04:35:13 using different roles that you can bring and compose according to your own needs. 00:04:35:15 - 00:04:38:17 As I Container Solutions isn't really a product company. 00:04:38:17 - 00:04:43:06 So all of this was built with the intention of a self-hosted model. 00:04:43:11 - 00:04:47:22 This also helps with that data resistance requirements, data continuous requirements 00:04:47:22 - 00:04:50:19 During the demonstration, we be basically three things. 00:04:50:19 - 00:04:54:21 Our own control implementation layer, How does the system security plan 00:04:54:21 - 00:04:58:13 looks like within CCF, and more of the custom 00:04:58:13 - 00:05:00:17 things that we needed to build in order for this 00:05:00:17 - 00:05:04:24 to make sense from our user perspective, which are the observation, 00:05:05:00 - 00:05:08:14 all the automation that we've built around this, the risks and workflows 00:05:08:14 - 00:05:11:11 Workflows on CCFs is equivalent 00:05:11:11 - 00:05:15:02 to the tasks and steps activities of the assessment plan 00:05:15:10 - 00:05:18:12 With no further ado, let's jump into the demonstration. 00:05:18:12 - 00:05:20:20 For that, I'll need to stop sharing for a bit. 00:05:21:15 - 00:05:24:15 Now you should be able to see a continuous compliance framework 00:05:24:19 - 00:05:29:15 the UI element of it. I'll increase it a little bit it to to be better to see 00:05:29:15 - 00:05:32:10 The first thing that I want to mention is within the catalogs 00:05:32:10 - 00:05:34:07 themselves, in the control implementation layer. 00:05:34:07 - 00:05:36:06 When we're talking to our user base, 00:05:36:06 - 00:05:40:14 even though everything can be mapped out as an OSCAL catalog model, 00:05:40:15 - 00:05:41:18 as an OSCAL catalog, 00:05:41:18 - 00:05:45:02 they still felt the need to have a separation between what’s the 00:05:45:02 - 00:05:48:13 external standard policy and internal catalogs 00:05:48:13 - 00:05:51:13 that are addressing that policy. So we created a custom property 00:05:51:14 - 00:05:55:04 within OSCAL just to be able to map out this catalog categories here. 00:05:55:04 - 00:05:58:21 And these catalogs, they are standard catalogs. 00:05:58:21 - 00:06:01:11 We can have groups. These groups will have controls. 00:06:01:11 - 00:06:04:11 Each control will have a statement, an objective and a guidance. 00:06:04:11 - 00:06:09:04 The one thing that we missed on this layer is the ability to do rendering. 00:06:09:04 - 00:06:13:02 So we cannot have a catalog template with custom properties 00:06:13:02 - 00:06:16:08 to be embedded on it rendered for a given system security plan. 00:06:17:03 - 00:06:20:01 That's really the only thing that we're missing here. 00:06:20:01 - 00:06:21:10 From the profiles layer, 00:06:21:10 - 00:06:23:15 It's pretty much standard implementation. 00:06:23:15 - 00:06:25:20 We can have several profiles. 00:06:25:20 - 00:06:29:09 Each profile can define any number of catalogs, 00:06:29:09 - 00:06:31:24 and within that catalog, any number of controls. 00:06:31:24 - 00:06:33:20 In this case, only one control. 00:06:33:20 - 00:06:37:19 If I open a different profile, we will have more controls here. 00:06:37:22 - 00:06:42:09 Everything is pretty much standard, and where things get interesting 00:06:42:11 - 00:06:46:02 is we go to the system here on the system view. 00:06:46:04 - 00:06:48:01 you can pretty much define anything 00:06:48:01 - 00:06:51:01 a system security plan would You can define system users. 00:06:51:01 - 00:06:54:20 You can define your components if you have any already leverage authorizations. 00:06:54:20 - 00:06:57:20 But the thing that is interesting about it that is a little bit different. 00:06:57:23 - 00:06:59:12 On this system plan view, 00:06:59:12 - 00:07:03:24 we are allowing the users to select multiple profiles under the back end. 00:07:04:00 - 00:07:08:05 This is a skill tree system security plans, but from a user perspective 00:07:08:06 - 00:07:11:11 they find it easier to manage as if we were just 00:07:11:11 - 00:07:14:17 targeting the same plan against different profiles. 00:07:14:17 - 00:07:15:22 That's why we have it here. 00:07:15:22 - 00:07:20:10 And as you can see, we don't have the control implementation 00:07:20:10 - 00:07:21:08 and implemented 00:07:21:08 - 00:07:25:15 requirements in here. That's intentional because this is done on this view. 00:07:25:15 - 00:07:31:04 So we try to bring to the user an easy way for them to look at the controls 00:07:31:04 - 00:07:36:06 that they need to comply, allow them to define their implementation 00:07:36:06 - 00:07:41:23 and allow them to link observations that are related with this implementation. 00:07:41:23 - 00:07:43:17 This is the key difference between 00:07:43:17 - 00:07:48:16 CCF is that our observations, which are an assessment result element, 00:07:48:18 - 00:07:53:23 is linked directly to a given statement to a given control implementation. 00:07:53:23 - 00:07:57:08 And we do that via this evidence linking dashboards, 00:07:57:08 - 00:08:00:14 which are nothing more than filters to the evidence. 00:08:01:07 - 00:08:05:14 We can also define if a given implementation is just planned 00:08:05:14 - 00:08:07:05 and if it is not applicable. 00:08:07:05 - 00:08:11:15 We can see here for this that we some passing evidence 00:08:11:15 - 00:08:13:09 and some failing evidence. 00:08:13:09 - 00:08:18:15 The fact that we have failed evidence here automatically generates a risk 00:08:18:15 - 00:08:21:15 for this control, for this system security plan 00:08:22:03 - 00:08:24:06 If I go here to this view evidence, 00:08:25:06 - 00:08:27:08 we can see here all the 00:08:27:08 - 00:08:31:04 gathered evidence for that specific control on that system 00:08:31:04 - 00:08:37:01 And the evidence here, they can be both gathered manually or automatically on the screen. 00:08:37:01 - 00:08:41:24 Right now we're seeing only data that is collected automatically via 00:08:42:01 - 00:08:45:00 CCF agents specifically targeting 00:08:45:00 - 00:08:48:15 Pam product called Jump server with a specific jump server 00:08:49:01 - 00:08:53:17 If I click on this, for instance, we can see here a couple of information. 00:08:53:18 - 00:08:56:17 The first one, why is it currently failed 00:08:56:17 - 00:09:00:08 on this overview? when this information was collected. 00:09:00:10 - 00:09:04:01 When it expires, what were the steps 00:09:04:01 - 00:09:08:00 that CCF automatically did to gather these evidence 00:09:08:22 - 00:09:13:03 we also contain the standard metadata that we can have for properties and links. 00:09:13:03 - 00:09:16:12 But as the addition that we needed to are the labels, 00:09:16:17 - 00:09:19:14 this is how we implement the filtering. 00:09:19:14 - 00:09:22:16 In order for this evidence to be mapped out across any 00:09:22:16 - 00:09:26:07 number of system security plans and any number of controls. 00:09:26:07 - 00:09:30:02 We of course can see here what is the associated risk, 00:09:30:05 - 00:09:33:12 its current status and likelihood and impact. 00:09:33:15 - 00:09:36:15 Also, the system security plan that is linked to it 00:09:36:17 - 00:09:42:01 and we can also see for this evidence that it has no verifiable attestation. 00:09:42:01 - 00:09:44:17 So we don't know what is the provenance of this evidence. 00:09:44:17 - 00:09:47:20 It was perhaps manually submitted or the agent itself 00:09:47:20 - 00:09:50:21 does not have the cryptographically find requirements 00:09:50:21 - 00:09:55:06 in order to find of course the whole history, every single time 00:09:55:06 - 00:09:59:04 this evidence was captured and reset with its current status. 00:09:59:06 - 00:10:00:20 If I go over the risk here. 00:10:02:01 - 00:10:05:11 We can see what is the risk definition. 00:10:06:16 - 00:10:09:15 If we have any owners assigned to it 00:10:09:15 - 00:10:13:20 we can review it to decide to reopen the risk or to extend it. 00:10:13:20 - 00:10:17:16 In this case, this risk was already accepted as a risk we can tolerate. 00:10:17:16 - 00:10:21:24 We can see the score progression for this risk particularly. 00:10:22:08 - 00:10:28:00 And also if we decide to mitigate it, we can create our own mitigation plan. 00:10:28:01 - 00:10:32:00 We can also see what are the remediation steps that you can perform 00:10:32:00 - 00:10:33:05 in order to cover this risk. 00:10:33:05 - 00:10:34:20 This risk was generated 00:10:34:20 - 00:10:39:04 automatically via CCF agents, and it's purely based on the evidence. 00:10:39:04 - 00:10:44:05 Which means if you want to cover this risk, it is very prescriptive 00:10:44:05 - 00:10:46:23 in terms of the steps that you need to do in order to do in order to do it. 00:10:46:23 - 00:10:48:06 You can see though, 00:10:48:10 - 00:10:49:07 if I go here. 00:10:50:23 - 00:10:53:01 Not every evidence will have 00:10:53:01 - 00:10:57:00 a risk associated to it. That's one key thing that we did on CCF. 00:10:57:00 - 00:11:00:09 We only need to care about the observations 00:11:00:09 - 00:11:03:15 that are related to our system security plan 00:11:03:15 - 00:11:06:22 So if a given evidence has no filters bound to it 00:11:07:00 - 00:11:11:12 we will not create a risk for it, even if it is status passing or failing. 00:11:11:14 - 00:11:16:20 It's simply not part of our implementation for us to create a risk or not. 00:11:16:20 - 00:11:18:11 For a given system. 00:11:18:11 - 00:11:22:08 All of these risks are compiled on this risk overview. 00:11:22:08 - 00:11:25:03 So we can see here what is the status breakdown. 00:11:25:03 - 00:11:27:22 What heatmap in terms of likelihood and impact. 00:11:27:22 - 00:11:29:22 What are the ones that we should address first? 00:11:29:22 - 00:11:31:19 What are the ones that we still need to see? 00:11:31:19 - 00:11:33:24 We accept or we need to mitigate 00:11:33:24 - 00:11:38:07 or if we remediate completely and of course more programmatically. 00:11:38:07 - 00:11:40:12 We can also see them in a list here. 00:11:41:14 - 00:11:44:02 Even though we have capabilities to 00:11:44:02 - 00:11:48:23 automate this risk management aspect, you can also create manual risks. 00:11:49:24 - 00:11:54:12 This is an example of a manual It was created by a user on a given point and time 00:11:54:12 - 00:11:59:06 specifying why what the risk is in this case, possible process failure, 00:11:59:06 - 00:12:03:06 and what are the controls associated with that specific process failure. 00:12:03:06 - 00:12:04:10 If I click here on it’ll open 00:12:04:10 - 00:12:08:22 I go back to see exactly where this risk is pointed in my system. 00:12:09:00 - 00:12:14:22 Of course, CCF framework is intended to be a platform to gather information across 00:12:14:22 - 00:12:19:20 many different business units, across many different systems, within the same UI. 00:12:19:24 - 00:12:23:12 You can manage and map different system security plans, 00:12:23:12 - 00:12:26:24 which by themselves would cross many profiles. 00:12:26:24 - 00:12:30:23 And those profiles will have different filters providing a different risk 00:12:30:23 - 00:12:34:11 mapping a different evidence compliance mapping, etc. 00:12:35:18 - 00:12:37:08 Another thing that I want to mention, 00:12:39:04 - 00:12:41:18 all of these evidence are automatically gathered 00:12:41:18 - 00:12:46:18 As I said, we can also create a manual evidence if we want, set up a start date 00:12:46:18 - 00:12:50:08 and then date and expiry for any processes that are built manually. 00:12:50:08 - 00:12:53:14 But we also have from the assessment plans, 00:12:53:14 - 00:12:57:00 set up a way to define your own activities and steps. 00:12:57:00 - 00:12:59:01 These are what we call workflows. 00:12:59:13 - 00:13:01:04 Here, if I click a workflow definition 00:13:01:04 - 00:13:05:10 I can see we have two one of them to perform a disaster recovery exercise. 00:13:05:12 - 00:13:10:14 So compliance more focused on the residency side instead of security. 00:13:10:14 - 00:13:13:15 And typical access review and restriction workflow. 00:13:13:15 - 00:13:16:21 If I click on this one, we can see here 00:13:16:21 - 00:13:20:20 all the steps that this workflow composed is composed of 00:13:20:20 - 00:13:25:06 So we have a plan failure scenario followed by an execution failover 00:13:25:09 - 00:13:28:22 for a measure RTO and RPO and then a sign of exercise. 00:13:29:00 - 00:13:32:15 The key thing here is that of course you can define as many steps as you 00:13:32:22 - 00:13:36:16 but you can also define as many roles as you want. 00:13:36:16 - 00:13:38:05 In this case we have two roles. 00:13:38:05 - 00:13:40:24 There is owner and the IP operations. 00:13:40:24 - 00:13:45:00 And within this role, we can also define what are the evidence needed 00:13:45:16 - 00:13:47:01 for that role to be satisfied. 00:13:48:16 - 00:13:51:01 If I go on the instance itself 00:13:51:01 - 00:13:54:18 we can see the same definition is used across 00:13:54:18 - 00:13:58:09 three different system security plans one for the customer portal, 00:13:58:10 - 00:14:01:21 one for the payments processing and one for the core banking data platform 00:14:01:21 - 00:14:05:09 If I view this one, first thing you can see myself 00:14:05:11 - 00:14:08:22 am added to both of the roles right to perform the demonstration, 00:14:08:22 - 00:14:13:00 but you can select any user within CCF have to perform these roles. 00:14:13:06 - 00:14:16:05 we a couple of executions from our date 00:14:16:05 - 00:14:19:12 If I click on one of them, we can see all of these status 00:14:19:12 - 00:14:23:17 being performed, and for each one, we'll have 00:14:23:17 - 00:14:27:21 a given evidence gathered here just to show how that looks like. 00:14:28:00 - 00:14:29:23 I execute it now. 00:14:31:05 - 00:14:34:19 We can see here we have it on pending and block stage. 00:14:35:13 - 00:14:39:08 If I start the step, I can then select 00:14:39:08 - 00:14:43:10 what is my plan, upload any given file that I want for evidence. 00:14:43:10 - 00:14:47:07 In this case I'll upload a simple gif, a simple image for us to see it. 00:14:47:07 - 00:14:48:22 Afterwards I can complete the step. 00:14:50:14 - 00:14:52:16 move on to the next, etc. 00:14:53:11 - 00:14:54:16 instead of doing that. 00:14:54:24 - 00:14:56:15 Actually I will do that. 00:14:59:10 - 00:15:00:19 Adding a log. 00:15:00:19 - 00:15:03:00 Let me add I don't know this file here. 00:15:06:00 - 00:15:09:04 Add a comment for our measure of RTO/RPO. 00:15:12:18 - 00:15:15:17 Of course, this is just for the sake of demonstrating the system 00:15:15:17 - 00:15:17:21 and last off, doing a sign off. 00:15:19:08 - 00:15:21:09 What's the cool thing about all of that 00:15:23:13 - 00:15:26:13 Is that as soon as this workflow is finished, 00:15:26:14 - 00:15:30:13 we can actually view its whole evidence stream. 00:15:30:13 - 00:15:36:09 Whenever all the steps were implemented by whom was done. If I select this evidence here 00:15:36:14 - 00:15:40:14 we can see that this one is signed and it was performed by myself. 00:15:40:19 - 00:15:44:08 At this given date and time, cryptographically verified offline. 00:15:44:08 - 00:15:46:22 Even cooler in this case, if I go to media, 00:15:46:22 - 00:15:52:21 I can see PNG document that I submitted, which means all of documentation 00:15:52:21 - 00:15:56:22 that I added to show compliance is going to be forever here in CCF. 00:15:56:22 - 00:16:01:20 And of course we have an expiry date so we can track even workflow processes 00:16:01:20 - 00:16:05:03 whenever they executing and whenever they are falling short. 00:16:05:05 - 00:16:09:14 Of course, this is all native because of the agent framework. 00:16:09:14 - 00:16:11:06 It is also possible to connect 00:16:11:06 - 00:16:16:05 to any IPS system such as ServiceNow such as workforce. 00:16:16:06 - 00:16:19:17 You name It is possible to collect all of these evidence 00:16:19:17 - 00:16:24:17 for typical processes and have them gathered centrally in one single place, 00:16:24:17 - 00:16:29:14 so that you can track down according to your need to your implementation. 00:16:30:07 - 00:16:35:08 Having said all going back to the presentation, just to show you one thing. 00:16:36:14 - 00:16:37:00 Can you see 00:16:37:00 - 00:16:38:02 that again, I think so. 00:16:38:02 - 00:16:40:03 One thing that we didn't show here is how 00:16:40:03 - 00:16:42:10 these agents are working under the hood. 00:16:42:10 - 00:16:45:01 They are basically based on configuration. 00:16:45:01 - 00:16:49:07 So the agent itself will configure which plugins 00:16:49:07 - 00:16:53:11 we want it to run on a given cadence with a given source. 00:16:53:11 - 00:16:55:03 So even though this one is using 00:16:55:03 - 00:17:00:18 a compliance framework plugin you can point to any plugins that you and you can ask it 00:17:00:18 - 00:17:04:23 to run on any given role in this case called policies that you want. 00:17:04:24 - 00:17:07:24 And of course, if you are plugging each specific 00:17:07:24 - 00:17:10:05 configuration, you can also add it here 00:17:11:08 - 00:17:13:23 The plugin itself is actually code. 00:17:13:23 - 00:17:17:05 So it might be a little bit hard to create it your own. 00:17:17:05 - 00:17:21:14 We try to have as many as possible for the community to use and the policies. 00:17:21:15 - 00:17:23:13 They are easier for you to extend. 00:17:23:13 - 00:17:26:10 They are based on an open policy language called OPA. 00:17:26:10 - 00:17:31:14 And if you the ability internally to define it, you can create any policies 00:17:31:14 - 00:17:35:13 for all the plugins that are there This is a many to many relationship. 00:17:36:16 - 00:17:38:04 Going very quickly on 00:17:38:04 - 00:17:42:11 what the differences here in terms of OSCAL and CCF. 00:17:42:11 - 00:17:43:23 These are basically six points. 00:17:43:23 - 00:17:48:03 One the catalog, the fact that we have some catalog categories, quote on quote. 00:17:48:05 - 00:17:52:13 The second is the single system security plan view for multiple profiles. 00:17:52:13 - 00:17:57:10 The third one is our observation versus evidence difference, 00:17:57:10 - 00:18:02:06 and the fact that we can inject evidence directly on the implementation layer, 00:18:02:11 - 00:18:04:03 the risks and the ability 00:18:04:03 - 00:18:05:23 to create risks automatically 00:18:05:23 - 00:18:09:11 based on all of these evidence and the systems that are used 00:18:09:11 - 00:18:12:22 in that evidence as a way to attach themselves. And of course, the whole agent 00:18:13:09 - 00:18:17:15 There is a sixth point We have in CCF at least three 00:18:17:15 - 00:18:20:21 elements that are part of the assessment the observations, 00:18:21:00 - 00:18:24:19 the depth, the activities, and the assessment All of them. 00:18:24:19 - 00:18:27:14 They are detached from the assessment plan and assessment results. 00:18:27:14 - 00:18:31:01 You can't really define your own assessment plan or define 00:18:31:01 - 00:18:35:15 an assessment result in CCF right but that's really just temporary. 00:18:35:16 - 00:18:38:06 It is part of the next in terms of roadmap. 00:18:38:06 - 00:18:40:05 In order for us to really get to there 00:18:40:05 - 00:18:43:09 we want to first focus on finishing the implementation layer. 00:18:43:09 - 00:18:46:11 There is one feature that we really think we need to do, and that's 00:18:46:11 - 00:18:50:18 what we're building right now is allowing SSP export and import. 00:18:50:20 - 00:18:55:10 Our second step is to move to OSCAL 1.2, just to be able to use the control 00:18:55:10 - 00:18:59:24 mapping logic and then focus having a proper assessment plan and assessment 00:18:59:24 - 00:19:05:22 result interface for our And with that, I thank you all for coming. 00:19:05:22 - 00:19:09:14 This is really just to show what we're doing here with OSCAL, 00:19:09:14 - 00:19:13:01 and we see that it is being by our users 00:19:13:01 - 00:19:16:07 with the focus on scaling compliance. 00:19:16:13 - 00:19:21:03 Stop doing compliance by sampling and start doing it by population. 00:19:21:03 - 00:19:23:16 That's really the focus from an engineering perspective. 00:19:23:16 - 00:19:25:01 So a little bit bottoms up 00:19:25:01 - 00:19:28:11 But that's really the focus that we see people getting interested in this 00:19:28:15 - 00:19:29:02 Thank you.