Style

Signed-off-by: Bryan Frimin <bryan@frimin.fr>

controls/code/COD.001.patch_review.md

@@ -5,17 +5,17 @@ revision-version: 1
 revision-date: "2024-01-07"
 estimate-time: "15m"
 frameworks:
-    - name: "soc2"
-      sections: ["CC1.4", "CC5.2", "CC8.1"]
+  - name: "soc2"
+    sections: ["CC1.4", "CC5.2", "CC8.1"]
 ---
 
 ## Purpose
-Requiring pull requests and code reviews ensures higher code quality
-and security by allowing multiple team members to catch bugs,
-inefficiencies, and potential vulnerabilities before code is
-merged. It also promotes collaboration, knowledge sharing, and
-accountability within the team. This process helps prevent issues in
-production and maintains adherence to coding standards.
+
+Requiring pull requests and code reviews ensures higher code quality and
+security by allowing multiple team members to catch bugs, inefficiencies, and
+potential vulnerabilities before code is merged. It also promotes collaboration,
+knowledge sharing, and accountability within the team. This process helps
+prevent issues in production and maintains adherence to coding standards.
 
 ## Implementation
 
@@ -23,8 +23,7 @@ production and maintains adherence to coding standards.
 
 1. Open your GitHub repository and go to settings.
 2. In "Branche"s, click "Add Rule".
-3. Enter the branch name (e.g. "main") in the branch name pattern
-   field.
+3. Enter the branch name (e.g. "main") in the branch name pattern field.
 4. Enable: "Require a pull request before merging"
 5. Click Create or Save to apply the rule
 

controls/code/COD.002.enable_code_scanning.md

@@ -5,14 +5,14 @@ revision-version: 1
 revision-date: "2024-01-07"
 estimate-time: "15m"
 frameworks:
-    - name: "soc2"
-      sections: ["CC4.1", "CC8.1"]
+  - name: "soc2"
+    sections: ["CC4.1", "CC8.1"]
 ---
 
 ## Purpose
-It ensures that potential security flaws are detected early. This
-proactive approach strengthens your security posture and helps
-maintain high code quality.
+
+It ensures that potential security flaws are detected early. This proactive
+approach strengthens your security posture and helps maintain high code quality.
 
 ## Implementation
 
@@ -23,8 +23,8 @@ maintain high code quality.
 3. Select "Set up this workflow" under "CodeQL Analysis".
 4. Review the YAML file and commit it to your repository.
 
-Code scanning will now run every time code is pushed to the
-repository, and results will appear in the Security tab.
+Code scanning will now run every time code is pushed to the repository, and
+results will appear in the Security tab.
 
 ## Evidence
 

controls/code/COD.003.dependancy_vulnerability_alerts.md

@@ -5,14 +5,15 @@ revision-version: 1
 revision-date: "2024-01-07"
 estimate-time: "15m"
 frameworks:
-    - name: "soc2"
-      sections: ["CC4.1", "CC8.1"]
+  - name: "soc2"
+    sections: ["CC4.1", "CC8.1"]
 ---
 
 ## Purpose
-It ensures your project stays secure and up-to-date without manual
-tracking of dependencies. It also reduces the risk of using outdated
-or insecure libraries in your codebase.
+
+It ensures your project stays secure and up-to-date without manual tracking of
+dependencies. It also reduces the risk of using outdated or insecure libraries
+in your codebase.
 
 ## Implementation
 
@@ -21,13 +22,13 @@ or insecure libraries in your codebase.
 1. Go to your repository on GitHub.
 2. Click on the "Settings" tab.
 3. On the left sidebar, click "Security & analysis".
-4. Under "Dependabot alerts", ensure "Dependency graph" and
-   "Dependabot security updates" are enabled.
-5. GitHub will now alert you to any vulnerable dependencies and
-   automatically open pull requests to fix them.
+4. Under "Dependabot alerts", ensure "Dependency graph" and "Dependabot security
+   updates" are enabled.
+5. GitHub will now alert you to any vulnerable dependencies and automatically
+   open pull requests to fix them.
 
 ## Evidence
+
 - Screenshot of Dependabot configuration screen
 - Sample of dependency update PRs
 - Vulnerability alert history
-

controls/code/COD.004.systems_development_life_cycle.md

@@ -5,21 +5,20 @@ revision-version: 1
 revision-date: "2024-01-08"
 estimate-time: "1h"
 frameworks:
-    - name: "soc2"
-      sections: ["CC1.4", "CC5.2", "CC8.1"]
+  - name: "soc2"
+    sections: ["CC1.4", "CC5.2", "CC8.1"]
 ---
 
 ## Purpose
 
-Formalizing a proper development lifecycle helps your engineer in
-their jobs and helps you to scale your team. It reduces the chances of
-human error.
+Formalizing a proper development lifecycle helps your engineer in their jobs and
+helps you to scale your team. It reduces the chances of human error.
 
 ## Implementation
 
-Write a document with your development lifecycle. It should include:
-planning, analysis, design, coding, testing, and maintenance. Don’t
-forget secure coding practices (eg code review) and quality.
+Write a document with your development lifecycle. It should include: planning,
+analysis, design, coding, testing, and maintenance. Don’t forget secure coding
+practices (eg code review) and quality.
 
 ## Evidence
 

controls/platform/email-security/PLT.EMAIL.001.sender_policy_framework.md

@@ -5,16 +5,16 @@ revision-version: 1
 revision-date: "2024-01-07"
 estimate-time: "30m"
 frameworks:
-    - name: "soc2"
-      sections: ["CC6.1", "CC6.8"]
+  - name: "soc2"
+    sections: ["CC6.1", "CC6.8"]
 ---
 
 ## Purpose
-SPF (Sender Policy Framework) prevents email spoofing by defining
-which mail servers are authorized to send emails on behalf of your
-domain. It helps receiving mail servers verify that incoming email
-from a domain comes from a host authorized by that domain's
-administrators.
+
+SPF (Sender Policy Framework) prevents email spoofing by defining which mail
+servers are authorized to send emails on behalf of your domain. It helps
+receiving mail servers verify that incoming email from a domain comes from a
+host authorized by that domain's administrators.
 
 ## Implementation
 
@@ -35,10 +35,9 @@ administrators.
    - Create TXT record at domain root
    - Publish SPF record in DNS
    - Wait for DNS propagation
-   
+
 ## Evidence
 
 - Screenshot of published SPF DNS record
 - Email header samples showing SPF pass
 - Documentation of authorized senders
-

controls/platform/email-security/PLT.EMAIL.002.dkim_implementation.md

@@ -5,15 +5,16 @@ revision-version: 1
 revision-date: "2024-01-07"
 estimate-time: "30m"
 frameworks:
-    - name: "soc2"
-      sections: ["CC6.1", "CC6.8"]
+  - name: "soc2"
+    sections: ["CC6.1", "CC6.8"]
 ---
 
 ## Purpose
-DKIM (DomainKeys Identified Mail) helps prevent email spoofing by
-adding a digital signature to outgoing messages, allowing receiving
-mail systems to verify that emails genuinely came from your domain and
-weren't modified in transit.
+
+DKIM (DomainKeys Identified Mail) helps prevent email spoofing by adding a
+digital signature to outgoing messages, allowing receiving mail systems to
+verify that emails genuinely came from your domain and weren't modified in
+transit.
 
 ## Implementation
 
@@ -24,7 +25,8 @@ weren't modified in transit.
 3. Select your domain and click "Generate new record".
 4. Copy the DKIM TXT record provided by Google.
 5. Add this TXT record to your DNS.
-6. After DNS propagation, return to Admin console and click "Start authentication".
+6. After DNS propagation, return to Admin console and click "Start
+   authentication".
 
 ## Evidence
 

controls/platform/email-security/PLT.EMAIL.003.domain_based_message_authentication.md

@@ -15,16 +15,18 @@ frameworks:
 ---
 
 ## Purpose
-DMARC (Domain-based Message Authentication, Reporting, and
-Conformance) is a policy framework that builds upon SPF and DKIM. It
-tells receiving servers what to do when emails fail SPF or DKIM
-checks, and provides reporting on authentication results.
+
+DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a
+policy framework that builds upon SPF and DKIM. It tells receiving servers what
+to do when emails fail SPF or DKIM checks, and provides reporting on
+authentication results.
 
 ## Implementation
 
 ### Google Workspace
 
-1. Create a Google Group named `dmarc-report@example.com` which is assecible from external users.
+1. Create a Google Group named `dmarc-report@example.com` which is assecible
+   from external users.
 2. Create DMARC record in monitoring mode:
    ```
    Record: _dmarc.example.com
@@ -38,5 +40,6 @@ checks, and provides reporting on authentication results.
    authentication of emails.
 
 ## Evidence
+
 - Screenshot of DMARC DNS record
 - Sample aggregate reports

controls/platform/email-security/PLT.EMAIL.004.email_filtering_and_warning_system.md

@@ -5,16 +5,15 @@ revision-version: 1
 revision-date: "2024-01-07"
 estimate-time: "15m"
 frameworks:
-    - name: "soc2"
-      sections: ["CC6.8", "CC7.2"]
+  - name: "soc2"
+    sections: ["CC6.8", "CC7.2"]
 ---
 
 ## Purpose
 
-Implement email filtering and warning systems to reduce phishing risks
-and protect employees from malicious emails. This reduces mental load
-on employees and decreases company risk exposure through email-based
-attacks.
+Implement email filtering and warning systems to reduce phishing risks and
+protect employees from malicious emails. This reduces mental load on employees
+and decreases company risk exposure through email-based attacks.
 
 ## Implementation
 
@@ -27,13 +26,13 @@ attacks.
    ```
 3. Configure "Safety" settings:
    - Attachments Protection
-	 - Scan for anomalous attachment types
-	 - Block attachments with scripts
-	 - Block encrypted attachments from untrusted senders
+   - Scan for anomalous attachment types
+   - Block attachments with scripts
+   - Block encrypted attachments from untrusted senders
    - Links and External Images:
-	 - Enable scanning of linked images
-	 - Identify shortened URLs
-	 - Display warning prompts for untrusted domains
+   - Enable scanning of linked images
+   - Identify shortened URLs
+   - Display warning prompts for untrusted domains
 
 ## Evidence