Style

Signed-off-by: Bryan Frimin <bryan@frimin.fr>

controls/code/COD.001.patch_review.md

@@ -5,17 +5,17 @@ revision-version: 1
 revision-date: "2024-01-07"
 estimate-time: "15m"
 frameworks:
-    - name: "soc2"
+  - name: "soc2"
-      sections: ["CC1.4", "CC5.2", "CC8.1"]
+    sections: ["CC1.4", "CC5.2", "CC8.1"]
 ---
 
 ## Purpose
-Requiring pull requests and code reviews ensures higher code quality
+
-and security by allowing multiple team members to catch bugs,
+Requiring pull requests and code reviews ensures higher code quality and
-inefficiencies, and potential vulnerabilities before code is
+security by allowing multiple team members to catch bugs, inefficiencies, and
-merged. It also promotes collaboration, knowledge sharing, and
+potential vulnerabilities before code is merged. It also promotes collaboration,
-accountability within the team. This process helps prevent issues in
+knowledge sharing, and accountability within the team. This process helps
-production and maintains adherence to coding standards.
+prevent issues in production and maintains adherence to coding standards.
 
 ## Implementation
 
@@ -23,8 +23,7 @@ production and maintains adherence to coding standards.
 
 1. Open your GitHub repository and go to settings.
 2. In "Branche"s, click "Add Rule".
-3. Enter the branch name (e.g. "main") in the branch name pattern
+3. Enter the branch name (e.g. "main") in the branch name pattern field.
-   field.
 4. Enable: "Require a pull request before merging"
 5. Click Create or Save to apply the rule
 

controls/code/COD.002.enable_code_scanning.md

@@ -5,14 +5,14 @@ revision-version: 1
 revision-date: "2024-01-07"
 estimate-time: "15m"
 frameworks:
-    - name: "soc2"
+  - name: "soc2"
-      sections: ["CC4.1", "CC8.1"]
+    sections: ["CC4.1", "CC8.1"]
 ---
 
 ## Purpose
-It ensures that potential security flaws are detected early. This
+
-proactive approach strengthens your security posture and helps
+It ensures that potential security flaws are detected early. This proactive
-maintain high code quality.
+approach strengthens your security posture and helps maintain high code quality.
 
 ## Implementation
 
@@ -23,8 +23,8 @@ maintain high code quality.
 3. Select "Set up this workflow" under "CodeQL Analysis".
 4. Review the YAML file and commit it to your repository.
 
-Code scanning will now run every time code is pushed to the
+Code scanning will now run every time code is pushed to the repository, and
-repository, and results will appear in the Security tab.
+results will appear in the Security tab.
 
 ## Evidence
 

controls/code/COD.003.dependancy_vulnerability_alerts.md

@@ -5,14 +5,15 @@ revision-version: 1
 revision-date: "2024-01-07"
 estimate-time: "15m"
 frameworks:
-    - name: "soc2"
+  - name: "soc2"
-      sections: ["CC4.1", "CC8.1"]
+    sections: ["CC4.1", "CC8.1"]
 ---
 
 ## Purpose
-It ensures your project stays secure and up-to-date without manual
+
-tracking of dependencies. It also reduces the risk of using outdated
+It ensures your project stays secure and up-to-date without manual tracking of
-or insecure libraries in your codebase.
+dependencies. It also reduces the risk of using outdated or insecure libraries
+in your codebase.
 
 ## Implementation
 
@@ -21,13 +22,13 @@ or insecure libraries in your codebase.
 1. Go to your repository on GitHub.
 2. Click on the "Settings" tab.
 3. On the left sidebar, click "Security & analysis".
-4. Under "Dependabot alerts", ensure "Dependency graph" and
+4. Under "Dependabot alerts", ensure "Dependency graph" and "Dependabot security
-   "Dependabot security updates" are enabled.
+   updates" are enabled.
-5. GitHub will now alert you to any vulnerable dependencies and
+5. GitHub will now alert you to any vulnerable dependencies and automatically
-   automatically open pull requests to fix them.
+   open pull requests to fix them.
 
 ## Evidence
+
 - Screenshot of Dependabot configuration screen
 - Sample of dependency update PRs
 - Vulnerability alert history
-

controls/code/COD.004.systems_development_life_cycle.md

@@ -5,21 +5,20 @@ revision-version: 1
 revision-date: "2024-01-08"
 estimate-time: "1h"
 frameworks:
-    - name: "soc2"
+  - name: "soc2"
-      sections: ["CC1.4", "CC5.2", "CC8.1"]
+    sections: ["CC1.4", "CC5.2", "CC8.1"]
 ---
 
 ## Purpose
 
-Formalizing a proper development lifecycle helps your engineer in
+Formalizing a proper development lifecycle helps your engineer in their jobs and
-their jobs and helps you to scale your team. It reduces the chances of
+helps you to scale your team. It reduces the chances of human error.
-human error.
 
 ## Implementation
 
-Write a document with your development lifecycle. It should include:
+Write a document with your development lifecycle. It should include: planning,
-planning, analysis, design, coding, testing, and maintenance. Don’t
+analysis, design, coding, testing, and maintenance. Don’t forget secure coding
-forget secure coding practices (eg code review) and quality.
+practices (eg code review) and quality.
 
 ## Evidence
 

controls/platform/email-security/PLT.EMAIL.001.sender_policy_framework.md

@@ -5,16 +5,16 @@ revision-version: 1
 revision-date: "2024-01-07"
 estimate-time: "30m"
 frameworks:
-    - name: "soc2"
+  - name: "soc2"
-      sections: ["CC6.1", "CC6.8"]
+    sections: ["CC6.1", "CC6.8"]
 ---
 
 ## Purpose
-SPF (Sender Policy Framework) prevents email spoofing by defining
+
-which mail servers are authorized to send emails on behalf of your
+SPF (Sender Policy Framework) prevents email spoofing by defining which mail
-domain. It helps receiving mail servers verify that incoming email
+servers are authorized to send emails on behalf of your domain. It helps
-from a domain comes from a host authorized by that domain's
+receiving mail servers verify that incoming email from a domain comes from a
-administrators.
+host authorized by that domain's administrators.
 
 ## Implementation
 
@@ -41,4 +41,3 @@ administrators.
 - Screenshot of published SPF DNS record
 - Email header samples showing SPF pass
 - Documentation of authorized senders
-

controls/platform/email-security/PLT.EMAIL.002.dkim_implementation.md

@@ -5,15 +5,16 @@ revision-version: 1
 revision-date: "2024-01-07"
 estimate-time: "30m"
 frameworks:
-    - name: "soc2"
+  - name: "soc2"
-      sections: ["CC6.1", "CC6.8"]
+    sections: ["CC6.1", "CC6.8"]
 ---
 
 ## Purpose
-DKIM (DomainKeys Identified Mail) helps prevent email spoofing by
+
-adding a digital signature to outgoing messages, allowing receiving
+DKIM (DomainKeys Identified Mail) helps prevent email spoofing by adding a
-mail systems to verify that emails genuinely came from your domain and
+digital signature to outgoing messages, allowing receiving mail systems to
-weren't modified in transit.
+verify that emails genuinely came from your domain and weren't modified in
+transit.
 
 ## Implementation
 
@@ -24,7 +25,8 @@ weren't modified in transit.
 3. Select your domain and click "Generate new record".
 4. Copy the DKIM TXT record provided by Google.
 5. Add this TXT record to your DNS.
-6. After DNS propagation, return to Admin console and click "Start authentication".
+6. After DNS propagation, return to Admin console and click "Start
+   authentication".
 
 ## Evidence
 

controls/platform/email-security/PLT.EMAIL.003.domain_based_message_authentication.md

@@ -15,16 +15,18 @@ frameworks:
 ---
 
 ## Purpose
-DMARC (Domain-based Message Authentication, Reporting, and
+
-Conformance) is a policy framework that builds upon SPF and DKIM. It
+DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a
-tells receiving servers what to do when emails fail SPF or DKIM
+policy framework that builds upon SPF and DKIM. It tells receiving servers what
-checks, and provides reporting on authentication results.
+to do when emails fail SPF or DKIM checks, and provides reporting on
+authentication results.
 
 ## Implementation
 
 ### Google Workspace
 
-1. Create a Google Group named `dmarc-report@example.com` which is assecible from external users.
+1. Create a Google Group named `dmarc-report@example.com` which is assecible
+   from external users.
 2. Create DMARC record in monitoring mode:
    ```
    Record: _dmarc.example.com
@@ -38,5 +40,6 @@ checks, and provides reporting on authentication results.
    authentication of emails.
 
 ## Evidence
+
 - Screenshot of DMARC DNS record
 - Sample aggregate reports

controls/platform/email-security/PLT.EMAIL.004.email_filtering_and_warning_system.md

@@ -5,16 +5,15 @@ revision-version: 1
 revision-date: "2024-01-07"
 estimate-time: "15m"
 frameworks:
-    - name: "soc2"
+  - name: "soc2"
-      sections: ["CC6.8", "CC7.2"]
+    sections: ["CC6.8", "CC7.2"]
 ---
 
 ## Purpose
 
-Implement email filtering and warning systems to reduce phishing risks
+Implement email filtering and warning systems to reduce phishing risks and
-and protect employees from malicious emails. This reduces mental load
+protect employees from malicious emails. This reduces mental load on employees
-on employees and decreases company risk exposure through email-based
+and decreases company risk exposure through email-based attacks.
-attacks.
 
 ## Implementation
 
@@ -27,13 +26,13 @@ attacks.
    ```
 3. Configure "Safety" settings:
    - Attachments Protection
-	 - Scan for anomalous attachment types
+   - Scan for anomalous attachment types
-	 - Block attachments with scripts
+   - Block attachments with scripts
-	 - Block encrypted attachments from untrusted senders
+   - Block encrypted attachments from untrusted senders
    - Links and External Images:
-	 - Enable scanning of linked images
+   - Enable scanning of linked images
-	 - Identify shortened URLs
+   - Identify shortened URLs
-	 - Display warning prompts for untrusted domains
+   - Display warning prompts for untrusted domains
 
 ## Evidence