Simplify control category

Signed-off-by: Bryan Frimin <bryan@frimin.fr>

controls/code/COD.001.patch_review.md

@@ -0,0 +1,35 @@
+---
+id: "COD-001"
+category: "code"
+revision-version: 1
+revision-date: "2024-01-07"
+estimate-time: "15m"
+frameworks:
+    - name: "soc2"
+      sections: ["CC1.4", "CC5.2", "CC8.1"]
+---
+
+## Purpose
+Requiring pull requests and code reviews ensures higher code quality
+and security by allowing multiple team members to catch bugs,
+inefficiencies, and potential vulnerabilities before code is
+merged. It also promotes collaboration, knowledge sharing, and
+accountability within the team. This process helps prevent issues in
+production and maintains adherence to coding standards.
+
+## Implementation
+
+### Github
+
+1. Open your GitHub repository and go to settings.
+2. In "Branche"s, click "Add Rule".
+3. Enter the branch name (e.g. "main") in the branch name pattern
+   field.
+4. Enable: "Require a pull request before merging"
+5. Click Create or Save to apply the rule
+
+## Evidence
+
+- Screenshot of branch protection rules configuration
+- Documentation of PR review process
+- Sample PR showing enforced requirements

controls/code/COD.002.enable_code_scanning.md

@@ -0,0 +1,32 @@
+---
+id: "COD-002"
+category: "code"
+revision-version: 1
+revision-date: "2024-01-07"
+estimate-time: "15m"
+frameworks:
+    - name: "soc2"
+      sections: ["CC4.1", "CC8.1"]
+---
+
+## Purpose
+It ensures that potential security flaws are detected early. This
+proactive approach strengthens your security posture and helps
+maintain high code quality.
+
+## Implementation
+
+### Github
+
+1. Go to the "Security" tab of your repository.
+2. Click on "Set up code scanning".
+3. Select "Set up this workflow" under "CodeQL Analysis".
+4. Review the YAML file and commit it to your repository.
+
+Code scanning will now run every time code is pushed to the
+repository, and results will appear in the Security tab.
+
+## Evidence
+
+- Screenshot of code scanning results from Security tab
+- Sample of resolved security alerts

controls/code/COD.003.dependancy_vulnerability_alerts.md

@@ -0,0 +1,33 @@
+---
+id: "COD-003"
+category: "code"
+revision-version: 1
+revision-date: "2024-01-07"
+estimate-time: "15m"
+frameworks:
+    - name: "soc2"
+      sections: ["CC4.1", "CC8.1"]
+---
+
+## Purpose
+It ensures your project stays secure and up-to-date without manual
+tracking of dependencies. It also reduces the risk of using outdated
+or insecure libraries in your codebase.
+
+## Implementation
+
+### Github
+
+1. Go to your repository on GitHub.
+2. Click on the "Settings" tab.
+3. On the left sidebar, click "Security & analysis".
+4. Under "Dependabot alerts", ensure "Dependency graph" and
+   "Dependabot security updates" are enabled.
+5. GitHub will now alert you to any vulnerable dependencies and
+   automatically open pull requests to fix them.
+
+## Evidence
+- Screenshot of Dependabot configuration screen
+- Sample of dependency update PRs
+- Vulnerability alert history
+

controls/code/COD.004.systems_development_life_cycle.md

@@ -0,0 +1,26 @@
+---
+id: "COD-004"
+category: "code"
+revision-version: 1
+revision-date: "2024-01-08"
+estimate-time: "1h"
+frameworks:
+    - name: "soc2"
+      sections: ["CC1.4", "CC5.2", "CC8.1"]
+---
+
+## Purpose
+
+Formalizing a proper development lifecycle helps your engineer in
+their jobs and helps you to scale your team. It reduces the chances of
+human error.
+
+## Implementation
+
+Write a document with your development lifecycle. It should include:
+planning, analysis, design, coding, testing, and maintenance. Don’t
+forget secure coding practices (eg code review) and quality.
+
+## Evidence
+
+- System development lifecycle document