Simplify control category

Signed-off-by: Bryan Frimin <bryan@frimin.fr>

controls/platform/email-security/PLT.EMAIL.001.sender_policy_framework.md

@@ -0,0 +1,44 @@
+---
+id: "PLT-EMAIL-001"
+category: "platform/email-security"
+revision-version: 1
+revision-date: "2024-01-07"
+estimate-time: "30m"
+frameworks:
+    - name: "soc2"
+      sections: ["CC6.1", "CC6.8"]
+---
+
+## Purpose
+SPF (Sender Policy Framework) prevents email spoofing by defining
+which mail servers are authorized to send emails on behalf of your
+domain. It helps receiving mail servers verify that incoming email
+from a domain comes from a host authorized by that domain's
+administrators.
+
+## Implementation
+
+1. Identify all legitimate email sources:
+   - Your mail servers
+   - Third-party services (e.g., Google Workspace)
+   - Marketing platforms
+   - Any other authorized email senders
+2. Create SPF record
+   ```
+   v=spf1 include:_spf.google.com ~all
+   ```
+   Where:
+   - `v=spf1`: Version of SPF
+   - `include:_spf.google.com`: Include Google's mail servers
+   - `~all`: Soft fail for others (can be changed to -all for hard fail)
+3. Add record to DNS:
+   - Create TXT record at domain root
+   - Publish SPF record in DNS
+   - Wait for DNS propagation
+   
+## Evidence
+
+- Screenshot of published SPF DNS record
+- Email header samples showing SPF pass
+- Documentation of authorized senders
+

controls/platform/email-security/PLT.EMAIL.002.dkim_implementation.md

@@ -0,0 +1,32 @@
+---
+id: "PLT-EMAIL-002"
+category: "platform/email-security"
+revision-version: 1
+revision-date: "2024-01-07"
+estimate-time: "30m"
+frameworks:
+    - name: "soc2"
+      sections: ["CC6.1", "CC6.8"]
+---
+
+## Purpose
+DKIM (DomainKeys Identified Mail) helps prevent email spoofing by
+adding a digital signature to outgoing messages, allowing receiving
+mail systems to verify that emails genuinely came from your domain and
+weren't modified in transit.
+
+## Implementation
+
+### Google Workspace
+
+1. Go to [Google Admin console](admin.google.com).
+2. Navigate to Apps > Google Workspace > Gmail > Authenticate Email.
+3. Select your domain and click "Generate new record".
+4. Copy the DKIM TXT record provided by Google.
+5. Add this TXT record to your DNS.
+6. After DNS propagation, return to Admin console and click "Start authentication".
+
+## Evidence
+
+- Screenshot of published DKIM DNS record
+- Sample email headers showing DKIM pass

controls/platform/email-security/PLT.EMAIL.003.domain_based_message_authentication.md

@@ -0,0 +1,42 @@
+---
+id: "PLT-EMAIL-003"
+category: "platform/email-security"
+revision-version: 1
+revision-date: "2024-01-07"
+estimate-time: "30m"
+related:
+    - id: "COM-EMAIL-001"
+	  required: true
+	- id: "COM-EMAIL-002"
+	  required: true
+frameworks:
+    - name: "soc2"
+      sections: ["CC6.1", "CC6.8"]
+---
+
+## Purpose
+DMARC (Domain-based Message Authentication, Reporting, and
+Conformance) is a policy framework that builds upon SPF and DKIM. It
+tells receiving servers what to do when emails fail SPF or DKIM
+checks, and provides reporting on authentication results.
+
+## Implementation
+
+### Google Workspace
+
+1. Create a Google Group named `dmarc-report@example.com` which is assecible from external users.
+2. Create DMARC record in monitoring mode:
+   ```
+   Record: _dmarc.example.com
+   Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com
+   ```
+   Where:
+   - `v=DMARC1`: Protocol version
+   - `p=none`: Policy for failed checks
+   - `rua=`: Address for aggregate reports
+3. Check the reports sent to the rua email address to ensure proper
+   authentication of emails.
+
+## Evidence
+- Screenshot of DMARC DNS record
+- Sample aggregate reports