Add categories descriptions

Signed-off-by: gearnode <bryan@frimin.fr>

controls/core/data/README.md

@@ -0,0 +1,14 @@
+# Safeguard your data
+
+Your data is one of your company most valuable asset - you must keep it safe
+
+## Why does it matter?
+
+It minimizes the risk of unauthorized access, data breaches, and loss. By
+implementing data security measures, you demonstrates a commitment to protecting
+client information.
+
+## How can I proceed?
+
+Implement measures to protect data from unauthorized access and set up processes
+to regularly secure and monitor its location.

controls/core/infra/README.md

@@ -0,0 +1,16 @@
+# Secure your infrastructure
+
+## Why does it matter?
+
+Your infrastructure holds your sensitive data and makes sure your service is
+available to your customers. Protecting it from unauthorized access or attacks
+is key to prevent any data leak or service outage.
+
+## How can I proceed?
+
+To secure your infrastructure, you will need to:
+
+1. Understand what your are protecting
+2. Regulate access
+3. Log changes
+4. Fix known vulnerabilities

controls/core/network/README.md

@@ -0,0 +1,17 @@
+# Protect your Network
+
+Your network connects your devices, servers, and systems.
+
+## Why does it matter?
+
+Protecting your network is essential for the data and services your company
+provides. Network security helps ensure that sensitive data is accessible only
+to authorized users and that systems remain operational and resilient to
+attacks.
+
+## How can I proceed?
+
+Strengthening network security in a targeted, efficient way is essential. By
+restricting access to infrastructure, implementing protective layers like
+Cloudflare, and conducting regular security assessments, you can effectively
+safeguard your systems against unauthorized access and potential attacks.

controls/core/src/README.md

@@ -0,0 +1,18 @@
+# Secure your codebase
+
+Your code is one of your most valuable asset, you want to be sure things are
+running smoothly and in a predictable way.
+
+## Why does it matter?
+
+A proper development lifecycle insure your application is iterated on in a
+secure and systematic manner. It reduces the chances of error or vulnerabilities
+and so increase the stability, integrity and security of your software. Also, it
+helps you scale your engineering team.
+
+## How can I proceed?
+
+- **Communicate policies:** Publish and update key documents and services.
+- **Implement structured processes:** Define a development lifecycle for
+  software, adopt Infrastructure-as-Code (IaC), and deploy configuration
+  management systems to maintain consistency and security.

controls/operations/incidents/README.md

@@ -0,0 +1,11 @@
+# Prepare for incidents
+
+## Why does it matter?
+
+Let’s face it, you won’t be the exception with no incident ever. As it is going
+to happen to you, it is best to prepare for such event in order to reduce their
+impacts.
+
+## How can I proceed?
+
+Create a procedure to restore services and test it

controls/operations/monitoring/README.md

@@ -0,0 +1,14 @@
+# Log collection and monitoring
+
+Being proactive provides you with more visibility and ensures system
+reliability.
+
+## Why does it matter?
+
+Logging and monitoring your infrastructure and network is crucial for
+identifying and responding to security incidents, system issues or unauthorized
+access in real-time.
+
+## How can I proceed?
+
+Log critical event and implement alerts to be notified if everything goes wrong.

controls/personnel/access/README.md

@@ -0,0 +1,21 @@
+# Configure your system access
+
+You can start by making sure you properly manage access to your company system
+and data.
+
+## Why does it matter?
+
+Someone having access to something he should not can have serious consequences
+such as a data leak or a service interruption. It is important to mitigate those
+risks you have identified previously.
+
+## How can I proceed?
+
+The main idea is to follow those principles:
+
+1. **Least privilege:** everyone’s access is limited to what's necessary for job
+   duties
+2. **Secure:** nobody can easily get access to the your employees
+   passwords/access
+3. **Continuous update:** making sure the privileges are up to date and you use
+   the latest best practices

controls/personnel/comms/README.md

@@ -0,0 +1,17 @@
+# Secure your emails
+
+## Why does it matter?
+
+Do you know what is the most common attack vector among cyber threats?
+**Emails**
+
+And by far! It is also where your employees are talking with externals. By
+configuring a few things in your settings, you are preventing many threats from
+reaching your employees and you are protecting your data and systems.
+
+## How can I proceed?
+
+To do so, we divided the work in two steps:
+
+- You secure the access to your offices.
+- You secure the internet connexion of remote employees

controls/personnel/lifecycle/README.md

@@ -0,0 +1,17 @@
+# Set up your employees for success
+
+## Why does it matter?
+
+Without the proper security measures in place, employees can inadvertently
+expose your company to breaches and vulnerabilities. Providing secure access and
+clear guidelines on handling sensitive information is crucial to protect your
+organization from potential threats.
+
+## How can I proceed?
+
+You will focus on two things:
+
+- **Processes:** whether it is to recruit, onboard or off-board, things are
+  prepared and you are sure not to forgot anything.
+- **Enabling**: empower your employees to take the best decision possible to
+  maintain your security posture

controls/physical/facilities/README.md

@@ -0,0 +1,19 @@
+# Secure your offices and internet access
+
+Start by assessing whether your team works from a physical office or operates
+remotely, as this will guide your approach to securing the workspace.
+
+## Why does it matter?
+
+Unauthorized access to your office or network can lead to serious consequences
+such as data theft, or other serious issues. Protecting both physical and
+digital environments is essential to mitigate those risks.
+
+## How can I proceed?
+
+We break this into two main areas of focus:
+
+1. **Office Security:** Ensure that the access to your office is secured against
+   unauthorized entry.
+2. **Internet Security:** Ensure that members of your teams or contractors that
+   work remotely have a secure access to internet.

controls/physical/hardware/README.md

@@ -0,0 +1,19 @@
+# Manage your computers
+
+## Why does it matter?
+
+Your company devices have the potential to store or process data ⇒ If someone
+lose his laptop or it gets compromised, it can expose you to a data leak (and a
+few other things)
+
+## How can I proceed?
+
+You have to make sure that every device is properly set-up. To monitor things,
+the easiest way is to leverage a Mobile Device Management software (MDM), but if
+you are early in your development, proper guidelines are enough. On each
+machine, you need:
+
+- Screenlock is enabled
+- Firewall is active
+- Anti-malware detection is active
+- Data is encrypted