gap analysis: link description can be more consistent and more clear, and intermittent links can be removed
robvanderveer opened this issue · comments
The link description popup talks about 'linked to' but the correct term is 'related to' in opencre pages.
Other locations of linked to ARE correct. When standards are connected to a CRE we call it 'linked'. When a CRE is connected to a CRE we call it related, unless it is a parent/child.
The reverse of 'contains' should be named 'is part of'.
Furthermore, it is unclear why NIST SSDF RV.1.1 is in the below description, as it is the description for how PW.4.4. is linked. This was in the SAMM-NIST SSDF analysis.
So below the first linked to is correct, then the second linked to can be removed I think. Then the third linked to should be renamed to RELATED_TO, then the CONTAINS after that should be renamed to IS_PART_OF.
It seems to me that the directions of the arrows is then no longer necessary, which makes it all a lot easier to interpret.
<- LINKED_TO <- Vulnerability management -> LINKED_TO -> NIST SSDF RV.1.1 Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that the software uses, and investigate all credible reports. <- LINKED_TO <- Dependency management <- CONTAINS <- Supply chain management -> LINKED_TO -> NIST SSDF PW.4.4 Verify that acquired commercial, open-source, and all other third-party software components comply with the requirements, as defined by the organization, throughout their life cycles
Improved in #378 see what you think
Love it,as said