Review of level 1 activities

[vbakke]

Added missing descriptions and assessments, on level 1 activities.

Feel free to comment and adjust. I reckon we should aim to avoid repeating the same message in multiple attributes of the same activity. But I might still be doing that. Nice with more sets of eyes to improve...

[wurstbrot]

Looks good in general.

For the assessment attribute: It was written in a way that users understand what they have to provide in order to get it marked as implemented. I do not enforce that you re-write it, but for you know.

E.g.

The organization has a process for triaging and documenting false positives and accepted risks

could be

Provide a maximum one year old sample of a false positive or accepted finding including the date, description and date and expire date

[vbakke]

Thank you for a thorough review.

Looks like I skipped Implementation and Test and Verification. I can try to add them soon.

However, could you please elaborate some on Default settings for intensity? The current text is very short, and I struggle to understand the boundaries for the activity.

[vbakke]

@wurstbrot : How do you define 'simple access control'?
Or better, can you describe to me what would not classify as simple access control?

This is a basic activity, so I presume it is any basic form for authentication? I.e. that requirering a username and password, or some form of api-key for machine-to-machine communication?

Where do we draw the line?