I'm thinking if there is such a tool to do help with cross referencing compliance requirement with policy document.

Let me illustrate with an example,

In PCI DSS there are requirement for handling cardholder data, such as

3.1 Keep cardholder data storage to a minimum by implementing data retention and disposal policies, procedures and processes that include at least the following for all cardholder data (CHD) storage:

Here is an example of Information Security Policy that can be found by Google. In it there is one such policy statement:

2.2.3. Card Data Handling Requirements

  • Credit card data should NOT be stored in LSE
  • Credit card data is classified as confidential, in accordance with the LSE Information Classification Standard. This means that if credit card data is stored for whatever reason it must be protected. If it is stored in systems, it has to be encrypted. If it is stored on paper it must be locked away at all times unless in use. In the first instance, report any credit card number storage to the Information Security Manager.

What I would like to achieve with such a software (if it exist) is that there is a way for user to create the policy in the software and then tag requirement to be cross referenced.

If I look up the requirement, I can reference the policy that implement the requirement.

Right now, what we do is manually maintain a spreadsheet that does the cross reference. It is tedious to update when requirements changes.

As for the software itself, I'm open to alternatives - install on any platform or Saas. I can possibly also consider scripts, document generation such as markdown or some kind of syntax.

Free is very much preferred. If paid, either a one time of $100 or less or yearly subscription of $25 or less.

  • 1
    What format are the policy documents written in? This task is easy if you're using a text-based format (e.g., HTML) but could be difficult if you're using a binary format (e.g., Word). – Kodiologist Apr 26 '17 at 1:09
  • @Kodiologist it doesn't matter. If it is a suitable to, we can take a one time effort to convert and do the linking. – kenchew Apr 26 '17 at 1:10
  • If I answered your question to your satisfaction, you can accept my answer by clicking the check mark under the voting arrows. – Kodiologist Jun 8 '17 at 22:33
  • 1
    @Kodiologist thank you for the answer. It presents a possible way. I'm more looking for a software that I can start using. So I'm leaving it open at this time. – kenchew Jun 9 '17 at 5:10
  • 1
    @kemchew If you can't use my software for some reason, you should edit your post to describe the constraints on what you can use. – Kodiologist Jun 9 '17 at 14:20

The simplest way to do this seems to be to design a syntax for referencing requirements, use that to mark up the policy documents, and have a little program collect a list of requirements and their matching policies from the policy documents.

For example, suppose your policy documents are written in HTML (or, more likely, some other format that's exported to HTML, like reStructuredText) and each policy looks like:

<h3 class="policy">2.2.3. Card Data Handling Requirements <span class="req">PCI DSS 3.1</span></h3>

The idea is, in the headline element for each policy, you put a span of class req that names the requirement the policy satisfies. Now to get a list of policies and requirements, you run this Python 3 program:

import lxml.html

doc = lxml.html.parse("policy.html")
for req_ref in doc.xpath("//span[@class='req']"):
    header = req_ref.getparent()
    print(req_ref.text.strip(), "---", header.text.strip())

If policy.html contains only the above, this prints:

PCI DSS 3.1 --- 2.2.3. Card Data Handling Requirements

It's straightforward to make this program do fancier things such as sort the output according to taste, produce an HTML document with hyperlinks to the policy sections, etc.

  • 1
    Thank you for the idea and answer. Do you know if any codes (in github maybe) that does something similar. I'm hoping to doing as little development as possible. Hopefully a less technical person can just use the tool – kenchew Apr 26 '17 at 1:46
  • 1
    @kenchew I don't, but feel free to use the code I wrote here. – Kodiologist Apr 26 '17 at 1:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.