)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"d302605432bdbecc239ca1293fa46ae7b2dc2263","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Added sections 1.2 and 1.3"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Added sections 1.2 and 1.3 to the Compliance Overview chapter of the security guide."},{"line_number":10,"context_line":"Closes-Bug: #1341819"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: Ie4ea7688deb78ec2ad91b318f57e678461403f3d"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"baada198_9d218e51","line":10,"updated":"2014-07-25 19:12:08.000000000","message":"Closes-Bug should be after Change-Id.","commit_id":"f65f8073b393e8560d4ead9d5e190b79a7bef9af"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"273104411c322a34d73f3795ef7976272321cf23","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Added sections 1.2 and 1.3"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Added sections 1.2 and 1.3 to the Compliance Overview chapter of the security guide."},{"line_number":10,"context_line":"Closes-Bug: #1341819"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: Ie4ea7688deb78ec2ad91b318f57e678461403f3d"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"baada198_5d87f611","line":10,"in_reply_to":"baada198_9d218e51","updated":"2014-07-25 19:14:46.000000000","message":"Christian, this is not needed, see: https://wiki.openstack.org/wiki/GitCommitMessages#Information_in_commit_messages","commit_id":"f65f8073b393e8560d4ead9d5e190b79a7bef9af"}],"security-guide/ch_compliance-overview.xml":[{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"4a75245cc7bd48ed9779dea579aaca66239e8052","unresolved":false,"context_lines":[{"line_number":37,"context_line":"        \u003clistitem\u003e"},{"line_number":38,"context_line":"          \u003cpara\u003eIdentify where risks exist in a cloud architecture and apply controls to mitigate"},{"line_number":39,"context_line":"            the risks. In areas of significant concern, layered defences provide multiple"},{"line_number":40,"context_line":"            complementary controls to further mitigate risk. For example, to ensure adequate"},{"line_number":41,"context_line":"            isolation between cloud tenants, we recommend hardening QEMU, using a hypervisor with"},{"line_number":42,"context_line":"            SELinux support, enforcing mandatory access control policies, and reducing the overall"},{"line_number":43,"context_line":"            attack surface. The foundational principle is to harden an area of concern with multiple"}],"source_content_type":"application/xml","patch_set":2,"id":"baada198_90ebda11","line":40,"updated":"2014-07-22 13:14:59.000000000","message":"This is a horrible sentence, I\u0027m pretty sure I wrote it, so I\u0027ll follow up with a CR to change this myself once this is accepted.","commit_id":"20407ff9a8f4125137a4f782f4c35215c03868e5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"f157ce96083e0e9b131f2e8539206eb22cacc24d","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    \u003c/variablelist\u003e"},{"line_number":94,"context_line":"  \u003c/section\u003e"},{"line_number":95,"context_line":"  \u003csection xml:id\u003d\"compliance-overview-CommonControlFramework\"\u003e"},{"line_number":96,"context_line":"    \u003ctitle\u003eCommon Control Frameworks\u003c/title\u003e"},{"line_number":97,"context_line":"    \u003cpara\u003eThe following is a list of Control Frameworks that an organization can use to build their"},{"line_number":98,"context_line":"      security controls\u003c/para\u003e"},{"line_number":99,"context_line":"    \u003cvariablelist\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"baada198_f9e89ae0","line":96,"updated":"2014-07-22 07:42:26.000000000","message":"Sentence style capitalization","commit_id":"20407ff9a8f4125137a4f782f4c35215c03868e5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"f157ce96083e0e9b131f2e8539206eb22cacc24d","unresolved":false,"context_lines":[{"line_number":146,"context_line":"    \u003c/variablelist\u003e"},{"line_number":147,"context_line":"  \u003c/section\u003e"},{"line_number":148,"context_line":"  \u003csection xml:id\u003d\"compliance-overview-AuditReference\"\u003e"},{"line_number":149,"context_line":"    \u003ctitle\u003eAudit Reference\u003c/title\u003e"},{"line_number":150,"context_line":"    \u003cpara\u003eOpenStack is innovative in many ways however the process used to audit an openstack"},{"line_number":151,"context_line":"      deployment is fairly common.  Auditors will always evaluate a process by two criteria: Is the"},{"line_number":152,"context_line":"      control designed effectively and is the control is operating effectively.  An understanding of"}],"source_content_type":"application/xml","patch_set":2,"id":"baada198_59da664b","line":149,"updated":"2014-07-22 07:42:26.000000000","message":"Please use sentence style capitalization - see https://wiki.openstack.org/wiki/Documentation/Conventions#Headings","commit_id":"20407ff9a8f4125137a4f782f4c35215c03868e5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"f157ce96083e0e9b131f2e8539206eb22cacc24d","unresolved":false,"context_lines":[{"line_number":149,"context_line":"    \u003ctitle\u003eAudit Reference\u003c/title\u003e"},{"line_number":150,"context_line":"    \u003cpara\u003eOpenStack is innovative in many ways however the process used to audit an openstack"},{"line_number":151,"context_line":"      deployment is fairly common.  Auditors will always evaluate a process by two criteria: Is the"},{"line_number":152,"context_line":"      control designed effectively and is the control is operating effectively.  An understanding of"},{"line_number":153,"context_line":"      how an auditor evaluates if a control is designed and operating effectively will be discussed"},{"line_number":154,"context_line":"      in the \u0027Understanding the Audit Process\u0027 chapter.\u003c/para\u003e"},{"line_number":155,"context_line":"    \u003cpara\u003eThe most common frameworks for auditing and evaluating a cloud deployment include the"}],"source_content_type":"application/xml","patch_set":2,"id":"baada198_b977023a","line":152,"updated":"2014-07-22 07:42:26.000000000","message":"\"is the control is\" -\u003e \"if the control is\"","commit_id":"20407ff9a8f4125137a4f782f4c35215c03868e5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"f157ce96083e0e9b131f2e8539206eb22cacc24d","unresolved":false,"context_lines":[{"line_number":151,"context_line":"      deployment is fairly common.  Auditors will always evaluate a process by two criteria: Is the"},{"line_number":152,"context_line":"      control designed effectively and is the control is operating effectively.  An understanding of"},{"line_number":153,"context_line":"      how an auditor evaluates if a control is designed and operating effectively will be discussed"},{"line_number":154,"context_line":"      in the \u0027Understanding the Audit Process\u0027 chapter.\u003c/para\u003e"},{"line_number":155,"context_line":"    \u003cpara\u003eThe most common frameworks for auditing and evaluating a cloud deployment include the"},{"line_number":156,"context_line":"      previosely mentioned ISO 27001/2 Information Security standard,  ISACA\u0027s Control Objectives"},{"line_number":157,"context_line":"      for Information and Related Technology (COBIT) framework, Committee of Sponsoring"}],"source_content_type":"application/xml","patch_set":2,"id":"baada198_19b70ed9","line":154,"updated":"2014-07-22 07:42:26.000000000","message":"Could you add an xlink to this chapter, pelase?","commit_id":"20407ff9a8f4125137a4f782f4c35215c03868e5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"f157ce96083e0e9b131f2e8539206eb22cacc24d","unresolved":false,"context_lines":[{"line_number":153,"context_line":"      how an auditor evaluates if a control is designed and operating effectively will be discussed"},{"line_number":154,"context_line":"      in the \u0027Understanding the Audit Process\u0027 chapter.\u003c/para\u003e"},{"line_number":155,"context_line":"    \u003cpara\u003eThe most common frameworks for auditing and evaluating a cloud deployment include the"},{"line_number":156,"context_line":"      previosely mentioned ISO 27001/2 Information Security standard,  ISACA\u0027s Control Objectives"},{"line_number":157,"context_line":"      for Information and Related Technology (COBIT) framework, Committee of Sponsoring"},{"line_number":158,"context_line":"      Organizations of the Treadway Commission (COSO), and Information Technology Infrastructure"},{"line_number":159,"context_line":"      Library (ITIL).  It is very common for audits to be include areas of focus from one or more of"}],"source_content_type":"application/xml","patch_set":2,"id":"baada198_79b00adc","line":156,"updated":"2014-07-22 07:42:26.000000000","message":"Typo: previously","commit_id":"20407ff9a8f4125137a4f782f4c35215c03868e5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"f157ce96083e0e9b131f2e8539206eb22cacc24d","unresolved":false,"context_lines":[{"line_number":156,"context_line":"      previosely mentioned ISO 27001/2 Information Security standard,  ISACA\u0027s Control Objectives"},{"line_number":157,"context_line":"      for Information and Related Technology (COBIT) framework, Committee of Sponsoring"},{"line_number":158,"context_line":"      Organizations of the Treadway Commission (COSO), and Information Technology Infrastructure"},{"line_number":159,"context_line":"      Library (ITIL).  It is very common for audits to be include areas of focus from one or more of"},{"line_number":160,"context_line":"      these frameworks.  Fortunately there is a lot of overlap between the frameworks, so an"},{"line_number":161,"context_line":"      organization that adopts one will be in a good position come audit time.\u003c/para\u003e"},{"line_number":162,"context_line":"  \u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"baada198_99d15efd","line":159,"updated":"2014-07-22 07:42:26.000000000","message":"\"to be include\" -\u003e \"to include\"","commit_id":"20407ff9a8f4125137a4f782f4c35215c03868e5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"8cbf51b678d5e706de410aee430283aa363187b5","unresolved":false,"context_lines":[{"line_number":151,"context_line":"      deployment is fairly common. Auditors will always evaluate a process by two criteria: Is the"},{"line_number":152,"context_line":"      control designed effectively and if the control is operating effectively. An understanding of"},{"line_number":153,"context_line":"      how an auditor evaluates if a control is designed and operating effectively will be discussed"},{"line_number":154,"context_line":"      in the \u003cxref linkend\u003d\"understanding-the-audit-process\" /\u003e chapter.\u003c/para\u003e"},{"line_number":155,"context_line":"    \u003cpara\u003eThe most common frameworks for auditing and evaluating a cloud deployment include the"},{"line_number":156,"context_line":"      previously mentioned ISO 27001/2 Information Security standard,  ISACA\u0027s Control Objectives"},{"line_number":157,"context_line":"      for Information and Related Technology (COBIT) framework, Committee of Sponsoring"}],"source_content_type":"application/xml","patch_set":3,"id":"baada198_132ca292","line":154,"updated":"2014-07-25 10:48:33.000000000","message":"Please check the generated html at http://docs-draft.openstack.org/70/108570/3/check/gate-security-doc-tox-doc-publish-checkbuild/9b200f6/publish-docs/security-guide/content/compliance-overview.html\n\nThe output is: \" will be discussed in the Chapter 48, Understanding the audit process chapter.\"\n\nThus change your sentence to\n\"... in \u003cxref...\u003e.\u003c/para\u003e\"","commit_id":"2d45235471d45c1bc6f6abe896c1ff40da0f18e7"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"75cd70a3bc4b697dd03ea8ba8303b24151017b61","unresolved":false,"context_lines":[{"line_number":151,"context_line":"      deployment is fairly common. Auditors will always evaluate a process by two criteria: Is the"},{"line_number":152,"context_line":"      control designed effectively and if the control is operating effectively. An understanding of"},{"line_number":153,"context_line":"      how an auditor evaluates if a control is designed and operating effectively will be discussed"},{"line_number":154,"context_line":"      in \u003cxref linkend\u003d\"understanding-the-audit-process\"/\u003e chapter.\u003c/para\u003e"},{"line_number":155,"context_line":"    \u003cpara\u003eThe most common frameworks for auditing and evaluating a cloud deployment include the"},{"line_number":156,"context_line":"      previously mentioned ISO 27001/2 Information Security standard,  ISACA\u0027s Control Objectives"},{"line_number":157,"context_line":"      for Information and Related Technology (COBIT) framework, Committee of Sponsoring"}],"source_content_type":"application/xml","patch_set":4,"id":"baada198_f52b8b79","line":154,"updated":"2014-07-25 14:41:34.000000000","message":"You need to remove the word \"chapter\" as well, see my earlier comment.","commit_id":"2831315cc10f3fb12176e2258a56d956b8c5f9e4"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"db09d6295794e0dcdd2aed63898416d94af898d3","unresolved":false,"context_lines":[{"line_number":123,"context_line":"          \u003cpara\u003eThe ISO 27001 Information Security standard and certification has been used for"},{"line_number":124,"context_line":"            many years to evaluate and distinguish an organizations alignment with information"},{"line_number":125,"context_line":"            Security best practices.  The standard is comprised of two parts: Mandatory Clauses that"},{"line_number":126,"context_line":"            deine the Information Security Managment System (ISMS) and Annex A which contains a list"},{"line_number":127,"context_line":"            of controls organized by domain.\u003c/para\u003e"},{"line_number":128,"context_line":"          \u003cpara\u003eThe information security managemnet system preserves the confidentiality, integrity,"},{"line_number":129,"context_line":"            and availability of information by applying a risk management process and gives"}],"source_content_type":"application/xml","patch_set":5,"id":"baada198_d63beee7","line":126,"updated":"2014-07-25 15:46:47.000000000","message":"deine -\u003e define","commit_id":"f65f8073b393e8560d4ead9d5e190b79a7bef9af"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"db09d6295794e0dcdd2aed63898416d94af898d3","unresolved":false,"context_lines":[{"line_number":147,"context_line":"  \u003c/section\u003e"},{"line_number":148,"context_line":"  \u003csection xml:id\u003d\"compliance-overview-AuditReference\"\u003e"},{"line_number":149,"context_line":"    \u003ctitle\u003eAudit reference\u003c/title\u003e"},{"line_number":150,"context_line":"    \u003cpara\u003eOpenStack is innovative in many ways however the process used to audit an openstack"},{"line_number":151,"context_line":"      deployment is fairly common. Auditors will always evaluate a process by two criteria: Is the"},{"line_number":152,"context_line":"      control designed effectively and if the control is operating effectively. An understanding of"},{"line_number":153,"context_line":"      how an auditor evaluates if a control is designed and operating effectively will be discussed"}],"source_content_type":"application/xml","patch_set":5,"id":"baada198_367c2ab6","line":150,"updated":"2014-07-25 15:46:47.000000000","message":"openstack (end of line) should probably be OpenStack","commit_id":"f65f8073b393e8560d4ead9d5e190b79a7bef9af"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"db09d6295794e0dcdd2aed63898416d94af898d3","unresolved":false,"context_lines":[{"line_number":148,"context_line":"  \u003csection xml:id\u003d\"compliance-overview-AuditReference\"\u003e"},{"line_number":149,"context_line":"    \u003ctitle\u003eAudit reference\u003c/title\u003e"},{"line_number":150,"context_line":"    \u003cpara\u003eOpenStack is innovative in many ways however the process used to audit an openstack"},{"line_number":151,"context_line":"      deployment is fairly common. Auditors will always evaluate a process by two criteria: Is the"},{"line_number":152,"context_line":"      control designed effectively and if the control is operating effectively. An understanding of"},{"line_number":153,"context_line":"      how an auditor evaluates if a control is designed and operating effectively will be discussed"},{"line_number":154,"context_line":"      in \u003cxref linkend\u003d\"understanding-the-audit-process\"/\u003e.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"baada198_b6367a00","line":151,"updated":"2014-07-25 15:46:47.000000000","message":"remove always","commit_id":"f65f8073b393e8560d4ead9d5e190b79a7bef9af"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"db09d6295794e0dcdd2aed63898416d94af898d3","unresolved":false,"context_lines":[{"line_number":149,"context_line":"    \u003ctitle\u003eAudit reference\u003c/title\u003e"},{"line_number":150,"context_line":"    \u003cpara\u003eOpenStack is innovative in many ways however the process used to audit an openstack"},{"line_number":151,"context_line":"      deployment is fairly common. Auditors will always evaluate a process by two criteria: Is the"},{"line_number":152,"context_line":"      control designed effectively and if the control is operating effectively. An understanding of"},{"line_number":153,"context_line":"      how an auditor evaluates if a control is designed and operating effectively will be discussed"},{"line_number":154,"context_line":"      in \u003cxref linkend\u003d\"understanding-the-audit-process\"/\u003e.\u003c/para\u003e"},{"line_number":155,"context_line":"    \u003cpara\u003eThe most common frameworks for auditing and evaluating a cloud deployment include the"}],"source_content_type":"application/xml","patch_set":5,"id":"baada198_56419ea4","line":152,"updated":"2014-07-25 15:46:47.000000000","message":"if -\u003e is","commit_id":"f65f8073b393e8560d4ead9d5e190b79a7bef9af"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"254a92932ae7623281b2a3c2670902fdaee33447","unresolved":false,"context_lines":[{"line_number":149,"context_line":"    \u003ctitle\u003eAudit reference\u003c/title\u003e"},{"line_number":150,"context_line":"    \u003cpara\u003eOpenStack is innovative in many ways however the process used to audit an openstack"},{"line_number":151,"context_line":"      deployment is fairly common. Auditors will always evaluate a process by two criteria: Is the"},{"line_number":152,"context_line":"      control designed effectively and if the control is operating effectively. An understanding of"},{"line_number":153,"context_line":"      how an auditor evaluates if a control is designed and operating effectively will be discussed"},{"line_number":154,"context_line":"      in \u003cxref linkend\u003d\"understanding-the-audit-process\"/\u003e.\u003c/para\u003e"},{"line_number":155,"context_line":"    \u003cpara\u003eThe most common frameworks for auditing and evaluating a cloud deployment include the"}],"source_content_type":"application/xml","patch_set":5,"id":"baada198_fcf6138f","line":152,"in_reply_to":"baada198_56419ea4","updated":"2014-07-25 16:32:23.000000000","message":"Please disregard, I missed the second \u0027is\u0027","commit_id":"f65f8073b393e8560d4ead9d5e190b79a7bef9af"}]}