{
  "onecamp_template": 1,
  "name": "Security audit prep",
  "description": "The groundwork before an auditor or a customer's security review: policies, access, backups and evidence.",
  "tasks": [
    {
      "name": "Agree on the scope and the auditor",
      "description": "<p>Which standard or questionnaire, which systems are in scope, and the dates.</p>",
      "status": "todo",
      "priority": "high",
      "tags": "audit",
      "due_day": 3
    },
    {
      "name": "Gather the policies",
      "description": "<p>Keep each policy as a doc, with its owner and the date it was last reviewed.</p>",
      "status": "todo",
      "priority": "high",
      "tags": "audit",
      "due_day": 10,
      "subtasks": [
        {
          "name": "Information security"
        },
        {
          "name": "Access control"
        },
        {
          "name": "Incident response"
        },
        {
          "name": "Backups and recovery"
        },
        {
          "name": "Vendor management"
        }
      ]
    },
    {
      "name": "Review who has access to what",
      "description": "<p>Remove the accounts of people who left, and admin rights nobody uses.</p>",
      "status": "todo",
      "priority": "high",
      "tags": "audit",
      "due_day": 14
    },
    {
      "name": "Review vendors",
      "description": "<p>Every service that holds our data or our customers&#39; data, and what it holds.</p>",
      "status": "todo",
      "priority": "medium",
      "tags": "audit",
      "due_day": 17
    },
    {
      "name": "Test a restore from backup",
      "description": "<p>Restore to a spare server, check the data is all there, and note how long it took.</p>",
      "status": "todo",
      "priority": "high",
      "tags": "audit",
      "due_day": 21
    },
    {
      "name": "Run an incident drill",
      "description": "<p>Walk through a made-up incident, such as a lost laptop or a leaked password, using the incident response policy. Note what didn&#39;t work.</p>",
      "status": "todo",
      "priority": "medium",
      "tags": "audit",
      "due_day": 24
    },
    {
      "name": "Collect the evidence",
      "description": "<p>Screenshots, exports and logs, one folder per control, named so the auditor can find them.</p>",
      "status": "todo",
      "priority": "high",
      "tags": "audit",
      "due_day": 28
    },
    {
      "name": "Walk the auditor through it",
      "description": "<p>The scope, the policies and where each piece of evidence is. Note every question that couldn&#39;t be answered on the spot.</p>",
      "status": "todo",
      "priority": "high",
      "tags": "audit",
      "due_day": 35
    },
    {
      "name": "Fix what they found",
      "description": "<p>One task per finding, each with an owner and a date.</p>",
      "status": "backlog",
      "priority": "medium",
      "tags": "audit",
      "due_day": 49
    }
  ]
}