n0mad1k
87 lines
2.0 KiB
Django/Jinja
87 lines
2.0 KiB
Django/Jinja
# FedRAMP Phishing Test Compliance Configuration
|
|
# This configuration ensures compliance with FedRAMP requirements
|
|
|
|
compliance_mode: fedramp
|
|
test_type: user_awareness_only
|
|
|
|
# Email Configuration
|
|
email_settings:
|
|
# Emails must be whitelisted on all security systems
|
|
require_whitelist: true
|
|
bypass_security_controls: true
|
|
|
|
# No modification of emails allowed
|
|
allow_header_modification: false
|
|
allow_content_filtering: false
|
|
|
|
# Tracking requirements
|
|
tracking:
|
|
- email_opened (via pixel)
|
|
- link_clicked
|
|
- credentials_submitted
|
|
- user_identity (tied to actions)
|
|
|
|
# Landing Page Requirements
|
|
landing_page:
|
|
# Must immediately identify as phishing test
|
|
show_phishing_notice: true
|
|
phishing_notice_text: |
|
|
This was a phishing simulation!
|
|
You should never enter your credentials on suspicious websites.
|
|
|
|
# Educational content required
|
|
include_education: true
|
|
education_content:
|
|
- How to identify phishing emails
|
|
- Red flags to watch for
|
|
- Reporting procedures
|
|
- Best practices for email security
|
|
|
|
# Reporting Requirements
|
|
reporting:
|
|
# No PII in reports
|
|
anonymize_data: true
|
|
report_format: aggregate_only
|
|
|
|
# Required metrics
|
|
metrics:
|
|
- total_emails_sent
|
|
- emails_opened_percentage
|
|
- links_clicked_percentage
|
|
- credentials_submitted_percentage
|
|
- department_breakdown
|
|
- role_based_statistics
|
|
|
|
# Prohibited data
|
|
exclude:
|
|
- individual_names
|
|
- specific_email_addresses
|
|
- personal_identifiers
|
|
|
|
# Technical Configuration
|
|
technical:
|
|
# Simple campaign only
|
|
campaign_type: basic_phishing_test
|
|
|
|
# No exploitation
|
|
allow_malware: false
|
|
allow_exploitation: false
|
|
allow_persistence: false
|
|
|
|
# Clean tracking only
|
|
tracking_methods:
|
|
- pixel_tracking
|
|
- unique_urls
|
|
- form_submission
|
|
|
|
# Approval Process
|
|
approval:
|
|
requires_3pao_approval: true
|
|
requires_template_review: true
|
|
approval_documentation: required
|
|
|
|
# Post-Test Requirements
|
|
post_test:
|
|
notify_failures: true
|
|
provide_training: true
|
|
remediation_timeline: 30_days |