Data Management User Stories
Complete set of user stories for Vulcan's data management system — exports, imports, backup, restore, and DISA submission workflows. These define what the finished system supports once all current work is complete.
References
docs/site/disa-process/export-requirements.md— Gap analysis and export architecturedocs/site/disa-process/field-requirements.md— DISA field matrix by statusdocs/site/disa-process/overview.md— DISA vendor process overviewdocs/site/disa-process/intent-form.md— DISA Intent Form requirements
Export Stories
1. Vendor Submission (DISA Excel)
As a vendor security engineer, I need to export my completed Component as a strict 17-column DISA spreadsheet so I can submit it to DISA for STIG publication.
Acceptance criteria:
- Exactly 17 columns per DISA Table 8-1
- Check/Fix blank for non-AC statuses (DISA adds boilerplate during finalization)
- VulnDiscussion and Severity blank for NA
- STIGID blank (DISA assigns during finalization)
- Satisfies text folded into VulnDiscussion (not a separate column)
- Warning if any rules are still NYD (DISA rejects NYD)
2. Working Copy (Excel / CSV)
As a team lead, I need to export my Component as-is so I can share progress with my team, do offline review, or import into another Vulcan instance.
Acceptance criteria:
- All fields exactly as authored — no blanking, no content modification
- All statuses included (including NYD)
- Optional toggle: include or exclude satisfied-by rules
- Available at Component level AND Project level
- CSV format works (not just Excel)
- ProjectComponents page export URL works correctly
3. Published STIG (XCCDF)
As a compliance engineer, I need to export a finalized Component as XCCDF XML so downstream tools (STIG Viewer, SCAP scanners) can consume it.
Acceptance criteria:
- AC rules only (matches what DISA publishes on Cyber Exchange)
- Satisfied-by rules excluded
- Satisfies text in VulnDiscussion
- Valid XCCDF schema
4. InSpec Profile
As a DevSecOps engineer, I need to export my Component as an InSpec profile so I can automate compliance scanning.
Acceptance criteria:
- AC rules only, satisfied-by excluded
- Maps rule fields to InSpec control structure (title, desc, impact, tags, check/fix)
5. Backup (JSON Archive)
As a Vulcan administrator, I need to export a Component as a full-fidelity JSON archive (all rules, all statuses, all metadata, all reviews) and re-import it into the same or different Vulcan instance for backup, migration, or disaster recovery.
Acceptance criteria:
- ALL rules, ALL statuses, ALL metadata — nothing filtered
- Includes NYD, NA, AIM, ADNM
- Preserves satisfaction relationships, vendor comments, reviews, triage decisions
- Re-import creates a new Component (or updates existing)
- Round-trip: export then import produces identical data
- Works across Vulcan instances
Import Stories
6. Spreadsheet Import (Round-Trip)
As a security engineer, I need to import a spreadsheet (XLSX or CSV) to create or update a Component, including re-importing data I previously exported.
Acceptance criteria:
- Accepts DISA headers AND benchmark CSV headers (Postel's Law — done via header aliases)
- CSV file format accepted in UI
- InSpec Control Body column imported if present
- Satisfaction keywords parsed from VulnDiscussion
7. SRG/STIG XCCDF Import
As a security engineer, I need to import SRG and STIG XML files from DISA Cyber Exchange so I can use them as baselines for new Components.
Status: Working. This is the core import path and has been functional.
8. Backup Import (JSON Archive)
As a Vulcan administrator, I need to re-import a JSON archive backup to restore a Component from a previous export.
Acceptance criteria:
- Accepts backup archive exported from story 5
- Creates new Component with all fields preserved
- Works across Vulcan instances (export from A, import to B)
- Optionally include/exclude reviews and memberships
9. InSpec Profile Import (Future)
As a team inheriting an existing InSpec profile, I need to import it into Vulcan so I can manage it alongside our other STIGs.
Acceptance criteria:
- Parse InSpec control files from ZIP or directory
- Extract control ID, title, desc, impact, tags (check, fix, cci, nist)
- Map to Vulcan rule fields
- Requires a base SRG (same as spreadsheet import)
Approach: Use inspec json CLI to convert profile to JSON, then parse structured JSON rather than writing a Ruby DSL parser.
Infrastructure Stories
10. Database Backup and Restore
As a Vulcan administrator, I need to backup and restore the entire database so I can recover from failures, migrate between servers, or clone environments.
Acceptance criteria:
- Backup: pg_dump to compressed file with timestamp naming
- Restore: pg_restore from backup file with safety confirmations
- Access: Available via rake task and optionally via admin UI
- Safety: Restore requires confirmation, warns about data loss
- Scheduling: Document cron-based automated backup pattern
- Storage: Configurable backup directory
- Document backup strategy per deployment type (Docker, Heroku, bare metal)
Execution Order
Phase A: Export Implementation (parallel)
- Vendor Submission mode (strict DISA 17-column template)
- Fix export routing (project CSV + ProjectComponents URL)
- Satisfied-by filter toggle for Excel/CSV
Phase B: Round-Trip Testing (after Phase A)
- Export/import round-trip fidelity tests
Phase C: Documentation (after Phase A)
- Sync VitePress docs with finalized export system
Independent (no blockers)
- JSON archive backup/restore
- Database backup/restore
- InSpec import (future)