Remove ambiguity on Network vs IAM controls

[mlysaght2017]

Feature Request

Description of Problem:

I'm a bit confused about CCC.05: https://github.com/finos/common-cloud-controls/blob/main/services/common-controls.yaml#L191

Is it intended to be an IAM layer control or a Network layer control or both? Right now it's down as being a member of the IAM family, but reads more like a network layer control (to me at least). If we intend it to be both, the control_family object should be an array.

Also, a common feature was added recently for network access rules: https://github.com/finos/common-cloud-controls/blob/main/services/common-features.yaml#L31

The feature for IAM is this one: https://github.com/finos/common-cloud-controls/blob/main/services/common-features.yaml#L31 which is explicit about it relating to user identities.

If we're making the distinction at the feature level between network and iam access controls, then that should probably be separated out at the threat and control level too.

Potential Solutions:

I think we need to separate out IAM and Network Controls...?

[mlysaght2017]

@eddie-knight @smendis-scottlogic - could just be me, but I struggled with this one.

[eddie-knight]

This seems related to my poorly caputured issue #490