Hey @noelmcloughlin! Right now we have been primarily using Terraform and Ansible for IaC, and our CaC/validation toolkit is in very early stages (we have recently decided to move away from Probr due to a lack of active development on that project).

We have primarily determined our scope for CFI based on the availability of contribution, which has so far been focused on public cloud resources. Considering that, I'm happy to open up discussion around what it would look like to accept contributions on elements that are not within the currently documented scope. Do you have anything specific in mind?

Hey @eddie-knight
Sorry for delay (vacation, etc). I'm an individual member of FINOS and thinking about contributions. Browsing issues, I see some of my DevSecOps engineering interests mentioned: Azure, OCP, Containers, Runtime Validation, OSCAL. Good engineering interests me greatly.

Current documented scope is correct in terms of what is industry priority and community focus. However, I do believe that good CFI engineering practices and enterprise architecture are equally applicable to both public and private cloud. We could note private cloud/data center contributors, as documentation exercise is perhaps my core suggesting.

Good work by the way, CFI is interesting evolving project adding value.