Zero trust paper

community/resources/zero-trust-whitepaper/README.md

@@ -0,0 +1,78 @@
+# Cloud Native Zero Trust Whitepaper
+
+<!-- cSpell:ignore CNZTWP -->
+
+> :sunflower: **Click
+> _[here](v1/cloud-native-zero-trust-whitepaper.pdf)_ for
+> _version 1_ (PDF) whitepaper**
+
+## About
+
+The Cloud Native Zero Trust Whitepaper (CNZTWP) is a TAG-Security effort to ensure
+the cloud native community has access to information about building,
+distributing, deploying, and running applications in accordance with Zero Trust principles.
+
+## Updates to the paper
+
+The Cloud Native Zero Trust Whitepaper (CNZTWP) is intended to be a living document
+created and maintained for the community, by its members.
+
+Updates to the whitepaper, suggestions for updates, or discussion for updates
+should initiate with an [issue](https://github.com/cncf/tag-security/issues)
+submitted to the repo and labeled with "suggestion" and "whitepaper".
+
+### Markdown
+
+The living CNZTWP is maintained in [markdown][whitepaper-v1-md]
+and all updates will be made in markdown.
+
+### Contributing updates
+
+All members of the community are welcome to contribute updates to this whitepaper.
+We ask potential contributors to refer to the original design decisions, listed
+below, as guidance when determining the content of their updates.
+
+It is highly recommended that you seek peer review for your updates beyond that
+of the Technical Leads and Co-Chairs of the TAG.
+
+Once the PR is submitted, please place the link in the CNCF TAG-Security Channel
+for the CNZTWP:
+[#tag-security-whitepaper](https://cloud-native.slack.com/archives/C017K5AN70T)
+to request a review.
+
+### Versioning and publishing
+
+It is expected that many minor updates will occur, corrections to grammar,
+spelling, clarification in language, translations, etc.  When these occur they
+are considered minor changes to the overall content and will not warrant the
+regeneration of the PDF.
+
+When significant changes to the intent, content, or numerous minor changes
+occur, the CNZTWP working group will assess and determine if a new major version
+of the PDF needs published.  When this decision is made, the markdown content
+will be converted to text document and sent to the CNCF technical writers to
+create the PDF.  The PDF will then be published back into the repository
+annotating the new version, updating the links in the README.md accordingly.
+
+Minor updates to the markdown shall receive a minor version bump indicated in
+the Metadata table of the document and recorded as WIP.  When enough significant
+changes have been recorded, the markdown will be placed "In Review" (via PR) and
+solicited to the CNCF TAG-Security and TOC mailing list for review, at a
+minimum.
+
+Upon completion of review, the TAG-Security TOC Liaison shall provide final
+approval on the PR.  At which point the markdown state will be changed to
+"Approved" and merged.
+
+## Links
+
+### Version 1
+
+* [Managed version in markdown][whitepaper-v1-md]
+* [Posted PDF first version][whitepaper-pdf-v1]
+* [Original Issue](https://github.com/cncf/tag-security/issues/950)
+
+[whitepaper-v1-md]:
+./v1/cloud-native-zero-trust-whitepaper.md
+[whitepaper-pdf-v1]:
+./v1/cloud-native-zero-trust-whitepaper.pdf