diff --git a/CLAUDE.md b/CLAUDE.md index db977dce..1ec00f0f 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -75,5 +75,6 @@ Criticality : score ≥ 7.0 = critical · ≥ 4.0 = high · ≥ 2.0 = medium · 23. ~~Gestion complète des risques — cycle de vie ISO 31000 + éval. quantitative exposée live~~ ✅ fait + **vérifié live le 16/07/2026** (branche `feat/risk-lifecycle-iso31000`). Demande utilisateur explicite (5 sous-fonctions : registre / identification auto+manuelle / éval. qualitative P×I / éval. quantitative pertes financières / cycle de vie complet Identifier→Analyser→Évaluer→Traiter→Surveiller→Clôturer). **Vérification préalable** : (1) registre, (2) identification (manuel + CTI `cti_auto` + scanner + import), (3) qualitatif (Score Engine P×I×AC) = **déjà faits et live**. (4) quantitatif : `pkg/crq` calcule bien l'ALE (SLE×ARO, FCFA+USD) et le handler `quantify()` le renseigne, **mais l'onglet « Financier » ne vivait que dans `RiskListPage`/`RiskDrawer.tsx` orphelins (non routés)** — le drawer **live** (inline dans `RiskRegisterPage`) ne l'exposait pas. (5) cycle de vie : un sous-système legacy `/risk-management/*` (`RiskManagementService` sur `database.DB`, modèle `RiskRegister`/`RiskTreatmentPlan`/`RiskMonitoringReview`/… **dupliquant** l'entité `Risk`) existait mais **tables absentes d'`AutoMigrate` → 500 systématique**, requêtes `First(&x,"id = ?",id)` **sans filtre tenant** (fuite cross-tenant), et un front orphelin (`pages/RiskManagement.tsx` + hooks `useRiskManagement` appelant des endpoints inexistants `getRiskRegister`/`treat`/`review`/`communicate`) — `/risk-management` redirige de toute façon vers `/risks`. **Décision** : ne PAS ressusciter le legacy dupliqué ; porter le cycle de vie sur l'entité `Risk` **réelle**. **Livré — backend** : type `domain.RiskPhase` (6 phases + `riskPhaseOrder` + `ParseRiskPhase` + `CanTransitionTo` = ±1 pas, →`closed` depuis n'importe où, réouverture depuis `closed`, no-op refusé), champ `Risk.LifecyclePhase` (`gorm default 'identified'`, indexé, dans `AutoMigrate` via `Risk`), défaut posé dans `CreateRiskUseCase` ; `TransitionPhaseUseCase` (1 fichier, tenant-scoped via `GetByID(tenant)`, garde la transition, **couple le statut** : →treated met `in_progress`, →closed met `closed`, réouverture remet `open`, audit best-effort), handler `TransitionPhase` + DTO + route `POST /risks/:id/transition` (garde `risks:update`), migration `0031_add_risk_lifecycle_phase` (colonne + backfill depuis `status` + index). **Frontend** : types `RiskPhase` + `lifecycle_phase`/CRQ ajoutés à `useRiskStore.Risk` + `riskService.Risk` ; action store `transitionPhase` (optimiste) ; `riskService.transitionPhase` ; `UiRisk.phase` dans `riskMap` ; **drawer live** (inline `RiskRegisterPage`) enrichi : pastille de phase dans l'en-tête + onglet **« Cycle de vie »** (stepper vertical 6 phases, boutons Précédente/Suivante/Clôturer/Rouvrir gardés par `risks:update` + note optionnelle) + onglet **« Financier »** (ALE FCFA/USD depuis `raw` + SLE/ARO éditables → `updateRisk` → recalcul). Tests : `transition_phase_test.go` (Success / clôture→statut closed / NotFound / cross-tenant→NotFound / transition invalide +2 / phase inconnue / no-op) + `risk_handler_test.go` mis à jour (nouvelle signature `NewRiskHandler`). **Preuves live (Postgres:5434+Redis, binaire sur :8091)** : création → phase `identified` + ALE référence 15 M FCFA ; identified→analyzed→evaluated 200 ; **evaluated→monitored (saut +2) 400, phase inchangée** ; evaluated→treated → statut `in_progress` ; treated→closed → statut `closed` ; closed→monitored (réouverture) → statut `open` ; phase inconnue 400 ; no-op 400 ; transition sur id inexistant 404 ; **CRQ explicite** PATCH sle=2 M/aro=0.5 → ALE 1 M FCFA / 1666.67 USD / basis `explicit` ; transitions tracées dans `risk_histories` (hook AfterSave). `go build`/`vet`/`go test ./internal/application/risk/...` verts, `tsc -b`/`vite build` verts. **Restes honnêtes** : le legacy `/risk-management/*` reste en place mais **superseded** (non migré/cross-tenant/orphelin — à supprimer dans une passe de nettoyage) ; `CreateAuditEntry`→`audit_logs` est un no-op pré-existant (schémas `AuditLogEntry` vs `AuditLog` incompatibles, partagé avec `AcceptRisk`) — les transitions sont malgré tout tracées via `risk_histories` ; frontend prouvé par tsc/build + endpoints live (le sandbox bloque le pilotage CDP interactif) ; les deux vocabulaires `RiskStatus` (lowercase/uppercase) toujours non unifiés (`toRiskStatus` mappe `closed`→`mitigated` pour la pastille — cosmétique). 24. ~~Corrections post-cycle-de-vie : `created_by` + suppression du legacy `/risk-management`~~ ✅ fait le 16/07/2026 (branche `fix/remove-legacy-risk-management`). **(a) `created_by`** : la note « `CreateRisk` ne renseigne pas `created_by` (reste `uuid.Nil`) » était **périmée** — vérifié live (nouveau risque via API → `created_by` = id réel de l'admin `admin@opendefender.io`) ; le handler passe `mwCtx.UserID` au use case depuis le fix `SetContext` du 08/07. Seul le chemin CTI auto-création met **volontairement** `uuid.Nil` (`matcher.go:79`, commenté « auto-generated, no human author ») — laissé tel quel (intentionnel). Note retirée de ROADMAP/CLAUDE. **(b) Legacy `/risk-management/*` supprimé** (la « meilleure solution » demandée) : ce sous-système **dupliquait** l'entité `Risk` (`RiskRegister`/`RiskTreatmentPlan`/`RiskMonitoringReview`/`RiskDecision`/…), ses tables n'étaient **jamais dans `AutoMigrate` (→ 500 systématique)**, ses requêtes `First(&x,"id = ?",id)` étaient **sans filtre tenant (fuite cross-tenant)**, et son front (`pages/RiskManagement.tsx` + `hooks/useRiskManagement` + 9 composants de phase + `api/riskManagementService`) était **orphelin** (`/risk-management` redirige déjà vers `/risks`). Supprimés : **backend** `internal/domain/risk_management.go`, `internal/service/risk_management_service.go`, `internal/handler/risk_management_handler.go`, `internal/infrastructure/repository/risk_management_repositories.go` + le bloc de routes dans `main.go` (remplacé par un commentaire pointant vers `POST /risks/:id/transition`) ; **frontend** `pages/RiskManagement.tsx`, `hooks/useRiskManagement.ts`, `api/riskManagementService.ts`, `features/risks/components/Risk{Identification,Analysis,Treatment,Monitoring,Review,Communication}Phase.tsx` + `Risk{DecisionManagement,AuditCompliance,ManagementPolicy,Details}.tsx`, `pages/RiskRegister.tsx` (orphelin qui importait le `RiskDetails` supprimé), `__tests__/api.test.ts` (testait uniquement l'API legacy, dont des endpoints inexistants `/treat`/`/monitor`/`/communicate`). Redirect `/risk-management`→`/risks` **conservé** (deep links). Le cycle de vie ISO 31000 sur l'entité `Risk` réelle (item 23) remplace intégralement ce legacy. `go build`/`vet` verts, `tsc -b`/`vite build` verts ; `TestRiskCRUDFlow` reste rouge (**pré-existant, confirmé au commit parent `62191679` via worktree**, indépendant de cette suppression). 25. ~~Gestion des vulnérabilités — module dédié (7 intégrations + priorisation risk-based)~~ ✅ fait + **vérifié live le 16/07/2026** (branche `feat/vulnerability-management`). Demande utilisateur explicite : intégration Nessus/OpenVAS/Qualys/Microsoft Defender/AWS Inspector/Azure Defender/CrowdStrike + priorisation par CVSS/exploitabilité/criticité métier/actifs concernés. **Vérification préalable** : aucun module de vulnérabilités dédié n'existait — le scanner (Module 6) produit des `FindingDiscovery` transitoires (preview Redis) et le CTI a des `CTIVulnerability` (données de flux NVD/CISA), mais **pas de registre de vulnérabilités persistant, par actif, priorisé**. Livré — **backend** : `domain.Vulnerability` (tenant-scoped : CVE, CVSS+vector, sévérité, **EPSS**, **KEV**, exploit dispo+maturité, criticité métier snapshot de l'actif lié, **AffectedAssetsCount** = blast radius, source, statut de remédiation open→triaged→in_remediation→remediated/accepted/false_positive, **PriorityScore 0–100 + tier P1–P4** ; `DedupKey` ; dans `AutoMigrate`) + port `VulnerabilityRepository` + impl Gorm (`Upsert` par dedup qui rafraîchit les scores mais **préserve le statut de triage**, List filtres/tri/pagination, Stats agrégées, `CountAffectedAssets` distinct par CVE ; isolation tenant partout). **`pkg/vulnprio`** — moteur de priorisation **pur et déterministe** (8 tests) combinant les 4 axes demandés en pondération documentée : **CVSS 0.40** · **exploitabilité 0.30** (max(EPSS, KEV→0.95, exploit→0.70, maturité) ; **KEV plancher le score à 80 = P1** « patch now ») · **criticité métier 0.20** (facteur `AssetCriticality.ScoreFactor` de l'actif lié) · **actifs concernés 0.10** (blast radius, échelle log) → score 0–100 + tier + explication lisible. **`internal/vulnscan`** — couche d'intégration : `NormalizedFinding` + un **normaliseur par produit** (mapping du JSON natif de Nessus/OpenVAS/Qualys/Defender-TVM/Inspector-inspector2/Azure-subassessment/CrowdStrike-Spotlight → forme commune, extraction CVE robuste par regex, getters tolérants) + `Connectors()` (métadonnées UI ; AWS Inspector `live_pull=true` car SDK déjà vendored, les autres = import + seam honnête, jamais de données fabriquées). **`application/vulnerability`** — use cases 1-fichier tenant-safe + erreurs typées : `Ingest` (normalise→résout l'actif par id/hostname/external-id→**recompte le blast radius post-upsert et re-priorise**→upsert), List/Get/UpdateStatus/Delete/Stats (+ tests : Nessus normalisé+priorisé, re-ingest = update pas doublon, source inconnue 400, batch vide 400, update-status success/cross-tenant→404/invalide 400). **Handler** `vulnerability_handler.go` + routes `protected` gardées `vulnerabilities:{read,update,delete}` (`/vulnerabilities`, `/:id`, `/:id/status`, `/stats`, `/ingest`, `/vulnerability-connectors` ; **statiques avant `/:id`** — même piège Fiber que les assets). **Frontend** `features/vulnerabilities` : `vulnerabilityService` (typé, zéro `any`) + hooks React Query + `VulnerabilitiesPage` (KPI Total/Ouvertes/P1/KEV/Exploitables, filtres par tier/sévérité/KEV + recherche, **table triée par priorité** avec badge tier+score+flamme KEV, CVSS coloré, actif, source, statut) + **drawer** (breakdown de priorisation, CVSS/EPSS/signaux KEV/exploit, actif+criticité, blast radius, remédiation, **cycle de statut** gardé par permission, suppression) + **IngestModal** (choix source + collage du JSON natif + exemples) + **ConnectorsPanel** (7 connecteurs par catégorie network/EDR/cloud, badges Import/Live) ; item sidebar « Vulnérabilités » (icône Bug, groupe Sécurité) + route `/vulnerabilities` + i18n FR/EN (`n_vulns`). **Preuves live (Postgres:5434, binaire :8091)** : `GET /vulnerability-connectors` = 7 ; ingest Nessus Log4Shell → CVE-2021-44228 extraite, sévérité critique, **matché à web-01 par hostname**, criticité métier CRITICAL, priorité 62.2/P2 ; CrowdStrike `exploit_status:90` → exploit_available+maturité high, 76.4 ; **manual KEV CVSS 5.0 → floored 80/P1** (explication « floored to P1 by CISA-KEV ») ; **blast radius : même CVE sur web-03 → affected=3 → 66.97** (« 3 affected assets ») ; list triée P1 80 > P2 76.4 > P2 62.2 ; stats total/open/kev/exploit/bySeverity/byTier ; update-status→remediated (invalide 400) ; delete 204 → get 404 ; get random 404 ; ingest bad source 400 ; **capture headless de la page live** (nav active, KPI, table triée, P1 KEV en flamme). `go build`/`vet`/`go test ./pkg/vulnprio/... ./internal/application/vulnerability/...` verts, `tsc -b`/`vite build` verts. **Restes honnêtes** : les signaux EPSS/KEV viennent aujourd'hui du finding ingéré (enrichissement auto depuis le moteur CTI = prochaine itération) ; le live-pull réel des 6 connecteurs REST reste un seam honnête (AWS Inspector câblé SDK) ; pas encore de lien vuln→risque auto ; quelques vulnérabilités + actifs (web-01/db-02/web-03) laissés en **données de démo** dans la DB dev (comme les ~120 contrôles ISO d'une session passée) ; frontend prouvé par tsc/build + capture headless (le pilotage CDP interactif reste bloqué par le sandbox). +26. ~~Gestion des contrôles — catalogues de référentiels internationaux + personnalisation~~ ✅ fait + **vérifié live le 16/07/2026** (branche `feat/compliance-frameworks-intl`). Demande utilisateur : ISO 27001 / NIST CSF / CIS Controls / PCI-DSS / HIPAA / SOC 2 / ANTIC-CM / COBAC / BCEAO + personnalisation des contrôles. **Vérification préalable** : ISO 27001:2022 (93), ANTIC-CM (25), BCEAO (35), COBAC (45) existaient déjà et sont cités ; la **personnalisation** (référentiel vierge + contrôle ad-hoc) existait (item 16). **Manquaient** : NIST CSF, CIS, PCI-DSS, HIPAA, SOC 2. **Architecture plugin découverte** : chaque catalogue = un fichier `pkg/compliance/catalog_*.go` avec `init()`→`register(Catalog{Key,Name,Version,Available,Controls:[]CatalogControl{code,name,desc,sourceRef}})` ; `GET /compliance/catalogs` renvoie `compliance.List()` et le modal d'import du frontend le consomme déjà → **ajouter un catalogue le rend importable partout sans toucher au handler ni au frontend**. Livré — **5 nouveaux catalogues** (un commit chacun) : **NIST CSF 2.0** (22 catégories des 6 fonctions GOVERN/IDENTIFY/PROTECT/DETECT/RESPOND/RECOVER, IDs GV.OC…RC.CO), **CIS Controls v8** (18 contrôles), **PCI DSS 4.0** (12 exigences), **HIPAA Security Rule** (22 standards Administratif/Physique/Technique/Organisationnel/Documentation, **citations 45 CFR §164.308–316**), **SOC 2 / AICPA TSC 2017** (51 : Common Criteria complet CC1.1–CC9.2 + Availability A1 + Confidentiality C1 + Processing Integrity PI1 + Privacy P1–P8). Approche identique à l'ISO existant : **IDs/codes structurels = structure publique du référentiel (fiables), descriptions = résumés originaux** (le texte propriétaire des standards n'est pas recopié) ; chaque contrôle cite sa source (`SourceReference`). `TestNoOrphanControls` (codes uniques + citation par contrôle) + nouveau `TestExpectedControlCounts` (22/18/12/22/51, garde-fou anti-troncature) verts. **Preuves live (Postgres:5434, binaire :8091)** : `GET /compliance/catalogs` → **10 catalogues** (9 dispo + placeholder `cm-loi-2024-017`) avec bons comptes ; création framework + `import-catalog soc2-tsc` → **51 contrôles** créés, CC6.1 cite « AICPA TSC 2017, CC6.1 » ; import `nist-csf-2.0` → 22 ; **personnalisation** : référentiel vierge « Mon référentiel interne » + contrôle ad-hoc CUSTOM-1 « Politique de télétravail sécurisé » (status not_implemented) ; suppression 204. **Capture headless** de l'écran Conformité (« 288 contrôles sur 8 référentiels », carte « CIS Controls 0/18 »). `go build`/`vet`/`go test ./pkg/compliance/...` verts (aucun changement frontend requis). **Restes honnêtes** : catalogues modélisés au niveau catégorie/exigence/standard (les sous-contrôles fins — subcategories NIST, safeguards CIS, sous-exigences PCI — s'ajoutent en ad-hoc sur le framework importé) ; **cross-mapping entre référentiels toujours absent** ; frameworks V5 restants (DORA, NIS2, GDPR JSON) hors périmètre ; 5 frameworks importés laissés en **données de démo** dans la DB dev (supprimables via l'UI). Piège CORS mémo : la capture headless doit passer par un vite sur **localhost:5173** (seule origine autorisée, main.go:350). 13. Hors scope immédiat mais à planifier : passe d'animation complète sur les pages restantes (Reports, Marketplace, CustomFields, Users, Roles, Tenants, AuditLogs, TokenManagement — non touchées cette session, seul le Dashboard a reçu un vrai polish) ; les deux vocabulaires `RiskStatus` (lowercase vs uppercase) ne sont pas unifiés, seulement rendus non-fatals côté frontend — un vrai nettoyage nécessiterait de choisir un seul vocabulaire côté backend ; `CreateRisk` ne renseigne pas `created_by` depuis le contexte réel ; implémenter `/analytics/security-score` et `/analytics/assets/statistics` (routes jamais créées, widgets en repli gracieux) ; ~350 findings lint frontend ; 7 fichiers de tests frontend en échec (pré-existants, build) ; rétrofit du client OpenAPI généré sur Risk/Mitigation (pré-existant, M1) ; `TestRiskCRUDFlow`/`TestSetupMFA_Success` en échec (pré-existants, découverts pendant M1 — `TestStartAndStop`/`TestRateLimit_DifferentIPs` flaky, repassent au vert en isolation) ; `src/hooks/useAssetStore.ts` reste un chemin de données non contract-first (utilisé par les sélecteurs d'assets de `CreateRiskModal`/`EditRiskModal`/`DashboardGrid`, volontairement non touché pendant M3). diff --git a/ROADMAP.md b/ROADMAP.md index b93db0cf..9905a736 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -69,7 +69,7 @@ il n'est pas encore la plateforme différenciante du Master Prompt V5 (Wave 2/3) | **9. Notifications** | ✅ (cœur) | `pkg/notify`, `notification_service`, `notification_handler`, centre de notifs frontend. | Canaux **Email (Resend/SMTP), Slack, Webhook signé** non prouvés live. Webhooks sortants à vérifier. | | **10. IA Advisor** | 🟡 | **Fondation `pkg/ai` créée** (10/07, 1er vrai client LLM du repo : interface `Advisor`, `ClaudeAdvisor` sur `anthropics/anthropic-sdk-go` modèle `claude-opus-4-8`, `TemplateAdvisor` fallback). `ai_risk_predictor_service`, `recommendation_service`. | Les use cases V5 (analyze/mitigations/deduplicate/prioritize/narrative/executive-summary), l'`AIAdvisorTab` dans le RiskDrawer, le streaming, le cache/rate-limit IA : **non faits** (stubs sans provider). Chemin `ClaudeAdvisor` non prouvé live (pas de clé). | | **11. Reporting & Export** | 🟡 | `pkg/report` (PDF `fpdf`, **conformité + Board Report ✅**), export CSV risques (`export_risks.go`), `export_handler`. | Pas de `pkg/export` async (jobs Redis, XLSX `excelize`, MinIO/S3, TTL). **Templates officiels COBAC/BCEAO/ISO/PCI ❌.** `ReportsPage.tsx` = maquette non câblée. | -| **12. Compliance Frameworks** | ✅ (moteur) / 🟡 (couverture) | Moteur M1 vérifié live ; ISO 27001:2022 (93 contrôles) + **BCEAO (35) + ANTIC-CM (25) + COBAC (45)** cités article par article ; frameworks **tenant-scoped** (migration 0030). **Gestion complète sur les écrans redessinés (13/07)** : créer/importer/supprimer référentiel + contrôle (RBAC), preuve en chip cliquable, **progression temps réel**, **seuil de preuve obligatoire (mode strict, back+front)**. | ~20 frameworks V5 manquants (NIST, SOC2, DORA, NIS2, PCI, HIPAA, GDPR JSON…). **Cross-mapping ❌**, gap-analysis partiel. 1 placeholder (`cm-loi-2024-017`). | +| **12. Compliance Frameworks** | ✅ (moteur + couverture large) | Moteur M1 vérifié live ; **9 référentiels cités et importables** : ISO 27001:2022 (93) + **NIST CSF 2.0 (22 catégories)** + **CIS Controls v8 (18)** + **PCI DSS 4.0 (12 exigences)** + **HIPAA Security Rule (22 standards, cit. 45 CFR §164)** + **SOC 2 / AICPA TSC (51 : CC1–CC9 + A/C/PI/P)** + BCEAO (35) + ANTIC-CM (25) + COBAC (45) — chacun cité article/section par contrôle (`TestNoOrphanControls` + counts). Architecture plugin : un fichier `pkg/compliance/catalog_*.go` + `register()` → le catalogue remonte automatiquement dans `GET /compliance/catalogs` et devient importable, **zéro changement handler/frontend**. Frameworks **tenant-scoped** (migration 0030). **Gestion complète (13/07)** : créer/importer/supprimer référentiel + contrôle (RBAC), **personnalisation** (référentiel vierge + contrôle ad-hoc, vérifié live), preuve en chip cliquable, **progression temps réel**, **seuil de preuve obligatoire (mode strict, back+front)**. **Prouvé live 16/07** : les 10 catalogues listés avec bons comptes ; import SOC 2 (51) + NIST (22) ; contrôle ad-hoc CUSTOM-1 ; capture de l'écran Conformité (8 référentiels/288 contrôles). | Frameworks V5 restants (DORA, NIS2, GDPR JSON…) ; **cross-mapping ❌**, gap-analysis partiel ; catalogues modélisés au niveau catégorie/exigence (sous-contrôles ajoutables en ad-hoc) ; 1 placeholder (`cm-loi-2024-017`, texte non fourni). | | **13. Asset Management** | ✅ (inventaire + criticité + **dépendances** + historique, prouvé live 16/07) | M3 : Clean Architecture rétrofitée, snapshots historiques, criticité→Score Engine. `features/assets`. **Gestion centralisée complète (16/07, branche `feat/asset-dependency-mapping`)** : (1) **inventaire** étendu à la taxonomie GRC (Server/Application/Cloud/Database/SaaS/Storage/Network/Laptop/**Data/User/Supplier**) — icônes + chips de filtre ; (2) **classification par criticité** (déjà là, → Score Engine) ; (3) **cartographie des dépendances entre actifs** — nouveau modèle `AssetDependency` (arête dirigée tenant-scoped, 8 types de relation), repo+use cases (Create/List/Delete, gardes self-ref/doublon/cross-tenant, cascade à la suppression d'actif), handler `/asset-dependencies`, OpenAPI, `Asset Universe` **rebranché sur données réelles** (fixtures supprimées) avec éditeur de dépendances (ajout/retrait) dans le panneau ; (4) **historique des modifications** enfin exposé dans l'UI live (bouton « Historique » sur la modale d'édition → `AssetHistoryDrawer`). Preuves live : graph 7 actifs · 7 liens rendu, inventaire 11 types, endpoints 201/409/404/204, cascade + snapshot vérifiés. | Les 4 autres vues Universe (topology/bubbles/hierarchy) restent « coming soon ». Matching CVE via CPE dépend du CTI/Scanner (déjà câblé, item 21). | ### 1.2 Fonctionnalités avancées — Module 14.1 à 14.18 (le **moat** vs Vanta/Drata) diff --git a/backend/pkg/compliance/catalog_cis_v8.go b/backend/pkg/compliance/catalog_cis_v8.go new file mode 100644 index 00000000..e87a250d --- /dev/null +++ b/backend/pkg/compliance/catalog_cis_v8.go @@ -0,0 +1,46 @@ +// Copyright (c) 2026 OpenDefender Contributors +// SPDX-License-Identifier: BUSL-1.1 +// This Source Code Form is subject to the terms of the Business Source License, Version 1.1. +// If a copy of the BUSL was not distributed with this file, You can obtain one at https://mariadb.com/bsl11/ + +package compliance + +// CIS Critical Security Controls v8 — the 18 top-level Controls. Control numbers +// and titles are CIS's own public structure and are reliable; descriptions here +// are original summaries of each Control's intent, not CIS's own text (CIS +// Controls are © the Center for Internet Security). A tenant can add ad-hoc +// Safeguard-level controls to the imported framework. + +func init() { + register(Catalog{ + Key: "cis-v8", + Name: "CIS Critical Security Controls", + Version: "8", + Description: "The 18 CIS Critical Security Controls (v8) — prioritized, prescriptive cyber-defense best practices.", + Available: true, + Controls: cisV8Controls, + }) +} + +const cisV8Source = "CIS Controls v8, Control " + +var cisV8Controls = []CatalogControl{ + {"CIS-1", "Inventory and Control of Enterprise Assets", "Actively manage (inventory, track and correct) all enterprise assets connected to the infrastructure, so only authorized devices are given access and unauthorized/unmanaged devices are found and remediated.", cisV8Source + "1"}, + {"CIS-2", "Inventory and Control of Software Assets", "Actively manage all software (operating systems and applications) on the network so only authorized software is installed and can execute, and unauthorized software is found and prevented from installing or executing.", cisV8Source + "2"}, + {"CIS-3", "Data Protection", "Develop processes and technical controls to identify, classify, securely handle, retain and dispose of data.", cisV8Source + "3"}, + {"CIS-4", "Secure Configuration of Enterprise Assets and Software", "Establish and maintain the secure configuration of enterprise assets (end-user devices, servers, network devices) and software (operating systems and applications).", cisV8Source + "4"}, + {"CIS-5", "Account Management", "Use processes and tools to assign and manage authorization to credentials for user, administrator and service accounts across the enterprise.", cisV8Source + "5"}, + {"CIS-6", "Access Control Management", "Use processes and tools to create, assign, manage and revoke access credentials and privileges for user, administrator and service accounts.", cisV8Source + "6"}, + {"CIS-7", "Continuous Vulnerability Management", "Develop a plan to continuously assess and track vulnerabilities on all enterprise assets, and to remediate and minimize the window of opportunity for attackers.", cisV8Source + "7"}, + {"CIS-8", "Audit Log Management", "Collect, alert on, review and retain audit logs of events that could help detect, understand or recover from an attack.", cisV8Source + "8"}, + {"CIS-9", "Email and Web Browser Protections", "Improve protections and detections of threats from email and web vectors, which attackers use to manipulate human behavior through direct engagement.", cisV8Source + "9"}, + {"CIS-10", "Malware Defenses", "Prevent or control the installation, spread and execution of malicious applications, code or scripts on enterprise assets.", cisV8Source + "10"}, + {"CIS-11", "Data Recovery", "Establish and maintain data-recovery practices sufficient to restore in-scope enterprise assets to a pre-incident, trusted state.", cisV8Source + "11"}, + {"CIS-12", "Network Infrastructure Management", "Establish, implement and actively manage network devices to prevent attackers from exploiting vulnerable network services and access points.", cisV8Source + "12"}, + {"CIS-13", "Network Monitoring and Defense", "Operate processes and tooling to establish and maintain comprehensive network monitoring and defense against security threats across the enterprise's network infrastructure and user base.", cisV8Source + "13"}, + {"CIS-14", "Security Awareness and Skills Training", "Establish and maintain a security-awareness program to influence behavior among the workforce to be security-conscious and properly skilled to reduce cybersecurity risks.", cisV8Source + "14"}, + {"CIS-15", "Service Provider Management", "Develop a process to evaluate service providers who hold sensitive data or are responsible for critical IT platforms or processes, to ensure they protect those assets appropriately.", cisV8Source + "15"}, + {"CIS-16", "Application Software Security", "Manage the security life cycle of in-house developed, hosted or acquired software to prevent, detect and remediate security weaknesses before they can affect the enterprise.", cisV8Source + "16"}, + {"CIS-17", "Incident Response Management", "Establish a program to develop and maintain incident-response capability (policies, plans, procedures, roles, training and communications) to prepare, detect and quickly respond to an attack.", cisV8Source + "17"}, + {"CIS-18", "Penetration Testing", "Test the effectiveness and resiliency of enterprise assets by identifying and exploiting weaknesses in controls (people, processes and technology), and simulating the objectives and actions of an attacker.", cisV8Source + "18"}, +} diff --git a/backend/pkg/compliance/catalog_hipaa_security.go b/backend/pkg/compliance/catalog_hipaa_security.go new file mode 100644 index 00000000..a332f656 --- /dev/null +++ b/backend/pkg/compliance/catalog_hipaa_security.go @@ -0,0 +1,61 @@ +// Copyright (c) 2026 OpenDefender Contributors +// SPDX-License-Identifier: BUSL-1.1 +// This Source Code Form is subject to the terms of the Business Source License, Version 1.1. +// If a copy of the BUSL was not distributed with this file, You can obtain one at https://mariadb.com/bsl11/ + +package compliance + +// HIPAA Security Rule — the Standards of the Administrative, Physical and +// Technical Safeguards plus the Organizational and Documentation requirements, +// codified at 45 CFR Part 164, Subpart C (§§ 164.308–164.316). The CFR section +// citations are public U.S. federal regulation and are reliable. Descriptions +// here are original summaries of each Standard's intent; the required and +// addressable implementation specifications under each Standard can be added as +// ad-hoc controls on the imported framework. + +func init() { + register(Catalog{ + Key: "hipaa-security", + Name: "HIPAA Security Rule", + Version: "45 CFR Part 164 Subpart C", + Description: "Standards for the protection of electronic protected health information (ePHI) — Administrative, Physical and Technical Safeguards.", + Available: true, + Controls: hipaaSecurityControls, + }) +} + +const hipaaSource = "45 CFR § " + +var hipaaSecurityControls = []CatalogControl{ + // --- Administrative Safeguards (§ 164.308) --- + {"164.308(a)(1)", "Security Management Process", "Implement policies and procedures to prevent, detect, contain and correct security violations — including risk analysis, risk management, a sanction policy and information system activity review.", hipaaSource + "164.308(a)(1)"}, + {"164.308(a)(2)", "Assigned Security Responsibility", "Identify the security official who is responsible for the development and implementation of the policies and procedures required by the Security Rule.", hipaaSource + "164.308(a)(2)"}, + {"164.308(a)(3)", "Workforce Security", "Implement policies and procedures to ensure that all workforce members have appropriate access to ePHI, and to prevent those who should not have access from obtaining it.", hipaaSource + "164.308(a)(3)"}, + {"164.308(a)(4)", "Information Access Management", "Implement policies and procedures for authorizing access to ePHI that are consistent with the applicable requirements of the Privacy Rule.", hipaaSource + "164.308(a)(4)"}, + {"164.308(a)(5)", "Security Awareness and Training", "Implement a security awareness and training program for all workforce members, including management (security reminders, malware protection, log-in monitoring and password management).", hipaaSource + "164.308(a)(5)"}, + {"164.308(a)(6)", "Security Incident Procedures", "Implement policies and procedures to address security incidents, including identifying and responding to suspected or known incidents and mitigating their harmful effects.", hipaaSource + "164.308(a)(6)"}, + {"164.308(a)(7)", "Contingency Plan", "Establish policies and procedures for responding to an emergency or other occurrence that damages systems containing ePHI (data backup, disaster recovery, emergency-mode operation, testing and criticality analysis).", hipaaSource + "164.308(a)(7)"}, + {"164.308(a)(8)", "Evaluation", "Perform periodic technical and non-technical evaluations to establish the extent to which security policies and procedures meet the Security Rule's requirements.", hipaaSource + "164.308(a)(8)"}, + {"164.308(b)(1)", "Business Associate Contracts and Other Arrangements", "Obtain satisfactory assurances, documented through a written contract, that a business associate will appropriately safeguard the ePHI it creates, receives, maintains or transmits.", hipaaSource + "164.308(b)(1)"}, + + // --- Physical Safeguards (§ 164.310) --- + {"164.310(a)(1)", "Facility Access Controls", "Implement policies and procedures to limit physical access to electronic information systems and the facilities in which they are housed, while ensuring properly authorized access is allowed.", hipaaSource + "164.310(a)(1)"}, + {"164.310(b)", "Workstation Use", "Implement policies and procedures that specify the proper functions to be performed, the manner in which they are performed, and the physical attributes of the surroundings of workstations that access ePHI.", hipaaSource + "164.310(b)"}, + {"164.310(c)", "Workstation Security", "Implement physical safeguards for all workstations that access ePHI to restrict access to authorized users.", hipaaSource + "164.310(c)"}, + {"164.310(d)(1)", "Device and Media Controls", "Implement policies and procedures governing the receipt and removal of hardware and electronic media that contain ePHI into and out of a facility, and their movement within it (disposal, media re-use, accountability, data backup and storage).", hipaaSource + "164.310(d)(1)"}, + + // --- Technical Safeguards (§ 164.312) --- + {"164.312(a)(1)", "Access Control", "Implement technical policies and procedures for electronic information systems that maintain ePHI to allow access only to authorized persons or software (unique user IDs, emergency access, automatic logoff and encryption/decryption).", hipaaSource + "164.312(a)(1)"}, + {"164.312(b)", "Audit Controls", "Implement hardware, software and procedural mechanisms that record and examine activity in information systems that contain or use ePHI.", hipaaSource + "164.312(b)"}, + {"164.312(c)(1)", "Integrity", "Implement policies and procedures to protect ePHI from improper alteration or destruction, including mechanisms to authenticate that ePHI has not been altered.", hipaaSource + "164.312(c)(1)"}, + {"164.312(d)", "Person or Entity Authentication", "Implement procedures to verify that a person or entity seeking access to ePHI is the one claimed.", hipaaSource + "164.312(d)"}, + {"164.312(e)(1)", "Transmission Security", "Implement technical security measures to guard against unauthorized access to ePHI transmitted over an electronic communications network (integrity controls and encryption).", hipaaSource + "164.312(e)(1)"}, + + // --- Organizational Requirements (§ 164.314) --- + {"164.314(a)(1)", "Business Associate Contracts or Other Arrangements", "Ensure that the contract or other arrangement between a covered entity and a business associate meets the applicable requirements for safeguarding ePHI.", hipaaSource + "164.314(a)(1)"}, + {"164.314(b)(1)", "Requirements for Group Health Plans", "Ensure a group health plan's documents require the plan sponsor to reasonably and appropriately safeguard ePHI created, received, maintained or transmitted on its behalf.", hipaaSource + "164.314(b)(1)"}, + + // --- Policies, Procedures and Documentation (§ 164.316) --- + {"164.316(a)", "Policies and Procedures", "Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications and other requirements of the Security Rule.", hipaaSource + "164.316(a)"}, + {"164.316(b)(1)", "Documentation", "Maintain the required policies and procedures in written (which may be electronic) form, and retain documentation of any action, activity or assessment required by the Security Rule.", hipaaSource + "164.316(b)(1)"}, +} diff --git a/backend/pkg/compliance/catalog_nist_csf_2_0.go b/backend/pkg/compliance/catalog_nist_csf_2_0.go new file mode 100644 index 00000000..b13dc601 --- /dev/null +++ b/backend/pkg/compliance/catalog_nist_csf_2_0.go @@ -0,0 +1,66 @@ +// Copyright (c) 2026 OpenDefender Contributors +// SPDX-License-Identifier: BUSL-1.1 +// This Source Code Form is subject to the terms of the Business Source License, Version 1.1. +// If a copy of the BUSL was not distributed with this file, You can obtain one at https://mariadb.com/bsl11/ + +package compliance + +// NIST Cybersecurity Framework (CSF) 2.0 — the 22 Categories across the 6 +// Functions (GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER). The Function +// and Category identifiers (GV.OC, ID.AM, PR.AA, …) are NIST's own public +// structure and are reliable; the descriptions here are original summaries of +// each Category's intent written for this product, not NIST's own text. Verify +// against the published CSF 2.0 Core (NIST, Feb 2024) before an audit. +// +// Modeled at the Category level (not the 106 Subcategories) so the framework is +// complete and accurate at a granularity a tenant can meaningfully assess; a +// tenant can add ad-hoc Subcategory controls to any imported framework. + +func init() { + register(Catalog{ + Key: "nist-csf-2.0", + Name: "NIST Cybersecurity Framework", + Version: "2.0", + Description: "The NIST CSF 2.0 Core — 22 Categories across GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER.", + Available: true, + Controls: nistCSF20Controls, + }) +} + +const nistCSFSource = "NIST CSF 2.0 Core, Category " + +var nistCSF20Controls = []CatalogControl{ + // --- GOVERN (GV) --- + {"GV.OC", "Organizational Context", "Understand the circumstances — mission, stakeholder expectations, dependencies, and legal, regulatory and contractual requirements — surrounding the organization's cybersecurity risk management decisions.", nistCSFSource + "GV.OC"}, + {"GV.RM", "Risk Management Strategy", "Establish, communicate and use the organization's priorities, constraints, risk tolerance and appetite statements, and assumptions to support operational risk decisions.", nistCSFSource + "GV.RM"}, + {"GV.RR", "Roles, Responsibilities, and Authorities", "Establish and communicate cybersecurity roles, responsibilities and authorities to foster accountability, performance assessment and continuous improvement.", nistCSFSource + "GV.RR"}, + {"GV.PO", "Policy", "Establish, communicate and enforce organizational cybersecurity policy.", nistCSFSource + "GV.PO"}, + {"GV.OV", "Oversight", "Use the results of organization-wide cybersecurity risk management activities and performance to inform, improve and adjust the risk management strategy.", nistCSFSource + "GV.OV"}, + {"GV.SC", "Cybersecurity Supply Chain Risk Management", "Identify, establish, manage, monitor and improve cyber supply chain risk management processes agreed to by organizational stakeholders.", nistCSFSource + "GV.SC"}, + + // --- IDENTIFY (ID) --- + {"ID.AM", "Asset Management", "Identify and manage the assets — data, hardware, software, systems, facilities, services and people — that enable the organization to achieve its purposes, consistent with their relative importance and risk.", nistCSFSource + "ID.AM"}, + {"ID.RA", "Risk Assessment", "Understand the cybersecurity risk to the organization, its assets and individuals, including threats, vulnerabilities, likelihoods and impacts.", nistCSFSource + "ID.RA"}, + {"ID.IM", "Improvement", "Identify improvements to organizational cybersecurity risk management processes, procedures and activities across all CSF Functions.", nistCSFSource + "ID.IM"}, + + // --- PROTECT (PR) --- + {"PR.AA", "Identity Management, Authentication, and Access Control", "Limit access to physical and logical assets to authorized users, services and hardware, commensurate with the assessed risk of unauthorized access.", nistCSFSource + "PR.AA"}, + {"PR.AT", "Awareness and Training", "Provide the organization's personnel with cybersecurity awareness and training so they can perform their cybersecurity-related tasks.", nistCSFSource + "PR.AT"}, + {"PR.DS", "Data Security", "Manage data consistent with the organization's risk strategy to protect the confidentiality, integrity and availability of information.", nistCSFSource + "PR.DS"}, + {"PR.PS", "Platform Security", "Manage the hardware, software (e.g. firmware, operating systems, applications) and services of physical and virtual platforms consistent with the organization's risk strategy.", nistCSFSource + "PR.PS"}, + {"PR.IR", "Technology Infrastructure Resilience", "Manage security architectures with the organization's risk strategy to protect asset confidentiality, integrity and availability, and organizational resilience.", nistCSFSource + "PR.IR"}, + + // --- DETECT (DE) --- + {"DE.CM", "Continuous Monitoring", "Monitor assets to find anomalies, indicators of compromise and other potentially adverse events.", nistCSFSource + "DE.CM"}, + {"DE.AE", "Adverse Event Analysis", "Analyze anomalies, indicators of compromise and other potentially adverse events to characterize the events and detect cybersecurity incidents.", nistCSFSource + "DE.AE"}, + + // --- RESPOND (RS) --- + {"RS.MA", "Incident Management", "Manage responses to detected cybersecurity incidents.", nistCSFSource + "RS.MA"}, + {"RS.AN", "Incident Analysis", "Investigate incidents to ensure effective response and support forensics and recovery activities.", nistCSFSource + "RS.AN"}, + {"RS.CO", "Incident Response Reporting and Communication", "Coordinate response activities with internal and external stakeholders as required by laws, regulations or policies.", nistCSFSource + "RS.CO"}, + {"RS.MI", "Incident Mitigation", "Perform activities to prevent expansion of an event and mitigate its effects.", nistCSFSource + "RS.MI"}, + + // --- RECOVER (RC) --- + {"RC.RP", "Incident Recovery Plan Execution", "Perform restoration activities to ensure operational availability of systems and services affected by cybersecurity incidents.", nistCSFSource + "RC.RP"}, + {"RC.CO", "Incident Recovery Communication", "Coordinate restoration activities with internal and external parties.", nistCSFSource + "RC.CO"}, +} diff --git a/backend/pkg/compliance/catalog_pci_dss_4_0.go b/backend/pkg/compliance/catalog_pci_dss_4_0.go new file mode 100644 index 00000000..89316baf --- /dev/null +++ b/backend/pkg/compliance/catalog_pci_dss_4_0.go @@ -0,0 +1,46 @@ +// Copyright (c) 2026 OpenDefender Contributors +// SPDX-License-Identifier: BUSL-1.1 +// This Source Code Form is subject to the terms of the Business Source License, Version 1.1. +// If a copy of the BUSL was not distributed with this file, You can obtain one at https://mariadb.com/bsl11/ + +package compliance + +// PCI DSS v4.0 — the 12 core Requirements, grouped into 6 goals. Requirement +// numbers and titles are the PCI Security Standards Council's own public +// structure and are reliable; descriptions here are original summaries, not the +// standard's own text (PCI DSS is © PCI SSC). A tenant can add the detailed +// sub-requirements (e.g. 1.2.1) as ad-hoc controls on the imported framework. + +func init() { + register(Catalog{ + Key: "pci-dss-4.0", + Name: "PCI DSS", + Version: "4.0", + Description: "Payment Card Industry Data Security Standard v4.0 — the 12 core requirements protecting cardholder data.", + Available: true, + Controls: pciDSS40Controls, + }) +} + +const pciDSSSource = "PCI DSS v4.0, Requirement " + +var pciDSS40Controls = []CatalogControl{ + // Goal: Build and Maintain a Secure Network and Systems + {"PCI-1", "Install and Maintain Network Security Controls", "Install and maintain network security controls (NSCs, such as firewalls and other technologies) to protect the cardholder data environment from untrusted networks.", pciDSSSource + "1"}, + {"PCI-2", "Apply Secure Configurations to All System Components", "Apply secure configurations to all system components and remove or disable vendor default accounts, passwords and unnecessary services to reduce the attack surface.", pciDSSSource + "2"}, + // Goal: Protect Account Data + {"PCI-3", "Protect Stored Account Data", "Protect stored account data through data retention/disposal policies, strong cryptography, and rendering the Primary Account Number (PAN) unreadable wherever it is stored.", pciDSSSource + "3"}, + {"PCI-4", "Protect Cardholder Data with Strong Cryptography During Transmission", "Protect cardholder data with strong cryptography during transmission over open, public networks, and never send unprotected PANs by end-user messaging technologies.", pciDSSSource + "4"}, + // Goal: Maintain a Vulnerability Management Program + {"PCI-5", "Protect All Systems and Networks from Malicious Software", "Deploy and maintain anti-malware mechanisms and processes to protect all systems and networks from malicious software.", pciDSSSource + "5"}, + {"PCI-6", "Develop and Maintain Secure Systems and Software", "Develop and maintain secure systems and software through secure development practices, timely patching, and protection of public-facing web applications.", pciDSSSource + "6"}, + // Goal: Implement Strong Access Control Measures + {"PCI-7", "Restrict Access to System Components and Cardholder Data by Business Need to Know", "Restrict access to system components and cardholder data to only those individuals whose job requires it, based on need to know and least privilege, deny by default.", pciDSSSource + "7"}, + {"PCI-8", "Identify Users and Authenticate Access to System Components", "Assign a unique ID to each user and strongly authenticate access to system components, including multi-factor authentication into the cardholder data environment.", pciDSSSource + "8"}, + {"PCI-9", "Restrict Physical Access to Cardholder Data", "Restrict physical access to cardholder data and to systems that store, process or transmit it, including facility entry controls and media handling/destruction.", pciDSSSource + "9"}, + // Goal: Regularly Monitor and Test Networks + {"PCI-10", "Log and Monitor All Access to System Components and Cardholder Data", "Log all access to system components and cardholder data, protect and review those logs, and use time-synchronization and detection to identify anomalies.", pciDSSSource + "10"}, + {"PCI-11", "Test Security of Systems and Networks Regularly", "Regularly test the security of systems and networks through vulnerability scans, internal/external penetration testing, wireless detection and change-/tamper-detection.", pciDSSSource + "11"}, + // Goal: Maintain an Information Security Policy + {"PCI-12", "Support Information Security with Organizational Policies and Programs", "Maintain an information security policy and program — risk assessment, awareness, personnel screening, third-party management and an incident response plan — that supports the protection of account data.", pciDSSSource + "12"}, +} diff --git a/backend/pkg/compliance/catalog_soc2_tsc.go b/backend/pkg/compliance/catalog_soc2_tsc.go new file mode 100644 index 00000000..ab73c5b6 --- /dev/null +++ b/backend/pkg/compliance/catalog_soc2_tsc.go @@ -0,0 +1,105 @@ +// Copyright (c) 2026 OpenDefender Contributors +// SPDX-License-Identifier: BUSL-1.1 +// This Source Code Form is subject to the terms of the Business Source License, Version 1.1. +// If a copy of the BUSL was not distributed with this file, You can obtain one at https://mariadb.com/bsl11/ + +package compliance + +// SOC 2 — the AICPA Trust Services Criteria (TSC, 2017 with 2022 revised points +// of focus): the Common Criteria (CC1–CC9, which every SOC 2 engagement covers) +// plus the criteria for the Availability, Confidentiality, Processing Integrity +// and Privacy categories. The criteria numbers (CC1.1, A1.1, …) are the AICPA's +// public structure and are reliable; descriptions here are original summaries of +// each criterion's intent, not the AICPA's own text (the TSC are © AICPA). + +func init() { + register(Catalog{ + Key: "soc2-tsc", + Name: "SOC 2 (Trust Services Criteria)", + Version: "2017 (rev. 2022)", + Description: "AICPA Trust Services Criteria — Common Criteria (CC1–CC9) plus Availability, Confidentiality, Processing Integrity and Privacy.", + Available: true, + Controls: soc2TSCControls, + }) +} + +const soc2Source = "AICPA TSC 2017, " + +var soc2TSCControls = []CatalogControl{ + // --- CC1 Control Environment --- + {"CC1.1", "Commitment to Integrity and Ethical Values", "The entity demonstrates a commitment to integrity and ethical values.", soc2Source + "CC1.1"}, + {"CC1.2", "Board Independence and Oversight", "The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.", soc2Source + "CC1.2"}, + {"CC1.3", "Structures, Reporting Lines, Authorities", "Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in pursuit of objectives.", soc2Source + "CC1.3"}, + {"CC1.4", "Commitment to Competence", "The entity demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.", soc2Source + "CC1.4"}, + {"CC1.5", "Accountability", "The entity holds individuals accountable for their internal control responsibilities in the pursuit of objectives.", soc2Source + "CC1.5"}, + + // --- CC2 Communication and Information --- + {"CC2.1", "Quality Information", "The entity obtains or generates and uses relevant, quality information to support the functioning of internal control.", soc2Source + "CC2.1"}, + {"CC2.2", "Internal Communication", "The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support its functioning.", soc2Source + "CC2.2"}, + {"CC2.3", "External Communication", "The entity communicates with external parties regarding matters affecting the functioning of internal control.", soc2Source + "CC2.3"}, + + // --- CC3 Risk Assessment --- + {"CC3.1", "Specify Objectives", "The entity specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.", soc2Source + "CC3.1"}, + {"CC3.2", "Identify and Analyze Risk", "The entity identifies risks to the achievement of its objectives across the entity and analyzes them as a basis for determining how they should be managed.", soc2Source + "CC3.2"}, + {"CC3.3", "Consider Fraud", "The entity considers the potential for fraud in assessing risks to the achievement of objectives.", soc2Source + "CC3.3"}, + {"CC3.4", "Identify and Assess Change", "The entity identifies and assesses changes that could significantly impact the system of internal control.", soc2Source + "CC3.4"}, + + // --- CC4 Monitoring Activities --- + {"CC4.1", "Evaluate Controls", "The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.", soc2Source + "CC4.1"}, + {"CC4.2", "Communicate Deficiencies", "The entity evaluates and communicates internal control deficiencies in a timely manner to those responsible for taking corrective action.", soc2Source + "CC4.2"}, + + // --- CC5 Control Activities --- + {"CC5.1", "Select and Develop Controls", "The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.", soc2Source + "CC5.1"}, + {"CC5.2", "Technology Controls", "The entity selects and develops general control activities over technology to support the achievement of objectives.", soc2Source + "CC5.2"}, + {"CC5.3", "Deploy Through Policies", "The entity deploys control activities through policies that establish what is expected and procedures that put policies into action.", soc2Source + "CC5.3"}, + + // --- CC6 Logical and Physical Access Controls --- + {"CC6.1", "Logical Access Security", "The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events.", soc2Source + "CC6.1"}, + {"CC6.2", "Registration and Authorization", "Prior to issuing system credentials, the entity registers and authorizes new internal and external users, and removes access when no longer required.", soc2Source + "CC6.2"}, + {"CC6.3", "Manage Access Rights", "The entity authorizes, modifies, or removes access to data, software, functions, and other protected assets based on roles, responsibilities, and least privilege.", soc2Source + "CC6.3"}, + {"CC6.4", "Restrict Physical Access", "The entity restricts physical access to facilities and protected information assets to authorized personnel.", soc2Source + "CC6.4"}, + {"CC6.5", "Dispose of Assets", "The entity discontinues logical and physical protections over physical assets only after the ability to read or recover data has been diminished and is no longer required.", soc2Source + "CC6.5"}, + {"CC6.6", "Protect Against External Threats", "The entity implements logical access security measures to protect against threats from sources outside its system boundaries.", soc2Source + "CC6.6"}, + {"CC6.7", "Restrict Transmission and Movement", "The entity restricts the transmission, movement, and removal of information to authorized users and processes, and protects it during transmission, movement, or removal.", soc2Source + "CC6.7"}, + {"CC6.8", "Prevent Unauthorized Software", "The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software.", soc2Source + "CC6.8"}, + + // --- CC7 System Operations --- + {"CC7.1", "Detect Configuration Changes and Vulnerabilities", "The entity uses detection and monitoring procedures to identify changes to configurations that introduce new vulnerabilities and susceptibilities to newly discovered vulnerabilities.", soc2Source + "CC7.1"}, + {"CC7.2", "Monitor for Anomalies", "The entity monitors system components and the operation of those components for anomalies indicative of malicious acts, natural disasters, and errors, and evaluates them.", soc2Source + "CC7.2"}, + {"CC7.3", "Evaluate Security Events", "The entity evaluates security events to determine whether they could or have resulted in a failure to meet objectives (a security incident), and responds accordingly.", soc2Source + "CC7.3"}, + {"CC7.4", "Respond to Incidents", "The entity responds to identified security incidents by executing a defined incident-response program to understand, contain, remediate, and communicate them.", soc2Source + "CC7.4"}, + {"CC7.5", "Recover from Incidents", "The entity identifies, develops, and implements activities to recover from identified security incidents.", soc2Source + "CC7.5"}, + + // --- CC8 Change Management --- + {"CC8.1", "Manage Changes", "The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.", soc2Source + "CC8.1"}, + + // --- CC9 Risk Mitigation --- + {"CC9.1", "Mitigate Business Disruption Risk", "The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.", soc2Source + "CC9.1"}, + {"CC9.2", "Manage Vendor and Partner Risk", "The entity assesses and manages risks associated with vendors and business partners.", soc2Source + "CC9.2"}, + + // --- Availability (A1) --- + {"A1.1", "Capacity Management", "The entity maintains, monitors, and evaluates current processing capacity and use of system components to manage capacity demand and enable the implementation of additional capacity to meet its availability objectives.", soc2Source + "A1.1"}, + {"A1.2", "Environmental Protections and Backup", "The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data backup processes, and recovery infrastructure to meet its availability objectives.", soc2Source + "A1.2"}, + {"A1.3", "Test Recovery", "The entity tests recovery plan procedures supporting system recovery to meet its availability objectives.", soc2Source + "A1.3"}, + + // --- Confidentiality (C1) --- + {"C1.1", "Identify and Maintain Confidential Information", "The entity identifies and maintains confidential information to meet its confidentiality objectives.", soc2Source + "C1.1"}, + {"C1.2", "Dispose of Confidential Information", "The entity disposes of confidential information to meet its confidentiality objectives.", soc2Source + "C1.2"}, + + // --- Processing Integrity (PI1) --- + {"PI1.1", "Quality Definitions and Communication", "The entity obtains or generates, uses, and communicates relevant, quality information regarding the definitions of data processed and product/service specifications to support the use of products and services.", soc2Source + "PI1.1"}, + {"PI1.2", "Complete and Accurate Inputs", "The entity implements policies and procedures over system inputs, including controls over completeness and accuracy, to meet its processing integrity objectives.", soc2Source + "PI1.2"}, + {"PI1.3", "Complete and Accurate Processing", "The entity implements policies and procedures over system processing to result in products, services, and reporting that meet the entity's processing integrity objectives.", soc2Source + "PI1.3"}, + {"PI1.4", "Accurate and Timely Outputs", "The entity implements policies and procedures to make available or deliver output completely, accurately, and timely in accordance with specifications to meet its processing integrity objectives.", soc2Source + "PI1.4"}, + {"PI1.5", "Store Inputs and Outputs", "The entity implements policies and procedures to store inputs, items in processing, and outputs completely, accurately, and timely in accordance with system specifications to meet its processing integrity objectives.", soc2Source + "PI1.5"}, + + // --- Privacy (P1–P8) --- + {"P1.1", "Notice of Privacy Practices", "The entity provides notice to data subjects about its privacy practices to meet its objectives related to privacy.", soc2Source + "P1.1"}, + {"P2.1", "Choice and Consent", "The entity communicates choices available regarding the collection, use, retention, disclosure, and disposal of personal information and obtains consent as needed to meet its privacy objectives.", soc2Source + "P2.1"}, + {"P3.1", "Collection Consistent with Objectives", "The entity collects personal information consistent with its objectives related to privacy.", soc2Source + "P3.1"}, + {"P4.1", "Use, Retention, and Disposal", "The entity limits the use, retention, and disposal of personal information to meet its objectives related to privacy.", soc2Source + "P4.1"}, + {"P5.1", "Access by Data Subjects", "The entity grants identified and authenticated data subjects the ability to access their stored personal information for review and, upon request, correction to meet its privacy objectives.", soc2Source + "P5.1"}, + {"P6.1", "Disclosure to Third Parties", "The entity discloses personal information to third parties with the explicit consent of data subjects, and such consent is obtained prior to disclosure, to meet its privacy objectives.", soc2Source + "P6.1"}, + {"P7.1", "Quality of Personal Information", "The entity collects and maintains accurate, up-to-date, complete, and relevant personal information to meet its objectives related to privacy.", soc2Source + "P7.1"}, + {"P8.1", "Monitoring and Enforcement", "The entity implements a process for receiving, addressing, resolving, and communicating the resolution of inquiries, complaints, and disputes from data subjects to meet its privacy objectives.", soc2Source + "P8.1"}, +} diff --git a/backend/pkg/compliance/catalog_test.go b/backend/pkg/compliance/catalog_test.go index e6781fab..542267df 100644 --- a/backend/pkg/compliance/catalog_test.go +++ b/backend/pkg/compliance/catalog_test.go @@ -57,6 +57,30 @@ func TestISO27001_2022_HasExpectedControlCount(t *testing.T) { } } +// TestExpectedControlCounts locks the size of each new international catalog so a +// truncation (a dropped control block) is caught in CI rather than shipping a +// silently-incomplete framework. Counts are the framework's own public structure. +func TestExpectedControlCounts(t *testing.T) { + cases := map[string]int{ + "nist-csf-2.0": 22, // 6 Functions → 22 Categories + "cis-v8": 18, // 18 Critical Security Controls + "pci-dss-4.0": 12, // 12 core requirements + "hipaa-security": 22, // Administrative(9)+Physical(4)+Technical(5)+Organizational(2)+Docs(2) + "soc2-tsc": 51, // Common Criteria(33)+A(3)+C(2)+PI(5)+P(8) + } + for key, want := range cases { + t.Run(key, func(t *testing.T) { + cat, ok := Get(key) + if !ok { + t.Fatalf("catalog %q not registered", key) + } + if got := len(cat.Controls); got != want { + t.Errorf("expected %d controls in %q, got %d", want, key, got) + } + }) + } +} + func TestGet_UnknownKey(t *testing.T) { if _, ok := Get("does-not-exist"); ok { t.Error("expected ok=false for an unregistered catalog key")