Add international compliance catalogs for NIST, CIS, PCI, HIPAA, and SOC 2

ROADMAP.md

@@ -69,7 +69,7 @@ il n'est pas encore la plateforme différenciante du Master Prompt V5 (Wave 2/3)
 | **9. Notifications** | ✅ (cœur) | `pkg/notify`, `notification_service`, `notification_handler`, centre de notifs frontend. | Canaux **Email (Resend/SMTP), Slack, Webhook signé** non prouvés live. Webhooks sortants à vérifier. |
 | **10. IA Advisor** | 🟡 | **Fondation `pkg/ai` créée** (10/07, 1er vrai client LLM du repo : interface `Advisor`, `ClaudeAdvisor` sur `anthropics/anthropic-sdk-go` modèle `claude-opus-4-8`, `TemplateAdvisor` fallback). `ai_risk_predictor_service`, `recommendation_service`. | Les use cases V5 (analyze/mitigations/deduplicate/prioritize/narrative/executive-summary), l'`AIAdvisorTab` dans le RiskDrawer, le streaming, le cache/rate-limit IA : **non faits** (stubs sans provider). Chemin `ClaudeAdvisor` non prouvé live (pas de clé). |
 | **11. Reporting & Export** | 🟡 | `pkg/report` (PDF `fpdf`, **conformité + Board Report ✅**), export CSV risques (`export_risks.go`), `export_handler`. | Pas de `pkg/export` async (jobs Redis, XLSX `excelize`, MinIO/S3, TTL). **Templates officiels COBAC/BCEAO/ISO/PCI ❌.** `ReportsPage.tsx` = maquette non câblée. |
-| **12. Compliance Frameworks** | ✅ (moteur) / 🟡 (couverture) | Moteur M1 vérifié live ; ISO 27001:2022 (93 contrôles) + **BCEAO (35) + ANTIC-CM (25) + COBAC (45)** cités article par article ; frameworks **tenant-scoped** (migration 0030). **Gestion complète sur les écrans redessinés (13/07)** : créer/importer/supprimer référentiel + contrôle (RBAC), preuve en chip cliquable, **progression temps réel**, **seuil de preuve obligatoire (mode strict, back+front)**. | ~20 frameworks V5 manquants (NIST, SOC2, DORA, NIS2, PCI, HIPAA, GDPR JSON…). **Cross-mapping ❌**, gap-analysis partiel. 1 placeholder (`cm-loi-2024-017`). |
+| **12. Compliance Frameworks** | ✅ (moteur + couverture large) | Moteur M1 vérifié live ; **9 référentiels cités et importables** : ISO 27001:2022 (93) + **NIST CSF 2.0 (22 catégories)** + **CIS Controls v8 (18)** + **PCI DSS 4.0 (12 exigences)** + **HIPAA Security Rule (22 standards, cit. 45 CFR §164)** + **SOC 2 / AICPA TSC (51 : CC1–CC9 + A/C/PI/P)** + BCEAO (35) + ANTIC-CM (25) + COBAC (45) — chacun cité article/section par contrôle (`TestNoOrphanControls` + counts). Architecture plugin : un fichier `pkg/compliance/catalog_*.go` + `register()` → le catalogue remonte automatiquement dans `GET /compliance/catalogs` et devient importable, **zéro changement handler/frontend**. Frameworks **tenant-scoped** (migration 0030). **Gestion complète (13/07)** : créer/importer/supprimer référentiel + contrôle (RBAC), **personnalisation** (référentiel vierge + contrôle ad-hoc, vérifié live), preuve en chip cliquable, **progression temps réel**, **seuil de preuve obligatoire (mode strict, back+front)**. **Prouvé live 16/07** : les 10 catalogues listés avec bons comptes ; import SOC 2 (51) + NIST (22) ; contrôle ad-hoc CUSTOM-1 ; capture de l'écran Conformité (8 référentiels/288 contrôles). | Frameworks V5 restants (DORA, NIS2, GDPR JSON…) ; **cross-mapping ❌**, gap-analysis partiel ; catalogues modélisés au niveau catégorie/exigence (sous-contrôles ajoutables en ad-hoc) ; 1 placeholder (`cm-loi-2024-017`, texte non fourni). |
 | **13. Asset Management** | ✅ (inventaire + criticité + **dépendances** + historique, prouvé live 16/07) | M3 : Clean Architecture rétrofitée, snapshots historiques, criticité→Score Engine. `features/assets`. **Gestion centralisée complète (16/07, branche `feat/asset-dependency-mapping`)** : (1) **inventaire** étendu à la taxonomie GRC (Server/Application/Cloud/Database/SaaS/Storage/Network/Laptop/**Data/User/Supplier**) — icônes + chips de filtre ; (2) **classification par criticité** (déjà là, → Score Engine) ; (3) **cartographie des dépendances entre actifs** — nouveau modèle `AssetDependency` (arête dirigée tenant-scoped, 8 types de relation), repo+use cases (Create/List/Delete, gardes self-ref/doublon/cross-tenant, cascade à la suppression d'actif), handler `/asset-dependencies`, OpenAPI, `Asset Universe` **rebranché sur données réelles** (fixtures supprimées) avec éditeur de dépendances (ajout/retrait) dans le panneau ; (4) **historique des modifications** enfin exposé dans l'UI live (bouton « Historique » sur la modale d'édition → `AssetHistoryDrawer`). Preuves live : graph 7 actifs · 7 liens rendu, inventaire 11 types, endpoints 201/409/404/204, cascade + snapshot vérifiés. | Les 4 autres vues Universe (topology/bubbles/hierarchy) restent « coming soon ». Matching CVE via CPE dépend du CTI/Scanner (déjà câblé, item 21). |
 
 ### 1.2 Fonctionnalités avancées — Module 14.1 à 14.18 (le **moat** vs Vanta/Drata)

backend/pkg/compliance/catalog_cis_v8.go

@@ -0,0 +1,46 @@
+// Copyright (c) 2026 OpenDefender Contributors
+// SPDX-License-Identifier: BUSL-1.1
+// This Source Code Form is subject to the terms of the Business Source License, Version 1.1.
+// If a copy of the BUSL was not distributed with this file, You can obtain one at https://mariadb.com/bsl11/
+
+package compliance
+
+// CIS Critical Security Controls v8 — the 18 top-level Controls. Control numbers
+// and titles are CIS's own public structure and are reliable; descriptions here
+// are original summaries of each Control's intent, not CIS's own text (CIS
+// Controls are © the Center for Internet Security). A tenant can add ad-hoc
+// Safeguard-level controls to the imported framework.
+
+func init() {
+	register(Catalog{
+		Key:         "cis-v8",
+		Name:        "CIS Critical Security Controls",
+		Version:     "8",
+		Description: "The 18 CIS Critical Security Controls (v8) — prioritized, prescriptive cyber-defense best practices.",
+		Available:   true,
+		Controls:    cisV8Controls,
+	})
+}
+
+const cisV8Source = "CIS Controls v8, Control "
+
+var cisV8Controls = []CatalogControl{
+	{"CIS-1", "Inventory and Control of Enterprise Assets", "Actively manage (inventory, track and correct) all enterprise assets connected to the infrastructure, so only authorized devices are given access and unauthorized/unmanaged devices are found and remediated.", cisV8Source + "1"},
+	{"CIS-2", "Inventory and Control of Software Assets", "Actively manage all software (operating systems and applications) on the network so only authorized software is installed and can execute, and unauthorized software is found and prevented from installing or executing.", cisV8Source + "2"},
+	{"CIS-3", "Data Protection", "Develop processes and technical controls to identify, classify, securely handle, retain and dispose of data.", cisV8Source + "3"},
+	{"CIS-4", "Secure Configuration of Enterprise Assets and Software", "Establish and maintain the secure configuration of enterprise assets (end-user devices, servers, network devices) and software (operating systems and applications).", cisV8Source + "4"},
+	{"CIS-5", "Account Management", "Use processes and tools to assign and manage authorization to credentials for user, administrator and service accounts across the enterprise.", cisV8Source + "5"},
+	{"CIS-6", "Access Control Management", "Use processes and tools to create, assign, manage and revoke access credentials and privileges for user, administrator and service accounts.", cisV8Source + "6"},
+	{"CIS-7", "Continuous Vulnerability Management", "Develop a plan to continuously assess and track vulnerabilities on all enterprise assets, and to remediate and minimize the window of opportunity for attackers.", cisV8Source + "7"},
+	{"CIS-8", "Audit Log Management", "Collect, alert on, review and retain audit logs of events that could help detect, understand or recover from an attack.", cisV8Source + "8"},
+	{"CIS-9", "Email and Web Browser Protections", "Improve protections and detections of threats from email and web vectors, which attackers use to manipulate human behavior through direct engagement.", cisV8Source + "9"},
+	{"CIS-10", "Malware Defenses", "Prevent or control the installation, spread and execution of malicious applications, code or scripts on enterprise assets.", cisV8Source + "10"},
+	{"CIS-11", "Data Recovery", "Establish and maintain data-recovery practices sufficient to restore in-scope enterprise assets to a pre-incident, trusted state.", cisV8Source + "11"},
+	{"CIS-12", "Network Infrastructure Management", "Establish, implement and actively manage network devices to prevent attackers from exploiting vulnerable network services and access points.", cisV8Source + "12"},
+	{"CIS-13", "Network Monitoring and Defense", "Operate processes and tooling to establish and maintain comprehensive network monitoring and defense against security threats across the enterprise's network infrastructure and user base.", cisV8Source + "13"},
+	{"CIS-14", "Security Awareness and Skills Training", "Establish and maintain a security-awareness program to influence behavior among the workforce to be security-conscious and properly skilled to reduce cybersecurity risks.", cisV8Source + "14"},
+	{"CIS-15", "Service Provider Management", "Develop a process to evaluate service providers who hold sensitive data or are responsible for critical IT platforms or processes, to ensure they protect those assets appropriately.", cisV8Source + "15"},
+	{"CIS-16", "Application Software Security", "Manage the security life cycle of in-house developed, hosted or acquired software to prevent, detect and remediate security weaknesses before they can affect the enterprise.", cisV8Source + "16"},
+	{"CIS-17", "Incident Response Management", "Establish a program to develop and maintain incident-response capability (policies, plans, procedures, roles, training and communications) to prepare, detect and quickly respond to an attack.", cisV8Source + "17"},
+	{"CIS-18", "Penetration Testing", "Test the effectiveness and resiliency of enterprise assets by identifying and exploiting weaknesses in controls (people, processes and technology), and simulating the objectives and actions of an attacker.", cisV8Source + "18"},
+}

backend/pkg/compliance/catalog_hipaa_security.go

@@ -0,0 +1,61 @@
+// Copyright (c) 2026 OpenDefender Contributors
+// SPDX-License-Identifier: BUSL-1.1
+// This Source Code Form is subject to the terms of the Business Source License, Version 1.1.
+// If a copy of the BUSL was not distributed with this file, You can obtain one at https://mariadb.com/bsl11/
+
+package compliance
+
+// HIPAA Security Rule — the Standards of the Administrative, Physical and
+// Technical Safeguards plus the Organizational and Documentation requirements,
+// codified at 45 CFR Part 164, Subpart C (§§ 164.308–164.316). The CFR section
+// citations are public U.S. federal regulation and are reliable. Descriptions
+// here are original summaries of each Standard's intent; the required and
+// addressable implementation specifications under each Standard can be added as
+// ad-hoc controls on the imported framework.
+
+func init() {
+	register(Catalog{
+		Key:         "hipaa-security",
+		Name:        "HIPAA Security Rule",
+		Version:     "45 CFR Part 164 Subpart C",
+		Description: "Standards for the protection of electronic protected health information (ePHI) — Administrative, Physical and Technical Safeguards.",
+		Available:   true,
+		Controls:    hipaaSecurityControls,
+	})
+}
+
+const hipaaSource = "45 CFR § "
+
+var hipaaSecurityControls = []CatalogControl{
+	// --- Administrative Safeguards (§ 164.308) ---
+	{"164.308(a)(1)", "Security Management Process", "Implement policies and procedures to prevent, detect, contain and correct security violations — including risk analysis, risk management, a sanction policy and information system activity review.", hipaaSource + "164.308(a)(1)"},
+	{"164.308(a)(2)", "Assigned Security Responsibility", "Identify the security official who is responsible for the development and implementation of the policies and procedures required by the Security Rule.", hipaaSource + "164.308(a)(2)"},
+	{"164.308(a)(3)", "Workforce Security", "Implement policies and procedures to ensure that all workforce members have appropriate access to ePHI, and to prevent those who should not have access from obtaining it.", hipaaSource + "164.308(a)(3)"},
+	{"164.308(a)(4)", "Information Access Management", "Implement policies and procedures for authorizing access to ePHI that are consistent with the applicable requirements of the Privacy Rule.", hipaaSource + "164.308(a)(4)"},
+	{"164.308(a)(5)", "Security Awareness and Training", "Implement a security awareness and training program for all workforce members, including management (security reminders, malware protection, log-in monitoring and password management).", hipaaSource + "164.308(a)(5)"},
+	{"164.308(a)(6)", "Security Incident Procedures", "Implement policies and procedures to address security incidents, including identifying and responding to suspected or known incidents and mitigating their harmful effects.", hipaaSource + "164.308(a)(6)"},
+	{"164.308(a)(7)", "Contingency Plan", "Establish policies and procedures for responding to an emergency or other occurrence that damages systems containing ePHI (data backup, disaster recovery, emergency-mode operation, testing and criticality analysis).", hipaaSource + "164.308(a)(7)"},
+	{"164.308(a)(8)", "Evaluation", "Perform periodic technical and non-technical evaluations to establish the extent to which security policies and procedures meet the Security Rule's requirements.", hipaaSource + "164.308(a)(8)"},
+	{"164.308(b)(1)", "Business Associate Contracts and Other Arrangements", "Obtain satisfactory assurances, documented through a written contract, that a business associate will appropriately safeguard the ePHI it creates, receives, maintains or transmits.", hipaaSource + "164.308(b)(1)"},
+
+	// --- Physical Safeguards (§ 164.310) ---
+	{"164.310(a)(1)", "Facility Access Controls", "Implement policies and procedures to limit physical access to electronic information systems and the facilities in which they are housed, while ensuring properly authorized access is allowed.", hipaaSource + "164.310(a)(1)"},
+	{"164.310(b)", "Workstation Use", "Implement policies and procedures that specify the proper functions to be performed, the manner in which they are performed, and the physical attributes of the surroundings of workstations that access ePHI.", hipaaSource + "164.310(b)"},
+	{"164.310(c)", "Workstation Security", "Implement physical safeguards for all workstations that access ePHI to restrict access to authorized users.", hipaaSource + "164.310(c)"},
+	{"164.310(d)(1)", "Device and Media Controls", "Implement policies and procedures governing the receipt and removal of hardware and electronic media that contain ePHI into and out of a facility, and their movement within it (disposal, media re-use, accountability, data backup and storage).", hipaaSource + "164.310(d)(1)"},
+
+	// --- Technical Safeguards (§ 164.312) ---
+	{"164.312(a)(1)", "Access Control", "Implement technical policies and procedures for electronic information systems that maintain ePHI to allow access only to authorized persons or software (unique user IDs, emergency access, automatic logoff and encryption/decryption).", hipaaSource + "164.312(a)(1)"},
+	{"164.312(b)", "Audit Controls", "Implement hardware, software and procedural mechanisms that record and examine activity in information systems that contain or use ePHI.", hipaaSource + "164.312(b)"},
+	{"164.312(c)(1)", "Integrity", "Implement policies and procedures to protect ePHI from improper alteration or destruction, including mechanisms to authenticate that ePHI has not been altered.", hipaaSource + "164.312(c)(1)"},
+	{"164.312(d)", "Person or Entity Authentication", "Implement procedures to verify that a person or entity seeking access to ePHI is the one claimed.", hipaaSource + "164.312(d)"},
+	{"164.312(e)(1)", "Transmission Security", "Implement technical security measures to guard against unauthorized access to ePHI transmitted over an electronic communications network (integrity controls and encryption).", hipaaSource + "164.312(e)(1)"},
+
+	// --- Organizational Requirements (§ 164.314) ---
+	{"164.314(a)(1)", "Business Associate Contracts or Other Arrangements", "Ensure that the contract or other arrangement between a covered entity and a business associate meets the applicable requirements for safeguarding ePHI.", hipaaSource + "164.314(a)(1)"},
+	{"164.314(b)(1)", "Requirements for Group Health Plans", "Ensure a group health plan's documents require the plan sponsor to reasonably and appropriately safeguard ePHI created, received, maintained or transmitted on its behalf.", hipaaSource + "164.314(b)(1)"},
+
+	// --- Policies, Procedures and Documentation (§ 164.316) ---
+	{"164.316(a)", "Policies and Procedures", "Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications and other requirements of the Security Rule.", hipaaSource + "164.316(a)"},
+	{"164.316(b)(1)", "Documentation", "Maintain the required policies and procedures in written (which may be electronic) form, and retain documentation of any action, activity or assessment required by the Security Rule.", hipaaSource + "164.316(b)(1)"},
+}