// =============================================================================
// Order and Availability Controls
// Categories: ORDER_CONTROL, AVAILABILITY
// =============================================================================

import { ControlLibraryEntry } from '../../types'

export const ORDER_AVAILABILITY_CONTROLS: ControlLibraryEntry[] = [
  // ORDER_CONTROL
  {
    id: 'TOM-OR-01',
    code: 'TOM-OR-01',
    category: 'ORDER_CONTROL',
    type: 'ORGANIZATIONAL',
    name: { de: 'Auftragsverarbeitungsverträge (AVV)', en: 'Data Processing Agreements (DPA)' },
    description: {
      de: 'Abschluss von Auftragsverarbeitungsverträgen gemäß Art. 28 DSGVO mit allen Auftragsverarbeitern.',
      en: 'Conclusion of data processing agreements according to Art. 28 GDPR with all processors.',
    },
    mappings: [
      { framework: 'GDPR_ART28', reference: 'Art. 28 Abs. 3' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.15.1.2' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.hasSubprocessors', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 30 },
      { field: 'companyProfile.role', operator: 'EQUALS', value: 'CONTROLLER', result: 'REQUIRED', priority: 25 },
    ],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Unterschriebene AVVs', 'Auftragsverarbeiter-Verzeichnis'],
    reviewFrequency: 'ANNUAL',
    priority: 'CRITICAL',
    complexity: 'LOW',
    tags: ['contracts', 'avv', 'dpa'],
  },
  {
    id: 'TOM-OR-02',
    code: 'TOM-OR-02',
    category: 'ORDER_CONTROL',
    type: 'ORGANIZATIONAL',
    name: { de: 'Auftragsverarbeiter-Prüfung', en: 'Processor Auditing' },
    description: {
      de: 'Regelmäßige Überprüfung der technischen und organisatorischen Maßnahmen bei Auftragsverarbeitern.',
      en: 'Regular verification of technical and organizational measures at processors.',
    },
    mappings: [
      { framework: 'GDPR_ART28', reference: 'Art. 28 Abs. 3 lit. h' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.15.2.1' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.hasSubprocessors', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 25 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Audit-Berichte', 'Zertifikate der Auftragsverarbeiter', 'Prüfprotokolle'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['audit', 'processor'],
  },
  {
    id: 'TOM-OR-03',
    code: 'TOM-OR-03',
    category: 'ORDER_CONTROL',
    type: 'ORGANIZATIONAL',
    name: { de: 'Weisungsgebundenheit dokumentieren', en: 'Document Instruction Compliance' },
    description: {
      de: 'Dokumentation der Weisungsgebundenheit von Auftragsverarbeitern und Mitarbeitern.',
      en: 'Documentation of instruction compliance by processors and employees.',
    },
    mappings: [
      { framework: 'GDPR_ART28', reference: 'Art. 28 Abs. 3 lit. a' },
      { framework: 'GDPR_ART29', reference: 'Art. 29' },
    ],
    applicabilityConditions: [
      { field: 'companyProfile.role', operator: 'EQUALS', value: 'PROCESSOR', result: 'REQUIRED', priority: 30 },
    ],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Weisungsdokumentation', 'Schulungsnachweise'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'LOW',
    tags: ['processor', 'instructions'],
  },
  {
    id: 'TOM-OR-04',
    code: 'TOM-OR-04',
    category: 'ORDER_CONTROL',
    type: 'ORGANIZATIONAL',
    name: { de: 'Unterauftragsverarbeiter-Management', en: 'Sub-processor Management' },
    description: {
      de: 'Dokumentiertes Verfahren für die Genehmigung und Überwachung von Unterauftragsverarbeitern.',
      en: 'Documented procedure for approval and monitoring of sub-processors.',
    },
    mappings: [
      { framework: 'GDPR_ART28', reference: 'Art. 28 Abs. 2, 4' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.15.1.3' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.hasSubprocessors', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 30 },
      { field: 'companyProfile.role', operator: 'EQUALS', value: 'PROCESSOR', result: 'REQUIRED', priority: 25 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Unterauftragsverarbeiter-Liste', 'Genehmigungsprotokolle', 'AVVs mit Unterauftragsverarbeitern'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['sub-processor', 'management'],
  },
  {
    id: 'TOM-OR-05',
    code: 'TOM-OR-05',
    category: 'ORDER_CONTROL',
    type: 'ORGANIZATIONAL',
    name: { de: 'Auftragsverarbeiter-Monitoring', en: 'Processor Monitoring' },
    description: {
      de: 'Regelmaessige Ueberpruefung und Bewertung der Datenschutz-Massnahmen bei Auftragsverarbeitern gemaess Art. 28 Abs. 3 lit. h DSGVO.',
      en: 'Regular review and assessment of data protection measures at processors according to Art. 28(3)(h) GDPR.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 28 Abs. 3 lit. h' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.15.2.1' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.hasSubprocessors', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 25 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Audit-Berichte der Auftragsverarbeiter', 'Monitoring-Checklisten'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['order-control', 'processor', 'monitoring'],
  },
  {
    id: 'TOM-OR-06',
    code: 'TOM-OR-06',
    category: 'ORDER_CONTROL',
    type: 'ORGANIZATIONAL',
    name: { de: 'Sub-Processor Management', en: 'Sub-Processor Management' },
    description: {
      de: 'Dokumentiertes Verfahren zur Genehmigung, Ueberwachung und Dokumentation von Unterauftragsverarbeitern.',
      en: 'Documented process for approval, monitoring and documentation of sub-processors.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 28 Abs. 2, 4' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.15.1.2' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.hasSubprocessors', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 25 },
      { field: 'architectureProfile.subprocessorCount', operator: 'GREATER_THAN', value: 3, result: 'REQUIRED', priority: 20 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Sub-Processor-Register', 'Genehmigungsverfahren', 'Vertragsdokumentation'],
    reviewFrequency: 'SEMI_ANNUAL',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['order-control', 'sub-processor'],
  },

  // AVAILABILITY
  {
    id: 'TOM-AV-01',
    code: 'TOM-AV-01',
    category: 'AVAILABILITY',
    type: 'TECHNICAL',
    name: { de: 'Backup-Strategie', en: 'Backup Strategy' },
    description: {
      de: 'Implementierung einer umfassenden Backup-Strategie mit regelmäßigen Sicherungen und Aufbewahrung.',
      en: 'Implementation of a comprehensive backup strategy with regular backups and retention.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. c' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.12.3.1' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Backup-Konzept', 'Backup-Protokolle', 'Restore-Tests'],
    reviewFrequency: 'QUARTERLY',
    priority: 'CRITICAL',
    complexity: 'MEDIUM',
    tags: ['backup', 'recovery'],
  },
  {
    id: 'TOM-AV-02',
    code: 'TOM-AV-02',
    category: 'AVAILABILITY',
    type: 'TECHNICAL',
    name: { de: 'Redundante Systeme', en: 'Redundant Systems' },
    description: {
      de: 'Implementierung von Redundanz für kritische Systeme zur Sicherstellung der Verfügbarkeit.',
      en: 'Implementation of redundancy for critical systems to ensure availability.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.17.2.1' },
    ],
    applicabilityConditions: [
      { field: 'riskProfile.ciaAssessment.availability', operator: 'GREATER_THAN', value: 3, result: 'REQUIRED', priority: 20 },
      { field: 'riskProfile.protectionLevel', operator: 'EQUALS', value: 'VERY_HIGH', result: 'REQUIRED', priority: 25 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Redundanzkonzept', 'Architekturdokumentation'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'HIGH',
    tags: ['redundancy', 'availability'],
  },
  {
    id: 'TOM-AV-03',
    code: 'TOM-AV-03',
    category: 'AVAILABILITY',
    type: 'TECHNICAL',
    name: { de: 'Unterbrechungsfreie Stromversorgung (USV)', en: 'Uninterruptible Power Supply (UPS)' },
    description: {
      de: 'Einsatz von USV-Anlagen zum Schutz kritischer Systeme vor Stromausfällen.',
      en: 'Use of UPS systems to protect critical systems from power failures.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.11.2.2' },
      { framework: 'BSI_IT_GRUNDSCHUTZ', reference: 'INF.2' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.hostingModel', operator: 'IN', value: ['ON_PREMISE', 'PRIVATE_CLOUD', 'HYBRID'], result: 'REQUIRED', priority: 15 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['USV-Dokumentation', 'Wartungsprotokolle'],
    reviewFrequency: 'ANNUAL',
    priority: 'MEDIUM',
    complexity: 'MEDIUM',
    tags: ['power', 'infrastructure'],
  },
  {
    id: 'TOM-AV-04',
    code: 'TOM-AV-04',
    category: 'AVAILABILITY',
    type: 'ORGANIZATIONAL',
    name: { de: 'Notfallvorsorge (Business Continuity)', en: 'Business Continuity Planning' },
    description: {
      de: 'Dokumentierte Notfallvorsorge zur Aufrechterhaltung kritischer Geschäftsprozesse.',
      en: 'Documented emergency preparedness to maintain critical business processes.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. c' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.17.1.1' },
    ],
    applicabilityConditions: [
      { field: 'riskProfile.ciaAssessment.availability', operator: 'GREATER_THAN', value: 2, result: 'REQUIRED', priority: 15 },
    ],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Business-Continuity-Plan', 'Notfallkontakte', 'Übungsprotokolle'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['bcp', 'continuity'],
  },
  {
    id: 'TOM-AV-05',
    code: 'TOM-AV-05',
    category: 'AVAILABILITY',
    type: 'TECHNICAL',
    name: { de: 'Monitoring und Alerting', en: 'Monitoring and Alerting' },
    description: {
      de: 'Kontinuierliche Überwachung der Systemverfügbarkeit mit automatischen Benachrichtigungen bei Ausfällen.',
      en: 'Continuous monitoring of system availability with automatic notifications for outages.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.12.4.1' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Monitoring-Konfiguration', 'Alert-Regeln', 'Verfügbarkeitsberichte'],
    reviewFrequency: 'QUARTERLY',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['monitoring', 'alerting'],
  },
  {
    id: 'TOM-AV-06',
    code: 'TOM-AV-06',
    category: 'AVAILABILITY',
    type: 'TECHNICAL',
    name: { de: 'Monitoring und Alerting', en: 'Monitoring and Alerting' },
    description: {
      de: 'Implementierung einer umfassenden Ueberwachung aller IT-Systeme mit automatischen Benachrichtigungen bei Stoerungen oder Schwellenwert-Ueberschreitungen.',
      en: 'Implementation of comprehensive monitoring of all IT systems with automatic notifications for disruptions or threshold violations.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.12.4.1' },
      { framework: 'BSI_IT_GRUNDSCHUTZ', reference: 'OPS.1.1.2' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Monitoring-Konzept', 'Alerting-Konfiguration', 'Eskalationsmatrix'],
    reviewFrequency: 'QUARTERLY',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['availability', 'monitoring', 'alerting'],
  },
  {
    id: 'TOM-AV-07',
    code: 'TOM-AV-07',
    category: 'AVAILABILITY',
    type: 'ORGANIZATIONAL',
    name: { de: 'Service Level Management', en: 'Service Level Management' },
    description: {
      de: 'Definition und Ueberwachung von Service Level Agreements (SLAs) fuer alle kritischen IT-Services mit klaren Verfuegbarkeitszielen.',
      en: 'Definition and monitoring of Service Level Agreements (SLAs) for all critical IT services with clear availability targets.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.15.2.1' },
    ],
    applicabilityConditions: [
      { field: 'companyProfile.size', operator: 'IN', value: ['MEDIUM', 'LARGE', 'ENTERPRISE'], result: 'RECOMMENDED', priority: 10 },
      { field: 'architectureProfile.hasSubprocessors', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 20 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['SLA-Dokumentation', 'Verfuegbarkeitsberichte', 'Eskalationsverfahren'],
    reviewFrequency: 'QUARTERLY',
    priority: 'MEDIUM',
    complexity: 'LOW',
    tags: ['availability', 'sla', 'service-management'],
  },
]
