// =============================================================================
// Review, Training, and Awareness Controls
// Category: REVIEW (includes training/TR-* and all REVIEW controls)
// =============================================================================

import { ControlLibraryEntry } from '../../types'

export const REVIEW_CONTROLS: ControlLibraryEntry[] = [
  {
    id: 'TOM-RV-01',
    code: 'TOM-RV-01',
    category: 'REVIEW',
    type: 'ORGANIZATIONAL',
    name: { de: 'Regelmaessige TOM-Ueberpruefung', en: 'Regular TOM Review' },
    description: {
      de: 'Periodische Ueberpruefung und Aktualisierung der technischen und organisatorischen Massnahmen.',
      en: 'Periodic review and update of technical and organizational measures.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. d' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.18.2.1' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Ueberpruefungsprotokolle', 'Massnahmenplan'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'LOW',
    tags: ['review', 'compliance'],
  },
  {
    id: 'TOM-RV-02',
    code: 'TOM-RV-02',
    category: 'REVIEW',
    type: 'TECHNICAL',
    name: { de: 'Penetrationstests', en: 'Penetration Testing' },
    description: {
      de: 'Regelmaessige Durchfuehrung von Penetrationstests durch qualifizierte Pruefer.',
      en: 'Regular penetration testing by qualified testers.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. d' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.18.2.3' },
    ],
    applicabilityConditions: [
      { field: 'riskProfile.protectionLevel', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'REQUIRED', priority: 20 },
      { field: 'dataProfile.hasSpecialCategories', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 25 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Penetrationstest-Berichte', 'Massnahmenplan'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'HIGH',
    tags: ['security-testing', 'pentest'],
  },
  {
    id: 'TOM-RV-03',
    code: 'TOM-RV-03',
    category: 'REVIEW',
    type: 'TECHNICAL',
    name: { de: 'Schwachstellenscanning', en: 'Vulnerability Scanning' },
    description: {
      de: 'Regelmaessiges automatisiertes Scanning nach bekannten Schwachstellen in Systemen und Anwendungen.',
      en: 'Regular automated scanning for known vulnerabilities in systems and applications.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. d' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.12.6.1' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Scan-Berichte', 'Behebungsnachweis'],
    reviewFrequency: 'MONTHLY',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['security-testing', 'vulnerability'],
  },
  {
    id: 'TOM-RV-04',
    code: 'TOM-RV-04',
    category: 'REVIEW',
    type: 'ORGANIZATIONAL',
    name: { de: 'Sicherheitsaudits', en: 'Security Audits' },
    description: {
      de: 'Durchfuehrung regelmaessiger interner oder externer Sicherheitsaudits.',
      en: 'Conducting regular internal or external security audits.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. d' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.18.2.1' },
    ],
    applicabilityConditions: [
      { field: 'riskProfile.protectionLevel', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'REQUIRED', priority: 20 },
      { field: 'companyProfile.role', operator: 'EQUALS', value: 'PROCESSOR', result: 'REQUIRED', priority: 15 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Audit-Berichte', 'Zertifikate', 'Massnahmenplan'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['audit', 'compliance'],
  },
  {
    id: 'TOM-RV-05',
    code: 'TOM-RV-05',
    category: 'REVIEW',
    type: 'ORGANIZATIONAL',
    name: { de: 'Datenschutzschulung', en: 'Data Protection Training' },
    description: {
      de: 'Regelmaessige Schulung aller Mitarbeiter zu Datenschutz und IT-Sicherheit.',
      en: 'Regular training of all employees on data protection and IT security.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.7.2.2' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Schulungskonzept', 'Teilnehmerlisten', 'Schulungsnachweise'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'LOW',
    tags: ['training', 'awareness'],
  },
  {
    id: 'TOM-RV-06',
    code: 'TOM-RV-06',
    category: 'REVIEW',
    type: 'ORGANIZATIONAL',
    name: { de: 'Incident Response Plan', en: 'Incident Response Plan' },
    description: {
      de: 'Dokumentiertes Verfahren zur Erkennung, Meldung und Behandlung von Sicherheitsvorfaellen.',
      en: 'Documented procedure for detection, reporting and handling of security incidents.',
    },
    mappings: [
      { framework: 'GDPR_ART33', reference: 'Art. 33' },
      { framework: 'GDPR_ART34', reference: 'Art. 34' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.16.1.1' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Incident-Response-Plan', 'Kontaktliste', 'Meldeformulare', 'Uebungsprotokolle'],
    reviewFrequency: 'ANNUAL',
    priority: 'CRITICAL',
    complexity: 'MEDIUM',
    tags: ['incident-response', 'breach'],
  },
  {
    id: 'TOM-RV-07',
    code: 'TOM-RV-07',
    category: 'REVIEW',
    type: 'TECHNICAL',
    name: {
      de: 'Security Information and Event Management (SIEM)',
      en: 'Security Information and Event Management (SIEM)',
    },
    description: {
      de: 'Zentralisierte Sammlung und Analyse von Sicherheitsereignissen zur Erkennung von Angriffen.',
      en: 'Centralized collection and analysis of security events to detect attacks.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.12.4.1' },
    ],
    applicabilityConditions: [
      { field: 'riskProfile.protectionLevel', operator: 'EQUALS', value: 'VERY_HIGH', result: 'REQUIRED', priority: 30 },
      { field: 'companyProfile.size', operator: 'IN', value: ['LARGE', 'ENTERPRISE'], result: 'RECOMMENDED', priority: 15 },
    ],
    defaultApplicability: 'OPTIONAL',
    evidenceRequirements: ['SIEM-Konfiguration', 'Korrelationsregeln', 'Alert-Berichte'],
    reviewFrequency: 'QUARTERLY',
    priority: 'HIGH',
    complexity: 'HIGH',
    tags: ['siem', 'monitoring', 'detection'],
  },
  {
    id: 'TOM-RV-08',
    code: 'TOM-RV-08',
    category: 'REVIEW',
    type: 'ORGANIZATIONAL',
    name: {
      de: 'Datenschutz-Folgenabschaetzung (DSFA)',
      en: 'Data Protection Impact Assessment (DPIA)',
    },
    description: {
      de: 'Durchfuehrung von Datenschutz-Folgenabschaetzungen fuer risikoreiche Verarbeitungen.',
      en: 'Conducting data protection impact assessments for high-risk processing.',
    },
    mappings: [
      { framework: 'GDPR_ART35', reference: 'Art. 35' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.18.1.4' },
    ],
    applicabilityConditions: [
      { field: 'riskProfile.dsfaRequired', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 30 },
      { field: 'dataProfile.hasSpecialCategories', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 25 },
      { field: 'dataProfile.processesMinors', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 25 },
    ],
    defaultApplicability: 'OPTIONAL',
    evidenceRequirements: ['DSFA-Dokumentation', 'Risikobewertung', 'Massnahmenplan'],
    reviewFrequency: 'ANNUAL',
    priority: 'CRITICAL',
    complexity: 'HIGH',
    tags: ['dpia', 'dsfa', 'risk-assessment'],
  },
  {
    id: 'TOM-RV-09',
    code: 'TOM-RV-09',
    category: 'REVIEW',
    type: 'ORGANIZATIONAL',
    name: { de: 'Datenschutz-Audit-Programm', en: 'Data Protection Audit Program' },
    description: {
      de: 'Systematisches Programm zur regelmaessigen internen Ueberpruefung aller Datenschutzmassnahmen mit dokumentierten Ergebnissen und Massnahmenverfolgung.',
      en: 'Systematic program for regular internal review of all data protection measures with documented results and action tracking.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. d' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.18.2.1' },
      { framework: 'BSI_IT_GRUNDSCHUTZ', reference: 'DER.3.1' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Audit-Programm', 'Audit-Berichte', 'Massnahmenplan'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['review', 'audit', 'data-protection'],
  },
  {
    id: 'TOM-RV-10',
    code: 'TOM-RV-10',
    category: 'REVIEW',
    type: 'TECHNICAL',
    name: { de: 'Automatisierte Compliance-Pruefung', en: 'Automated Compliance Checking' },
    description: {
      de: 'Einsatz automatisierter Tools zur kontinuierlichen Ueberpruefung der Einhaltung von Sicherheits- und Datenschutzrichtlinien.',
      en: 'Use of automated tools for continuous monitoring of compliance with security and data protection policies.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. d' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.18.2.2' },
    ],
    applicabilityConditions: [
      { field: 'companyProfile.size', operator: 'IN', value: ['MEDIUM', 'LARGE', 'ENTERPRISE'], result: 'RECOMMENDED', priority: 10 },
      { field: 'riskProfile.protectionLevel', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'RECOMMENDED', priority: 15 },
    ],
    defaultApplicability: 'OPTIONAL',
    evidenceRequirements: ['Tool-Konfiguration', 'Compliance-Dashboard', 'Automatisierte Berichte'],
    reviewFrequency: 'QUARTERLY',
    priority: 'MEDIUM',
    complexity: 'HIGH',
    tags: ['review', 'automation', 'compliance'],
  },
  {
    id: 'TOM-RV-11',
    code: 'TOM-RV-11',
    category: 'REVIEW',
    type: 'ORGANIZATIONAL',
    name: { de: 'Management Review (Art. 32 Abs. 1 lit. d)', en: 'Management Review (Art. 32(1)(d))' },
    description: {
      de: 'Regelmaessige Ueberpruefung der Wirksamkeit aller technischen und organisatorischen Massnahmen durch die Geschaeftsfuehrung mit dokumentierten Ergebnissen.',
      en: 'Regular review of the effectiveness of all technical and organizational measures by management with documented results.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. d' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.18.2.1' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Management-Review-Protokolle', 'Massnahmenplan', 'Wirksamkeitsbewertung'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'LOW',
    tags: ['review', 'management', 'effectiveness'],
  },
  // Training and confidentiality controls (also REVIEW category)
  {
    id: 'TOM-TR-01',
    code: 'TOM-TR-01',
    category: 'REVIEW',
    type: 'ORGANIZATIONAL',
    name: { de: 'Datenschutzschulung', en: 'Data Protection Training' },
    description: {
      de: 'Regelmaessige Schulung aller Mitarbeiter zu Datenschutzgrundlagen, DSGVO-Anforderungen und betrieblichen Datenschutzrichtlinien.',
      en: 'Regular training of all employees on data protection fundamentals, GDPR requirements, and organizational data protection policies.',
    },
    mappings: [
      { framework: 'GDPR_ART39', reference: 'Art. 39 Abs. 1 lit. b' },
      { framework: 'GDPR_ART47', reference: 'Art. 47 Abs. 2 lit. n' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.6.3' },
    ],
    applicabilityConditions: [
      { field: 'orgProfile.employeeCount', operator: 'GREATER_THAN', value: 0, result: 'REQUIRED', priority: 30 },
    ],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Schulungsplan (jaehrlich)', 'Teilnahmelisten / Schulungsnachweise', 'Schulungsmaterialien / Praesentation', 'Wissenstest-Ergebnisse (optional)'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'LOW',
    tags: ['training', 'schulung', 'awareness', 'organizational'],
  },
  {
    id: 'TOM-TR-02',
    code: 'TOM-TR-02',
    category: 'REVIEW',
    type: 'ORGANIZATIONAL',
    name: { de: 'Verpflichtung auf Datengeheimnis', en: 'Confidentiality Obligation' },
    description: {
      de: 'Schriftliche Verpflichtung aller Mitarbeiter und externen Dienstleister auf die Vertraulichkeit personenbezogener Daten.',
      en: 'Written obligation of all employees and external service providers to maintain confidentiality of personal data.',
    },
    mappings: [
      { framework: 'GDPR_ART28', reference: 'Art. 28 Abs. 3 lit. b' },
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 4' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.6.6' },
    ],
    applicabilityConditions: [
      { field: 'orgProfile.employeeCount', operator: 'GREATER_THAN', value: 0, result: 'REQUIRED', priority: 30 },
    ],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Muster-Verpflichtungserklaerung', 'Unterschriebene Verpflichtungserklaerungen', 'Register der verpflichteten Personen'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'LOW',
    tags: ['training', 'confidentiality', 'vertraulichkeit', 'obligation'],
  },
  {
    id: 'TOM-TR-03',
    code: 'TOM-TR-03',
    category: 'REVIEW',
    type: 'ORGANIZATIONAL',
    name: { de: 'Security Awareness Programm', en: 'Security Awareness Program' },
    description: {
      de: 'Fortlaufendes Awareness-Programm zu IT-Sicherheit, Phishing-Erkennung, Social Engineering und sicherem Umgang mit Daten.',
      en: 'Ongoing awareness program on IT security, phishing detection, social engineering, and safe data handling.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. d' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.6.3' },
      { framework: 'BSI_C5', reference: 'ORP.3' },
    ],
    applicabilityConditions: [
      { field: 'orgProfile.employeeCount', operator: 'GREATER_THAN', value: 10, result: 'REQUIRED', priority: 20 },
      { field: 'orgProfile.employeeCount', operator: 'GREATER_THAN', value: 0, result: 'RECOMMENDED', priority: 15 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Awareness-Programm-Dokumentation', 'Phishing-Simulationsergebnisse', 'Teilnahmenachweise'],
    reviewFrequency: 'SEMI_ANNUAL',
    priority: 'MEDIUM',
    complexity: 'MEDIUM',
    tags: ['training', 'security-awareness', 'phishing', 'social-engineering'],
  },
]
