// =============================================================================
// Separation and Encryption Controls
// Categories: SEPARATION (incl. deletion/DL-*), ENCRYPTION
// =============================================================================

import { ControlLibraryEntry } from '../../types'

export const SEPARATION_ENCRYPTION_CONTROLS: ControlLibraryEntry[] = [
  // SEPARATION
  {
    id: 'TOM-SE-01',
    code: 'TOM-SE-01',
    category: 'SEPARATION',
    type: 'TECHNICAL',
    name: { de: 'Mandantentrennung', en: 'Multi-Tenant Separation' },
    description: {
      de: 'Technische Trennung von Daten verschiedener Kunden/Mandanten in mandantenfähigen Systemen.',
      en: 'Technical separation of data from different customers/tenants in multi-tenant systems.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.13.1.3' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.multiTenancy', operator: 'EQUALS', value: 'MULTI_TENANT', result: 'REQUIRED', priority: 30 },
      { field: 'companyProfile.role', operator: 'EQUALS', value: 'PROCESSOR', result: 'REQUIRED', priority: 20 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Mandantentrennungskonzept', 'Architekturdokumentation', 'Penetrationstest-Ergebnisse'],
    reviewFrequency: 'ANNUAL',
    priority: 'CRITICAL',
    complexity: 'HIGH',
    tags: ['multi-tenant', 'separation'],
  },
  {
    id: 'TOM-SE-02',
    code: 'TOM-SE-02',
    category: 'SEPARATION',
    type: 'TECHNICAL',
    name: { de: 'Netzwerksegmentierung', en: 'Network Segmentation' },
    description: {
      de: 'Segmentierung des Netzwerks zur Trennung verschiedener Sicherheitszonen und Datenverarbeitungsbereiche.',
      en: 'Network segmentation to separate different security zones and data processing areas.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.13.1.3' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.hostingModel', operator: 'IN', value: ['ON_PREMISE', 'PRIVATE_CLOUD', 'HYBRID'], result: 'REQUIRED', priority: 15 },
      { field: 'riskProfile.protectionLevel', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'REQUIRED', priority: 20 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Netzwerkdiagramm', 'Firewall-Regeln'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['network', 'segmentation'],
  },
  {
    id: 'TOM-SE-03',
    code: 'TOM-SE-03',
    category: 'SEPARATION',
    type: 'TECHNICAL',
    name: { de: 'Umgebungstrennung (Dev/Test/Prod)', en: 'Environment Separation (Dev/Test/Prod)' },
    description: {
      de: 'Strikte Trennung von Entwicklungs-, Test- und Produktionsumgebungen.',
      en: 'Strict separation of development, test and production environments.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.12.1.4' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Umgebungsdokumentation', 'Zugriffsrechte je Umgebung'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['environments', 'separation'],
  },
  {
    id: 'TOM-SE-04',
    code: 'TOM-SE-04',
    category: 'SEPARATION',
    type: 'ORGANIZATIONAL',
    name: { de: 'Zweckbindung dokumentieren', en: 'Document Purpose Limitation' },
    description: {
      de: 'Dokumentation und technische Durchsetzung der Zweckbindung bei der Datenverarbeitung.',
      en: 'Documentation and technical enforcement of purpose limitation in data processing.',
    },
    mappings: [
      { framework: 'GDPR_ART5', reference: 'Art. 5 Abs. 1 lit. b' },
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
    ],
    applicabilityConditions: [],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Verarbeitungsverzeichnis', 'Zweckdokumentation'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'LOW',
    tags: ['purpose-limitation', 'documentation'],
  },
  {
    id: 'TOM-SE-05',
    code: 'TOM-SE-05',
    category: 'SEPARATION',
    type: 'TECHNICAL',
    name: { de: 'Netzwerksegmentierung', en: 'Network Segmentation' },
    description: {
      de: 'Aufteilung des Netzwerks in separate Sicherheitszonen mit kontrollierten Uebergaengen zur Begrenzung der Ausbreitung von Sicherheitsvorfaellen.',
      en: 'Division of the network into separate security zones with controlled transitions to limit the spread of security incidents.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.13.1.3' },
      { framework: 'BSI_IT_GRUNDSCHUTZ', reference: 'NET.1.1' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.hostingModel', operator: 'IN', value: ['ON_PREMISE', 'PRIVATE_CLOUD', 'HYBRID'], result: 'REQUIRED', priority: 20 },
      { field: 'riskProfile.protectionLevel', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'REQUIRED', priority: 25 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Netzwerkplan', 'Firewall-Regeln', 'Segmentierungskonzept'],
    reviewFrequency: 'SEMI_ANNUAL',
    priority: 'HIGH',
    complexity: 'HIGH',
    tags: ['separation', 'network', 'segmentation'],
  },
  {
    id: 'TOM-SE-06',
    code: 'TOM-SE-06',
    category: 'SEPARATION',
    type: 'TECHNICAL',
    name: { de: 'Mandantenisolierung in Cloud', en: 'Tenant Isolation in Cloud' },
    description: {
      de: 'Technische Sicherstellung der vollstaendigen Datentrennung zwischen verschiedenen Mandanten in Multi-Tenant-Cloud-Umgebungen.',
      en: 'Technical assurance of complete data separation between different tenants in multi-tenant cloud environments.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. b' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.13.1.3' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.multiTenancy', operator: 'EQUALS', value: 'MULTI_TENANT', result: 'REQUIRED', priority: 30 },
      { field: 'architectureProfile.hostingModel', operator: 'IN', value: ['PUBLIC_CLOUD', 'HYBRID'], result: 'RECOMMENDED', priority: 15 },
    ],
    defaultApplicability: 'OPTIONAL',
    evidenceRequirements: ['Mandantentrennungskonzept', 'Isolierungstests', 'Cloud-Security-Assessment'],
    reviewFrequency: 'SEMI_ANNUAL',
    priority: 'CRITICAL',
    complexity: 'HIGH',
    tags: ['separation', 'multi-tenant', 'cloud'],
  },
  // Deletion/secure data removal controls (SEPARATION category)
  {
    id: 'TOM-DL-01',
    code: 'TOM-DL-01',
    category: 'SEPARATION',
    type: 'TECHNICAL',
    name: { de: 'Sichere Datenloeschung', en: 'Secure Data Deletion' },
    description: {
      de: 'Implementierung sicherer Loeschverfahren, die personenbezogene Daten unwiederbringlich entfernen (z.B. nach DIN 66399).',
      en: 'Implementation of secure deletion procedures that irrecoverably remove personal data (e.g. per DIN 66399).',
    },
    mappings: [
      { framework: 'GDPR_ART17', reference: 'Art. 17' },
      { framework: 'GDPR_ART5', reference: 'Art. 5 Abs. 1 lit. e' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.8.10' },
      { framework: 'BSI_C5', reference: 'SY-09' },
    ],
    applicabilityConditions: [
      { field: 'dataProfile.dataVolume', operator: 'NOT_EQUALS', value: 'NONE', result: 'REQUIRED', priority: 30 },
    ],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Loeschkonzept / Loeschrichtlinie', 'Loeschprotokolle mit Zeitstempeln', 'DIN 66399 Konformitaetsnachweis'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['deletion', 'loeschung', 'data-lifecycle', 'din-66399'],
  },
  {
    id: 'TOM-DL-02',
    code: 'TOM-DL-02',
    category: 'SEPARATION',
    type: 'TECHNICAL',
    name: { de: 'Datentraegervernichtung', en: 'Media Destruction' },
    description: {
      de: 'Physische Vernichtung von Datentraegern (Festplatten, SSDs, USB-Sticks, Papier) gemaess DIN 66399 Schutzklassen.',
      en: 'Physical destruction of storage media (hard drives, SSDs, USB sticks, paper) per DIN 66399 protection classes.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.7.14' },
      { framework: 'BSI_C5', reference: 'AM-08' },
    ],
    applicabilityConditions: [
      { field: 'dataProfile.dataVolume', operator: 'NOT_EQUALS', value: 'NONE', result: 'RECOMMENDED', priority: 20 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Vernichtungsprotokoll mit Seriennummern', 'Zertifikat des Vernichtungsdienstleisters', 'DIN 66399 Sicherheitsstufe-Nachweis'],
    reviewFrequency: 'ANNUAL',
    priority: 'MEDIUM',
    complexity: 'LOW',
    tags: ['deletion', 'media-destruction', 'physical-security', 'din-66399'],
  },
  {
    id: 'TOM-DL-03',
    code: 'TOM-DL-03',
    category: 'SEPARATION',
    type: 'ORGANIZATIONAL',
    name: { de: 'Loeschprotokollierung', en: 'Deletion Logging' },
    description: {
      de: 'Systematische Protokollierung aller Loeschvorgaenge mit Zeitstempel, Verantwortlichem, Datenobjekt und Loeschmethode.',
      en: 'Systematic logging of all deletion operations with timestamp, responsible person, data object, and deletion method.',
    },
    mappings: [
      { framework: 'GDPR_ART5', reference: 'Art. 5 Abs. 2 (Rechenschaftspflicht)' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.8.10' },
    ],
    applicabilityConditions: [
      { field: 'dataProfile.dataVolume', operator: 'NOT_EQUALS', value: 'NONE', result: 'REQUIRED', priority: 25 },
    ],
    defaultApplicability: 'REQUIRED',
    evidenceRequirements: ['Loeschprotokoll-Template', 'Archivierte Loeschprotokolle (Stichprobe)', 'Automatisierungsnachweis (bei automatischen Loeschungen)'],
    reviewFrequency: 'SEMI_ANNUAL',
    priority: 'HIGH',
    complexity: 'LOW',
    tags: ['deletion', 'logging', 'accountability', 'documentation'],
  },
  {
    id: 'TOM-DL-04',
    code: 'TOM-DL-04',
    category: 'SEPARATION',
    type: 'TECHNICAL',
    name: { de: 'Backup-Bereinigung', en: 'Backup Sanitization' },
    description: {
      de: 'Sicherstellung, dass personenbezogene Daten auch in Backup-Systemen nach Ablauf der Loeschfrist entfernt werden.',
      en: 'Ensuring that personal data is also removed from backup systems after the retention period expires.',
    },
    mappings: [
      { framework: 'GDPR_ART17', reference: 'Art. 17 Abs. 2' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.8.13' },
    ],
    applicabilityConditions: [
      { field: 'techProfile.hasBackups', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 25 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Backup-Loeschkonzept', 'Backup-Rotationsplan', 'Nachweis der Backup-Bereinigung'],
    reviewFrequency: 'SEMI_ANNUAL',
    priority: 'MEDIUM',
    complexity: 'HIGH',
    tags: ['deletion', 'backup', 'data-lifecycle', 'retention'],
  },
  {
    id: 'TOM-DL-05',
    code: 'TOM-DL-05',
    category: 'SEPARATION',
    type: 'ORGANIZATIONAL',
    name: { de: 'Datenloesch-Audit', en: 'Data Deletion Audit' },
    description: {
      de: 'Regelmaessige Ueberpruefung der Wirksamkeit und Vollstaendigkeit von Datenloeschvorgaengen durch unabhaengige Stellen.',
      en: 'Regular review of the effectiveness and completeness of data deletion processes by independent parties.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 5 Abs. 1 lit. e' },
      { framework: 'GDPR_ART32', reference: 'Art. 17' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.8.3.2' },
    ],
    applicabilityConditions: [
      { field: 'dataProfile.hasSpecialCategories', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 25 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Audit-Berichte', 'Loeschprotokolle', 'Stichproben-Ergebnisse'],
    reviewFrequency: 'ANNUAL',
    priority: 'MEDIUM',
    complexity: 'MEDIUM',
    tags: ['separation', 'deletion', 'audit'],
  },

  // ENCRYPTION
  {
    id: 'TOM-ENC-01',
    code: 'TOM-ENC-01',
    category: 'ENCRYPTION',
    type: 'TECHNICAL',
    name: { de: 'Verschlüsselung ruhender Daten', en: 'Encryption at Rest' },
    description: {
      de: 'Verschlüsselung aller gespeicherten personenbezogenen Daten mit modernen Verschlüsselungsalgorithmen.',
      en: 'Encryption of all stored personal data using modern encryption algorithms.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. a' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.10.1.1' },
    ],
    applicabilityConditions: [
      { field: 'dataProfile.hasSpecialCategories', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 30 },
      { field: 'riskProfile.protectionLevel', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'REQUIRED', priority: 20 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Verschlüsselungskonzept', 'Konfigurationsdokumentation'],
    reviewFrequency: 'ANNUAL',
    priority: 'CRITICAL',
    complexity: 'MEDIUM',
    tags: ['encryption', 'at-rest'],
  },
  {
    id: 'TOM-ENC-02',
    code: 'TOM-ENC-02',
    category: 'ENCRYPTION',
    type: 'TECHNICAL',
    name: { de: 'Schlüsselmanagement', en: 'Key Management' },
    description: {
      de: 'Sicheres Verfahren zur Erzeugung, Speicherung, Rotation und Vernichtung kryptografischer Schlüssel.',
      en: 'Secure process for generation, storage, rotation and destruction of cryptographic keys.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. a' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.10.1.2' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.encryptionAtRest', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 30 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Schlüsselmanagement-Richtlinie', 'HSM/KMS-Dokumentation'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'HIGH',
    tags: ['encryption', 'key-management'],
  },
  {
    id: 'TOM-ENC-03',
    code: 'TOM-ENC-03',
    category: 'ENCRYPTION',
    type: 'TECHNICAL',
    name: { de: 'Datenbank-Verschlüsselung', en: 'Database Encryption' },
    description: {
      de: 'Verschlüsselung von Datenbanken auf Ebene der Datenbank oder einzelner Felder.',
      en: 'Encryption of databases at database level or individual field level.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. a' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.10.1.1' },
    ],
    applicabilityConditions: [
      { field: 'dataProfile.hasSpecialCategories', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 30 },
      { field: 'dataProfile.dataVolume', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'RECOMMENDED', priority: 15 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Datenbank-Verschlüsselungskonfiguration', 'Feldverschlüsselungsmatrix'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['encryption', 'database'],
  },
  {
    id: 'TOM-ENC-04',
    code: 'TOM-ENC-04',
    category: 'ENCRYPTION',
    type: 'TECHNICAL',
    name: { de: 'Zertifikatsmanagement (TLS/SSL)', en: 'Certificate Management (TLS/SSL)' },
    description: {
      de: 'Systematische Verwaltung, Ueberwachung und rechtzeitige Erneuerung aller TLS/SSL-Zertifikate zur Vermeidung von Sicherheitsluecken durch abgelaufene Zertifikate.',
      en: 'Systematic management, monitoring and timely renewal of all TLS/SSL certificates to prevent security gaps from expired certificates.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. a' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.10.1.2' },
      { framework: 'BSI_IT_GRUNDSCHUTZ', reference: 'CON.1' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.encryptionInTransit', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 25 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Zertifikatsinventar', 'Monitoring-Konfiguration', 'Erneuerungsprotokolle'],
    reviewFrequency: 'QUARTERLY',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['encryption', 'certificates', 'tls'],
  },
  {
    id: 'TOM-ENC-05',
    code: 'TOM-ENC-05',
    category: 'ENCRYPTION',
    type: 'ORGANIZATIONAL',
    name: { de: 'Schluesselmanagement-Policy', en: 'Key Management Policy' },
    description: {
      de: 'Dokumentierte Richtlinie fuer den gesamten Lebenszyklus kryptografischer Schluessel inkl. Erzeugung, Verteilung, Speicherung, Rotation und Vernichtung.',
      en: 'Documented policy for the full lifecycle of cryptographic keys including generation, distribution, storage, rotation and destruction.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. a' },
      { framework: 'ISO27001_ANNEX_A', reference: 'A.10.1.2' },
    ],
    applicabilityConditions: [
      { field: 'architectureProfile.encryptionAtRest', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 25 },
      { field: 'dataProfile.hasSpecialCategories', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 30 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Schluesselmanagement-Richtlinie', 'Schluesselrotationsplan'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'LOW',
    tags: ['encryption', 'key-management', 'policy'],
  },

]
