Benjamin_Boenisch/breakpilot-compliance
1
1
Fork 0
Code Issues 24 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ucca): first CRA Annex I -> OWASP retriever candidates (step 3)

Browse Source 
18 retriever_candidate mappings generated via the sdk-dev control-intent
retriever. All marked retriever_candidate (NOT curated truth) — the review
step turns the good ones into human_curated.

Empirical validation of the A-decision: the retriever proposes, but produces
wrong candidates (e.g. encryption -> V14 Config instead of V11 Crypto;
V14.2.4 over-appears) that only human review catches. Review notes inline.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Benjamin Admin
2026-06-25 09:36:53 +02:00
parent d987e4fde6
commit 2f3c98fbe0
1 changed files with 21 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ai-compliance-sdk/data/control_mappings/cra_owasp.jsonl
+21 -4
View File
@@ -1,5 +1,22 @@
// Control-Mapping: CRA Annex I -> OWASP ASVS 5.0. Eine Zeile = ein Mapping (Schema: ControlMapping). // Control-Mapping: CRA Annex I -> OWASP ASVS 5.0. Eine Zeile = ein Mapping (Schema: ControlMapping).
// provenance=retriever_candidate sind Vorschlaege des Control-Intent-Retrievers, NOCH NICHT kuratiert. // provenance=retriever_candidate: Vorschlaege des Control-Intent-Retriever (sdk-dev), NOCH NICHT kuratiert.
// Erst nach Human/Rule-Review wird provenance=human_curated/rule_based gesetzt (= Audit-Wahrheit). // Erst nach Human/Rule-Review wird provenance=human_curated/rule_based gesetzt (= Audit-Wahrheit, die der Advisor nutzt).
{"source_norm":"CRA Annex I Part I (2)(d) — Schutz der Vertraulichkeit / Verschluesselung","source_role":"operational_requirement","target_framework":"OWASP ASVS","target_control":"V11.1.1","mapping_type":"supports","confidence":"medium","provenance":"retriever_candidate","rationale":"CRA-Vertraulichkeits-/Verschluesselungsanforderung deckt sich mit ASVS Cryptographic Inventory and Documentation (V11.1.1). Retriever-Kandidat, Review noetig.","version":"2026-06-25"} // Erzeugt 2026-06-25 via gen_cra_owasp.py. REVIEW-Hinweise: (2)(d) Verschluesselung -> V14 (Config) ist falsch, gehoert zu V11 (Crypto); V14.2.4 ueber-erscheint.
{"source_norm":"CRA Annex I Part II — Vulnerability Handling","source_role":"operational_requirement","target_framework":"OWASP ASVS","target_control":"V6.2.4","mapping_type":"related","confidence":"low","provenance":"retriever_candidate","rationale":"User-Beispielzeile (Schema-Illustration). Part II ist Prozess-Pflicht (Schwachstellenbehandlung), V6.2.4 ist Passwort-Control — semantisch schwacher Kandidat, klarer Review-Fall.","version":"2026-06-25"} {"source_norm": "CRA Annex I Part I (2)(c) — Schutz vor unbefugtem Zugriff", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V6.3.1", "mapping_type": "supports", "confidence": "medium", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.197) fuer 'Authentifizierung und Zugriffskontrolle, Schutz vor unbefugtem Zugriff'. Retriever-Vorschlag, Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(c) — Schutz vor unbefugtem Zugriff", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V6.1.1", "mapping_type": "supports", "confidence": "medium", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.194) fuer 'Authentifizierung und Zugriffskontrolle, Schutz vor unbefugtem Zugriff'. Retriever-Vorschlag, Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(c) — Schutz vor unbefugtem Zugriff", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V14.2.4", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.190) fuer 'Authentifizierung und Zugriffskontrolle, Schutz vor unbefugtem Zugriff'. Schwacher Kandidat (V14=Config), Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(d) — Vertraulichkeit / Verschluesselung", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V14.2.4", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Retriever-Top (score 1.206), aber V14=Config statt V11=Crypto — wahrscheinlich FALSCH, Review-Korrektur auf V11.x.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(d) — Vertraulichkeit / Verschluesselung", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V14.3.2", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.146). Review noetig (Crypto gehoert zu V11).", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(d) — Vertraulichkeit / Verschluesselung", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V14.2.3", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.145). Review noetig (Crypto gehoert zu V11).", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(e) — Integritaet", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V14.2.4", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.202), V14.2.4 ueber-erscheint — Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(e) — Integritaet", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V1.2.4", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.166). Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(e) — Integritaet", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V6.1.1", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.159). Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(k) — Sicherheitsrelevante Ereignisse / Logging", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V16.3.3", "mapping_type": "supports", "confidence": "medium", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.223) fuer Logging. Plausibel (V16=Logging), Review zur Bestaetigung.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(k) — Sicherheitsrelevante Ereignisse / Logging", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V16.3.4", "mapping_type": "supports", "confidence": "medium", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.196) fuer Logging. Plausibel (V16=Logging), Review zur Bestaetigung.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(k) — Sicherheitsrelevante Ereignisse / Logging", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V16.1.1", "mapping_type": "supports", "confidence": "medium", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.186) fuer Logging. Plausibel (V16=Logging), Review zur Bestaetigung.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(l) — Sichere Updates", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V14.2.4", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Schwacher Kandidat (score 1.141) — ASVS deckt 'sichere Updates' kaum ab, Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(l) — Sichere Updates", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V2.4.1", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Schwacher Kandidat (score 1.138). Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(l) — Sichere Updates", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V6.1.1", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Schwacher Kandidat (score 1.129). Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(i) — Angriffsflaeche minimieren", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V6.1.1", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Schwacher Kandidat (score 1.162). Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(i) — Angriffsflaeche minimieren", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V15.3.3", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Schwacher Kandidat (score 1.136). Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(i) — Angriffsflaeche minimieren", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V8.2.4", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Schwacher Kandidat (score 1.136). Review noetig.", "version": "2026-06-25"}