Benjamin_Boenisch/breakpilot-compliance
1
1
Fork 0
Code Issues 24 Pull Requests Actions Packages Projects Releases Wiki Activity

Fill semantic control->obligation_id (4/7; V16 pending logging cut)

Browse Source 
V6.x->user_authentication_required, V11.2.1->credential_confidentiality_protection,
V11.7.1->auth_key_management; semantisch (NICHT CRA-Anker, die sind approximativ).
V16.x pending bis Logging-Cut. anchor_quality_note dokumentiert.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Benjamin Admin
2026-06-25 11:44:56 +02:00
parent 5e3ed4071b
commit 3259984d1c
1 changed files with 38 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
obligations/controls_for_obligation_mapping.json
+38 -42
View File
@@ -2,70 +2,66 @@
"schema_version": "controls_for_obligation_mapping_v1", "schema_version": "controls_for_obligation_mapping_v1",
"purpose": "Accepted CRA->OWASP controls (Compliance Execution Graph) for the Obligation Registry to propose the SEMANTIC control->obligation_id, replacing the coarse citation_unit interim join. Fill proposed_obligation_id per control, then we adopt it into control_mapping.obligation_id.", "purpose": "Accepted CRA->OWASP controls (Compliance Execution Graph) for the Obligation Registry to propose the SEMANTIC control->obligation_id, replacing the coarse citation_unit interim join. Fill proposed_obligation_id per control, then we adopt it into control_mapping.obligation_id.",
"source": "ai-compliance-sdk control_mappings, mapping_status=accepted, reviewed_by=benjamin 2026-06-25", "source": "ai-compliance-sdk control_mappings, mapping_status=accepted, reviewed_by=benjamin 2026-06-25",
"filled_by": "obligation-registry-session 2026-06-25",
"join_principle": "SEMANTISCH via obligation_id, NICHT via citation_unit/legal_basis-Anker. Die CRA-Anker sind im Registry teils approximativ (siehe anchor_quality_note) — daher ist obligation_id der stabile Primaerschluessel, nicht der Anker.",
"anchor_quality_note": "Registry-legal_basis-Anker sind teils CRA-Part-I-fehlzugeordnet (Opus-Synthese): user_authentication_required steht auf (2)(d) statt (2)(c); Crypto-Obligations auf (2)(e) statt (2)(d). CRA Annex I Part I: (2)(c)=Zugriffsschutz, (2)(d)=Vertraulichkeit, (2)(e)=Integritaet. Korrektur kommt mit dem zitierfaehigen Re-Ingest (span-genau). Deshalb: NICHT auf Anker joinen.",
"count": 7, "count": 7,
"controls": [ "controls": [
{ {
"framework": "OWASP ASVS", "framework": "OWASP ASVS", "control": "V6.3.1",
"control": "V6.3.1",
"source_norm": "CRA Annex I Part I (2)(c) — Schutz vor unbefugtem Zugriff", "source_norm": "CRA Annex I Part I (2)(c) — Schutz vor unbefugtem Zugriff",
"citation_unit": "Annex I (2)(c)", "citation_unit": "Annex I (2)(c)", "family": "auth", "mapping_type": "supports",
"family": "auth", "proposed_obligation_id": "user_authentication_required",
"mapping_type": "supports", "mapping_method": "semantic",
"proposed_obligation_id": "" "mapping_note": "Zugriffsschutz/Authentisierung-vor-Zugriff = Nutzer-Auth (NICHT firmware, trotz strukturellem (2)(c)-Join)"
}, },
{ {
"framework": "OWASP ASVS", "framework": "OWASP ASVS", "control": "V6.1.1",
"control": "V6.1.1",
"source_norm": "CRA Annex I Part I (2)(c) — Schutz vor unbefugtem Zugriff", "source_norm": "CRA Annex I Part I (2)(c) — Schutz vor unbefugtem Zugriff",
"citation_unit": "Annex I (2)(c)", "citation_unit": "Annex I (2)(c)", "family": "auth", "mapping_type": "supports",
"family": "auth", "proposed_obligation_id": "user_authentication_required",
"mapping_type": "supports", "mapping_method": "semantic",
"proposed_obligation_id": "" "mapping_note": "wie V6.3.1"
}, },
{ {
"framework": "OWASP ASVS", "framework": "OWASP ASVS", "control": "V11.2.1",
"control": "V11.2.1",
"source_norm": "CRA Annex I Part I (2)(d) — Vertraulichkeit / Verschluesselung", "source_norm": "CRA Annex I Part I (2)(d) — Vertraulichkeit / Verschluesselung",
"citation_unit": "Annex I (2)(d)", "citation_unit": "Annex I (2)(d)", "family": "crypto", "mapping_type": "supports",
"family": "crypto", "proposed_obligation_id": "credential_confidentiality_protection",
"mapping_type": "supports", "mapping_method": "semantic",
"proposed_obligation_id": "" "mapping_note": "Vertraulichkeit von Auth-Daten. ALT: encrypted_auth_channel, falls V11.2.1 transit-/kanal-spezifisch ist — bitte aus eurem Control-Text bestaetigen."
}, },
{ {
"framework": "OWASP ASVS", "framework": "OWASP ASVS", "control": "V11.7.1",
"control": "V11.7.1",
"source_norm": "CRA Annex I Part I (2)(d) — Vertraulichkeit / Verschluesselung", "source_norm": "CRA Annex I Part I (2)(d) — Vertraulichkeit / Verschluesselung",
"citation_unit": "Annex I (2)(d)", "citation_unit": "Annex I (2)(d)", "family": "crypto", "mapping_type": "supports",
"family": "crypto", "proposed_obligation_id": "auth_key_management",
"mapping_type": "supports", "mapping_method": "semantic",
"proposed_obligation_id": "" "mapping_note": "Key Management = Schluessel erzeugen/speichern/HSM"
}, },
{ {
"framework": "OWASP ASVS", "framework": "OWASP ASVS", "control": "V16.3.3",
"control": "V16.3.3",
"source_norm": "CRA Annex I Part I (2)(k) — Sicherheitsrelevante Ereignisse / Logging", "source_norm": "CRA Annex I Part I (2)(k) — Sicherheitsrelevante Ereignisse / Logging",
"citation_unit": "Annex I (2)(k)", "citation_unit": "Annex I (2)(k)", "family": "logging", "mapping_type": "supports",
"family": "logging", "proposed_obligation_id": "",
"mapping_type": "supports", "mapping_method": "pending_logging_cut",
"proposed_obligation_id": "" "mapping_note": "wird auf logging_* gemappt, sobald der Logging-Cut synthetisiert ist"
}, },
{ {
"framework": "OWASP ASVS", "framework": "OWASP ASVS", "control": "V16.3.4",
"control": "V16.3.4",
"source_norm": "CRA Annex I Part I (2)(k) — Sicherheitsrelevante Ereignisse / Logging", "source_norm": "CRA Annex I Part I (2)(k) — Sicherheitsrelevante Ereignisse / Logging",
"citation_unit": "Annex I (2)(k)", "citation_unit": "Annex I (2)(k)", "family": "logging", "mapping_type": "supports",
"family": "logging", "proposed_obligation_id": "",
"mapping_type": "supports", "mapping_method": "pending_logging_cut",
"proposed_obligation_id": "" "mapping_note": "wird auf logging_* gemappt, sobald der Logging-Cut synthetisiert ist"
}, },
{ {
"framework": "OWASP ASVS", "framework": "OWASP ASVS", "control": "V16.1.1",
"control": "V16.1.1",
"source_norm": "CRA Annex I Part I (2)(k) — Sicherheitsrelevante Ereignisse / Logging", "source_norm": "CRA Annex I Part I (2)(k) — Sicherheitsrelevante Ereignisse / Logging",
"citation_unit": "Annex I (2)(k)", "citation_unit": "Annex I (2)(k)", "family": "logging", "mapping_type": "supports",
"family": "logging", "proposed_obligation_id": "",
"mapping_type": "supports", "mapping_method": "pending_logging_cut",
"proposed_obligation_id": "" "mapping_note": "wird auf logging_* gemappt, sobald der Logging-Cut synthetisiert ist"
} }
] ]
} }