diff --git a/ai-compliance-sdk/data/control_mappings/cra_nist.jsonl b/ai-compliance-sdk/data/control_mappings/cra_nist.jsonl new file mode 100644 index 00000000..569a2436 --- /dev/null +++ b/ai-compliance-sdk/data/control_mappings/cra_nist.jsonl @@ -0,0 +1,8 @@ +// Control-Mapping: CRA Annex I -> NIST SP 800-53 Rev. 5. Eine Zeile = ein Mapping (Schema: ControlMapping). +// Reviewt 2026-06-25 (benjamin): 3 accepted, mapping_type=primary_implementation (kanonische Primaer-Control je Anforderung). +// Heimat der OWASP-Rejects (2)(e)/(2)(l)/(2)(i): dort war OWASP nicht der Zielstandard ("Mapping ueber NIST/BSI erforderlich"). +// related-Controls (SC-3(3), RA-5, AC-6, SI-16, ...) folgen separat als mapping_type=supports — hier nur der kanonische Einstieg. +// obligation_id bewusst LEER: vergibt die Obligation-Registry (Export via controls_for_obligation_mapping.json), dann adoptieren. +{"source_norm": "CRA Annex I Part I (2)(e) — Integritaet", "source_role": "operational_requirement", "target_framework": "NIST SP 800-53", "target_control": "SI-7", "mapping_type": "primary_implementation", "mapping_status": "accepted", "provenance": "human_curated", "rationale": "NIST SI-7 = Software, Firmware, and Information Integrity — kanonische Integritaetskontrolle (Signaturpruefung, Manipulationserkennung).", "reviewed_by": "benjamin", "review_date": "2026-06-25", "review_reason": "Primaere Implementierung der CRA-Integritaetsanforderung; OWASP war hier kein passender Treffer. Related (spaeter, supports): SA-10, CM-14.", "version": "2026-06-25"} +{"source_norm": "CRA Annex I Part I (2)(l) — Sichere Updates", "source_role": "operational_requirement", "target_framework": "NIST SP 800-53", "target_control": "SI-2", "mapping_type": "primary_implementation", "mapping_status": "accepted", "provenance": "human_curated", "rationale": "NIST SI-2 = Flaw Remediation — kanonische Update-/Patch-Kontrolle.", "reviewed_by": "benjamin", "review_date": "2026-06-25", "review_reason": "Primaere Implementierung der CRA-Update-Anforderung. Related (spaeter, supports): RA-5, CM-3, SA-11.", "version": "2026-06-25"} +{"source_norm": "CRA Annex I Part I (2)(i) — Angriffsflaeche minimieren", "source_role": "operational_requirement", "target_framework": "NIST SP 800-53", "target_control": "CM-7", "mapping_type": "primary_implementation", "mapping_status": "accepted", "provenance": "human_curated", "rationale": "NIST CM-7 = Least Functionality — Deaktivierung nicht benoetigter Ports/Dienste/Funktionen.", "reviewed_by": "benjamin", "review_date": "2026-06-25", "review_reason": "CM-7 als Primaer-Control fuer Angriffsflaeche (nicht SC-3(3)). Related (spaeter, supports): SC-3(3), AC-6, SI-16.", "version": "2026-06-25"} diff --git a/ai-compliance-sdk/data/evidence_requirements/nist_evidence.jsonl b/ai-compliance-sdk/data/evidence_requirements/nist_evidence.jsonl new file mode 100644 index 00000000..2db93458 --- /dev/null +++ b/ai-compliance-sdk/data/evidence_requirements/nist_evidence.jsonl @@ -0,0 +1,10 @@ +// Evidence-Requirements je NIST-SP-800-53-Control (Schema: EvidenceRequirement). Eine Zeile = eine geforderte Evidenz. +// WICHTIG: evidence_type ist FRAMEWORK-AGNOSTISCH (geteilter Katalog config_export/test_report/repo_scan/sbom/...) — +// dieselben Typen tragen CRA, NIST, ISO 27001, IEC 62443, BSI. (framework, control) ist nur der Verweis, nicht der Typ. +// Stand 2026-06-25, Basis: die 3 accepted CRA->NIST primary_implementation-Mappings (SI-7 Integritaet, SI-2 Updates, CM-7 Angriffsflaeche). +{"framework": "NIST SP 800-53", "control": "SI-7", "evidence_type": "config_export", "evidence_source": "github", "freshness_requirement": "per_release", "required": true, "rationale": "Secure-Boot-/Code-Signing-Konfiguration als Nachweis der Integritaetspruefung.", "version": "2026-06-25"} +{"framework": "NIST SP 800-53", "control": "SI-7", "evidence_type": "test_report", "evidence_source": "ci", "freshness_requirement": "per_release", "required": true, "rationale": "Signatur-/Integritaets-Verifikationstest (CI) belegt funktionierende Manipulationserkennung.", "version": "2026-06-25"} +{"framework": "NIST SP 800-53", "control": "SI-2", "evidence_type": "repo_scan", "evidence_source": "scanner", "freshness_requirement": "continuous", "required": true, "rationale": "Fortlaufender Dependency-/Vuln-Scan weist Behebung bekannter ausnutzbarer Schwachstellen nach.", "version": "2026-06-25"} +{"framework": "NIST SP 800-53", "control": "SI-2", "evidence_type": "config_export", "evidence_source": "github", "freshness_requirement": "per_release", "required": true, "rationale": "Konfiguration des sicheren Update-/Patch-Mechanismus als technischer Nachweis.", "version": "2026-06-25"} +{"framework": "NIST SP 800-53", "control": "CM-7", "evidence_type": "config_export", "evidence_source": "github", "freshness_requirement": "per_release", "required": true, "rationale": "Konfiguration deaktivierter Ports/Dienste/Funktionen als Nachweis minimierter Angriffsflaeche.", "version": "2026-06-25"} +{"framework": "NIST SP 800-53", "control": "CM-7", "evidence_type": "repo_scan", "evidence_source": "scanner", "freshness_requirement": "quarterly", "required": false, "rationale": "Angriffsflaechen-Scan (offene Ports/Dienste) — vertiefend, nicht Pflicht je Release.", "version": "2026-06-25"} diff --git a/ai-compliance-sdk/internal/ucca/control_mapping.go b/ai-compliance-sdk/internal/ucca/control_mapping.go index 5d148716..80dbe7b9 100644 --- a/ai-compliance-sdk/internal/ucca/control_mapping.go +++ b/ai-compliance-sdk/internal/ucca/control_mapping.go @@ -23,7 +23,7 @@ type ControlMapping struct { SourceRole string `json:"source_role"` // source_role of the norm (operational_requirement, ...) TargetFramework string `json:"target_framework"` // e.g. "OWASP ASVS" TargetControl string `json:"target_control"` // e.g. "V6.3.1" - MappingType string `json:"mapping_type"` // supports | partially_supports | implements | related | contradicts + MappingType string `json:"mapping_type"` // primary_implementation | implements | supports | partially_supports | related | contradicts MappingStatus string `json:"mapping_status"` // candidate | accepted | rejected | superseded Provenance string `json:"provenance"` // retriever_candidate | human_curated | rule_based ObligationID string `json:"obligation_id,omitempty"` // stable cross-session join key (Obligation Registry); empty until adopted, citation_unit is the interim bridge @@ -36,7 +36,7 @@ type ControlMapping struct { // Allowed enum values — the deterministic "rule" layer that keeps the curated store clean. var ( - mappingTypeValues = map[string]bool{"supports": true, "partially_supports": true, "implements": true, "related": true, "contradicts": true} + mappingTypeValues = map[string]bool{"primary_implementation": true, "implements": true, "supports": true, "partially_supports": true, "related": true, "contradicts": true} mappingStatusValues = map[string]bool{"candidate": true, "accepted": true, "rejected": true, "superseded": true} provenanceValues = map[string]bool{"retriever_candidate": true, "human_curated": true, "rule_based": true} )