From e46e74ddbbde14a7971049de66eabd8ad743de41 Mon Sep 17 00:00:00 2001 From: Benjamin Admin Date: Thu, 25 Jun 2026 18:57:17 +0200 Subject: [PATCH] feat(bridge): export 3 CRA->NIST controls (primary_implementation) for obligation_id Adds SI-7/SI-2/CM-7 to controls_for_obligation_mapping.json (7 OWASP -> 10), mapping_type=primary_implementation (the single canonical control per obligation). proposed_obligation_id left empty for the Registry to assign. Notes aligned to the updates family (join_keys 93): SI-2 -> provide_security_updates (strong), SI-7 -> signed_update_integrity (partial; SI-7 broader), CM-7 -> remote_access_attack_surface_min (partial; CM-7 broader). Origin-only (data/tooling; backend does not load obligations/* at runtime) -> no Orca. Co-Authored-By: Claude Opus 4.7 --- .../controls_for_obligation_mapping.json | 33 ++++++++++++++++--- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/obligations/controls_for_obligation_mapping.json b/obligations/controls_for_obligation_mapping.json index 28449ae9..f2e03563 100644 --- a/obligations/controls_for_obligation_mapping.json +++ b/obligations/controls_for_obligation_mapping.json @@ -1,11 +1,12 @@ { "schema_version": "controls_for_obligation_mapping_v1", - "purpose": "Accepted CRA->OWASP controls (Compliance Execution Graph) for the Obligation Registry to propose the SEMANTIC control->obligation_id, replacing the coarse citation_unit interim join. Fill proposed_obligation_id per control, then we adopt it into control_mapping.obligation_id.", - "source": "ai-compliance-sdk control_mappings, mapping_status=accepted, reviewed_by=benjamin 2026-06-25", - "filled_by": "obligation-registry-session 2026-06-25 (alle 7/7: 4 auth/crypto + 3 logging via cra_logging.json)", + "purpose": "Accepted CRA->Framework controls (Compliance Execution Graph) for the Obligation Registry to propose the SEMANTIC control->obligation_id, replacing the coarse citation_unit interim join. Fill proposed_obligation_id per control, then we adopt it into control_mapping.obligation_id.", + "source": "ai-compliance-sdk control_mappings, mapping_status=accepted, reviewed_by=benjamin 2026-06-25. OWASP ASVS (7, gefuellt) + NIST SP 800-53 (3, pending).", + "filled_by": "obligation-registry-session 2026-06-25 (OWASP 7/7: 4 auth/crypto + 3 logging). NIST 3 NEU + pending: SI-7/SI-2/CM-7. Notes auf updates-Familie (join_keys 93) ausgerichtet: SI-2->provide_security_updates (stark), SI-7->signed_update_integrity (partiell, SI-7 breiter), CM-7->remote_access_attack_surface_min (partiell, CM-7 breiter).", "join_principle": "SEMANTISCH via obligation_id, NICHT via citation_unit/legal_basis-Anker. Die CRA-Anker sind im Registry teils approximativ (siehe anchor_quality_note) — daher ist obligation_id der stabile Primaerschluessel, nicht der Anker.", "anchor_quality_note": "Registry-legal_basis-Anker sind teils CRA-Part-I-fehlzugeordnet (Opus-Synthese): user_authentication_required steht auf (2)(d) statt (2)(c); Crypto-Obligations auf (2)(e) statt (2)(d). CRA Annex I Part I: (2)(c)=Zugriffsschutz, (2)(d)=Vertraulichkeit, (2)(e)=Integritaet. Korrektur kommt mit dem zitierfaehigen Re-Ingest (span-genau). Deshalb: NICHT auf Anker joinen. ABER: der Logging-Cut (V16.*) ist korrekt auf (2)(k) verankert (echte Logging-Subsektion, kein Fehl-Anker).", - "count": 7, + "mapping_type_note": "NEU: mapping_type=primary_implementation = die kanonische Primaer-Control einer Anforderung (genau eine), staerker als implements/supports. related-Controls (SC-3(3), RA-5, AC-6, SI-16, SA-10, ...) folgen separat als supports. Eine Obligation kann mehrere Controls haben, aber genau einen primary_implementation-Einstieg.", + "count": 10, "controls": [ { "framework": "OWASP ASVS", "control": "V6.3.1", @@ -62,6 +63,30 @@ "proposed_obligation_id": "event_logging_security_events", "mapping_method": "semantic", "mapping_note": "V16.1 = allgemeine Logging-Anforderung -> Umbrella-LM event_logging_security_events. Hohe Konfidenz." + }, + { + "framework": "NIST SP 800-53", "control": "SI-7", + "source_norm": "CRA Annex I Part I (2)(e) — Integritaet", + "citation_unit": "Annex I (2)(e)", "family": "integrity", "mapping_type": "primary_implementation", + "proposed_obligation_id": "", + "mapping_method": "semantic", + "mapping_note": "NIST SI-7 = Software/Firmware/Information Integrity (Signaturpruefung, Manipulationserkennung, Secure Boot, Runtime-Integritaet). Naechster vorhandener Treffer (93-Stand): signed_update_integrity (updates-Familie, Annex I (1)(3)(f)) — deckt aber NUR Update-Signatur. SI-7 ist BREITER (gesamte Produkt-Integritaet). Falls keine generische Integritaets-Obligation existiert: neue noetig (Vorschlag software_integrity_protection); sonst SI-7 primary_implementation fuer signed_update_integrity (update-scoped) + supports fuers Breitere. NICHT log_integrity_immutability (Audit-Log-Schutz, andere Ebene)." + }, + { + "framework": "NIST SP 800-53", "control": "SI-2", + "source_norm": "CRA Annex I Part I (2)(l) — Sichere Updates", + "citation_unit": "Annex I (2)(l)", "family": "update", "mapping_type": "primary_implementation", + "proposed_obligation_id": "", + "mapping_method": "semantic", + "mapping_note": "NIST SI-2 = Flaw Remediation. STARKER Treffer in eurer NEUEN updates-Familie (93-Stand): provide_security_updates (LEGAL_MINIMUM, Annex I (2)(c) + Art. 13) = DAS sichere-Update-LM. -> SI-2 primary_implementation = provide_security_updates. Verwandt (supports): vuln_remediation_patching (Part II Remediations-PROZESS), support_period_maintenance, update_testing_validation, update_rollback. Mein source_norm-Anker (2)(l) ist approximativ -> bitte (2)(c)/Art.13 via provide_security_updates nutzen." + }, + { + "framework": "NIST SP 800-53", "control": "CM-7", + "source_norm": "CRA Annex I Part I (2)(i) — Angriffsflaeche minimieren", + "citation_unit": "Annex I (2)(i)", "family": "attack_surface", "mapping_type": "primary_implementation", + "proposed_obligation_id": "", + "mapping_method": "semantic", + "mapping_note": "NIST CM-7 = Least Functionality (deaktivierte Ports/Dienste/Funktionen, GESAMTE Angriffsflaeche). Naechster vorhandener Treffer (93-Stand): remote_access_attack_surface_min (remote_access-Familie) — deckt aber NUR Remote-Access-Flaeche. CM-7 ist BREITER. Vermutlich generische Obligation noetig (Vorschlag attack_surface_minimization); sonst CM-7 supports fuer remote_access_attack_surface_min. related (supports): SC-3(3)/AC-6/SI-16." } ] }