Benjamin_Boenisch/breakpilot-compliance
1
1
Fork 0
Code Issues 24 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
2f3c98fbe055b64c64c916c3a3bd33db30dd68fa
breakpilot-compliance/ai-compliance-sdk/data/control_mappings/cra_owasp.jsonl
T
Benjamin Admin 2f3c98fbe0 feat(ucca): first CRA Annex I -> OWASP retriever candidates (step 3) 
18 retriever_candidate mappings generated via the sdk-dev control-intent
retriever. All marked retriever_candidate (NOT curated truth) — the review
step turns the good ones into human_curated.

Empirical validation of the A-decision: the retriever proposes, but produces
wrong candidates (e.g. encryption -> V14 Config instead of V11 Crypto;
V14.2.4 over-appears) that only human review catches. Review notes inline.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-06-25 09:36:53 +02:00

23 lines
7.4 KiB
JSON
Raw Blame History

// Control-Mapping: CRA Annex I -> OWASP ASVS 5.0. Eine Zeile = ein Mapping (Schema: ControlMapping).
// provenance=retriever_candidate: Vorschlaege des Control-Intent-Retriever (sdk-dev), NOCH NICHT kuratiert.
// Erst nach Human/Rule-Review wird provenance=human_curated/rule_based gesetzt (= Audit-Wahrheit, die der Advisor nutzt).
// Erzeugt 2026-06-25 via gen_cra_owasp.py. REVIEW-Hinweise: (2)(d) Verschluesselung -> V14 (Config) ist falsch, gehoert zu V11 (Crypto); V14.2.4 ueber-erscheint.
{"source_norm": "CRA Annex I Part I (2)(c) — Schutz vor unbefugtem Zugriff", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V6.3.1", "mapping_type": "supports", "confidence": "medium", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.197) fuer 'Authentifizierung und Zugriffskontrolle, Schutz vor unbefugtem Zugriff'. Retriever-Vorschlag, Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(c) — Schutz vor unbefugtem Zugriff", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V6.1.1", "mapping_type": "supports", "confidence": "medium", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.194) fuer 'Authentifizierung und Zugriffskontrolle, Schutz vor unbefugtem Zugriff'. Retriever-Vorschlag, Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(c) — Schutz vor unbefugtem Zugriff", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V14.2.4", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.190) fuer 'Authentifizierung und Zugriffskontrolle, Schutz vor unbefugtem Zugriff'. Schwacher Kandidat (V14=Config), Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(d) — Vertraulichkeit / Verschluesselung", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V14.2.4", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Retriever-Top (score 1.206), aber V14=Config statt V11=Crypto — wahrscheinlich FALSCH, Review-Korrektur auf V11.x.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(d) — Vertraulichkeit / Verschluesselung", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V14.3.2", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.146). Review noetig (Crypto gehoert zu V11).", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(d) — Vertraulichkeit / Verschluesselung", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V14.2.3", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.145). Review noetig (Crypto gehoert zu V11).", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(e) — Integritaet", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V14.2.4", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.202), V14.2.4 ueber-erscheint — Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(e) — Integritaet", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V1.2.4", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.166). Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(e) — Integritaet", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V6.1.1", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.159). Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(k) — Sicherheitsrelevante Ereignisse / Logging", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V16.3.3", "mapping_type": "supports", "confidence": "medium", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.223) fuer Logging. Plausibel (V16=Logging), Review zur Bestaetigung.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(k) — Sicherheitsrelevante Ereignisse / Logging", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V16.3.4", "mapping_type": "supports", "confidence": "medium", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.196) fuer Logging. Plausibel (V16=Logging), Review zur Bestaetigung.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(k) — Sicherheitsrelevante Ereignisse / Logging", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V16.1.1", "mapping_type": "supports", "confidence": "medium", "provenance": "retriever_candidate", "rationale": "Top-OWASP-Kandidat (score 1.186) fuer Logging. Plausibel (V16=Logging), Review zur Bestaetigung.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(l) — Sichere Updates", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V14.2.4", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Schwacher Kandidat (score 1.141) — ASVS deckt 'sichere Updates' kaum ab, Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(l) — Sichere Updates", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V2.4.1", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Schwacher Kandidat (score 1.138). Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(l) — Sichere Updates", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V6.1.1", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Schwacher Kandidat (score 1.129). Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(i) — Angriffsflaeche minimieren", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V6.1.1", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Schwacher Kandidat (score 1.162). Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(i) — Angriffsflaeche minimieren", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V15.3.3", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Schwacher Kandidat (score 1.136). Review noetig.", "version": "2026-06-25"}
{"source_norm": "CRA Annex I Part I (2)(i) — Angriffsflaeche minimieren", "source_role": "operational_requirement", "target_framework": "OWASP ASVS", "target_control": "V8.2.4", "mapping_type": "related", "confidence": "low", "provenance": "retriever_candidate", "rationale": "Schwacher Kandidat (score 1.136). Review noetig.", "version": "2026-06-25"}
Reference in New Issue View Git Blame Copy Permalink