3c4f7d900d
Split the monolithic file into three content modules plus a barrel re-export: - compliance-scope-profiling-blocks.ts (489 LOC): blocks 1-7, hidden questions, autofill IDs - compliance-scope-profiling-vvt-blocks.ts (274 LOC): blocks 8-9, SCOPE_QUESTION_BLOCKS aggregate - compliance-scope-profiling-helpers.ts (359 LOC): all prefill/export/progress functions - compliance-scope-profiling.ts (41 LOC): barrel re-export preserving existing import paths All files under the 500 LOC hard cap. No consumer changes needed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
490 lines
16 KiB
TypeScript
490 lines
16 KiB
TypeScript
import type {
|
||
ScopeQuestionBlock,
|
||
ScopeProfilingQuestion,
|
||
} from './compliance-scope-types'
|
||
|
||
/**
|
||
* IDs of questions that are auto-filled from company profile.
|
||
* These are no longer shown as interactive questions but still contribute to scoring.
|
||
*/
|
||
export const PROFILE_AUTOFILL_QUESTION_IDS = [
|
||
'org_employee_count',
|
||
'org_annual_revenue',
|
||
'org_industry',
|
||
'org_business_model',
|
||
'org_has_dsb',
|
||
'org_cert_target',
|
||
'data_volume',
|
||
'prod_type',
|
||
'prod_webshop',
|
||
] as const
|
||
|
||
/**
|
||
* Block 1: Organisation & Reife
|
||
*/
|
||
export const BLOCK_1_ORGANISATION: ScopeQuestionBlock = {
|
||
id: 'organisation',
|
||
title: 'Kunden & Nutzer',
|
||
description: 'Informationen zu Ihren Kunden und Nutzern',
|
||
order: 1,
|
||
questions: [
|
||
{
|
||
id: 'org_customer_count',
|
||
type: 'single',
|
||
question: 'Wie viele Kunden/Nutzer betreuen Sie?',
|
||
helpText: 'Schätzen Sie die Anzahl aktiver Kunden oder Nutzer',
|
||
required: true,
|
||
options: [
|
||
{ value: '<100', label: 'Weniger als 100' },
|
||
{ value: '100-1000', label: '100 bis 1.000' },
|
||
{ value: '1000-10000', label: '1.000 bis 10.000' },
|
||
{ value: '10000-100000', label: '10.000 bis 100.000' },
|
||
{ value: '100000+', label: 'Mehr als 100.000' },
|
||
],
|
||
scoreWeights: { risk: 6, complexity: 7, assurance: 6 },
|
||
},
|
||
],
|
||
}
|
||
|
||
/**
|
||
* Block 2: Daten & Betroffene
|
||
*/
|
||
export const BLOCK_2_DATA: ScopeQuestionBlock = {
|
||
id: 'data',
|
||
title: 'Datenverarbeitung',
|
||
description: 'Art und Umfang der verarbeiteten personenbezogenen Daten',
|
||
order: 2,
|
||
questions: [
|
||
{
|
||
id: 'data_minors',
|
||
type: 'boolean',
|
||
question: 'Verarbeiten Sie Daten von Minderjährigen?',
|
||
helpText: 'Besondere Schutzpflichten für unter 16-Jährige (bzw. 13-Jährige bei Online-Diensten)',
|
||
required: true,
|
||
scoreWeights: { risk: 10, complexity: 5, assurance: 7 },
|
||
mapsToVVTQuestion: 'data_minors',
|
||
},
|
||
{
|
||
id: 'data_art9',
|
||
type: 'multi',
|
||
question: 'Verarbeiten Sie besondere Kategorien personenbezogener Daten (Art. 9 DSGVO)?',
|
||
helpText: 'Diese Daten unterliegen erhöhten Schutzanforderungen',
|
||
required: true,
|
||
options: [
|
||
{ value: 'gesundheit', label: 'Gesundheitsdaten' },
|
||
{ value: 'biometrie', label: 'Biometrische Daten (z.B. Fingerabdruck, Gesichtserkennung)' },
|
||
{ value: 'genetik', label: 'Genetische Daten' },
|
||
{ value: 'politisch', label: 'Politische Meinungen' },
|
||
{ value: 'religion', label: 'Religiöse/weltanschauliche Überzeugungen' },
|
||
{ value: 'gewerkschaft', label: 'Gewerkschaftszugehörigkeit' },
|
||
{ value: 'sexualleben', label: 'Sexualleben/sexuelle Orientierung' },
|
||
{ value: 'strafrechtlich', label: 'Strafrechtliche Verurteilungen/Straftaten' },
|
||
{ value: 'ethnisch', label: 'Ethnische Herkunft' },
|
||
],
|
||
scoreWeights: { risk: 10, complexity: 8, assurance: 9 },
|
||
mapsToVVTQuestion: 'data_health',
|
||
},
|
||
{
|
||
id: 'data_hr',
|
||
type: 'boolean',
|
||
question: 'Verarbeiten Sie Personaldaten (HR)?',
|
||
helpText: 'Bewerberdaten, Gehälter, Leistungsbeurteilungen etc.',
|
||
required: true,
|
||
scoreWeights: { risk: 6, complexity: 4, assurance: 5 },
|
||
mapsToVVTQuestion: 'dept_hr',
|
||
mapsToLFQuestion: 'data-hr',
|
||
},
|
||
{
|
||
id: 'data_communication',
|
||
type: 'boolean',
|
||
question: 'Verarbeiten Sie Kommunikationsdaten (E-Mail, Chat, Telefonie)?',
|
||
helpText: 'Inhalte oder Metadaten von Kommunikationsvorgängen',
|
||
required: true,
|
||
scoreWeights: { risk: 7, complexity: 5, assurance: 6 },
|
||
},
|
||
{
|
||
id: 'data_financial',
|
||
type: 'boolean',
|
||
question: 'Verarbeiten Sie Finanzdaten (Konten, Zahlungen)?',
|
||
helpText: 'Bankdaten, Kreditkartendaten, Buchhaltungsdaten',
|
||
required: true,
|
||
scoreWeights: { risk: 8, complexity: 6, assurance: 7 },
|
||
mapsToVVTQuestion: 'dept_finance',
|
||
mapsToLFQuestion: 'data-buchhaltung',
|
||
},
|
||
],
|
||
}
|
||
|
||
/**
|
||
* Block 3: Verarbeitung & Zweck
|
||
*/
|
||
export const BLOCK_3_PROCESSING: ScopeQuestionBlock = {
|
||
id: 'processing',
|
||
title: 'Verarbeitung & Zweck',
|
||
description: 'Wie und wofür werden personenbezogene Daten verarbeitet?',
|
||
order: 3,
|
||
questions: [
|
||
{
|
||
id: 'proc_tracking',
|
||
type: 'boolean',
|
||
question: 'Setzen Sie Tracking oder Profiling ein?',
|
||
helpText: 'Web-Analytics, Werbe-Tracking, Nutzungsprofile etc.',
|
||
required: true,
|
||
scoreWeights: { risk: 7, complexity: 6, assurance: 6 },
|
||
},
|
||
{
|
||
id: 'proc_adm_scoring',
|
||
type: 'boolean',
|
||
question: 'Treffen Sie automatisierte Entscheidungen (Art. 22 DSGVO)?',
|
||
helpText: 'Scoring, Bonitätsprüfung, automatische Ablehnung ohne menschliche Beteiligung',
|
||
required: true,
|
||
scoreWeights: { risk: 9, complexity: 8, assurance: 8 },
|
||
},
|
||
{
|
||
id: 'proc_ai_usage',
|
||
type: 'multi',
|
||
question: 'Setzen Sie KI-Systeme ein?',
|
||
helpText: 'KI-Einsatz kann zusätzliche Anforderungen (EU AI Act) auslösen',
|
||
required: true,
|
||
options: [
|
||
{ value: 'keine', label: 'Keine KI im Einsatz' },
|
||
{ value: 'chatbot', label: 'Chatbots/Virtuelle Assistenten' },
|
||
{ value: 'scoring', label: 'Scoring/Risikobewertung' },
|
||
{ value: 'profiling', label: 'Profiling/Verhaltensvorhersage' },
|
||
{ value: 'generativ', label: 'Generative KI (Text, Bild, Code)' },
|
||
{ value: 'autonom', label: 'Autonome Systeme/Entscheidungen' },
|
||
],
|
||
scoreWeights: { risk: 8, complexity: 9, assurance: 7 },
|
||
},
|
||
{
|
||
id: 'proc_data_combination',
|
||
type: 'boolean',
|
||
question: 'Führen Sie Daten aus verschiedenen Quellen zusammen?',
|
||
helpText: 'Data Matching, Anreicherung aus externen Quellen',
|
||
required: true,
|
||
scoreWeights: { risk: 7, complexity: 7, assurance: 6 },
|
||
},
|
||
{
|
||
id: 'proc_employee_monitoring',
|
||
type: 'boolean',
|
||
question: 'Überwachen Sie Mitarbeiter (Zeiterfassung, Standort, IT-Nutzung)?',
|
||
helpText: 'Beschäftigtendatenschutz nach § 26 BDSG',
|
||
required: true,
|
||
scoreWeights: { risk: 8, complexity: 6, assurance: 7 },
|
||
},
|
||
{
|
||
id: 'proc_video_surveillance',
|
||
type: 'boolean',
|
||
question: 'Setzen Sie Videoüberwachung ein?',
|
||
helpText: 'Kameras in Büros, Produktionsstätten, Verkaufsräumen etc.',
|
||
required: true,
|
||
scoreWeights: { risk: 8, complexity: 5, assurance: 7 },
|
||
mapsToVVTQuestion: 'special_video_surveillance',
|
||
mapsToLFQuestion: 'data-video',
|
||
},
|
||
],
|
||
}
|
||
|
||
/**
|
||
* Block 4: Technik/Hosting/Transfers
|
||
*/
|
||
export const BLOCK_4_TECH: ScopeQuestionBlock = {
|
||
id: 'tech',
|
||
title: 'Hosting & Verarbeitung',
|
||
description: 'Technische Infrastruktur und Datenübermittlung',
|
||
order: 4,
|
||
questions: [
|
||
{
|
||
id: 'tech_hosting_location',
|
||
type: 'single',
|
||
question: 'Wo werden Ihre Daten primär gehostet?',
|
||
helpText: 'Standort bestimmt anwendbares Datenschutzrecht',
|
||
required: true,
|
||
options: [
|
||
{ value: 'de', label: 'Deutschland' },
|
||
{ value: 'eu', label: 'EU (ohne Deutschland)' },
|
||
{ value: 'ewr', label: 'EWR (z.B. Norwegen, Island)' },
|
||
{ value: 'us_adequacy', label: 'USA (mit Angemessenheitsbeschluss/DPF)' },
|
||
{ value: 'drittland', label: 'Drittland ohne Angemessenheitsbeschluss' },
|
||
],
|
||
scoreWeights: { risk: 7, complexity: 6, assurance: 7 },
|
||
},
|
||
{
|
||
id: 'tech_subprocessors',
|
||
type: 'boolean',
|
||
question: 'Nutzen Sie Auftragsverarbeiter (externe Dienstleister)?',
|
||
helpText: 'Cloud-Anbieter, Hosting, E-Mail-Service, CRM etc. – erfordert AVV nach Art. 28 DSGVO',
|
||
required: true,
|
||
scoreWeights: { risk: 6, complexity: 7, assurance: 7 },
|
||
},
|
||
{
|
||
id: 'tech_third_country',
|
||
type: 'boolean',
|
||
question: 'Übermitteln Sie Daten in Drittländer?',
|
||
helpText: 'Transfer außerhalb EU/EWR erfordert Schutzmaßnahmen (SCC, BCR etc.)',
|
||
required: true,
|
||
scoreWeights: { risk: 9, complexity: 8, assurance: 8 },
|
||
mapsToVVTQuestion: 'transfer_cloud_us',
|
||
},
|
||
{
|
||
id: 'tech_encryption_rest',
|
||
type: 'boolean',
|
||
question: 'Sind Daten im Ruhezustand verschlüsselt (at rest)?',
|
||
helpText: 'Datenbank-, Dateisystem- oder Volume-Verschlüsselung',
|
||
required: true,
|
||
scoreWeights: { risk: -5, complexity: 3, assurance: 7 },
|
||
},
|
||
{
|
||
id: 'tech_encryption_transit',
|
||
type: 'boolean',
|
||
question: 'Sind Daten bei Übertragung verschlüsselt (in transit)?',
|
||
helpText: 'TLS/SSL für alle Verbindungen',
|
||
required: true,
|
||
scoreWeights: { risk: -5, complexity: 2, assurance: 7 },
|
||
},
|
||
{
|
||
id: 'tech_cloud_providers',
|
||
type: 'multi',
|
||
question: 'Welche Cloud-Anbieter nutzen Sie?',
|
||
helpText: 'Mehrfachauswahl möglich',
|
||
required: false,
|
||
options: [
|
||
{ value: 'aws', label: 'Amazon Web Services (AWS)' },
|
||
{ value: 'azure', label: 'Microsoft Azure' },
|
||
{ value: 'gcp', label: 'Google Cloud Platform (GCP)' },
|
||
{ value: 'hetzner', label: 'Hetzner' },
|
||
{ value: 'ionos', label: 'IONOS' },
|
||
{ value: 'ovh', label: 'OVH' },
|
||
{ value: 'andere', label: 'Andere Anbieter' },
|
||
{ value: 'keine', label: 'Keine Cloud-Nutzung (On-Premise)' },
|
||
],
|
||
scoreWeights: { risk: 5, complexity: 6, assurance: 6 },
|
||
},
|
||
],
|
||
}
|
||
|
||
/**
|
||
* Block 5: Rechte & Prozesse
|
||
*/
|
||
export const BLOCK_5_PROCESSES: ScopeQuestionBlock = {
|
||
id: 'processes',
|
||
title: 'Rechte & Prozesse',
|
||
description: 'Etablierte Datenschutz- und Sicherheitsprozesse',
|
||
order: 5,
|
||
questions: [
|
||
{
|
||
id: 'proc_dsar_process',
|
||
type: 'boolean',
|
||
question: 'Haben Sie einen Prozess für Betroffenenrechte (DSAR)?',
|
||
helpText: 'Auskunft, Löschung, Berichtigung, Widerspruch etc. – Art. 15-22 DSGVO',
|
||
required: true,
|
||
scoreWeights: { risk: 6, complexity: 5, assurance: 8 },
|
||
},
|
||
{
|
||
id: 'proc_deletion_concept',
|
||
type: 'boolean',
|
||
question: 'Haben Sie ein Löschkonzept?',
|
||
helpText: 'Definierte Löschfristen und automatisierte Löschroutinen',
|
||
required: true,
|
||
scoreWeights: { risk: 7, complexity: 6, assurance: 8 },
|
||
},
|
||
{
|
||
id: 'proc_incident_response',
|
||
type: 'boolean',
|
||
question: 'Haben Sie einen Notfallplan für Datenschutzvorfälle?',
|
||
helpText: 'Incident Response Plan, 72h-Meldepflicht an Aufsichtsbehörde (Art. 33 DSGVO)',
|
||
required: true,
|
||
scoreWeights: { risk: 8, complexity: 6, assurance: 9 },
|
||
},
|
||
{
|
||
id: 'proc_regular_audits',
|
||
type: 'boolean',
|
||
question: 'Führen Sie regelmäßige Datenschutz-Audits durch?',
|
||
helpText: 'Interne oder externe Prüfungen mindestens jährlich',
|
||
required: true,
|
||
scoreWeights: { risk: 5, complexity: 4, assurance: 9 },
|
||
},
|
||
{
|
||
id: 'proc_training',
|
||
type: 'boolean',
|
||
question: 'Schulen Sie Ihre Mitarbeiter im Datenschutz?',
|
||
helpText: 'Awareness-Trainings, Onboarding, jährliche Auffrischung',
|
||
required: true,
|
||
scoreWeights: { risk: 6, complexity: 3, assurance: 7 },
|
||
},
|
||
],
|
||
}
|
||
|
||
/**
|
||
* Block 6: Produktkontext
|
||
*/
|
||
export const BLOCK_6_PRODUCT: ScopeQuestionBlock = {
|
||
id: 'product',
|
||
title: 'Website und Services',
|
||
description: 'Spezifische Merkmale Ihrer Produkte und Services',
|
||
order: 6,
|
||
questions: [
|
||
{
|
||
id: 'prod_cookies_consent',
|
||
type: 'boolean',
|
||
question: 'Benötigen Sie Cookie-Consent (Tracking-Cookies)?',
|
||
helpText: 'Nicht-essenzielle Cookies erfordern opt-in Einwilligung',
|
||
required: true,
|
||
scoreWeights: { risk: 5, complexity: 4, assurance: 6 },
|
||
},
|
||
{
|
||
id: 'prod_api_external',
|
||
type: 'boolean',
|
||
question: 'Bieten Sie externe APIs an (Daten-Weitergabe an Dritte)?',
|
||
helpText: 'Programmierschnittstellen für Partner, Entwickler etc.',
|
||
required: true,
|
||
scoreWeights: { risk: 7, complexity: 7, assurance: 7 },
|
||
},
|
||
{
|
||
id: 'prod_data_broker',
|
||
type: 'boolean',
|
||
question: 'Handeln Sie mit Daten (Data Brokerage, Adresshandel)?',
|
||
helpText: 'Verkauf oder Vermittlung personenbezogener Daten',
|
||
required: true,
|
||
scoreWeights: { risk: 10, complexity: 8, assurance: 9 },
|
||
},
|
||
],
|
||
}
|
||
|
||
/**
|
||
* Hidden questions -- removed from UI but still contribute to scoring.
|
||
* These are auto-filled from the Company Profile.
|
||
*/
|
||
export const HIDDEN_SCORING_QUESTIONS: ScopeProfilingQuestion[] = [
|
||
{
|
||
id: 'org_employee_count',
|
||
type: 'number',
|
||
question: 'Mitarbeiterzahl (aus Profil)',
|
||
required: false,
|
||
scoreWeights: { risk: 5, complexity: 8, assurance: 6 },
|
||
mapsToCompanyProfile: 'employeeCount',
|
||
},
|
||
{
|
||
id: 'org_annual_revenue',
|
||
type: 'single',
|
||
question: 'Jahresumsatz (aus Profil)',
|
||
required: false,
|
||
scoreWeights: { risk: 4, complexity: 6, assurance: 7 },
|
||
mapsToCompanyProfile: 'annualRevenue',
|
||
},
|
||
{
|
||
id: 'org_industry',
|
||
type: 'single',
|
||
question: 'Branche (aus Profil)',
|
||
required: false,
|
||
scoreWeights: { risk: 7, complexity: 5, assurance: 6 },
|
||
mapsToCompanyProfile: 'industry',
|
||
mapsToVVTQuestion: 'org_industry',
|
||
mapsToLFQuestion: 'org-branche',
|
||
},
|
||
{
|
||
id: 'org_business_model',
|
||
type: 'single',
|
||
question: 'Geschäftsmodell (aus Profil)',
|
||
required: false,
|
||
scoreWeights: { risk: 6, complexity: 5, assurance: 5 },
|
||
mapsToCompanyProfile: 'businessModel',
|
||
mapsToVVTQuestion: 'org_b2b_b2c',
|
||
mapsToLFQuestion: 'org-geschaeftsmodell',
|
||
},
|
||
{
|
||
id: 'org_has_dsb',
|
||
type: 'boolean',
|
||
question: 'DSB vorhanden (aus Profil)',
|
||
required: false,
|
||
scoreWeights: { risk: 5, complexity: 3, assurance: 6 },
|
||
},
|
||
{
|
||
id: 'org_cert_target',
|
||
type: 'multi',
|
||
question: 'Zertifizierungen (aus Profil)',
|
||
required: false,
|
||
scoreWeights: { risk: 3, complexity: 5, assurance: 10 },
|
||
},
|
||
{
|
||
id: 'data_volume',
|
||
type: 'single',
|
||
question: 'Personendatensaetze (aus Profil)',
|
||
required: false,
|
||
scoreWeights: { risk: 7, complexity: 6, assurance: 6 },
|
||
},
|
||
{
|
||
id: 'prod_type',
|
||
type: 'multi',
|
||
question: 'Angebotstypen (aus Profil)',
|
||
required: false,
|
||
scoreWeights: { risk: 5, complexity: 6, assurance: 5 },
|
||
},
|
||
{
|
||
id: 'prod_webshop',
|
||
type: 'boolean',
|
||
question: 'Webshop (aus Profil)',
|
||
required: false,
|
||
scoreWeights: { risk: 7, complexity: 6, assurance: 6 },
|
||
},
|
||
]
|
||
|
||
/**
|
||
* Block 7: KI-Systeme (portiert aus Company Profile Step 7)
|
||
*/
|
||
export const BLOCK_7_AI_SYSTEMS: ScopeQuestionBlock = {
|
||
id: 'ai_systems',
|
||
title: 'KI-Systeme',
|
||
description: 'Erfassung eingesetzter KI-Systeme für EU AI Act und DSGVO-Dokumentation',
|
||
order: 7,
|
||
questions: [
|
||
{
|
||
id: 'ai_uses_ai',
|
||
type: 'boolean',
|
||
question: 'Setzt Ihr Unternehmen KI-Systeme ein?',
|
||
helpText: 'Chatbots, Empfehlungssysteme, automatisierte Entscheidungen, Copilot, etc.',
|
||
required: true,
|
||
scoreWeights: { risk: 8, complexity: 7, assurance: 6 },
|
||
},
|
||
{
|
||
id: 'ai_categories',
|
||
type: 'multi',
|
||
question: 'Welche Kategorien von KI-Systemen setzen Sie ein?',
|
||
helpText: 'Mehrfachauswahl möglich. Wird nur angezeigt, wenn KI im Einsatz ist.',
|
||
required: false,
|
||
options: [
|
||
{ value: 'chatbot', label: 'Text-KI / Chatbots (ChatGPT, Claude, Gemini)' },
|
||
{ value: 'office', label: 'Office / Produktivität (Copilot, Workspace AI)' },
|
||
{ value: 'code', label: 'Code-Assistenz (GitHub Copilot, Cursor)' },
|
||
{ value: 'image', label: 'Bildgenerierung (DALL-E, Midjourney, Firefly)' },
|
||
{ value: 'translation', label: 'Übersetzung / Sprache (DeepL)' },
|
||
{ value: 'crm', label: 'CRM / Sales KI (Salesforce Einstein, HubSpot AI)' },
|
||
{ value: 'internal', label: 'Eigene / interne KI-Systeme' },
|
||
{ value: 'other', label: 'Sonstige KI-Systeme' },
|
||
],
|
||
scoreWeights: { risk: 5, complexity: 5, assurance: 5 },
|
||
},
|
||
{
|
||
id: 'ai_personal_data',
|
||
type: 'boolean',
|
||
question: 'Werden personenbezogene Daten an KI-Systeme übermittelt?',
|
||
helpText: 'Z.B. Kundendaten in ChatGPT eingeben, E-Mails mit Copilot verarbeiten',
|
||
required: false,
|
||
scoreWeights: { risk: 10, complexity: 5, assurance: 7 },
|
||
},
|
||
{
|
||
id: 'ai_risk_assessment',
|
||
type: 'single',
|
||
question: 'Haben Sie eine KI-Risikobewertung nach EU AI Act durchgeführt?',
|
||
helpText: 'Risikoeinstufung der KI-Systeme (verboten / hochriskant / begrenzt / minimal)',
|
||
required: false,
|
||
options: [
|
||
{ value: 'yes', label: 'Ja' },
|
||
{ value: 'no', label: 'Nein' },
|
||
{ value: 'not_yet', label: 'Noch nicht' },
|
||
],
|
||
scoreWeights: { risk: -5, complexity: 3, assurance: 8 },
|
||
},
|
||
],
|
||
}
|