Benjamin Admin
63d65af41b
CRA Annex I Part I (2)(e)/(2)(l)/(2)(i) had no clean OWASP target (rejected: "Mapping ueber NIST/BSI erforderlich"). Their NIST home, curated + accepted: (2)(e) Integritaet -> SI-7 (Software/Firmware/Information Integrity) (2)(l) Sichere Updates -> SI-2 (Flaw Remediation) (2)(i) Angriffsflaeche -> CM-7 (Least Functionality) New mapping_type=primary_implementation = the single canonical control per obligation (stronger than implements/supports); related controls (SC-3(3), RA-5, AC-6, SI-16, ...) follow later as supports. Evidence is framework-AGNOSTIC: SI-7/SI-2/CM-7 reuse the shared evidence_type catalog (config_export/test_report/repo_scan) - same types carry CRA, NIST, ISO 27001, IEC 62443, BSI. (framework,control) is only the link, not the type. obligation_id left empty: the Obligation Registry assigns it (exported via controls_for_obligation_mapping.json), then we adopt. go test ./internal/ucca green. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
9 lines
2.4 KiB
JSON
9 lines
2.4 KiB
JSON
// Control-Mapping: CRA Annex I -> NIST SP 800-53 Rev. 5. Eine Zeile = ein Mapping (Schema: ControlMapping).
|
|
// Reviewt 2026-06-25 (benjamin): 3 accepted, mapping_type=primary_implementation (kanonische Primaer-Control je Anforderung).
|
|
// Heimat der OWASP-Rejects (2)(e)/(2)(l)/(2)(i): dort war OWASP nicht der Zielstandard ("Mapping ueber NIST/BSI erforderlich").
|
|
// related-Controls (SC-3(3), RA-5, AC-6, SI-16, ...) folgen separat als mapping_type=supports — hier nur der kanonische Einstieg.
|
|
// obligation_id bewusst LEER: vergibt die Obligation-Registry (Export via controls_for_obligation_mapping.json), dann adoptieren.
|
|
{"source_norm": "CRA Annex I Part I (2)(e) — Integritaet", "source_role": "operational_requirement", "target_framework": "NIST SP 800-53", "target_control": "SI-7", "mapping_type": "primary_implementation", "mapping_status": "accepted", "provenance": "human_curated", "rationale": "NIST SI-7 = Software, Firmware, and Information Integrity — kanonische Integritaetskontrolle (Signaturpruefung, Manipulationserkennung).", "reviewed_by": "benjamin", "review_date": "2026-06-25", "review_reason": "Primaere Implementierung der CRA-Integritaetsanforderung; OWASP war hier kein passender Treffer. Related (spaeter, supports): SA-10, CM-14.", "version": "2026-06-25"}
|
|
{"source_norm": "CRA Annex I Part I (2)(l) — Sichere Updates", "source_role": "operational_requirement", "target_framework": "NIST SP 800-53", "target_control": "SI-2", "mapping_type": "primary_implementation", "mapping_status": "accepted", "provenance": "human_curated", "rationale": "NIST SI-2 = Flaw Remediation — kanonische Update-/Patch-Kontrolle.", "reviewed_by": "benjamin", "review_date": "2026-06-25", "review_reason": "Primaere Implementierung der CRA-Update-Anforderung. Related (spaeter, supports): RA-5, CM-3, SA-11.", "version": "2026-06-25"}
|
|
{"source_norm": "CRA Annex I Part I (2)(i) — Angriffsflaeche minimieren", "source_role": "operational_requirement", "target_framework": "NIST SP 800-53", "target_control": "CM-7", "mapping_type": "primary_implementation", "mapping_status": "accepted", "provenance": "human_curated", "rationale": "NIST CM-7 = Least Functionality — Deaktivierung nicht benoetigter Ports/Dienste/Funktionen.", "reviewed_by": "benjamin", "review_date": "2026-06-25", "review_reason": "CM-7 als Primaer-Control fuer Angriffsflaeche (nicht SC-3(3)). Related (spaeter, supports): SC-3(3), AC-6, SI-16.", "version": "2026-06-25"}
|