Benjamin Admin
77459d06d6
Two reviewed knowledge decisions (2026-06-28) + the deferred cosmetic counter, before #59. 1. ISO13485 removed from the incident_management hypothesis. ISO 13485 CAPA / quality-safety incident handling is NOT security incident management — the mapping was too broad and would seed false hypotheses for the empirical loop. A dedicated manage_quality_and_safety_incidents capability can come later IF a target needs it; not forced now. (ISO27001/TISAX/IEC62443 keep incident_management.) 2. patch_policy_doc -> secure_signed_update_distribution stays `partial`, but the curated rationale is sharpened: "indicates update governance, does not evidence signed distribution" (a patch policy is not proof of SIGNED distribution). New optional SignalMapping.rationale field carries the curated note. (github_actions_ci -> SDL and dependency_scanning -> vuln-mgmt reviewed and APPROVED as-is.) 3. Cosmetic (folded in since we touched the file): the silent-intake summary now counts detected and indications SEPARATELY ("N automatisch erkannt, M Indikation(en)") instead of lumping partial signals into "automatisch erkannt" — consistent with the three-state model just shipped. Tests: ISO13485 no longer resolves to incident_management; summary counts split correctly. 29 onboarding tests pass, mypy --strict clean, demo runs, check-loc 0. Runtime-visible (hypothesis resolution + summary text) -> deploy + smoke.
36 lines
3.8 KiB
YAML
36 lines
3.8 KiB
YAML
# Silent Knowledge Pass — signal -> conclusion map (curated DATA, injected).
|
|
#
|
|
# What a scanner finding lets us conclude WITHOUT asking the user. A signal yields either a capability
|
|
# the company demonstrably has (with the evidence already in hand) or a product fact that drives scope.
|
|
# `relationship: detected` = a concrete artifact (strong, no question); `partial` = indicative (still
|
|
# verify, but lower priority). The scanners (website crawler, repo scanner, doc parser, product intake)
|
|
# are UPSTREAM and produce the signals; this file only interprets them. No norm text, no real names.
|
|
|
|
mappings:
|
|
# Only OBSERVATION-kind signals appear here. requirement-kind signals (sbom_required, psirt_required,
|
|
# signed_updates_required) are intentionally ABSENT — they describe a target, never the present state,
|
|
# and the Silent Pass would never consume them anyway (it filters on kind == observation).
|
|
# ── website ───────────────────────────────────────────────────────────────────────────────
|
|
- {signal: cvd_policy_present, capability: coordinated_vulnerability_disclosure, relationship: detected, evidence: cvd_policy}
|
|
- {signal: ce_marking_on_site, capability: ce_conformity_assessment_and_technical_documentation, relationship: partial, evidence: ce_declaration}
|
|
- {signal: support_lifecycle_page, capability: security_update_support_period, relationship: partial, evidence: support_policy}
|
|
- {signal: security_policy_page, capability: information_security_management, relationship: partial}
|
|
# ── repository ────────────────────────────────────────────────────────────────────────────
|
|
- {signal: sbom_present, capability: sbom_creation, relationship: detected, evidence: sbom}
|
|
- {signal: signed_releases, capability: secure_signed_update_distribution, relationship: detected, evidence: signing_config}
|
|
- {signal: github_actions_ci, capability: secure_development_lifecycle, relationship: partial, evidence: ci_pipeline}
|
|
- {signal: dependency_scanning, capability: technical_vulnerability_management, relationship: partial, evidence: vuln_scanning_config}
|
|
# ── documents ─────────────────────────────────────────────────────────────────────────────
|
|
- {signal: ce_conformity_doc, capability: ce_conformity_assessment_and_technical_documentation, relationship: detected, evidence: technical_documentation}
|
|
- {signal: product_risk_assessment_doc, capability: product_cyber_risk_assessment, relationship: detected, evidence: product_risk_assessment}
|
|
- {signal: patch_policy_doc, capability: secure_signed_update_distribution, relationship: partial, evidence: patch_policy,
|
|
rationale: "indicates update governance, does not evidence signed distribution"}
|
|
- {signal: incident_response_plan_doc, capability: incident_management, relationship: detected, evidence: incident_procedure}
|
|
# ── product facts (drive scope / target applicability) ──────────────────────────────────────
|
|
- {signal: cloud_connectivity, product_fact: connected_to_internet}
|
|
- {signal: plc_sps, product_fact: is_machine}
|
|
- {signal: embedded_software, product_fact: has_embedded_software}
|
|
- {signal: wireless_radio, product_fact: has_radio_equipment}
|
|
- {signal: remote_access, product_fact: has_remote_access}
|
|
- {signal: generates_usage_data, product_fact: generates_usage_data}
|