4435e7ea0a
Services: Admin-Compliance, Backend-Compliance, AI-Compliance-SDK, Consent-SDK, Developer-Portal, PCA-Platform, DSMS Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
763 lines
29 KiB
Go
763 lines
29 KiB
Go
package ucca
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"time"
|
|
|
|
"gopkg.in/yaml.v3"
|
|
)
|
|
|
|
// ============================================================================
|
|
// NIS2 Module
|
|
// ============================================================================
|
|
//
|
|
// This module implements the NIS2 directive (EU 2022/2555) and the German
|
|
// implementation (BSIG-E - BSI-Gesetz Entwurf).
|
|
//
|
|
// NIS2 applies to:
|
|
// - Essential Entities (besonders wichtige Einrichtungen): Large enterprises in Annex I sectors
|
|
// - Important Entities (wichtige Einrichtungen): Medium enterprises in Annex I/II sectors
|
|
//
|
|
// Classification depends on:
|
|
// 1. Sector (Annex I = high criticality, Annex II = other critical)
|
|
// 2. Size (employees, revenue, balance sheet)
|
|
// 3. Special criteria (KRITIS, special services like DNS/TLD/Cloud)
|
|
//
|
|
// ============================================================================
|
|
|
|
// NIS2Module implements the RegulationModule interface for NIS2
|
|
type NIS2Module struct {
|
|
obligations []Obligation
|
|
controls []ObligationControl
|
|
incidentDeadlines []IncidentDeadline
|
|
decisionTree *DecisionTree
|
|
loaded bool
|
|
}
|
|
|
|
// NIS2 Sector Annexes
|
|
var (
|
|
// Annex I: Sectors of High Criticality
|
|
NIS2AnnexISectors = map[string]bool{
|
|
"energy": true, // Energie (Strom, Öl, Gas, Wasserstoff, Fernwärme)
|
|
"transport": true, // Verkehr (Luft, Schiene, Wasser, Straße)
|
|
"banking_financial": true, // Bankwesen
|
|
"financial_market": true, // Finanzmarktinfrastrukturen
|
|
"health": true, // Gesundheitswesen
|
|
"drinking_water": true, // Trinkwasser
|
|
"wastewater": true, // Abwasser
|
|
"digital_infrastructure": true, // Digitale Infrastruktur
|
|
"ict_service_mgmt": true, // IKT-Dienstverwaltung (B2B)
|
|
"public_administration": true, // Öffentliche Verwaltung
|
|
"space": true, // Weltraum
|
|
}
|
|
|
|
// Annex II: Other Critical Sectors
|
|
NIS2AnnexIISectors = map[string]bool{
|
|
"postal": true, // Post- und Kurierdienste
|
|
"waste": true, // Abfallbewirtschaftung
|
|
"chemicals": true, // Chemie
|
|
"food": true, // Lebensmittel
|
|
"manufacturing": true, // Verarbeitendes Gewerbe (wichtige Produkte)
|
|
"digital_providers": true, // Digitale Dienste (Marktplätze, Suchmaschinen, soziale Netze)
|
|
"research": true, // Forschung
|
|
}
|
|
|
|
// Special services that are always in scope (regardless of size)
|
|
NIS2SpecialServices = map[string]bool{
|
|
"dns": true, // DNS-Dienste
|
|
"tld": true, // TLD-Namenregister
|
|
"cloud": true, // Cloud-Computing-Dienste
|
|
"datacenter": true, // Rechenzentrumsdienste
|
|
"cdn": true, // Content-Delivery-Netze
|
|
"trust_service": true, // Vertrauensdienste
|
|
"public_network": true, // Öffentliche elektronische Kommunikationsnetze
|
|
"electronic_comms": true, // Elektronische Kommunikationsdienste
|
|
"msp": true, // Managed Service Provider
|
|
"mssp": true, // Managed Security Service Provider
|
|
}
|
|
)
|
|
|
|
// NewNIS2Module creates a new NIS2 module, loading obligations from YAML
|
|
func NewNIS2Module() (*NIS2Module, error) {
|
|
m := &NIS2Module{
|
|
obligations: []Obligation{},
|
|
controls: []ObligationControl{},
|
|
incidentDeadlines: []IncidentDeadline{},
|
|
}
|
|
|
|
// Try to load from YAML, fall back to hardcoded if not found
|
|
if err := m.loadFromYAML(); err != nil {
|
|
// Use hardcoded defaults
|
|
m.loadHardcodedObligations()
|
|
}
|
|
|
|
m.buildDecisionTree()
|
|
m.loaded = true
|
|
|
|
return m, nil
|
|
}
|
|
|
|
// ID returns the module identifier
|
|
func (m *NIS2Module) ID() string {
|
|
return "nis2"
|
|
}
|
|
|
|
// Name returns the human-readable name
|
|
func (m *NIS2Module) Name() string {
|
|
return "NIS2-Richtlinie / BSIG-E"
|
|
}
|
|
|
|
// Description returns a brief description
|
|
func (m *NIS2Module) Description() string {
|
|
return "EU-Richtlinie über Maßnahmen für ein hohes gemeinsames Cybersicherheitsniveau (NIS2) und deutsche Umsetzung (BSIG-E)"
|
|
}
|
|
|
|
// IsApplicable checks if NIS2 applies to the organization
|
|
func (m *NIS2Module) IsApplicable(facts *UnifiedFacts) bool {
|
|
classification := m.Classify(facts)
|
|
return classification != NIS2NotAffected
|
|
}
|
|
|
|
// GetClassification returns the NIS2 classification as string
|
|
func (m *NIS2Module) GetClassification(facts *UnifiedFacts) string {
|
|
return string(m.Classify(facts))
|
|
}
|
|
|
|
// Classify determines the NIS2 classification for an organization
|
|
func (m *NIS2Module) Classify(facts *UnifiedFacts) NIS2Classification {
|
|
// Check for special services (always in scope, regardless of size)
|
|
if m.hasSpecialService(facts) {
|
|
// Special services are typically essential entities
|
|
return NIS2EssentialEntity
|
|
}
|
|
|
|
// Check if in relevant sector
|
|
inAnnexI := NIS2AnnexISectors[facts.Sector.PrimarySector]
|
|
inAnnexII := NIS2AnnexIISectors[facts.Sector.PrimarySector]
|
|
|
|
if !inAnnexI && !inAnnexII {
|
|
// Not in a regulated sector
|
|
return NIS2NotAffected
|
|
}
|
|
|
|
// Check size thresholds
|
|
meetsSize := facts.Organization.MeetsNIS2SizeThreshold()
|
|
isLarge := facts.Organization.MeetsNIS2LargeThreshold()
|
|
|
|
if !meetsSize {
|
|
// Too small (< 50 employees AND < €10m revenue/balance)
|
|
// Exception: KRITIS operators are always in scope
|
|
if facts.Sector.IsKRITIS && facts.Sector.KRITISThresholdMet {
|
|
return NIS2EssentialEntity
|
|
}
|
|
return NIS2NotAffected
|
|
}
|
|
|
|
// Annex I sectors
|
|
if inAnnexI {
|
|
if isLarge {
|
|
// Large enterprise in Annex I = Essential Entity
|
|
return NIS2EssentialEntity
|
|
}
|
|
// Medium enterprise in Annex I = Important Entity
|
|
return NIS2ImportantEntity
|
|
}
|
|
|
|
// Annex II sectors
|
|
if inAnnexII {
|
|
if isLarge {
|
|
// Large enterprise in Annex II = Important Entity (not essential)
|
|
return NIS2ImportantEntity
|
|
}
|
|
// Medium enterprise in Annex II = Important Entity
|
|
return NIS2ImportantEntity
|
|
}
|
|
|
|
return NIS2NotAffected
|
|
}
|
|
|
|
// hasSpecialService checks if the organization provides special NIS2 services
|
|
func (m *NIS2Module) hasSpecialService(facts *UnifiedFacts) bool {
|
|
for _, service := range facts.Sector.SpecialServices {
|
|
if NIS2SpecialServices[service] {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// DeriveObligations derives all applicable NIS2 obligations
|
|
func (m *NIS2Module) DeriveObligations(facts *UnifiedFacts) []Obligation {
|
|
classification := m.Classify(facts)
|
|
if classification == NIS2NotAffected {
|
|
return []Obligation{}
|
|
}
|
|
|
|
var result []Obligation
|
|
for _, obl := range m.obligations {
|
|
if m.obligationApplies(obl, classification, facts) {
|
|
// Copy and customize obligation
|
|
customized := obl
|
|
customized.RegulationID = m.ID()
|
|
result = append(result, customized)
|
|
}
|
|
}
|
|
|
|
return result
|
|
}
|
|
|
|
// obligationApplies checks if a specific obligation applies
|
|
func (m *NIS2Module) obligationApplies(obl Obligation, classification NIS2Classification, facts *UnifiedFacts) bool {
|
|
// Check applies_when condition
|
|
switch obl.AppliesWhen {
|
|
case "classification == 'besonders_wichtige_einrichtung'":
|
|
return classification == NIS2EssentialEntity
|
|
case "classification == 'wichtige_einrichtung'":
|
|
return classification == NIS2ImportantEntity
|
|
case "classification in ['wichtige_einrichtung', 'besonders_wichtige_einrichtung']":
|
|
return classification == NIS2EssentialEntity || classification == NIS2ImportantEntity
|
|
case "classification != 'nicht_betroffen'":
|
|
return classification != NIS2NotAffected
|
|
case "":
|
|
// No condition = applies to all classified entities
|
|
return classification != NIS2NotAffected
|
|
default:
|
|
// Default: applies if not unaffected
|
|
return classification != NIS2NotAffected
|
|
}
|
|
}
|
|
|
|
// DeriveControls derives all applicable NIS2 controls
|
|
func (m *NIS2Module) DeriveControls(facts *UnifiedFacts) []ObligationControl {
|
|
classification := m.Classify(facts)
|
|
if classification == NIS2NotAffected {
|
|
return []ObligationControl{}
|
|
}
|
|
|
|
var result []ObligationControl
|
|
for _, ctrl := range m.controls {
|
|
ctrl.RegulationID = m.ID()
|
|
result = append(result, ctrl)
|
|
}
|
|
|
|
return result
|
|
}
|
|
|
|
// GetDecisionTree returns the NIS2 applicability decision tree
|
|
func (m *NIS2Module) GetDecisionTree() *DecisionTree {
|
|
return m.decisionTree
|
|
}
|
|
|
|
// GetIncidentDeadlines returns NIS2 incident reporting deadlines
|
|
func (m *NIS2Module) GetIncidentDeadlines(facts *UnifiedFacts) []IncidentDeadline {
|
|
classification := m.Classify(facts)
|
|
if classification == NIS2NotAffected {
|
|
return []IncidentDeadline{}
|
|
}
|
|
|
|
return m.incidentDeadlines
|
|
}
|
|
|
|
// ============================================================================
|
|
// YAML Loading
|
|
// ============================================================================
|
|
|
|
// NIS2ObligationsConfig is the YAML structure for NIS2 obligations
|
|
type NIS2ObligationsConfig struct {
|
|
Regulation string `yaml:"regulation"`
|
|
Name string `yaml:"name"`
|
|
Obligations []ObligationYAML `yaml:"obligations"`
|
|
Controls []ControlYAML `yaml:"controls"`
|
|
IncidentDeadlines []IncidentDeadlineYAML `yaml:"incident_deadlines"`
|
|
}
|
|
|
|
// ObligationYAML is the YAML structure for an obligation
|
|
type ObligationYAML struct {
|
|
ID string `yaml:"id"`
|
|
Title string `yaml:"title"`
|
|
Description string `yaml:"description"`
|
|
AppliesWhen string `yaml:"applies_when"`
|
|
LegalBasis []LegalRefYAML `yaml:"legal_basis"`
|
|
Category string `yaml:"category"`
|
|
Responsible string `yaml:"responsible"`
|
|
Deadline *DeadlineYAML `yaml:"deadline,omitempty"`
|
|
Sanctions *SanctionYAML `yaml:"sanctions,omitempty"`
|
|
Evidence []string `yaml:"evidence,omitempty"`
|
|
Priority string `yaml:"priority"`
|
|
ISO27001 []string `yaml:"iso27001_mapping,omitempty"`
|
|
HowTo string `yaml:"how_to_implement,omitempty"`
|
|
}
|
|
|
|
type LegalRefYAML struct {
|
|
Norm string `yaml:"norm"`
|
|
Article string `yaml:"article,omitempty"`
|
|
}
|
|
|
|
type DeadlineYAML struct {
|
|
Type string `yaml:"type"`
|
|
Date string `yaml:"date,omitempty"`
|
|
Duration string `yaml:"duration,omitempty"`
|
|
}
|
|
|
|
type SanctionYAML struct {
|
|
MaxFine string `yaml:"max_fine,omitempty"`
|
|
PersonalLiability bool `yaml:"personal_liability,omitempty"`
|
|
}
|
|
|
|
type ControlYAML struct {
|
|
ID string `yaml:"id"`
|
|
Name string `yaml:"name"`
|
|
Description string `yaml:"description"`
|
|
Category string `yaml:"category"`
|
|
WhatToDo string `yaml:"what_to_do"`
|
|
ISO27001 []string `yaml:"iso27001_mapping,omitempty"`
|
|
Priority string `yaml:"priority"`
|
|
}
|
|
|
|
type IncidentDeadlineYAML struct {
|
|
Phase string `yaml:"phase"`
|
|
Deadline string `yaml:"deadline"`
|
|
Content string `yaml:"content"`
|
|
Recipient string `yaml:"recipient"`
|
|
LegalBasis []LegalRefYAML `yaml:"legal_basis"`
|
|
}
|
|
|
|
func (m *NIS2Module) loadFromYAML() error {
|
|
// Search paths for YAML file
|
|
searchPaths := []string{
|
|
"policies/obligations/nis2_obligations.yaml",
|
|
filepath.Join(".", "policies", "obligations", "nis2_obligations.yaml"),
|
|
filepath.Join("..", "policies", "obligations", "nis2_obligations.yaml"),
|
|
filepath.Join("..", "..", "policies", "obligations", "nis2_obligations.yaml"),
|
|
"/app/policies/obligations/nis2_obligations.yaml",
|
|
}
|
|
|
|
var data []byte
|
|
var err error
|
|
for _, path := range searchPaths {
|
|
data, err = os.ReadFile(path)
|
|
if err == nil {
|
|
break
|
|
}
|
|
}
|
|
|
|
if err != nil {
|
|
return fmt.Errorf("NIS2 obligations YAML not found: %w", err)
|
|
}
|
|
|
|
var config NIS2ObligationsConfig
|
|
if err := yaml.Unmarshal(data, &config); err != nil {
|
|
return fmt.Errorf("failed to parse NIS2 YAML: %w", err)
|
|
}
|
|
|
|
// Convert YAML to internal structures
|
|
m.convertObligations(config.Obligations)
|
|
m.convertControls(config.Controls)
|
|
m.convertIncidentDeadlines(config.IncidentDeadlines)
|
|
|
|
return nil
|
|
}
|
|
|
|
func (m *NIS2Module) convertObligations(yamlObls []ObligationYAML) {
|
|
for _, y := range yamlObls {
|
|
obl := Obligation{
|
|
ID: y.ID,
|
|
RegulationID: "nis2",
|
|
Title: y.Title,
|
|
Description: y.Description,
|
|
AppliesWhen: y.AppliesWhen,
|
|
Category: ObligationCategory(y.Category),
|
|
Responsible: ResponsibleRole(y.Responsible),
|
|
Priority: ObligationPriority(y.Priority),
|
|
ISO27001Mapping: y.ISO27001,
|
|
HowToImplement: y.HowTo,
|
|
}
|
|
|
|
// Convert legal basis
|
|
for _, lb := range y.LegalBasis {
|
|
obl.LegalBasis = append(obl.LegalBasis, LegalReference{
|
|
Norm: lb.Norm,
|
|
Article: lb.Article,
|
|
})
|
|
}
|
|
|
|
// Convert deadline
|
|
if y.Deadline != nil {
|
|
obl.Deadline = &Deadline{
|
|
Type: DeadlineType(y.Deadline.Type),
|
|
Duration: y.Deadline.Duration,
|
|
}
|
|
if y.Deadline.Date != "" {
|
|
if t, err := time.Parse("2006-01-02", y.Deadline.Date); err == nil {
|
|
obl.Deadline.Date = &t
|
|
}
|
|
}
|
|
}
|
|
|
|
// Convert sanctions
|
|
if y.Sanctions != nil {
|
|
obl.Sanctions = &SanctionInfo{
|
|
MaxFine: y.Sanctions.MaxFine,
|
|
PersonalLiability: y.Sanctions.PersonalLiability,
|
|
}
|
|
}
|
|
|
|
// Convert evidence
|
|
for _, e := range y.Evidence {
|
|
obl.Evidence = append(obl.Evidence, EvidenceItem{Name: e, Required: true})
|
|
}
|
|
|
|
m.obligations = append(m.obligations, obl)
|
|
}
|
|
}
|
|
|
|
func (m *NIS2Module) convertControls(yamlCtrls []ControlYAML) {
|
|
for _, y := range yamlCtrls {
|
|
ctrl := ObligationControl{
|
|
ID: y.ID,
|
|
RegulationID: "nis2",
|
|
Name: y.Name,
|
|
Description: y.Description,
|
|
Category: y.Category,
|
|
WhatToDo: y.WhatToDo,
|
|
ISO27001Mapping: y.ISO27001,
|
|
Priority: ObligationPriority(y.Priority),
|
|
}
|
|
m.controls = append(m.controls, ctrl)
|
|
}
|
|
}
|
|
|
|
func (m *NIS2Module) convertIncidentDeadlines(yamlDeadlines []IncidentDeadlineYAML) {
|
|
for _, y := range yamlDeadlines {
|
|
deadline := IncidentDeadline{
|
|
RegulationID: "nis2",
|
|
Phase: y.Phase,
|
|
Deadline: y.Deadline,
|
|
Content: y.Content,
|
|
Recipient: y.Recipient,
|
|
}
|
|
for _, lb := range y.LegalBasis {
|
|
deadline.LegalBasis = append(deadline.LegalBasis, LegalReference{
|
|
Norm: lb.Norm,
|
|
Article: lb.Article,
|
|
})
|
|
}
|
|
m.incidentDeadlines = append(m.incidentDeadlines, deadline)
|
|
}
|
|
}
|
|
|
|
// ============================================================================
|
|
// Hardcoded Fallback
|
|
// ============================================================================
|
|
|
|
func (m *NIS2Module) loadHardcodedObligations() {
|
|
// BSI Registration deadline
|
|
bsiDeadline := time.Date(2025, 1, 17, 0, 0, 0, 0, time.UTC)
|
|
|
|
m.obligations = []Obligation{
|
|
{
|
|
ID: "NIS2-OBL-001",
|
|
RegulationID: "nis2",
|
|
Title: "BSI-Registrierung",
|
|
Description: "Registrierung beim BSI über das Meldeportal. Anzugeben sind: Kontaktdaten, IP-Bereiche, verantwortliche Ansprechpartner.",
|
|
LegalBasis: []LegalReference{{Norm: "§ 33 BSIG-E", Article: "Registrierungspflicht"}},
|
|
Category: CategoryMeldepflicht,
|
|
Responsible: RoleManagement,
|
|
Deadline: &Deadline{Type: DeadlineAbsolute, Date: &bsiDeadline},
|
|
Sanctions: &SanctionInfo{MaxFine: "500.000 EUR", PersonalLiability: false},
|
|
Evidence: []EvidenceItem{{Name: "Registrierungsbestätigung BSI", Required: true}, {Name: "Dokumentierte Ansprechpartner", Required: true}},
|
|
Priority: PriorityCritical,
|
|
AppliesWhen: "classification in ['wichtige_einrichtung', 'besonders_wichtige_einrichtung']",
|
|
},
|
|
{
|
|
ID: "NIS2-OBL-002",
|
|
RegulationID: "nis2",
|
|
Title: "Risikomanagement-Maßnahmen implementieren",
|
|
Description: "Umsetzung angemessener technischer, operativer und organisatorischer Maßnahmen zur Beherrschung der Risiken für die Sicherheit der Netz- und Informationssysteme.",
|
|
LegalBasis: []LegalReference{{Norm: "Art. 21 NIS2"}, {Norm: "§ 30 BSIG-E"}},
|
|
Category: CategoryGovernance,
|
|
Responsible: RoleCISO,
|
|
Deadline: &Deadline{Type: DeadlineRelative, Duration: "18 Monate nach Inkrafttreten"},
|
|
Sanctions: &SanctionInfo{MaxFine: "10 Mio. EUR oder 2% Jahresumsatz", PersonalLiability: true},
|
|
Evidence: []EvidenceItem{{Name: "ISMS-Dokumentation", Required: true}, {Name: "Risikoanalyse", Required: true}, {Name: "Maßnahmenkatalog", Required: true}},
|
|
Priority: PriorityHigh,
|
|
ISO27001Mapping: []string{"A.5", "A.6", "A.8"},
|
|
AppliesWhen: "classification != 'nicht_betroffen'",
|
|
},
|
|
{
|
|
ID: "NIS2-OBL-003",
|
|
RegulationID: "nis2",
|
|
Title: "Geschäftsführungs-Verantwortung",
|
|
Description: "Die Geschäftsleitung muss die Risikomanagementmaßnahmen genehmigen, deren Umsetzung überwachen und kann für Verstöße persönlich haftbar gemacht werden.",
|
|
LegalBasis: []LegalReference{{Norm: "Art. 20 NIS2"}, {Norm: "§ 38 BSIG-E"}},
|
|
Category: CategoryGovernance,
|
|
Responsible: RoleManagement,
|
|
Sanctions: &SanctionInfo{MaxFine: "10 Mio. EUR oder 2% Jahresumsatz", PersonalLiability: true},
|
|
Evidence: []EvidenceItem{{Name: "Vorstandsbeschluss zur Cybersicherheit", Required: true}, {Name: "Dokumentierte Genehmigung der Maßnahmen", Required: true}},
|
|
Priority: PriorityCritical,
|
|
AppliesWhen: "classification != 'nicht_betroffen'",
|
|
},
|
|
{
|
|
ID: "NIS2-OBL-004",
|
|
RegulationID: "nis2",
|
|
Title: "Cybersicherheits-Schulung der Geschäftsführung",
|
|
Description: "Mitglieder der Leitungsorgane müssen an Schulungen teilnehmen, um ausreichende Kenntnisse und Fähigkeiten zur Erkennung und Bewertung von Risiken zu erlangen.",
|
|
LegalBasis: []LegalReference{{Norm: "Art. 20 Abs. 2 NIS2"}, {Norm: "§ 38 Abs. 3 BSIG-E"}},
|
|
Category: CategoryTraining,
|
|
Responsible: RoleManagement,
|
|
Deadline: &Deadline{Type: DeadlineRecurring, Interval: "jährlich"},
|
|
Evidence: []EvidenceItem{{Name: "Schulungsnachweise der Geschäftsführung", Required: true}, {Name: "Schulungsplan", Required: true}},
|
|
Priority: PriorityHigh,
|
|
AppliesWhen: "classification != 'nicht_betroffen'",
|
|
},
|
|
{
|
|
ID: "NIS2-OBL-005",
|
|
RegulationID: "nis2",
|
|
Title: "Incident-Response-Prozess etablieren",
|
|
Description: "Etablierung eines Prozesses zur Erkennung, Analyse und Meldung von Sicherheitsvorfällen gemäß den gesetzlichen Meldefristen.",
|
|
LegalBasis: []LegalReference{{Norm: "Art. 23 NIS2"}, {Norm: "§ 32 BSIG-E"}},
|
|
Category: CategoryTechnical,
|
|
Responsible: RoleCISO,
|
|
Evidence: []EvidenceItem{{Name: "Incident-Response-Plan", Required: true}, {Name: "Meldeprozess-Dokumentation", Required: true}, {Name: "Kontaktdaten BSI", Required: true}},
|
|
Priority: PriorityCritical,
|
|
ISO27001Mapping: []string{"A.16"},
|
|
AppliesWhen: "classification != 'nicht_betroffen'",
|
|
},
|
|
{
|
|
ID: "NIS2-OBL-006",
|
|
RegulationID: "nis2",
|
|
Title: "Business Continuity Management",
|
|
Description: "Maßnahmen zur Aufrechterhaltung des Betriebs, Backup-Management, Notfallwiederherstellung und Krisenmanagement.",
|
|
LegalBasis: []LegalReference{{Norm: "Art. 21 Abs. 2 lit. c NIS2"}, {Norm: "§ 30 Abs. 2 Nr. 3 BSIG-E"}},
|
|
Category: CategoryTechnical,
|
|
Responsible: RoleCISO,
|
|
Evidence: []EvidenceItem{{Name: "BCM-Dokumentation", Required: true}, {Name: "Backup-Konzept", Required: true}, {Name: "Disaster-Recovery-Plan", Required: true}, {Name: "Testprotokolle", Required: true}},
|
|
Priority: PriorityHigh,
|
|
ISO27001Mapping: []string{"A.17"},
|
|
AppliesWhen: "classification != 'nicht_betroffen'",
|
|
},
|
|
{
|
|
ID: "NIS2-OBL-007",
|
|
RegulationID: "nis2",
|
|
Title: "Lieferketten-Sicherheit",
|
|
Description: "Sicherheit in der Lieferkette, einschließlich sicherheitsbezogener Aspekte der Beziehungen zwischen Einrichtung und direkten Anbietern oder Diensteanbietern.",
|
|
LegalBasis: []LegalReference{{Norm: "Art. 21 Abs. 2 lit. d NIS2"}, {Norm: "§ 30 Abs. 2 Nr. 4 BSIG-E"}},
|
|
Category: CategoryOrganizational,
|
|
Responsible: RoleCISO,
|
|
Evidence: []EvidenceItem{{Name: "Lieferanten-Risikobewertung", Required: true}, {Name: "Sicherheitsanforderungen in Verträgen", Required: true}},
|
|
Priority: PriorityMedium,
|
|
ISO27001Mapping: []string{"A.15"},
|
|
AppliesWhen: "classification != 'nicht_betroffen'",
|
|
},
|
|
{
|
|
ID: "NIS2-OBL-008",
|
|
RegulationID: "nis2",
|
|
Title: "Schwachstellenmanagement",
|
|
Description: "Umgang mit Schwachstellen und deren Offenlegung, Maßnahmen zur Erkennung und Behebung von Schwachstellen.",
|
|
LegalBasis: []LegalReference{{Norm: "Art. 21 Abs. 2 lit. e NIS2"}, {Norm: "§ 30 Abs. 2 Nr. 5 BSIG-E"}},
|
|
Category: CategoryTechnical,
|
|
Responsible: RoleCISO,
|
|
Evidence: []EvidenceItem{{Name: "Schwachstellen-Management-Prozess", Required: true}, {Name: "Patch-Management-Richtlinie", Required: true}, {Name: "Vulnerability-Scan-Berichte", Required: true}},
|
|
Priority: PriorityHigh,
|
|
ISO27001Mapping: []string{"A.12.6"},
|
|
AppliesWhen: "classification != 'nicht_betroffen'",
|
|
},
|
|
{
|
|
ID: "NIS2-OBL-009",
|
|
RegulationID: "nis2",
|
|
Title: "Zugangs- und Identitätsmanagement",
|
|
Description: "Konzepte für die Zugangskontrolle und das Management von Anlagen sowie Verwendung von MFA und kontinuierlicher Authentifizierung.",
|
|
LegalBasis: []LegalReference{{Norm: "Art. 21 Abs. 2 lit. i NIS2"}, {Norm: "§ 30 Abs. 2 Nr. 9 BSIG-E"}},
|
|
Category: CategoryTechnical,
|
|
Responsible: RoleITLeitung,
|
|
Evidence: []EvidenceItem{{Name: "Zugangskontroll-Richtlinie", Required: true}, {Name: "MFA-Implementierungsnachweis", Required: true}, {Name: "Identity-Management-Dokumentation", Required: true}},
|
|
Priority: PriorityHigh,
|
|
ISO27001Mapping: []string{"A.9"},
|
|
AppliesWhen: "classification != 'nicht_betroffen'",
|
|
},
|
|
{
|
|
ID: "NIS2-OBL-010",
|
|
RegulationID: "nis2",
|
|
Title: "Kryptographie und Verschlüsselung",
|
|
Description: "Konzepte und Verfahren für den Einsatz von Kryptographie und gegebenenfalls Verschlüsselung.",
|
|
LegalBasis: []LegalReference{{Norm: "Art. 21 Abs. 2 lit. h NIS2"}, {Norm: "§ 30 Abs. 2 Nr. 8 BSIG-E"}},
|
|
Category: CategoryTechnical,
|
|
Responsible: RoleCISO,
|
|
Evidence: []EvidenceItem{{Name: "Kryptographie-Richtlinie", Required: true}, {Name: "Verschlüsselungskonzept", Required: true}, {Name: "Key-Management-Dokumentation", Required: true}},
|
|
Priority: PriorityMedium,
|
|
ISO27001Mapping: []string{"A.10"},
|
|
AppliesWhen: "classification != 'nicht_betroffen'",
|
|
},
|
|
{
|
|
ID: "NIS2-OBL-011",
|
|
RegulationID: "nis2",
|
|
Title: "Personalsicherheit",
|
|
Description: "Sicherheit des Personals, Konzepte für die Zugriffskontrolle und das Management von Anlagen.",
|
|
LegalBasis: []LegalReference{{Norm: "Art. 21 Abs. 2 lit. j NIS2"}, {Norm: "§ 30 Abs. 2 Nr. 10 BSIG-E"}},
|
|
Category: CategoryOrganizational,
|
|
Responsible: RoleManagement,
|
|
Evidence: []EvidenceItem{{Name: "Personalsicherheits-Richtlinie", Required: true}, {Name: "Schulungskonzept", Required: true}},
|
|
Priority: PriorityMedium,
|
|
ISO27001Mapping: []string{"A.7"},
|
|
AppliesWhen: "classification != 'nicht_betroffen'",
|
|
},
|
|
{
|
|
ID: "NIS2-OBL-012",
|
|
RegulationID: "nis2",
|
|
Title: "Regelmäßige Audits (besonders wichtige Einrichtungen)",
|
|
Description: "Besonders wichtige Einrichtungen unterliegen regelmäßigen Sicherheitsüberprüfungen durch das BSI.",
|
|
LegalBasis: []LegalReference{{Norm: "Art. 32 NIS2"}, {Norm: "§ 39 BSIG-E"}},
|
|
Category: CategoryAudit,
|
|
Responsible: RoleCISO,
|
|
Deadline: &Deadline{Type: DeadlineRecurring, Interval: "alle 2 Jahre"},
|
|
Evidence: []EvidenceItem{{Name: "Audit-Berichte", Required: true}, {Name: "Maßnahmenplan aus Audits", Required: true}},
|
|
Priority: PriorityHigh,
|
|
AppliesWhen: "classification == 'besonders_wichtige_einrichtung'",
|
|
},
|
|
}
|
|
|
|
// Hardcoded controls
|
|
m.controls = []ObligationControl{
|
|
{
|
|
ID: "NIS2-CTRL-001",
|
|
RegulationID: "nis2",
|
|
Name: "ISMS implementieren",
|
|
Description: "Implementierung eines Informationssicherheits-Managementsystems",
|
|
Category: "Governance",
|
|
WhatToDo: "Aufbau eines ISMS nach ISO 27001 oder BSI IT-Grundschutz",
|
|
ISO27001Mapping: []string{"4", "5", "6", "7"},
|
|
Priority: PriorityHigh,
|
|
},
|
|
{
|
|
ID: "NIS2-CTRL-002",
|
|
RegulationID: "nis2",
|
|
Name: "Netzwerksegmentierung",
|
|
Description: "Segmentierung kritischer Netzwerkbereiche",
|
|
Category: "Technisch",
|
|
WhatToDo: "Implementierung von VLANs, Firewalls und Mikrosegmentierung für kritische Systeme",
|
|
ISO27001Mapping: []string{"A.13.1"},
|
|
Priority: PriorityHigh,
|
|
},
|
|
{
|
|
ID: "NIS2-CTRL-003",
|
|
RegulationID: "nis2",
|
|
Name: "Security Monitoring",
|
|
Description: "Kontinuierliche Überwachung der IT-Sicherheit",
|
|
Category: "Technisch",
|
|
WhatToDo: "Implementierung von SIEM, Log-Management und Anomalie-Erkennung",
|
|
ISO27001Mapping: []string{"A.12.4"},
|
|
Priority: PriorityHigh,
|
|
},
|
|
{
|
|
ID: "NIS2-CTRL-004",
|
|
RegulationID: "nis2",
|
|
Name: "Awareness-Programm",
|
|
Description: "Regelmäßige Sicherheitsschulungen für alle Mitarbeiter",
|
|
Category: "Organisatorisch",
|
|
WhatToDo: "Durchführung von Phishing-Simulationen, E-Learning und Präsenzschulungen",
|
|
ISO27001Mapping: []string{"A.7.2.2"},
|
|
Priority: PriorityMedium,
|
|
},
|
|
}
|
|
|
|
// Hardcoded incident deadlines
|
|
m.incidentDeadlines = []IncidentDeadline{
|
|
{
|
|
RegulationID: "nis2",
|
|
Phase: "Frühwarnung",
|
|
Deadline: "24 Stunden",
|
|
Content: "Unverzügliche Meldung erheblicher Sicherheitsvorfälle. Angabe ob böswilliger Angriff vermutet und ob grenzüberschreitende Auswirkungen möglich.",
|
|
Recipient: "BSI",
|
|
LegalBasis: []LegalReference{{Norm: "§ 32 Abs. 1 BSIG-E"}},
|
|
},
|
|
{
|
|
RegulationID: "nis2",
|
|
Phase: "Vorfallmeldung",
|
|
Deadline: "72 Stunden",
|
|
Content: "Aktualisierung der Frühwarnung. Erste Bewertung des Vorfalls, Schweregrad, Auswirkungen, Kompromittierungsindikatoren (IoCs).",
|
|
Recipient: "BSI",
|
|
LegalBasis: []LegalReference{{Norm: "§ 32 Abs. 2 BSIG-E"}},
|
|
},
|
|
{
|
|
RegulationID: "nis2",
|
|
Phase: "Abschlussbericht",
|
|
Deadline: "1 Monat",
|
|
Content: "Ausführliche Beschreibung des Vorfalls, Ursachenanalyse (Root Cause), ergriffene Abhilfemaßnahmen, grenzüberschreitende Auswirkungen.",
|
|
Recipient: "BSI",
|
|
LegalBasis: []LegalReference{{Norm: "§ 32 Abs. 3 BSIG-E"}},
|
|
},
|
|
}
|
|
}
|
|
|
|
// ============================================================================
|
|
// Decision Tree
|
|
// ============================================================================
|
|
|
|
func (m *NIS2Module) buildDecisionTree() {
|
|
m.decisionTree = &DecisionTree{
|
|
ID: "nis2_applicability",
|
|
Name: "NIS2 Anwendbarkeits-Entscheidungsbaum",
|
|
RootNode: &DecisionNode{
|
|
ID: "root",
|
|
Question: "Erbringt Ihr Unternehmen spezielle digitale Dienste (DNS, TLD, Cloud, Rechenzentrum, CDN, MSP, MSSP, Vertrauensdienste)?",
|
|
YesNode: &DecisionNode{
|
|
ID: "special_services",
|
|
Result: string(NIS2EssentialEntity),
|
|
Explanation: "Anbieter spezieller digitaler Dienste sind unabhängig von der Größe als besonders wichtige Einrichtungen einzustufen.",
|
|
},
|
|
NoNode: &DecisionNode{
|
|
ID: "sector_check",
|
|
Question: "Ist Ihr Unternehmen in einem der NIS2-Sektoren tätig (Energie, Verkehr, Gesundheit, Digitale Infrastruktur, Öffentliche Verwaltung, Finanzwesen, etc.)?",
|
|
YesNode: &DecisionNode{
|
|
ID: "size_check",
|
|
Question: "Hat Ihr Unternehmen mindestens 50 Mitarbeiter ODER mindestens 10 Mio. EUR Jahresumsatz UND Bilanzsumme?",
|
|
YesNode: &DecisionNode{
|
|
ID: "annex_check",
|
|
Question: "Ist Ihr Sektor in Anhang I der NIS2 (hohe Kritikalität: Energie, Verkehr, Gesundheit, Trinkwasser, Digitale Infrastruktur, Bankwesen, Öffentliche Verwaltung, Weltraum)?",
|
|
YesNode: &DecisionNode{
|
|
ID: "large_check_annex1",
|
|
Question: "Hat Ihr Unternehmen mindestens 250 Mitarbeiter ODER mindestens 50 Mio. EUR Jahresumsatz?",
|
|
YesNode: &DecisionNode{
|
|
ID: "essential_annex1",
|
|
Result: string(NIS2EssentialEntity),
|
|
Explanation: "Großes Unternehmen in Anhang I Sektor = Besonders wichtige Einrichtung",
|
|
},
|
|
NoNode: &DecisionNode{
|
|
ID: "important_annex1",
|
|
Result: string(NIS2ImportantEntity),
|
|
Explanation: "Mittleres Unternehmen in Anhang I Sektor = Wichtige Einrichtung",
|
|
},
|
|
},
|
|
NoNode: &DecisionNode{
|
|
ID: "important_annex2",
|
|
Result: string(NIS2ImportantEntity),
|
|
Explanation: "Unternehmen in Anhang II Sektor = Wichtige Einrichtung",
|
|
},
|
|
},
|
|
NoNode: &DecisionNode{
|
|
ID: "kritis_check",
|
|
Question: "Ist Ihr Unternehmen als KRITIS-Betreiber eingestuft?",
|
|
YesNode: &DecisionNode{
|
|
ID: "kritis_essential",
|
|
Result: string(NIS2EssentialEntity),
|
|
Explanation: "KRITIS-Betreiber sind unabhängig von der Größe als besonders wichtige Einrichtungen einzustufen.",
|
|
},
|
|
NoNode: &DecisionNode{
|
|
ID: "too_small",
|
|
Result: string(NIS2NotAffected),
|
|
Explanation: "Unternehmen unterhalb der Größenschwelle ohne KRITIS-Status sind nicht von NIS2 betroffen.",
|
|
},
|
|
},
|
|
},
|
|
NoNode: &DecisionNode{
|
|
ID: "not_in_sector",
|
|
Result: string(NIS2NotAffected),
|
|
Explanation: "Unternehmen außerhalb der NIS2-Sektoren sind nicht betroffen.",
|
|
},
|
|
},
|
|
},
|
|
}
|
|
}
|