a1980cd12d
All checks were successful
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-ai-compliance (push) Successful in 37s
CI / test-python-backend-compliance (push) Successful in 33s
CI / test-python-document-crawler (push) Successful in 23s
CI / test-python-dsms-gateway (push) Successful in 18s
- reporting_handlers.go: uuid.Nil-Check vor Store-Aufruf (→ 400) - reporting_handlers_test.go: 4 MissingTenantID-Tests (PASS) + 4 WithTenant-Tests (SKIP) - docs-src: requirements.md, controls.md, evidence.md, risks.md (je mit API, Schema, Tests) - mkdocs.yml: 4 neue Nav-Einträge + \n-Bug auf Zeile 91 behoben - compliance-kern.md: Link-Hinweise zu Detailseiten ergänzt Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
127 lines
3.2 KiB
Markdown
127 lines
3.2 KiB
Markdown
# Controls (CP-CTR)
|
|
|
|
Verwaltet technische und organisatorische Kontrollen (TOMs, Prozesse) und deren Prüfstatus.
|
|
|
|
**Prefix:** `CP-CTR` · **Frontend:** `https://macmini:3007/sdk/controls`
|
|
**Proxy:** `/api/sdk/v1/compliance/[[...path]]` → `backend-compliance:8002/compliance/...`
|
|
|
|
---
|
|
|
|
## Features
|
|
|
|
- Domain-basierte Filterung (gov, priv, iam, crypto, sdlc, ops, ai, cra, aud)
|
|
- Status-Tracking: pass / partial / fail / planned / n/a
|
|
- Evidence-Count pro Control
|
|
- KI-basierte Control-Vorschläge via RAG
|
|
- Automatisierte Controls via CI/CD-Ingest
|
|
|
|
---
|
|
|
|
## Rechtsgrundlage
|
|
|
|
| Artikel | Bezug |
|
|
|---------|-------|
|
|
| Art. 24 DSGVO | Verantwortlichkeit des Verantwortlichen |
|
|
| Art. 32 DSGVO | Sicherheit der Verarbeitung (TOMs) |
|
|
| Art. 9 AI Act | Risikomanagementsystem |
|
|
|
|
---
|
|
|
|
## Status-Enum
|
|
|
|
| Wert | Bedeutung |
|
|
|------|-----------|
|
|
| `pass` | Vollständig implementiert und geprüft |
|
|
| `partial` | Teilweise implementiert |
|
|
| `fail` | Nicht bestanden |
|
|
| `planned` | In Planung |
|
|
| `n/a` | Nicht anwendbar |
|
|
|
|
## Domain-Enum
|
|
|
|
`gov` · `priv` · `iam` · `crypto` · `sdlc` · `ops` · `ai` · `cra` · `aud`
|
|
|
|
---
|
|
|
|
## API Endpoints
|
|
|
|
| Methode | Pfad | Beschreibung |
|
|
|---------|------|--------------|
|
|
| `GET` | `/compliance/controls` | Liste mit Filtern (`domain`, `status`, `is_automated`, `search`) |
|
|
| `GET` | `/compliance/controls/paginated` | Paginiert (`page`, `page_size`) |
|
|
| `GET` | `/compliance/controls/{control_id}` | Einzelne Kontrolle + Evidence-Count |
|
|
| `PUT` | `/compliance/controls/{control_id}` | Titel, Status, Notizen aktualisieren |
|
|
| `PUT` | `/compliance/controls/{control_id}/review` | Kontrolle als geprüft markieren |
|
|
| `GET` | `/compliance/controls/by-domain/{domain}` | Alle Controls einer Domain |
|
|
|
|
### KI-Controls aus RAG vorschlagen
|
|
|
|
```http
|
|
POST /compliance/ai/suggest-controls
|
|
{
|
|
"requirement_id": "uuid-der-anforderung"
|
|
}
|
|
```
|
|
|
|
Gibt bis zu 5 KI-generierte Control-Vorschläge zurück:
|
|
|
|
```json
|
|
{
|
|
"requirement_id": "...",
|
|
"suggestions": [
|
|
{
|
|
"control_id": "GOV-KI-001",
|
|
"domain": "gov",
|
|
"title": "Datenschutzbeauftragter für KI-Systeme",
|
|
"description": "...",
|
|
"pass_criteria": "DSB nachweislich ernannt",
|
|
"is_automated": false,
|
|
"priority": 1,
|
|
"confidence_score": 0.87
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## Frontend
|
|
|
|
**URL:** `https://macmini:3007/sdk/controls`
|
|
|
|
Tabelle mit Domain-Tabs und Status-Badges. "KI-Controls aus RAG vorschlagen"-Button öffnet ein Modal mit Vorschlägen basierend auf einer ausgewählten Anforderung.
|
|
|
|
---
|
|
|
|
## Datenbankschema
|
|
|
|
```sql
|
|
compliance_controls (
|
|
id UUID PRIMARY KEY,
|
|
control_id VARCHAR UNIQUE, -- z.B. "GOV-001"
|
|
domain VARCHAR, -- gov/priv/iam/...
|
|
control_type VARCHAR, -- technical/organizational
|
|
title TEXT,
|
|
description TEXT,
|
|
status VARCHAR DEFAULT 'planned',
|
|
is_automated BOOLEAN DEFAULT false,
|
|
evidence_count INTEGER DEFAULT 0,
|
|
last_review TIMESTAMP,
|
|
notes TEXT,
|
|
created_at TIMESTAMP,
|
|
updated_at TIMESTAMP
|
|
)
|
|
```
|
|
|
|
---
|
|
|
|
## Tests
|
|
|
|
**Testdatei:** `backend-compliance/tests/test_control_routes.py`
|
|
**Anzahl Tests:** 21 · **Status:** ✅ alle bestanden (Stand 2026-03-05)
|
|
|
|
```bash
|
|
cd backend-compliance
|
|
python3 -m pytest tests/test_control_routes.py -v
|
|
```
|