a1980cd12d
All checks were successful
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-ai-compliance (push) Successful in 37s
CI / test-python-backend-compliance (push) Successful in 33s
CI / test-python-document-crawler (push) Successful in 23s
CI / test-python-dsms-gateway (push) Successful in 18s
- reporting_handlers.go: uuid.Nil-Check vor Store-Aufruf (→ 400) - reporting_handlers_test.go: 4 MissingTenantID-Tests (PASS) + 4 WithTenant-Tests (SKIP) - docs-src: requirements.md, controls.md, evidence.md, risks.md (je mit API, Schema, Tests) - mkdocs.yml: 4 neue Nav-Einträge + \n-Bug auf Zeile 91 behoben - compliance-kern.md: Link-Hinweise zu Detailseiten ergänzt Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
125 lines
3.1 KiB
Markdown
125 lines
3.1 KiB
Markdown
# Risiken (CP-RSK)
|
||
|
||
Verwaltet Datenschutz- und KI-Risiken mit Risikobewertung nach Likelihood × Impact.
|
||
|
||
**Prefix:** `CP-RSK` · **Frontend:** `https://macmini:3007/sdk/risks`
|
||
**Proxy:** `/api/sdk/v1/compliance/[[...path]]` → `backend-compliance:8002/compliance/...`
|
||
|
||
---
|
||
|
||
## Features
|
||
|
||
- Risikomatrix (Likelihood × Impact, 5×5)
|
||
- Kategorisierung nach Datenschutz, KI, Betrieb, Sicherheit
|
||
- Status-Tracking: open / mitigated / accepted / closed
|
||
- Restrisiko nach Mitigationsmaßnahmen
|
||
- Verknüpfung mit Controls
|
||
|
||
---
|
||
|
||
## Rechtsgrundlage
|
||
|
||
| Artikel | Bezug |
|
||
|---------|-------|
|
||
| Art. 24 DSGVO | Risikobasierter Ansatz |
|
||
| Art. 32 DSGVO | Risikobewertung für Sicherheitsmaßnahmen |
|
||
| Art. 35 DSGVO | DSFA bei hohem Risiko |
|
||
| Art. 9 AI Act | Risikomanagementsystem für KI |
|
||
|
||
---
|
||
|
||
## Risikobewertung
|
||
|
||
| Stufe | Likelihood × Impact | Farbe |
|
||
|-------|---------------------|-------|
|
||
| `low` | ≤ 4 | Grün |
|
||
| `medium` | 5–9 | Gelb |
|
||
| `high` | 10–19 | Orange |
|
||
| `critical` | ≥ 20 | Rot |
|
||
|
||
---
|
||
|
||
## API Endpoints
|
||
|
||
| Methode | Pfad | Beschreibung |
|
||
|---------|------|--------------|
|
||
| `GET` | `/risks` | Liste (`category`, `status`, `risk_level`) |
|
||
| `POST` | `/risks` | Neues Risiko anlegen |
|
||
| `PUT` | `/risks/{risk_id}` | Risiko aktualisieren (Status, Restrisiko) |
|
||
| `DELETE` | `/risks/{risk_id}` | Risiko löschen |
|
||
| `GET` | `/risks/matrix` | Risikomatrix (Likelihood × Impact) |
|
||
|
||
### Risikomatrix-Response
|
||
|
||
```http
|
||
GET /risks/matrix
|
||
```
|
||
|
||
```json
|
||
{
|
||
"matrix": {
|
||
"3": { "4": ["RISK-001", "RISK-007"] },
|
||
"1": { "1": [] }
|
||
},
|
||
"risks": [...]
|
||
}
|
||
```
|
||
|
||
Die Matrix ist nach `likelihood` (1–5) → `impact` (1–5) → `[risk_ids]` strukturiert.
|
||
|
||
### Request-Beispiel (POST)
|
||
|
||
```json
|
||
{
|
||
"title": "Unbefugter Datenzugriff durch Dritte",
|
||
"category": "data_privacy",
|
||
"likelihood": 3,
|
||
"impact": 4,
|
||
"description": "Dritte könnten über unsichere APIs auf personenbezogene Daten zugreifen.",
|
||
"mitigation": "Einführung von API-Gateway mit Authentifizierung"
|
||
}
|
||
```
|
||
|
||
---
|
||
|
||
## Frontend
|
||
|
||
**URL:** `https://macmini:3007/sdk/risks`
|
||
|
||
Interaktive Risikomatrix als 5×5-Heatmap. Listenansicht mit Status-Badges und Kategorie-Filter. Neue Risiken können über ein Formular angelegt und direkt gemindert werden.
|
||
|
||
---
|
||
|
||
## Datenbankschema
|
||
|
||
```sql
|
||
compliance_risks (
|
||
id UUID PRIMARY KEY,
|
||
risk_id VARCHAR UNIQUE, -- z.B. "RISK-001"
|
||
title TEXT,
|
||
category VARCHAR, -- data_privacy/ai/operational/security
|
||
description TEXT,
|
||
likelihood INTEGER CHECK (likelihood BETWEEN 1 AND 5),
|
||
impact INTEGER CHECK (impact BETWEEN 1 AND 5),
|
||
inherent_risk VARCHAR, -- low/medium/high/critical
|
||
residual_risk VARCHAR,
|
||
status VARCHAR DEFAULT 'open',
|
||
mitigation TEXT,
|
||
owner VARCHAR,
|
||
created_at TIMESTAMP,
|
||
updated_at TIMESTAMP
|
||
)
|
||
```
|
||
|
||
---
|
||
|
||
## Tests
|
||
|
||
**Testdatei:** `backend-compliance/tests/test_risk_routes.py`
|
||
**Anzahl Tests:** 16 (+ 8 aus Paket 2) · **Status:** ✅ alle bestanden (Stand 2026-03-05)
|
||
|
||
```bash
|
||
cd backend-compliance
|
||
python3 -m pytest tests/test_risk_routes.py -v
|
||
```
|