48ca0a6bef
Adds a routing layer between Pass 0a and Pass 0b that classifies obligations into atomic/compound/framework_container. Framework-container obligations (e.g. "CCM-Praktiken fuer AIS") are decomposed into concrete sub-obligations via an internal framework registry before Pass 0b composition. - New: framework_decomposition.py with routing, matching, decomposition - New: Framework registry (NIST SP 800-53, OWASP ASVS, CSA CCM) as JSON - New: Composite detection flags on atomic controls (is_composite, atomicity) - New: gen_meta fields: framework_ref, framework_domain, decomposition_source - Integration: _route_and_compose() in run_pass0b() deterministic path - 248 tests (198 decomposition + 50 framework), all passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
515 lines
22 KiB
JSON
515 lines
22 KiB
JSON
{
|
|
"framework_id": "NIST_SP800_53",
|
|
"display_name": "NIST SP 800-53 Rev. 5",
|
|
"license": {
|
|
"type": "public_domain",
|
|
"rag_allowed": true,
|
|
"use_as_metadata": true
|
|
},
|
|
"domains": [
|
|
{
|
|
"domain_id": "AC",
|
|
"title": "Access Control",
|
|
"aliases": ["access control", "zugriffskontrolle", "zugriffssteuerung"],
|
|
"keywords": ["access", "zugriff", "berechtigung", "authorization", "autorisierung"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "AC-1",
|
|
"title": "Access Control Policy and Procedures",
|
|
"statement": "Zugriffskontrollrichtlinien und -verfahren muessen definiert, dokumentiert und regelmaessig ueberprueft werden.",
|
|
"keywords": ["policy", "richtlinie", "verfahren", "procedures"],
|
|
"action_hint": "document",
|
|
"object_hint": "Zugriffskontrollrichtlinie",
|
|
"object_class": "policy"
|
|
},
|
|
{
|
|
"subcontrol_id": "AC-2",
|
|
"title": "Account Management",
|
|
"statement": "Benutzerkonten muessen ueber ihren gesamten Lebenszyklus verwaltet werden: Erstellung, Aktivierung, Aenderung, Deaktivierung und Loeschung.",
|
|
"keywords": ["account", "konto", "benutzer", "lifecycle", "lebenszyklus"],
|
|
"action_hint": "maintain",
|
|
"object_hint": "Benutzerkontenverwaltung",
|
|
"object_class": "account"
|
|
},
|
|
{
|
|
"subcontrol_id": "AC-3",
|
|
"title": "Access Enforcement",
|
|
"statement": "Der Zugriff auf Systemressourcen muss gemaess der definierten Zugriffskontrollrichtlinie durchgesetzt werden.",
|
|
"keywords": ["enforcement", "durchsetzung", "ressourcen", "system"],
|
|
"action_hint": "restrict_access",
|
|
"object_hint": "Zugriffsdurchsetzung",
|
|
"object_class": "access_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "AC-5",
|
|
"title": "Separation of Duties",
|
|
"statement": "Aufgabentrennung muss definiert und durchgesetzt werden, um Interessenkonflikte und Missbrauch zu verhindern.",
|
|
"keywords": ["separation", "trennung", "duties", "aufgaben", "funktionstrennung"],
|
|
"action_hint": "define",
|
|
"object_hint": "Aufgabentrennung",
|
|
"object_class": "role"
|
|
},
|
|
{
|
|
"subcontrol_id": "AC-6",
|
|
"title": "Least Privilege",
|
|
"statement": "Zugriffsrechte muessen nach dem Prinzip der minimalen Rechte vergeben werden.",
|
|
"keywords": ["least privilege", "minimal", "rechte", "privileg"],
|
|
"action_hint": "restrict_access",
|
|
"object_hint": "Minimale Rechtevergabe",
|
|
"object_class": "access_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "AC-7",
|
|
"title": "Unsuccessful Logon Attempts",
|
|
"statement": "Fehlgeschlagene Anmeldeversuche muessen begrenzt und ueberwacht werden.",
|
|
"keywords": ["logon", "anmeldung", "fehlgeschlagen", "sperre", "lockout"],
|
|
"action_hint": "monitor",
|
|
"object_hint": "Anmeldeversuchsueberwachung",
|
|
"object_class": "technical_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "AC-17",
|
|
"title": "Remote Access",
|
|
"statement": "Fernzugriff muss autorisiert, ueberwacht und verschluesselt werden.",
|
|
"keywords": ["remote", "fern", "vpn", "fernzugriff"],
|
|
"action_hint": "configure",
|
|
"object_hint": "Fernzugriffskonfiguration",
|
|
"object_class": "technical_control"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "AU",
|
|
"title": "Audit and Accountability",
|
|
"aliases": ["audit", "protokollierung", "accountability", "rechenschaftspflicht"],
|
|
"keywords": ["audit", "log", "protokoll", "nachvollziehbarkeit", "logging"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "AU-1",
|
|
"title": "Audit Policy and Procedures",
|
|
"statement": "Audit- und Protokollierungsrichtlinien muessen definiert und regelmaessig ueberprueft werden.",
|
|
"keywords": ["policy", "richtlinie", "audit"],
|
|
"action_hint": "document",
|
|
"object_hint": "Auditrichtlinie",
|
|
"object_class": "policy"
|
|
},
|
|
{
|
|
"subcontrol_id": "AU-2",
|
|
"title": "Event Logging",
|
|
"statement": "Sicherheitsrelevante Ereignisse muessen identifiziert und protokolliert werden.",
|
|
"keywords": ["event", "ereignis", "logging", "protokollierung"],
|
|
"action_hint": "configure",
|
|
"object_hint": "Ereignisprotokollierung",
|
|
"object_class": "configuration"
|
|
},
|
|
{
|
|
"subcontrol_id": "AU-3",
|
|
"title": "Content of Audit Records",
|
|
"statement": "Audit-Eintraege muessen ausreichende Informationen enthalten: Zeitstempel, Quelle, Ergebnis, Identitaet.",
|
|
"keywords": ["content", "inhalt", "record", "eintrag"],
|
|
"action_hint": "define",
|
|
"object_hint": "Audit-Eintragsformat",
|
|
"object_class": "record"
|
|
},
|
|
{
|
|
"subcontrol_id": "AU-6",
|
|
"title": "Audit Record Review and Reporting",
|
|
"statement": "Audit-Eintraege muessen regelmaessig ueberprueft und bei Anomalien berichtet werden.",
|
|
"keywords": ["review", "ueberpruefen", "reporting", "anomalie"],
|
|
"action_hint": "review",
|
|
"object_hint": "Audit-Ueberpruefung",
|
|
"object_class": "record"
|
|
},
|
|
{
|
|
"subcontrol_id": "AU-9",
|
|
"title": "Protection of Audit Information",
|
|
"statement": "Audit-Daten muessen vor unbefugtem Zugriff, Aenderung und Loeschung geschuetzt werden.",
|
|
"keywords": ["schutz", "protection", "integritaet", "integrity"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Audit-Datenschutz",
|
|
"object_class": "technical_control"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "AT",
|
|
"title": "Awareness and Training",
|
|
"aliases": ["awareness", "training", "schulung", "sensibilisierung"],
|
|
"keywords": ["training", "schulung", "awareness", "sensibilisierung", "weiterbildung"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "AT-1",
|
|
"title": "Policy and Procedures",
|
|
"statement": "Schulungs- und Sensibilisierungsrichtlinien muessen definiert und regelmaessig aktualisiert werden.",
|
|
"keywords": ["policy", "richtlinie"],
|
|
"action_hint": "document",
|
|
"object_hint": "Schulungsrichtlinie",
|
|
"object_class": "policy"
|
|
},
|
|
{
|
|
"subcontrol_id": "AT-2",
|
|
"title": "Literacy Training and Awareness",
|
|
"statement": "Alle Mitarbeiter muessen regelmaessig Sicherheitsschulungen erhalten.",
|
|
"keywords": ["mitarbeiter", "schulung", "sicherheit"],
|
|
"action_hint": "train",
|
|
"object_hint": "Sicherheitsschulung",
|
|
"object_class": "training"
|
|
},
|
|
{
|
|
"subcontrol_id": "AT-3",
|
|
"title": "Role-Based Training",
|
|
"statement": "Rollenbasierte Sicherheitsschulungen muessen fuer Mitarbeiter mit besonderen Sicherheitsaufgaben durchgefuehrt werden.",
|
|
"keywords": ["rollenbasiert", "role-based", "speziell"],
|
|
"action_hint": "train",
|
|
"object_hint": "Rollenbasierte Sicherheitsschulung",
|
|
"object_class": "training"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "CM",
|
|
"title": "Configuration Management",
|
|
"aliases": ["configuration management", "konfigurationsmanagement", "konfiguration"],
|
|
"keywords": ["konfiguration", "configuration", "baseline", "haertung", "hardening"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "CM-1",
|
|
"title": "Policy and Procedures",
|
|
"statement": "Konfigurationsmanagement-Richtlinien muessen dokumentiert und gepflegt werden.",
|
|
"keywords": ["policy", "richtlinie"],
|
|
"action_hint": "document",
|
|
"object_hint": "Konfigurationsmanagement-Richtlinie",
|
|
"object_class": "policy"
|
|
},
|
|
{
|
|
"subcontrol_id": "CM-2",
|
|
"title": "Baseline Configuration",
|
|
"statement": "Basiskonfigurationen fuer Systeme muessen definiert, dokumentiert und gepflegt werden.",
|
|
"keywords": ["baseline", "basis", "standard"],
|
|
"action_hint": "define",
|
|
"object_hint": "Basiskonfiguration",
|
|
"object_class": "configuration"
|
|
},
|
|
{
|
|
"subcontrol_id": "CM-6",
|
|
"title": "Configuration Settings",
|
|
"statement": "Sicherheitsrelevante Konfigurationseinstellungen muessen definiert und durchgesetzt werden.",
|
|
"keywords": ["settings", "einstellungen", "sicherheit"],
|
|
"action_hint": "configure",
|
|
"object_hint": "Sicherheitskonfiguration",
|
|
"object_class": "configuration"
|
|
},
|
|
{
|
|
"subcontrol_id": "CM-7",
|
|
"title": "Least Functionality",
|
|
"statement": "Systeme muessen so konfiguriert werden, dass nur notwendige Funktionen aktiv sind.",
|
|
"keywords": ["least functionality", "minimal", "dienste", "ports"],
|
|
"action_hint": "configure",
|
|
"object_hint": "Minimalkonfiguration",
|
|
"object_class": "configuration"
|
|
},
|
|
{
|
|
"subcontrol_id": "CM-8",
|
|
"title": "System Component Inventory",
|
|
"statement": "Ein Inventar aller Systemkomponenten muss gefuehrt und aktuell gehalten werden.",
|
|
"keywords": ["inventar", "inventory", "komponenten", "assets"],
|
|
"action_hint": "maintain",
|
|
"object_hint": "Systemkomponenten-Inventar",
|
|
"object_class": "register"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "IA",
|
|
"title": "Identification and Authentication",
|
|
"aliases": ["identification", "authentication", "identifikation", "authentifizierung"],
|
|
"keywords": ["authentifizierung", "identifikation", "identity", "passwort", "mfa", "credential"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "IA-1",
|
|
"title": "Policy and Procedures",
|
|
"statement": "Identifikations- und Authentifizierungsrichtlinien muessen dokumentiert und regelmaessig ueberprueft werden.",
|
|
"keywords": ["policy", "richtlinie"],
|
|
"action_hint": "document",
|
|
"object_hint": "Authentifizierungsrichtlinie",
|
|
"object_class": "policy"
|
|
},
|
|
{
|
|
"subcontrol_id": "IA-2",
|
|
"title": "Identification and Authentication",
|
|
"statement": "Benutzer und Geraete muessen eindeutig identifiziert und authentifiziert werden.",
|
|
"keywords": ["benutzer", "geraete", "identifizierung"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Benutzerauthentifizierung",
|
|
"object_class": "technical_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "IA-2(1)",
|
|
"title": "Multi-Factor Authentication",
|
|
"statement": "Multi-Faktor-Authentifizierung muss fuer privilegierte Konten implementiert werden.",
|
|
"keywords": ["mfa", "multi-faktor", "zwei-faktor", "2fa"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Multi-Faktor-Authentifizierung",
|
|
"object_class": "technical_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "IA-5",
|
|
"title": "Authenticator Management",
|
|
"statement": "Authentifizierungsmittel (Passwoerter, Token, Zertifikate) muessen sicher verwaltet werden.",
|
|
"keywords": ["passwort", "token", "zertifikat", "credential"],
|
|
"action_hint": "maintain",
|
|
"object_hint": "Authentifizierungsmittel-Verwaltung",
|
|
"object_class": "technical_control"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "IR",
|
|
"title": "Incident Response",
|
|
"aliases": ["incident response", "vorfallbehandlung", "vorfallreaktion", "incident management"],
|
|
"keywords": ["vorfall", "incident", "reaktion", "response", "breach", "sicherheitsvorfall"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "IR-1",
|
|
"title": "Policy and Procedures",
|
|
"statement": "Vorfallreaktionsrichtlinien und -verfahren muessen definiert und regelmaessig aktualisiert werden.",
|
|
"keywords": ["policy", "richtlinie", "verfahren"],
|
|
"action_hint": "document",
|
|
"object_hint": "Vorfallreaktionsrichtlinie",
|
|
"object_class": "policy"
|
|
},
|
|
{
|
|
"subcontrol_id": "IR-2",
|
|
"title": "Incident Response Training",
|
|
"statement": "Mitarbeiter muessen regelmaessig in der Vorfallreaktion geschult werden.",
|
|
"keywords": ["training", "schulung"],
|
|
"action_hint": "train",
|
|
"object_hint": "Vorfallreaktionsschulung",
|
|
"object_class": "training"
|
|
},
|
|
{
|
|
"subcontrol_id": "IR-4",
|
|
"title": "Incident Handling",
|
|
"statement": "Ein strukturierter Prozess fuer die Vorfallbehandlung muss implementiert werden: Erkennung, Analyse, Eindaemmung, Behebung.",
|
|
"keywords": ["handling", "behandlung", "erkennung", "eindaemmung"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Vorfallbehandlungsprozess",
|
|
"object_class": "process"
|
|
},
|
|
{
|
|
"subcontrol_id": "IR-5",
|
|
"title": "Incident Monitoring",
|
|
"statement": "Sicherheitsvorfaelle muessen kontinuierlich ueberwacht und verfolgt werden.",
|
|
"keywords": ["monitoring", "ueberwachung", "tracking"],
|
|
"action_hint": "monitor",
|
|
"object_hint": "Vorfallsueberwachung",
|
|
"object_class": "incident"
|
|
},
|
|
{
|
|
"subcontrol_id": "IR-6",
|
|
"title": "Incident Reporting",
|
|
"statement": "Sicherheitsvorfaelle muessen innerhalb definierter Fristen an die zustaendigen Stellen gemeldet werden.",
|
|
"keywords": ["reporting", "meldung", "melden", "frist"],
|
|
"action_hint": "report",
|
|
"object_hint": "Vorfallmeldung",
|
|
"object_class": "incident"
|
|
},
|
|
{
|
|
"subcontrol_id": "IR-8",
|
|
"title": "Incident Response Plan",
|
|
"statement": "Ein Vorfallreaktionsplan muss dokumentiert und regelmaessig getestet werden.",
|
|
"keywords": ["plan", "dokumentation", "test"],
|
|
"action_hint": "document",
|
|
"object_hint": "Vorfallreaktionsplan",
|
|
"object_class": "policy"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "RA",
|
|
"title": "Risk Assessment",
|
|
"aliases": ["risk assessment", "risikobewertung", "risikoanalyse"],
|
|
"keywords": ["risiko", "risk", "bewertung", "assessment", "analyse", "bedrohung", "threat"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "RA-1",
|
|
"title": "Policy and Procedures",
|
|
"statement": "Risikobewertungsrichtlinien muessen dokumentiert und regelmaessig aktualisiert werden.",
|
|
"keywords": ["policy", "richtlinie"],
|
|
"action_hint": "document",
|
|
"object_hint": "Risikobewertungsrichtlinie",
|
|
"object_class": "policy"
|
|
},
|
|
{
|
|
"subcontrol_id": "RA-3",
|
|
"title": "Risk Assessment",
|
|
"statement": "Regelmaessige Risikobewertungen muessen durchgefuehrt und dokumentiert werden.",
|
|
"keywords": ["bewertung", "assessment", "regelmaessig"],
|
|
"action_hint": "assess",
|
|
"object_hint": "Risikobewertung",
|
|
"object_class": "risk_artifact"
|
|
},
|
|
{
|
|
"subcontrol_id": "RA-5",
|
|
"title": "Vulnerability Monitoring and Scanning",
|
|
"statement": "Systeme muessen regelmaessig auf Schwachstellen gescannt und ueberwacht werden.",
|
|
"keywords": ["vulnerability", "schwachstelle", "scan", "monitoring"],
|
|
"action_hint": "monitor",
|
|
"object_hint": "Schwachstellenueberwachung",
|
|
"object_class": "system"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "SC",
|
|
"title": "System and Communications Protection",
|
|
"aliases": ["system protection", "communications protection", "kommunikationsschutz", "systemschutz"],
|
|
"keywords": ["verschluesselung", "encryption", "tls", "netzwerk", "network", "kommunikation", "firewall"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "SC-1",
|
|
"title": "Policy and Procedures",
|
|
"statement": "System- und Kommunikationsschutzrichtlinien muessen dokumentiert und aktuell gehalten werden.",
|
|
"keywords": ["policy", "richtlinie"],
|
|
"action_hint": "document",
|
|
"object_hint": "Kommunikationsschutzrichtlinie",
|
|
"object_class": "policy"
|
|
},
|
|
{
|
|
"subcontrol_id": "SC-7",
|
|
"title": "Boundary Protection",
|
|
"statement": "Netzwerkgrenzen muessen durch Firewall-Regeln und Zugangskontrollen geschuetzt werden.",
|
|
"keywords": ["boundary", "grenze", "firewall", "netzwerk"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Netzwerkgrenzschutz",
|
|
"object_class": "technical_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "SC-8",
|
|
"title": "Transmission Confidentiality and Integrity",
|
|
"statement": "Daten muessen bei der Uebertragung durch Verschluesselung geschuetzt werden.",
|
|
"keywords": ["transmission", "uebertragung", "verschluesselung", "tls"],
|
|
"action_hint": "encrypt",
|
|
"object_hint": "Uebertragungsverschluesselung",
|
|
"object_class": "cryptographic_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "SC-12",
|
|
"title": "Cryptographic Key Establishment and Management",
|
|
"statement": "Kryptographische Schluessel muessen sicher erzeugt, verteilt, gespeichert und widerrufen werden.",
|
|
"keywords": ["key", "schluessel", "kryptographie", "management"],
|
|
"action_hint": "maintain",
|
|
"object_hint": "Schluesselverwaltung",
|
|
"object_class": "cryptographic_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "SC-13",
|
|
"title": "Cryptographic Protection",
|
|
"statement": "Kryptographische Mechanismen muessen gemaess anerkannten Standards implementiert werden.",
|
|
"keywords": ["kryptographie", "verschluesselung", "standard"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Kryptographischer Schutz",
|
|
"object_class": "cryptographic_control"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "SI",
|
|
"title": "System and Information Integrity",
|
|
"aliases": ["system integrity", "information integrity", "systemintegritaet", "informationsintegritaet"],
|
|
"keywords": ["integritaet", "integrity", "malware", "patch", "flaw", "schwachstelle"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "SI-1",
|
|
"title": "Policy and Procedures",
|
|
"statement": "System- und Informationsintegritaetsrichtlinien muessen dokumentiert und regelmaessig ueberprueft werden.",
|
|
"keywords": ["policy", "richtlinie"],
|
|
"action_hint": "document",
|
|
"object_hint": "Integritaetsrichtlinie",
|
|
"object_class": "policy"
|
|
},
|
|
{
|
|
"subcontrol_id": "SI-2",
|
|
"title": "Flaw Remediation",
|
|
"statement": "Bekannte Schwachstellen muessen innerhalb definierter Fristen behoben werden.",
|
|
"keywords": ["flaw", "schwachstelle", "patch", "behebung", "remediation"],
|
|
"action_hint": "remediate",
|
|
"object_hint": "Schwachstellenbehebung",
|
|
"object_class": "system"
|
|
},
|
|
{
|
|
"subcontrol_id": "SI-3",
|
|
"title": "Malicious Code Protection",
|
|
"statement": "Systeme muessen vor Schadsoftware geschuetzt werden durch Erkennung und Abwehrmechanismen.",
|
|
"keywords": ["malware", "schadsoftware", "antivirus", "erkennung"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Schadsoftwareschutz",
|
|
"object_class": "technical_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "SI-4",
|
|
"title": "System Monitoring",
|
|
"statement": "Systeme muessen kontinuierlich auf Sicherheitsereignisse und Anomalien ueberwacht werden.",
|
|
"keywords": ["monitoring", "ueberwachung", "anomalie", "siem"],
|
|
"action_hint": "monitor",
|
|
"object_hint": "Systemueberwachung",
|
|
"object_class": "system"
|
|
},
|
|
{
|
|
"subcontrol_id": "SI-5",
|
|
"title": "Security Alerts and Advisories",
|
|
"statement": "Sicherheitswarnungen muessen empfangen, bewertet und darauf reagiert werden.",
|
|
"keywords": ["alert", "warnung", "advisory", "cve"],
|
|
"action_hint": "monitor",
|
|
"object_hint": "Sicherheitswarnungen",
|
|
"object_class": "incident"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "SA",
|
|
"title": "System and Services Acquisition",
|
|
"aliases": ["system acquisition", "services acquisition", "systembeschaffung", "secure development"],
|
|
"keywords": ["beschaffung", "acquisition", "entwicklung", "development", "lieferkette", "supply chain"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "SA-1",
|
|
"title": "Policy and Procedures",
|
|
"statement": "Beschaffungsrichtlinien mit Sicherheitsanforderungen muessen dokumentiert werden.",
|
|
"keywords": ["policy", "richtlinie", "beschaffung"],
|
|
"action_hint": "document",
|
|
"object_hint": "Beschaffungsrichtlinie",
|
|
"object_class": "policy"
|
|
},
|
|
{
|
|
"subcontrol_id": "SA-8",
|
|
"title": "Security and Privacy Engineering Principles",
|
|
"statement": "Sicherheits- und Datenschutzprinzipien muessen in die Systementwicklung integriert werden.",
|
|
"keywords": ["engineering", "development", "prinzipien", "design"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Security-by-Design-Prinzipien",
|
|
"object_class": "process"
|
|
},
|
|
{
|
|
"subcontrol_id": "SA-11",
|
|
"title": "Developer Testing and Evaluation",
|
|
"statement": "Entwickler muessen Sicherheitstests und Code-Reviews durchfuehren.",
|
|
"keywords": ["testing", "test", "code review", "evaluation"],
|
|
"action_hint": "test",
|
|
"object_hint": "Entwickler-Sicherheitstests",
|
|
"object_class": "process"
|
|
},
|
|
{
|
|
"subcontrol_id": "SA-12",
|
|
"title": "Supply Chain Protection",
|
|
"statement": "Lieferkettenrisiken muessen bewertet und Schutzmassnahmen implementiert werden.",
|
|
"keywords": ["supply chain", "lieferkette", "third party", "drittanbieter"],
|
|
"action_hint": "assess",
|
|
"object_hint": "Lieferkettenrisikobewertung",
|
|
"object_class": "risk_artifact"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|