95fcba34cd
Some checks failed
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-ai-compliance (push) Failing after 30s
CI / test-python-backend-compliance (push) Successful in 30s
CI / test-python-document-crawler (push) Successful in 21s
CI / test-python-dsms-gateway (push) Successful in 17s
- Ruff: 144 auto-fixes (unused imports, == None → is None), F821/F811/F841 manuell - CVEs: python-multipart>=0.0.22, weasyprint>=68.0, pillow>=12.1.1, npm audit fix (0 vulns) - TS: 5 tote Drafting-Engine-Dateien entfernt, allowed-facts/sanitizer/StepHeader/context fixes - Tests: +104 (ISMS 58, Evidence 18, VVT 14, Generation 14) → 1449 passed - Refactoring: collect_ci_evidence (F→A), row_to_response (E→A), extract_requirements (E→A) - Dead Code: pca-platform, 7 Go-Handler, dsr_api.py, duplicate Schemas entfernt Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
69 lines
3.6 KiB
Python
69 lines
3.6 KiB
Python
"""TOM template generator — creates TOM checklist based on regulatory flags."""
|
|
|
|
_BASE_TOMS = [
|
|
{"category": "Zutrittskontrolle", "name": "Physische Zugangskontrollen", "description": "Schlüssel, Kartenleser, Videoüberwachung"},
|
|
{"category": "Zugangskontrolle", "name": "Authentifizierung", "description": "Passwortrichtlinien, MFA, SSO"},
|
|
{"category": "Zugriffskontrolle", "name": "Berechtigungskonzept", "description": "RBAC, Least Privilege, regelmäßige Reviews"},
|
|
{"category": "Weitergabekontrolle", "name": "Verschlüsselung im Transit", "description": "TLS 1.3 für alle Verbindungen"},
|
|
{"category": "Eingabekontrolle", "name": "Audit-Logging", "description": "Protokollierung aller Datenänderungen"},
|
|
{"category": "Auftragskontrolle", "name": "AV-Verträge", "description": "Art. 28 DSGVO Auftragsverarbeitungsverträge"},
|
|
{"category": "Verfügbarkeitskontrolle", "name": "Backup & Recovery", "description": "Regelmäßige Backups, Disaster Recovery Plan"},
|
|
{"category": "Trennungsgebot", "name": "Mandantentrennung", "description": "Logische Datentrennung nach Mandanten"},
|
|
]
|
|
|
|
_NIS2_TOMS = [
|
|
{"category": "Cybersicherheit", "name": "Incident Response Plan", "description": "NIS2-konformer Vorfallreaktionsplan (72h Meldepflicht)"},
|
|
{"category": "Cybersicherheit", "name": "Supply Chain Security", "description": "Bewertung der Lieferkettensicherheit"},
|
|
{"category": "Cybersicherheit", "name": "Vulnerability Management", "description": "Regelmäßige Schwachstellenscans und Patch-Management"},
|
|
]
|
|
|
|
_ISO27001_TOMS = [
|
|
{"category": "ISMS", "name": "Risikomanagement", "description": "ISO 27001 Anhang A — Informationssicherheits-Risikobewertung"},
|
|
{"category": "ISMS", "name": "Dokumentenlenkung", "description": "Versionierte Sicherheitsrichtlinien und -verfahren"},
|
|
{"category": "ISMS", "name": "Management Review", "description": "Jährliche Überprüfung des ISMS durch die Geschäftsleitung"},
|
|
]
|
|
|
|
_AI_ACT_TOMS = [
|
|
{"category": "KI-Compliance", "name": "KI-Risikoklassifizierung", "description": "Bewertung aller KI-Systeme nach EU AI Act Risikokategorien"},
|
|
{"category": "KI-Compliance", "name": "Human Oversight", "description": "Menschliche Aufsicht für Hochrisiko-KI-Systeme sicherstellen"},
|
|
{"category": "KI-Compliance", "name": "KI-Transparenz", "description": "Transparenzpflichten bei KI-Einsatz gegenüber Betroffenen"},
|
|
]
|
|
|
|
|
|
def generate_tom_drafts(ctx: dict) -> list[dict]:
|
|
"""Generate TOM measure drafts based on regulatory flags.
|
|
|
|
Args:
|
|
ctx: Flat dict from company-profile/template-context
|
|
|
|
Returns:
|
|
List of TOM measure dicts ready for creation
|
|
"""
|
|
measures = list(_BASE_TOMS)
|
|
|
|
if ctx.get("subject_to_nis2"):
|
|
measures.extend(_NIS2_TOMS)
|
|
|
|
if ctx.get("subject_to_iso27001"):
|
|
measures.extend(_ISO27001_TOMS)
|
|
|
|
if ctx.get("subject_to_ai_act") or ctx.get("has_ai_systems"):
|
|
measures.extend(_AI_ACT_TOMS)
|
|
|
|
# Enrich with metadata
|
|
result = []
|
|
for i, m in enumerate(measures, 1):
|
|
result.append({
|
|
"control_id": f"TOM-AUTO-{i:03d}",
|
|
"name": m["name"],
|
|
"description": m["description"],
|
|
"category": m["category"],
|
|
"type": "technical" if m["category"] in ("Zugangskontrolle", "Zugriffskontrolle", "Weitergabekontrolle", "Cybersicherheit") else "organizational",
|
|
"implementation_status": "planned",
|
|
"responsible_department": "IT-Sicherheit",
|
|
"priority": "high" if "KI" in m.get("category", "") or "Cyber" in m.get("category", "") else "medium",
|
|
"review_frequency": f"{ctx.get('review_cycle_months', 12)} Monate",
|
|
})
|
|
|
|
return result
|