4b1eede45b
Phase A: TOM document HTML generator (12 sections, inline CSS, A4 print) Phase B: TOMDocumentTab component (org-header form, revisions, print/download) Phase C: 11 compliance checks with severity-weighted scoring Phase D: MkDocs documentation for TOM module Phase E: 25 new controls (63 → 88) in 13 categories Canonical Control Mapping (three-layer architecture): - Migration 068: tom_control_mappings + tom_control_sync_state tables - 6 API endpoints: sync, list, by-tom, stats, manual add, delete - Category mapping: 13 TOM categories → 17 canonical categories - Frontend: sync button + coverage card (Overview), drill-down (Editor), belegende Controls count (Document) - 20 tests (unit + API with mocked DB) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
907 lines
32 KiB
TypeScript
907 lines
32 KiB
TypeScript
// =============================================================================
|
|
// TOM Module - TOM-Dokumentation Document Generator
|
|
// Generates a printable, audit-ready HTML document according to DSGVO Art. 32
|
|
// =============================================================================
|
|
|
|
import type {
|
|
TOMGeneratorState,
|
|
DerivedTOM,
|
|
CompanyProfile,
|
|
RiskProfile,
|
|
ControlCategory,
|
|
} from './tom-generator/types'
|
|
|
|
import { SDM_CATEGORY_MAPPING } from './tom-generator/types'
|
|
|
|
import {
|
|
getControlById,
|
|
getControlsByCategory,
|
|
getAllCategories,
|
|
getCategoryMetadata,
|
|
} from './tom-generator/controls/loader'
|
|
|
|
import type { TOMComplianceCheckResult, TOMComplianceIssueSeverity } from './tom-compliance'
|
|
|
|
// =============================================================================
|
|
// TYPES
|
|
// =============================================================================
|
|
|
|
export interface TOMDocumentOrgHeader {
|
|
organizationName: string
|
|
industry: string
|
|
dpoName: string
|
|
dpoContact: string
|
|
responsiblePerson: string
|
|
itSecurityContact: string
|
|
locations: string[]
|
|
employeeCount: string
|
|
documentVersion: string
|
|
lastReviewDate: string
|
|
nextReviewDate: string
|
|
reviewInterval: string
|
|
}
|
|
|
|
export interface TOMDocumentRevision {
|
|
version: string
|
|
date: string
|
|
author: string
|
|
changes: string
|
|
}
|
|
|
|
// =============================================================================
|
|
// DEFAULTS
|
|
// =============================================================================
|
|
|
|
export function createDefaultTOMDocumentOrgHeader(): TOMDocumentOrgHeader {
|
|
const now = new Date()
|
|
const nextYear = new Date()
|
|
nextYear.setFullYear(nextYear.getFullYear() + 1)
|
|
|
|
return {
|
|
organizationName: '',
|
|
industry: '',
|
|
dpoName: '',
|
|
dpoContact: '',
|
|
responsiblePerson: '',
|
|
itSecurityContact: '',
|
|
locations: [],
|
|
employeeCount: '',
|
|
documentVersion: '1.0',
|
|
lastReviewDate: now.toISOString().split('T')[0],
|
|
nextReviewDate: nextYear.toISOString().split('T')[0],
|
|
reviewInterval: 'Jaehrlich',
|
|
}
|
|
}
|
|
|
|
// =============================================================================
|
|
// SEVERITY LABELS (for Compliance Status section)
|
|
// =============================================================================
|
|
|
|
const SEVERITY_LABELS_DE: Record<TOMComplianceIssueSeverity, string> = {
|
|
CRITICAL: 'Kritisch',
|
|
HIGH: 'Hoch',
|
|
MEDIUM: 'Mittel',
|
|
LOW: 'Niedrig',
|
|
}
|
|
|
|
const SEVERITY_COLORS: Record<TOMComplianceIssueSeverity, string> = {
|
|
CRITICAL: '#dc2626',
|
|
HIGH: '#ea580c',
|
|
MEDIUM: '#d97706',
|
|
LOW: '#6b7280',
|
|
}
|
|
|
|
// =============================================================================
|
|
// CATEGORY LABELS (German)
|
|
// =============================================================================
|
|
|
|
const CATEGORY_LABELS_DE: Record<ControlCategory, string> = {
|
|
ACCESS_CONTROL: 'Zutrittskontrolle',
|
|
ADMISSION_CONTROL: 'Zugangskontrolle',
|
|
ACCESS_AUTHORIZATION: 'Zugriffskontrolle',
|
|
TRANSFER_CONTROL: 'Weitergabekontrolle',
|
|
INPUT_CONTROL: 'Eingabekontrolle',
|
|
ORDER_CONTROL: 'Auftragskontrolle',
|
|
AVAILABILITY: 'Verfuegbarkeit',
|
|
SEPARATION: 'Trennbarkeit',
|
|
ENCRYPTION: 'Verschluesselung',
|
|
PSEUDONYMIZATION: 'Pseudonymisierung',
|
|
RESILIENCE: 'Belastbarkeit',
|
|
RECOVERY: 'Wiederherstellbarkeit',
|
|
REVIEW: 'Ueberpruefung & Bewertung',
|
|
}
|
|
|
|
// =============================================================================
|
|
// STATUS & APPLICABILITY LABELS
|
|
// =============================================================================
|
|
|
|
const STATUS_LABELS_DE: Record<string, string> = {
|
|
IMPLEMENTED: 'Umgesetzt',
|
|
PARTIAL: 'Teilweise umgesetzt',
|
|
NOT_IMPLEMENTED: 'Nicht umgesetzt',
|
|
}
|
|
|
|
const STATUS_BADGE_CLASSES: Record<string, string> = {
|
|
IMPLEMENTED: 'badge-active',
|
|
PARTIAL: 'badge-review',
|
|
NOT_IMPLEMENTED: 'badge-critical',
|
|
}
|
|
|
|
const APPLICABILITY_LABELS_DE: Record<string, string> = {
|
|
REQUIRED: 'Erforderlich',
|
|
RECOMMENDED: 'Empfohlen',
|
|
OPTIONAL: 'Optional',
|
|
NOT_APPLICABLE: 'Nicht anwendbar',
|
|
}
|
|
|
|
// =============================================================================
|
|
// HTML DOCUMENT BUILDER
|
|
// =============================================================================
|
|
|
|
export function buildTOMDocumentHtml(
|
|
derivedTOMs: DerivedTOM[],
|
|
orgHeader: TOMDocumentOrgHeader,
|
|
companyProfile: CompanyProfile | null,
|
|
riskProfile: RiskProfile | null,
|
|
complianceResult: TOMComplianceCheckResult | null,
|
|
revisions: TOMDocumentRevision[]
|
|
): string {
|
|
const today = new Date().toLocaleDateString('de-DE', {
|
|
day: '2-digit',
|
|
month: '2-digit',
|
|
year: 'numeric',
|
|
})
|
|
|
|
const orgName = orgHeader.organizationName || 'Organisation'
|
|
|
|
// Filter out NOT_APPLICABLE TOMs for display
|
|
const applicableTOMs = derivedTOMs.filter(t => t.applicability !== 'NOT_APPLICABLE')
|
|
|
|
// Group TOMs by category via control library lookup
|
|
const tomsByCategory = new Map<ControlCategory, DerivedTOM[]>()
|
|
for (const tom of applicableTOMs) {
|
|
const control = getControlById(tom.controlId)
|
|
const cat = control?.category || 'REVIEW'
|
|
if (!tomsByCategory.has(cat)) tomsByCategory.set(cat, [])
|
|
tomsByCategory.get(cat)!.push(tom)
|
|
}
|
|
|
|
// Build role map: role/department → list of control codes
|
|
const roleMap = new Map<string, string[]>()
|
|
for (const tom of applicableTOMs) {
|
|
const role = tom.responsiblePerson || tom.responsibleDepartment || 'Nicht zugewiesen'
|
|
if (!roleMap.has(role)) roleMap.set(role, [])
|
|
const control = getControlById(tom.controlId)
|
|
roleMap.get(role)!.push(control?.code || tom.controlId)
|
|
}
|
|
|
|
// =========================================================================
|
|
// HTML Template
|
|
// =========================================================================
|
|
|
|
let html = `<!DOCTYPE html>
|
|
<html lang="de">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<title>TOM-Dokumentation — ${escHtml(orgName)}</title>
|
|
<style>
|
|
@page { size: A4; margin: 20mm 18mm 22mm 18mm; }
|
|
* { margin: 0; padding: 0; box-sizing: border-box; }
|
|
body {
|
|
font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
|
|
font-size: 10pt;
|
|
line-height: 1.5;
|
|
color: #1e293b;
|
|
}
|
|
|
|
/* Cover */
|
|
.cover {
|
|
min-height: 90vh;
|
|
display: flex;
|
|
flex-direction: column;
|
|
justify-content: center;
|
|
align-items: center;
|
|
text-align: center;
|
|
page-break-after: always;
|
|
}
|
|
.cover h1 {
|
|
font-size: 28pt;
|
|
color: #5b21b6;
|
|
margin-bottom: 8px;
|
|
font-weight: 700;
|
|
}
|
|
.cover .subtitle {
|
|
font-size: 14pt;
|
|
color: #7c3aed;
|
|
margin-bottom: 40px;
|
|
}
|
|
.cover .org-info {
|
|
background: #f5f3ff;
|
|
border: 1px solid #ddd6fe;
|
|
border-radius: 8px;
|
|
padding: 24px 40px;
|
|
text-align: left;
|
|
width: 400px;
|
|
margin-bottom: 24px;
|
|
}
|
|
.cover .org-info div { margin-bottom: 6px; }
|
|
.cover .org-info .label { font-weight: 600; color: #5b21b6; display: inline-block; min-width: 160px; }
|
|
.cover .legal-ref {
|
|
font-size: 9pt;
|
|
color: #64748b;
|
|
margin-top: 20px;
|
|
}
|
|
|
|
/* TOC */
|
|
.toc {
|
|
page-break-after: always;
|
|
padding-top: 40px;
|
|
}
|
|
.toc h2 {
|
|
font-size: 18pt;
|
|
color: #5b21b6;
|
|
margin-bottom: 20px;
|
|
border-bottom: 2px solid #5b21b6;
|
|
padding-bottom: 8px;
|
|
}
|
|
.toc-entry {
|
|
display: flex;
|
|
justify-content: space-between;
|
|
padding: 6px 0;
|
|
border-bottom: 1px dotted #cbd5e1;
|
|
font-size: 10pt;
|
|
}
|
|
.toc-entry .toc-num { font-weight: 600; color: #5b21b6; min-width: 40px; }
|
|
|
|
/* Sections */
|
|
.section {
|
|
page-break-inside: avoid;
|
|
margin-bottom: 24px;
|
|
}
|
|
.section-header {
|
|
font-size: 14pt;
|
|
color: #5b21b6;
|
|
font-weight: 700;
|
|
margin: 30px 0 12px 0;
|
|
border-bottom: 2px solid #ddd6fe;
|
|
padding-bottom: 6px;
|
|
}
|
|
.section-body { margin-bottom: 16px; }
|
|
|
|
/* Tables */
|
|
table {
|
|
width: 100%;
|
|
border-collapse: collapse;
|
|
margin: 10px 0 16px 0;
|
|
font-size: 9pt;
|
|
}
|
|
th, td {
|
|
border: 1px solid #e2e8f0;
|
|
padding: 6px 8px;
|
|
text-align: left;
|
|
vertical-align: top;
|
|
}
|
|
th {
|
|
background: #f5f3ff;
|
|
color: #5b21b6;
|
|
font-weight: 600;
|
|
font-size: 8.5pt;
|
|
text-transform: uppercase;
|
|
letter-spacing: 0.3px;
|
|
}
|
|
tr:nth-child(even) td { background: #faf5ff; }
|
|
|
|
/* Detail cards */
|
|
.policy-detail {
|
|
page-break-inside: avoid;
|
|
border: 1px solid #e2e8f0;
|
|
border-radius: 6px;
|
|
margin-bottom: 16px;
|
|
overflow: hidden;
|
|
}
|
|
.policy-detail-header {
|
|
background: #f5f3ff;
|
|
padding: 8px 12px;
|
|
font-weight: 700;
|
|
color: #5b21b6;
|
|
border-bottom: 1px solid #ddd6fe;
|
|
display: flex;
|
|
justify-content: space-between;
|
|
}
|
|
.policy-detail-body { padding: 0; }
|
|
.policy-detail-body table { margin: 0; }
|
|
.policy-detail-body th { width: 200px; }
|
|
|
|
/* Badges */
|
|
.badge {
|
|
display: inline-block;
|
|
padding: 1px 8px;
|
|
border-radius: 9999px;
|
|
font-size: 8pt;
|
|
font-weight: 600;
|
|
}
|
|
.badge-active { background: #dcfce7; color: #166534; }
|
|
.badge-draft { background: #f3f4f6; color: #374151; }
|
|
.badge-review { background: #fef9c3; color: #854d0e; }
|
|
.badge-critical { background: #fecaca; color: #991b1b; }
|
|
.badge-high { background: #fed7aa; color: #9a3412; }
|
|
.badge-medium { background: #fef3c7; color: #92400e; }
|
|
.badge-low { background: #f3f4f6; color: #4b5563; }
|
|
|
|
/* Principles */
|
|
.principle {
|
|
margin-bottom: 10px;
|
|
padding-left: 20px;
|
|
position: relative;
|
|
}
|
|
.principle::before {
|
|
content: '';
|
|
position: absolute;
|
|
left: 0;
|
|
top: 6px;
|
|
width: 10px;
|
|
height: 10px;
|
|
background: #7c3aed;
|
|
border-radius: 50%;
|
|
}
|
|
.principle strong { color: #5b21b6; }
|
|
|
|
/* Score */
|
|
.score-box {
|
|
display: inline-block;
|
|
padding: 4px 16px;
|
|
border-radius: 8px;
|
|
font-size: 18pt;
|
|
font-weight: 700;
|
|
margin-right: 12px;
|
|
}
|
|
.score-excellent { background: #dcfce7; color: #166534; }
|
|
.score-good { background: #dbeafe; color: #1e40af; }
|
|
.score-needs-work { background: #fef3c7; color: #92400e; }
|
|
.score-poor { background: #fecaca; color: #991b1b; }
|
|
|
|
/* Footer */
|
|
.page-footer {
|
|
position: fixed;
|
|
bottom: 0;
|
|
left: 0;
|
|
right: 0;
|
|
padding: 8px 18mm;
|
|
font-size: 7.5pt;
|
|
color: #94a3b8;
|
|
display: flex;
|
|
justify-content: space-between;
|
|
border-top: 1px solid #e2e8f0;
|
|
}
|
|
|
|
/* Print */
|
|
@media print {
|
|
body { -webkit-print-color-adjust: exact; print-color-adjust: exact; }
|
|
.no-print { display: none !important; }
|
|
.page-break { page-break-after: always; }
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
`
|
|
|
|
// =========================================================================
|
|
// Section 0: Cover Page
|
|
// =========================================================================
|
|
html += `
|
|
<div class="cover">
|
|
<h1>TOM-Dokumentation</h1>
|
|
<div class="subtitle">Technische und Organisatorische Massnahmen gemaess Art. 32 DSGVO</div>
|
|
<div class="org-info">
|
|
<div><span class="label">Organisation:</span> ${escHtml(orgName)}</div>
|
|
${orgHeader.industry ? `<div><span class="label">Branche:</span> ${escHtml(orgHeader.industry)}</div>` : ''}
|
|
${orgHeader.dpoName ? `<div><span class="label">DSB:</span> ${escHtml(orgHeader.dpoName)}</div>` : ''}
|
|
${orgHeader.dpoContact ? `<div><span class="label">DSB-Kontakt:</span> ${escHtml(orgHeader.dpoContact)}</div>` : ''}
|
|
${orgHeader.responsiblePerson ? `<div><span class="label">Verantwortlicher:</span> ${escHtml(orgHeader.responsiblePerson)}</div>` : ''}
|
|
${orgHeader.itSecurityContact ? `<div><span class="label">IT-Sicherheit:</span> ${escHtml(orgHeader.itSecurityContact)}</div>` : ''}
|
|
${orgHeader.employeeCount ? `<div><span class="label">Mitarbeiter:</span> ${escHtml(orgHeader.employeeCount)}</div>` : ''}
|
|
${orgHeader.locations.length > 0 ? `<div><span class="label">Standorte:</span> ${escHtml(orgHeader.locations.join(', '))}</div>` : ''}
|
|
</div>
|
|
<div class="legal-ref">
|
|
Version ${escHtml(orgHeader.documentVersion)} | Stand: ${today}<br/>
|
|
Letzte Pruefung: ${formatDateDE(orgHeader.lastReviewDate)} | Naechste Pruefung: ${formatDateDE(orgHeader.nextReviewDate)}<br/>
|
|
Pruefintervall: ${escHtml(orgHeader.reviewInterval)}
|
|
</div>
|
|
</div>
|
|
`
|
|
|
|
// =========================================================================
|
|
// Table of Contents
|
|
// =========================================================================
|
|
const sections = [
|
|
'Ziel und Zweck',
|
|
'Geltungsbereich',
|
|
'Grundprinzipien Art. 32',
|
|
'Schutzbedarf und Risikoanalyse',
|
|
'Massnahmen-Uebersicht',
|
|
'Detaillierte Massnahmen',
|
|
'SDM Gewaehrleistungsziele',
|
|
'Verantwortlichkeiten',
|
|
'Pruef- und Revisionszyklus',
|
|
'Compliance-Status',
|
|
'Aenderungshistorie',
|
|
]
|
|
|
|
html += `
|
|
<div class="toc">
|
|
<h2>Inhaltsverzeichnis</h2>
|
|
${sections.map((s, i) => `<div class="toc-entry"><span><span class="toc-num">${i + 1}.</span> ${escHtml(s)}</span></div>`).join('\n ')}
|
|
</div>
|
|
`
|
|
|
|
// =========================================================================
|
|
// Section 1: Ziel und Zweck
|
|
// =========================================================================
|
|
html += `
|
|
<div class="section">
|
|
<div class="section-header">1. Ziel und Zweck</div>
|
|
<div class="section-body">
|
|
<p>Diese TOM-Dokumentation beschreibt die technischen und organisatorischen Massnahmen
|
|
zum Schutz personenbezogener Daten bei <strong>${escHtml(orgName)}</strong>. Sie dient
|
|
der Umsetzung folgender DSGVO-Anforderungen:</p>
|
|
<table>
|
|
<tr><th>Rechtsgrundlage</th><th>Inhalt</th></tr>
|
|
<tr><td><strong>Art. 32 Abs. 1 lit. a DSGVO</strong></td><td>Pseudonymisierung und Verschluesselung personenbezogener Daten</td></tr>
|
|
<tr><td><strong>Art. 32 Abs. 1 lit. b DSGVO</strong></td><td>Faehigkeit, die Vertraulichkeit, Integritaet, Verfuegbarkeit und Belastbarkeit der Systeme und Dienste im Zusammenhang mit der Verarbeitung auf Dauer sicherzustellen</td></tr>
|
|
<tr><td><strong>Art. 32 Abs. 1 lit. c DSGVO</strong></td><td>Faehigkeit, die Verfuegbarkeit der personenbezogenen Daten und den Zugang zu ihnen bei einem physischen oder technischen Zwischenfall rasch wiederherzustellen</td></tr>
|
|
<tr><td><strong>Art. 32 Abs. 1 lit. d DSGVO</strong></td><td>Verfahren zur regelmaessigen Ueberpruefung, Bewertung und Evaluierung der Wirksamkeit der technischen und organisatorischen Massnahmen</td></tr>
|
|
</table>
|
|
<p>Die TOM-Dokumentation ist fester Bestandteil des Datenschutz-Managementsystems und wird
|
|
regelmaessig ueberprueft und aktualisiert.</p>
|
|
</div>
|
|
</div>
|
|
`
|
|
|
|
// =========================================================================
|
|
// Section 2: Geltungsbereich
|
|
// =========================================================================
|
|
const industryInfo = companyProfile?.industry || orgHeader.industry || ''
|
|
const hostingInfo = companyProfile ? `Unternehmen: ${escHtml(companyProfile.name || orgName)}, Groesse: ${escHtml(companyProfile.size || '-')}` : ''
|
|
|
|
html += `
|
|
<div class="section">
|
|
<div class="section-header">2. Geltungsbereich</div>
|
|
<div class="section-body">
|
|
<p>Diese TOM-Dokumentation gilt fuer alle IT-Systeme, Anwendungen und Verarbeitungsprozesse
|
|
von <strong>${escHtml(orgName)}</strong>${industryInfo ? ` (Branche: ${escHtml(industryInfo)})` : ''}.</p>
|
|
${hostingInfo ? `<p>${hostingInfo}</p>` : ''}
|
|
${orgHeader.locations.length > 0 ? `<p>Standorte: ${escHtml(orgHeader.locations.join(', '))}</p>` : ''}
|
|
<p>Die dokumentierten Massnahmen stammen aus zwei Quellen:</p>
|
|
<ul style="margin: 8px 0 8px 24px;">
|
|
<li><strong>Embedded Library (TOM-xxx):</strong> Integrierte Kontrollbibliothek mit spezifischen Massnahmen fuer Art. 32 DSGVO</li>
|
|
<li><strong>Canonical Control Library (CP-CLIB):</strong> Uebergreifende Kontrollbibliothek mit framework-uebergreifenden Massnahmen</li>
|
|
</ul>
|
|
<p>Insgesamt umfasst dieses Dokument <strong>${applicableTOMs.length}</strong> anwendbare Massnahmen
|
|
in <strong>${tomsByCategory.size}</strong> Kategorien.</p>
|
|
</div>
|
|
</div>
|
|
`
|
|
|
|
// =========================================================================
|
|
// Section 3: Grundprinzipien Art. 32
|
|
// =========================================================================
|
|
html += `
|
|
<div class="section">
|
|
<div class="section-header">3. Grundprinzipien Art. 32</div>
|
|
<div class="section-body">
|
|
<div class="principle"><strong>Vertraulichkeit:</strong> Schutz personenbezogener Daten vor unbefugter Kenntnisnahme durch Zutrittskontrolle, Zugangskontrolle, Zugriffskontrolle und Verschluesselung (Art. 32 Abs. 1 lit. b DSGVO).</div>
|
|
<div class="principle"><strong>Integritaet:</strong> Sicherstellung, dass personenbezogene Daten nicht unbefugt oder unbeabsichtigt veraendert werden koennen, durch Eingabekontrolle, Weitergabekontrolle und Protokollierung (Art. 32 Abs. 1 lit. b DSGVO).</div>
|
|
<div class="principle"><strong>Verfuegbarkeit und Belastbarkeit:</strong> Gewaehrleistung, dass Systeme und Dienste bei Lastspitzen und Stoerungen zuverlaessig funktionieren, durch Backup, Redundanz und Disaster Recovery (Art. 32 Abs. 1 lit. b DSGVO).</div>
|
|
<div class="principle"><strong>Rasche Wiederherstellbarkeit:</strong> Faehigkeit, nach einem physischen oder technischen Zwischenfall Daten und Systeme schnell wiederherzustellen, durch getestete Recovery-Prozesse (Art. 32 Abs. 1 lit. c DSGVO).</div>
|
|
<div class="principle"><strong>Regelmaessige Wirksamkeitspruefung:</strong> Verfahren zur regelmaessigen Ueberpruefung, Bewertung und Evaluierung der Wirksamkeit aller technischen und organisatorischen Massnahmen (Art. 32 Abs. 1 lit. d DSGVO).</div>
|
|
</div>
|
|
</div>
|
|
`
|
|
|
|
// =========================================================================
|
|
// Section 4: Schutzbedarf und Risikoanalyse
|
|
// =========================================================================
|
|
html += `
|
|
<div class="section">
|
|
<div class="section-header">4. Schutzbedarf und Risikoanalyse</div>
|
|
<div class="section-body">
|
|
`
|
|
if (riskProfile) {
|
|
html += ` <p>Die folgende Schutzbedarfsanalyse bildet die Grundlage fuer die Auswahl und Priorisierung
|
|
der technischen und organisatorischen Massnahmen:</p>
|
|
<table>
|
|
<tr><th>Kriterium</th><th>Bewertung</th></tr>
|
|
<tr><td>Vertraulichkeit</td><td>${riskProfile.ciaAssessment.confidentiality}/5</td></tr>
|
|
<tr><td>Integritaet</td><td>${riskProfile.ciaAssessment.integrity}/5</td></tr>
|
|
<tr><td>Verfuegbarkeit</td><td>${riskProfile.ciaAssessment.availability}/5</td></tr>
|
|
<tr><td>Schutzniveau</td><td><strong>${escHtml(riskProfile.protectionLevel)}</strong></td></tr>
|
|
<tr><td>DSFA-Pflicht</td><td>${riskProfile.dsfaRequired ? 'Ja' : 'Nein'}</td></tr>
|
|
${riskProfile.specialRisks.length > 0 ? `<tr><td>Spezialrisiken</td><td>${escHtml(riskProfile.specialRisks.join(', '))}</td></tr>` : ''}
|
|
${riskProfile.regulatoryRequirements.length > 0 ? `<tr><td>Regulatorische Anforderungen</td><td>${escHtml(riskProfile.regulatoryRequirements.join(', '))}</td></tr>` : ''}
|
|
</table>
|
|
`
|
|
} else {
|
|
html += ` <p><em>Die Schutzbedarfsanalyse wurde noch nicht durchgefuehrt. Fuehren Sie den
|
|
Risiko-Wizard im TOM-Generator durch, um den Schutzbedarf zu ermitteln.</em></p>
|
|
`
|
|
}
|
|
|
|
html += ` </div>
|
|
</div>
|
|
`
|
|
|
|
// =========================================================================
|
|
// Section 5: Massnahmen-Uebersicht
|
|
// =========================================================================
|
|
html += `
|
|
<div class="section page-break">
|
|
<div class="section-header">5. Massnahmen-Uebersicht</div>
|
|
<div class="section-body">
|
|
<p>Die folgende Tabelle zeigt eine Uebersicht aller ${applicableTOMs.length} anwendbaren Massnahmen
|
|
nach Kategorie:</p>
|
|
<table>
|
|
<tr>
|
|
<th>Kategorie</th>
|
|
<th>Gesamt</th>
|
|
<th>Umgesetzt</th>
|
|
<th>Teilweise</th>
|
|
<th>Offen</th>
|
|
</tr>
|
|
`
|
|
const allCategories = getAllCategories()
|
|
for (const cat of allCategories) {
|
|
const tomsInCat = tomsByCategory.get(cat)
|
|
if (!tomsInCat || tomsInCat.length === 0) continue
|
|
|
|
const implemented = tomsInCat.filter(t => t.implementationStatus === 'IMPLEMENTED').length
|
|
const partial = tomsInCat.filter(t => t.implementationStatus === 'PARTIAL').length
|
|
const notImpl = tomsInCat.filter(t => t.implementationStatus === 'NOT_IMPLEMENTED').length
|
|
const catLabel = CATEGORY_LABELS_DE[cat] || cat
|
|
|
|
html += ` <tr>
|
|
<td>${escHtml(catLabel)}</td>
|
|
<td>${tomsInCat.length}</td>
|
|
<td>${implemented}</td>
|
|
<td>${partial}</td>
|
|
<td>${notImpl}</td>
|
|
</tr>
|
|
`
|
|
}
|
|
|
|
html += ` </table>
|
|
</div>
|
|
</div>
|
|
`
|
|
|
|
// =========================================================================
|
|
// Section 6: Detaillierte Massnahmen
|
|
// =========================================================================
|
|
html += `
|
|
<div class="section">
|
|
<div class="section-header">6. Detaillierte Massnahmen</div>
|
|
<div class="section-body">
|
|
`
|
|
|
|
for (const cat of allCategories) {
|
|
const tomsInCat = tomsByCategory.get(cat)
|
|
if (!tomsInCat || tomsInCat.length === 0) continue
|
|
|
|
const catLabel = CATEGORY_LABELS_DE[cat] || cat
|
|
const catMeta = getCategoryMetadata(cat)
|
|
const gdprRef = catMeta?.gdprReference || ''
|
|
|
|
html += ` <h3 style="color: #5b21b6; margin: 20px 0 10px 0; font-size: 11pt;">${escHtml(catLabel)}${gdprRef ? ` <span style="font-weight: 400; font-size: 9pt; color: #64748b;">(${escHtml(gdprRef)})</span>` : ''}</h3>
|
|
`
|
|
|
|
// Sort TOMs by control code
|
|
const sortedTOMs = [...tomsInCat].sort((a, b) => {
|
|
const codeA = getControlById(a.controlId)?.code || a.controlId
|
|
const codeB = getControlById(b.controlId)?.code || b.controlId
|
|
return codeA.localeCompare(codeB)
|
|
})
|
|
|
|
for (const tom of sortedTOMs) {
|
|
const control = getControlById(tom.controlId)
|
|
const code = control?.code || tom.controlId
|
|
const nameDE = control?.name?.de || tom.name
|
|
const descDE = control?.description?.de || tom.description
|
|
const typeLabel = control?.type === 'TECHNICAL' ? 'Technisch' : control?.type === 'ORGANIZATIONAL' ? 'Organisatorisch' : '-'
|
|
const statusLabel = STATUS_LABELS_DE[tom.implementationStatus] || tom.implementationStatus
|
|
const statusBadge = STATUS_BADGE_CLASSES[tom.implementationStatus] || 'badge-draft'
|
|
const applicabilityLabel = APPLICABILITY_LABELS_DE[tom.applicability] || tom.applicability
|
|
const responsible = [tom.responsiblePerson, tom.responsibleDepartment].filter(s => s && s.trim()).join(' / ') || '-'
|
|
const implDate = tom.implementationDate ? formatDateDE(typeof tom.implementationDate === 'string' ? tom.implementationDate : tom.implementationDate.toISOString()) : '-'
|
|
const reviewDate = tom.reviewDate ? formatDateDE(typeof tom.reviewDate === 'string' ? tom.reviewDate : tom.reviewDate.toISOString()) : '-'
|
|
|
|
// Evidence
|
|
const evidenceInfo = tom.linkedEvidence.length > 0
|
|
? tom.linkedEvidence.join(', ')
|
|
: tom.evidenceGaps.length > 0
|
|
? `<em style="color: #d97706;">Fehlend: ${escHtml(tom.evidenceGaps.join(', '))}</em>`
|
|
: '-'
|
|
|
|
// Framework mappings
|
|
let mappingsHtml = '-'
|
|
if (control?.mappings && control.mappings.length > 0) {
|
|
mappingsHtml = control.mappings.map(m => `${escHtml(m.framework)}: ${escHtml(m.reference)}`).join('<br/>')
|
|
}
|
|
|
|
html += `
|
|
<div class="policy-detail">
|
|
<div class="policy-detail-header">
|
|
<span>${escHtml(code)} — ${escHtml(nameDE)}</span>
|
|
<span class="badge ${statusBadge}">${escHtml(statusLabel)}</span>
|
|
</div>
|
|
<div class="policy-detail-body">
|
|
<table>
|
|
<tr><th>Beschreibung</th><td>${escHtml(descDE)}</td></tr>
|
|
<tr><th>Massnahmentyp</th><td>${escHtml(typeLabel)}</td></tr>
|
|
<tr><th>Anwendbarkeit</th><td>${escHtml(applicabilityLabel)}${tom.applicabilityReason ? ` — ${escHtml(tom.applicabilityReason)}` : ''}</td></tr>
|
|
<tr><th>Umsetzungsstatus</th><td><span class="badge ${statusBadge}">${escHtml(statusLabel)}</span></td></tr>
|
|
<tr><th>Verantwortlich</th><td>${escHtml(responsible)}</td></tr>
|
|
<tr><th>Umsetzungsdatum</th><td>${implDate}</td></tr>
|
|
<tr><th>Naechste Pruefung</th><td>${reviewDate}</td></tr>
|
|
<tr><th>Evidence</th><td>${evidenceInfo}</td></tr>
|
|
<tr><th>Framework-Mappings</th><td>${mappingsHtml}</td></tr>
|
|
</table>
|
|
</div>
|
|
</div>
|
|
`
|
|
}
|
|
}
|
|
|
|
html += ` </div>
|
|
</div>
|
|
`
|
|
|
|
// =========================================================================
|
|
// Section 7: SDM Gewaehrleistungsziele
|
|
// =========================================================================
|
|
const sdmGoals: Array<{ goal: string; categories: ControlCategory[] }> = []
|
|
const allSDMGoals = [
|
|
'Verfuegbarkeit',
|
|
'Integritaet',
|
|
'Vertraulichkeit',
|
|
'Nichtverkettung',
|
|
'Intervenierbarkeit',
|
|
'Transparenz',
|
|
'Datenminimierung',
|
|
] as const
|
|
|
|
for (const goal of allSDMGoals) {
|
|
const cats: ControlCategory[] = []
|
|
for (const [cat, goals] of Object.entries(SDM_CATEGORY_MAPPING)) {
|
|
if (goals.includes(goal)) {
|
|
cats.push(cat as ControlCategory)
|
|
}
|
|
}
|
|
sdmGoals.push({ goal, categories: cats })
|
|
}
|
|
|
|
html += `
|
|
<div class="section page-break">
|
|
<div class="section-header">7. SDM Gewaehrleistungsziele</div>
|
|
<div class="section-body">
|
|
<p>Die folgende Tabelle zeigt die Abdeckung der sieben Gewaehrleistungsziele des
|
|
Standard-Datenschutzmodells (SDM) durch die implementierten Massnahmen:</p>
|
|
<table>
|
|
<tr>
|
|
<th>Gewaehrleistungsziel</th>
|
|
<th>Abgedeckt</th>
|
|
<th>Gesamt</th>
|
|
<th>Abdeckung (%)</th>
|
|
</tr>
|
|
`
|
|
for (const { goal, categories } of sdmGoals) {
|
|
let totalInGoal = 0
|
|
let implementedInGoal = 0
|
|
for (const cat of categories) {
|
|
const tomsInCat = tomsByCategory.get(cat) || []
|
|
totalInGoal += tomsInCat.length
|
|
implementedInGoal += tomsInCat.filter(t => t.implementationStatus === 'IMPLEMENTED').length
|
|
}
|
|
const percentage = totalInGoal > 0 ? Math.round((implementedInGoal / totalInGoal) * 100) : 0
|
|
|
|
html += ` <tr>
|
|
<td>${escHtml(goal)}</td>
|
|
<td>${implementedInGoal}</td>
|
|
<td>${totalInGoal}</td>
|
|
<td>${percentage}%</td>
|
|
</tr>
|
|
`
|
|
}
|
|
|
|
html += ` </table>
|
|
</div>
|
|
</div>
|
|
`
|
|
|
|
// =========================================================================
|
|
// Section 8: Verantwortlichkeiten
|
|
// =========================================================================
|
|
html += `
|
|
<div class="section">
|
|
<div class="section-header">8. Verantwortlichkeiten</div>
|
|
<div class="section-body">
|
|
<p>Die folgende Rollenmatrix zeigt, welche Personen oder Abteilungen fuer welche Massnahmen
|
|
die Umsetzungsverantwortung tragen:</p>
|
|
<table>
|
|
<tr><th>Rolle / Verantwortlich</th><th>Massnahmen</th><th>Anzahl</th></tr>
|
|
`
|
|
for (const [role, controls] of roleMap.entries()) {
|
|
html += ` <tr>
|
|
<td>${escHtml(role)}</td>
|
|
<td>${controls.map(c => escHtml(c)).join(', ')}</td>
|
|
<td>${controls.length}</td>
|
|
</tr>
|
|
`
|
|
}
|
|
|
|
html += ` </table>
|
|
</div>
|
|
</div>
|
|
`
|
|
|
|
// =========================================================================
|
|
// Section 9: Pruef- und Revisionszyklus
|
|
// =========================================================================
|
|
html += `
|
|
<div class="section">
|
|
<div class="section-header">9. Pruef- und Revisionszyklus</div>
|
|
<div class="section-body">
|
|
<table>
|
|
<tr><th>Eigenschaft</th><th>Wert</th></tr>
|
|
<tr><td>Aktuelles Pruefintervall</td><td>${escHtml(orgHeader.reviewInterval)}</td></tr>
|
|
<tr><td>Letzte Pruefung</td><td>${formatDateDE(orgHeader.lastReviewDate)}</td></tr>
|
|
<tr><td>Naechste Pruefung</td><td>${formatDateDE(orgHeader.nextReviewDate)}</td></tr>
|
|
<tr><td>Aktuelle Version</td><td>${escHtml(orgHeader.documentVersion)}</td></tr>
|
|
</table>
|
|
<p style="margin-top: 8px;">Bei jeder Pruefung wird die TOM-Dokumentation auf folgende Punkte ueberprueft:</p>
|
|
<ul style="margin: 8px 0 8px 24px;">
|
|
<li>Vollstaendigkeit aller Massnahmen (neue Systeme oder Verarbeitungen erfasst?)</li>
|
|
<li>Aktualitaet des Umsetzungsstatus (Aenderungen seit letzter Pruefung?)</li>
|
|
<li>Wirksamkeit der technischen Massnahmen (Penetration-Tests, Audit-Ergebnisse)</li>
|
|
<li>Angemessenheit der organisatorischen Massnahmen (Schulungen, Richtlinien aktuell?)</li>
|
|
<li>Abdeckung aller SDM-Gewaehrleistungsziele</li>
|
|
<li>Zuordnung von Verantwortlichkeiten zu allen Massnahmen</li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
`
|
|
|
|
// =========================================================================
|
|
// Section 10: Compliance-Status
|
|
// =========================================================================
|
|
html += `
|
|
<div class="section page-break">
|
|
<div class="section-header">10. Compliance-Status</div>
|
|
<div class="section-body">
|
|
`
|
|
if (complianceResult) {
|
|
const scoreClass = complianceResult.score >= 90 ? 'score-excellent'
|
|
: complianceResult.score >= 75 ? 'score-good'
|
|
: complianceResult.score >= 50 ? 'score-needs-work'
|
|
: 'score-poor'
|
|
const scoreLabel = complianceResult.score >= 90 ? 'Ausgezeichnet'
|
|
: complianceResult.score >= 75 ? 'Gut'
|
|
: complianceResult.score >= 50 ? 'Verbesserungswuerdig'
|
|
: 'Mangelhaft'
|
|
|
|
html += ` <p><span class="score-box ${scoreClass}">${complianceResult.score}/100</span> ${escHtml(scoreLabel)}</p>
|
|
<table style="margin-top: 12px;">
|
|
<tr><th>Kennzahl</th><th>Wert</th></tr>
|
|
<tr><td>Gepruefte Massnahmen</td><td>${complianceResult.stats.total}</td></tr>
|
|
<tr><td>Bestanden</td><td>${complianceResult.stats.passed}</td></tr>
|
|
<tr><td>Beanstandungen</td><td>${complianceResult.stats.failed}</td></tr>
|
|
</table>
|
|
`
|
|
if (complianceResult.issues.length > 0) {
|
|
html += ` <p style="margin-top: 12px;"><strong>Befunde nach Schweregrad:</strong></p>
|
|
<table>
|
|
<tr><th>Schweregrad</th><th>Anzahl</th><th>Befunde</th></tr>
|
|
`
|
|
const severityOrder: TOMComplianceIssueSeverity[] = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW']
|
|
for (const sev of severityOrder) {
|
|
const count = complianceResult.stats.bySeverity[sev]
|
|
if (count === 0) continue
|
|
const issuesForSev = complianceResult.issues.filter(i => i.severity === sev)
|
|
html += ` <tr>
|
|
<td><span class="badge badge-${sev.toLowerCase()}" style="color: ${SEVERITY_COLORS[sev]}">${SEVERITY_LABELS_DE[sev]}</span></td>
|
|
<td>${count}</td>
|
|
<td>${issuesForSev.map(i => escHtml(i.title)).join('; ')}</td>
|
|
</tr>
|
|
`
|
|
}
|
|
html += ` </table>
|
|
`
|
|
} else {
|
|
html += ` <p style="margin-top: 8px;"><em>Keine Beanstandungen. Alle Massnahmen sind konform.</em></p>
|
|
`
|
|
}
|
|
} else {
|
|
html += ` <p><em>Compliance-Check wurde noch nicht ausgefuehrt. Fuehren Sie den Check im
|
|
Export-Tab durch, um den Status in das Dokument aufzunehmen.</em></p>
|
|
`
|
|
}
|
|
|
|
html += ` </div>
|
|
</div>
|
|
`
|
|
|
|
// =========================================================================
|
|
// Section 11: Aenderungshistorie
|
|
// =========================================================================
|
|
html += `
|
|
<div class="section">
|
|
<div class="section-header">11. Aenderungshistorie</div>
|
|
<div class="section-body">
|
|
<table>
|
|
<tr><th>Version</th><th>Datum</th><th>Autor</th><th>Aenderungen</th></tr>
|
|
`
|
|
if (revisions.length > 0) {
|
|
for (const rev of revisions) {
|
|
html += ` <tr>
|
|
<td>${escHtml(rev.version)}</td>
|
|
<td>${formatDateDE(rev.date)}</td>
|
|
<td>${escHtml(rev.author)}</td>
|
|
<td>${escHtml(rev.changes)}</td>
|
|
</tr>
|
|
`
|
|
}
|
|
} else {
|
|
html += ` <tr>
|
|
<td>${escHtml(orgHeader.documentVersion)}</td>
|
|
<td>${today}</td>
|
|
<td>${escHtml(orgHeader.dpoName || orgHeader.responsiblePerson || '-')}</td>
|
|
<td>Erstversion der TOM-Dokumentation</td>
|
|
</tr>
|
|
`
|
|
}
|
|
|
|
html += ` </table>
|
|
</div>
|
|
</div>
|
|
`
|
|
|
|
// =========================================================================
|
|
// Footer
|
|
// =========================================================================
|
|
html += `
|
|
<div class="page-footer">
|
|
<span>TOM-Dokumentation — ${escHtml(orgName)}</span>
|
|
<span>Stand: ${today} | Version ${escHtml(orgHeader.documentVersion)}</span>
|
|
</div>
|
|
|
|
</body>
|
|
</html>`
|
|
|
|
return html
|
|
}
|
|
|
|
// =============================================================================
|
|
// INTERNAL HELPERS
|
|
// =============================================================================
|
|
|
|
function escHtml(str: string): string {
|
|
return str
|
|
.replace(/&/g, '&')
|
|
.replace(/</g, '<')
|
|
.replace(/>/g, '>')
|
|
.replace(/"/g, '"')
|
|
}
|
|
|
|
function formatDateDE(dateStr: string | null | undefined): string {
|
|
if (!dateStr) return '-'
|
|
try {
|
|
const date = new Date(dateStr)
|
|
if (isNaN(date.getTime())) return '-'
|
|
return date.toLocaleDateString('de-DE', {
|
|
day: '2-digit',
|
|
month: '2-digit',
|
|
year: 'numeric',
|
|
})
|
|
} catch {
|
|
return '-'
|
|
}
|
|
}
|