Benjamin_Boenisch/breakpilot-lehrer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(rag): Applicability Notes UI + Branchen-Review

Browse Source 
- Matrix-Zeilen aufklappbar: Klick zeigt Branchenrelevanz-Erklaerung,
  Beschreibung und Gueltigkeitsdatum
- 27 Branchen-Zuordnungen korrigiert:
  - OWASP/NIST/CISA/SBOM-Standards → alle (Kunden entwickeln Software)
  - BSI-TR-03161 → leer (DiGA, nicht Zielmarkt)
  - BSI 200-4, ENISA Supply Chain → alle (CRA/NIS2-Pflicht)
  - EAA/BFSG → +automotive (digitale Interfaces)
- 264 horizontal, 42 sektorspezifisch, 14 nicht zutreffend

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Benjamin Admin
2026-04-15 19:15:01 +02:00
parent 261f686dac
commit c8e5e498b5
2 changed files with 122 additions and 121 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
admin-lehrer/app/(admin)/ai/rag/page.tsx
View File

@@ -724,6 +724,7 @@ export default function RAGPage() {
const [autoRefresh, setAutoRefresh] = useState(true) const [autoRefresh, setAutoRefresh] = useState(true)
const [elapsedTime, setElapsedTime] = useState<string>('') const [elapsedTime, setElapsedTime] = useState<string>('')
const [expandedDocTypes, setExpandedDocTypes] = useState<string[]>(['eu_regulation', 'eu_directive']) const [expandedDocTypes, setExpandedDocTypes] = useState<string[]>(['eu_regulation', 'eu_directive'])
const [expandedMatrixDoc, setExpandedMatrixDoc] = useState<string | null>(null)
// Chunk browser state is now in ChunkBrowserQA component // Chunk browser state is now in ChunkBrowserQA component
@@ -1803,7 +1804,11 @@ export default function RAGPage() {
{/* Documents in this section */} {/* Documents in this section */}
{isExpanded && docsInType.map((doc: any) => ( {isExpanded && docsInType.map((doc: any) => (
<tr key={doc.code} className="hover:bg-slate-50 border-b border-slate-100"> <React.Fragment key={doc.code}>
<tr
className={`hover:bg-slate-50 border-b border-slate-100 cursor-pointer ${expandedMatrixDoc === doc.code ? 'bg-teal-50' : ''}`}
onClick={() => setExpandedMatrixDoc(expandedMatrixDoc === doc.code ? null : doc.code)}
>
<td className="px-2 py-1.5 font-medium sticky left-0 bg-white"> <td className="px-2 py-1.5 font-medium sticky left-0 bg-white">
<span className="flex items-center gap-1"> <span className="flex items-center gap-1">
{isInRag(doc.code) ? ( {isInRag(doc.code) ? (
@@ -1814,6 +1819,9 @@ export default function RAGPage() {
<span className="text-teal-600 truncate max-w-[180px]" title={doc.full_name || doc.name}> <span className="text-teal-600 truncate max-w-[180px]" title={doc.full_name || doc.name}>
{doc.name} {doc.name}
</span> </span>
{(doc.applicability_note || doc.description) && (
<span className="text-slate-400 text-[10px] ml-1">{expandedMatrixDoc === doc.code ? '▼' : 'ⓘ'}</span>
)}
</span> </span>
</td> </td>
{INDUSTRIES_LIST.filter((i: any) => i.id !== 'all').map((industry: any) => { {INDUSTRIES_LIST.filter((i: any) => i.id !== 'all').map((industry: any) => {
@@ -1829,6 +1837,29 @@ export default function RAGPage() {
) )
})} })}
</tr> </tr>
{expandedMatrixDoc === doc.code && (doc.applicability_note || doc.description) && (
<tr className="bg-teal-50 border-b border-teal-200">
<td colSpan={INDUSTRIES_LIST.length} className="px-4 py-3">
<div className="text-xs space-y-1.5">
{doc.full_name && (
<p className="font-semibold text-slate-700">{doc.full_name}</p>
)}
{doc.applicability_note && (
<p className="text-teal-700 bg-teal-100 px-2 py-1 rounded inline-block">
<span className="font-medium">Branchenrelevanz:</span> {doc.applicability_note}
</p>
)}
{doc.description && (
<p className="text-slate-600">{doc.description}</p>
)}
{doc.effective_date && (
<p className="text-slate-400">In Kraft: {doc.effective_date}</p>
)}
</div>
</td>
</tr>
)}
</React.Fragment>
))} ))}
</React.Fragment> </React.Fragment>
) )

166
admin-lehrer/app/(admin)/ai/rag/rag-documents.json
View File

@@ -484,13 +484,14 @@
"industries": [ "industries": [
"handel", "handel",
"konsumgueter", "konsumgueter",
"elektrotechnik" "elektrotechnik",
"automotive"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_ce", "rag_collection": "bp_compliance_ce",
"effective_date": "28. Juni 2025", "effective_date": "28. Juni 2025",
"sort_order": 4, "sort_order": 4,
"applicability_note": "Sektorspezifisch: Handel, Konsumgueter, Elektrotechnik. Barrierefreiheitsanforderungen fuer Produkte und digitale Dienstleistungen." "applicability_note": "Sektorspezifisch: Handel, Konsumgueter, Elektrotechnik, Automotive. Barrierefreiheitsanforderungen fuer Produkte und Dienstleistungen mit digitalen Schnittstellen."
}, },
{ {
"code": "E_COMMERCE_RL", "code": "E_COMMERCE_RL",
@@ -837,11 +838,13 @@
"industries": [ "industries": [
"handel", "handel",
"konsumgueter", "konsumgueter",
"elektrotechnik" "elektrotechnik",
"automotive"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_gesetze", "rag_collection": "bp_compliance_gesetze",
"sort_order": 7 "sort_order": 7,
"applicability_note": "Sektorspezifisch: Handel, Konsumgueter, Elektrotechnik, Automotive. Deutsches Umsetzungsgesetz des EAA — betrifft Produkte mit digitalen Interfaces."
}, },
{ {
"code": "DE_BGB_AGB", "code": "DE_BGB_AGB",
@@ -1767,13 +1770,12 @@
"full_name": "BSI Standard 200-4 Business Continuity Management", "full_name": "BSI Standard 200-4 Business Continuity Management",
"doc_type": "bsi_standard", "doc_type": "bsi_standard",
"industries": [ "industries": [
"energie", "all"
"transport",
"chemie"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_gesetze", "rag_collection": "bp_compliance_gesetze",
"sort_order": 1 "sort_order": 1,
"applicability_note": "Gilt fuer alle Branchen. Business Continuity Management ist fuer jedes produzierende Unternehmen relevant."
}, },
{ {
"code": "BSI-TR-03161-1", "code": "BSI-TR-03161-1",
@@ -1781,14 +1783,12 @@
"full_name": "BSI TR-03161 Teil 1 — Sicherheitsanforderungen DiGA — Mobile Anwendungen", "full_name": "BSI TR-03161 Teil 1 — Sicherheitsanforderungen DiGA — Mobile Anwendungen",
"doc_type": "bsi_standard", "doc_type": "bsi_standard",
"description": "Deutsche Technische Richtlinie fuer die Sicherheit mobiler Gesundheits-Apps (DiGA). Definiert Pruefverfahren und Sicherheitsanforderungen fuer die DiGA-Zulassung.", "description": "Deutsche Technische Richtlinie fuer die Sicherheit mobiler Gesundheits-Apps (DiGA). Definiert Pruefverfahren und Sicherheitsanforderungen fuer die DiGA-Zulassung.",
"industries": [ "industries": [],
"elektrotechnik"
],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_gesetze", "rag_collection": "bp_compliance_gesetze",
"effective_date": "Version 1.0: 2020", "effective_date": "Version 1.0: 2020",
"sort_order": 2, "sort_order": 2,
"applicability_note": "Sektorspezifisch: Elektrotechnik. Sicherheitsanforderungen fuer mobile Anwendungen anwendbar auf App-Entwicklung in der Digitalindustrie." "applicability_note": "Nicht zutreffend fuer produzierende Industrie. Spezifisch fuer Digitale Gesundheitsanwendungen (DiGA)."
}, },
{ {
"code": "BSI-TR-03161-2", "code": "BSI-TR-03161-2",
@@ -1796,14 +1796,12 @@
"full_name": "BSI TR-03161 Teil 2 — Sicherheitsanforderungen DiGA — Web-Anwendungen", "full_name": "BSI TR-03161 Teil 2 — Sicherheitsanforderungen DiGA — Web-Anwendungen",
"doc_type": "bsi_standard", "doc_type": "bsi_standard",
"description": "Technische Richtlinie fuer die Sicherheit von Web-Anwendungen im Gesundheitswesen.", "description": "Technische Richtlinie fuer die Sicherheit von Web-Anwendungen im Gesundheitswesen.",
"industries": [ "industries": [],
"elektrotechnik"
],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_gesetze", "rag_collection": "bp_compliance_gesetze",
"effective_date": "Version 1.0: 2020", "effective_date": "Version 1.0: 2020",
"sort_order": 3, "sort_order": 3,
"applicability_note": "Sektorspezifisch: Elektrotechnik. Sicherheitsanforderungen fuer Web-Anwendungen anwendbar auf die Digitalindustrie." "applicability_note": "Nicht zutreffend fuer produzierende Industrie. Spezifisch fuer Digitale Gesundheitsanwendungen (DiGA)."
}, },
{ {
"code": "BSI-TR-03161-3", "code": "BSI-TR-03161-3",
@@ -1811,14 +1809,12 @@
"full_name": "BSI TR-03161 Teil 3 — Sicherheitsanforderungen DiGA — Hintergrundsysteme", "full_name": "BSI TR-03161 Teil 3 — Sicherheitsanforderungen DiGA — Hintergrundsysteme",
"doc_type": "bsi_standard", "doc_type": "bsi_standard",
"description": "Technische Richtlinie fuer Backend-Systeme von Gesundheitsanwendungen. Deckt Server, APIs, Datenbanken und Cloud-Infrastruktur ab.", "description": "Technische Richtlinie fuer Backend-Systeme von Gesundheitsanwendungen. Deckt Server, APIs, Datenbanken und Cloud-Infrastruktur ab.",
"industries": [ "industries": [],
"elektrotechnik"
],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_gesetze", "rag_collection": "bp_compliance_gesetze",
"effective_date": "Version 1.0: 2020", "effective_date": "Version 1.0: 2020",
"sort_order": 4, "sort_order": 4,
"applicability_note": "Sektorspezifisch: Elektrotechnik. Sicherheitsanforderungen fuer Backend-Systeme anwendbar auf die Digitalindustrie." "applicability_note": "Nicht zutreffend fuer produzierende Industrie. Spezifisch fuer Digitale Gesundheitsanwendungen (DiGA)."
}, },
{ {
"code": "EDPB_ACCESS_01_2022", "code": "EDPB_ACCESS_01_2022",
@@ -3525,15 +3521,13 @@
"doc_type": "nist_standard", "doc_type": "nist_standard",
"description": "NIST-Framework fuer sichere Softwareentwicklung. Definiert Praktiken und Aufgaben in vier Gruppen: Prepare, Protect, Produce, Respond.", "description": "NIST-Framework fuer sichere Softwareentwicklung. Definiert Praktiken und Aufgaben in vier Gruppen: Prepare, Protect, Produce, Respond.",
"industries": [ "industries": [
"automotive", "all"
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_ce", "rag_collection": "bp_compliance_ce",
"effective_date": "3. Februar 2022", "effective_date": "3. Februar 2022",
"sort_order": 3, "sort_order": 3,
"applicability_note": "Sektorspezifisch: Automotive, Maschinenbau, Elektrotechnik. Framework fuer sichere Softwareentwicklung relevant fuer Unternehmen mit Software-Produkten." "applicability_note": "Gilt fuer alle Branchen. Jedes Unternehmen das Software entwickelt — ob Maschinensteuerung, Fahrzeug-Firmware oder Kunden-Portal."
}, },
{ {
"code": "NISTIR_8259A", "code": "NISTIR_8259A",
@@ -3541,13 +3535,12 @@
"full_name": "NISTIR 8259A — IoT Device Cybersecurity Capability Core Baseline", "full_name": "NISTIR 8259A — IoT Device Cybersecurity Capability Core Baseline",
"doc_type": "nist_standard", "doc_type": "nist_standard",
"industries": [ "industries": [
"elektrotechnik", "all"
"maschinenbau",
"automotive"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_datenschutz", "rag_collection": "bp_compliance_datenschutz",
"sort_order": 4 "sort_order": 4,
"applicability_note": "Gilt fuer alle Branchen. IoT-Sicherheitsbaseline fuer jeden Hersteller vernetzter Geraete."
}, },
{ {
"code": "NIST_AI_RMF", "code": "NIST_AI_RMF",
@@ -3603,13 +3596,17 @@
"full_name": "NIST SP 800-82 Rev. 3 — Guide to OT Security", "full_name": "NIST SP 800-82 Rev. 3 — Guide to OT Security",
"doc_type": "nist_standard", "doc_type": "nist_standard",
"industries": [ "industries": [
"energie",
"maschinenbau", "maschinenbau",
"chemie" "automotive",
"elektrotechnik",
"chemie",
"energie",
"metall"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_ce", "rag_collection": "bp_compliance_ce",
"sort_order": 9 "sort_order": 9,
"applicability_note": "Sektorspezifisch: Branchen mit Operational Technology (OT) — Maschinenbau, Automotive, Elektrotechnik, Chemie, Energie, Metall."
}, },
{ {
"code": "NIST_SP_800_160", "code": "NIST_SP_800_160",
@@ -3629,13 +3626,12 @@
"full_name": "NIST SP 800-207 — Zero Trust Architecture", "full_name": "NIST SP 800-207 — Zero Trust Architecture",
"doc_type": "nist_standard", "doc_type": "nist_standard",
"industries": [ "industries": [
"energie", "all"
"maschinenbau",
"chemie"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_datenschutz", "rag_collection": "bp_compliance_datenschutz",
"sort_order": 11 "sort_order": 11,
"applicability_note": "Gilt fuer alle Branchen. Zero-Trust-Architektur als Sicherheitskonzept fuer alle Unternehmensnetzwerke."
}, },
{ {
"code": "OWASP_TOP10_2021", "code": "OWASP_TOP10_2021",
@@ -3643,13 +3639,12 @@
"full_name": "OWASP Top 10 (2021)", "full_name": "OWASP Top 10 (2021)",
"doc_type": "owasp_standard", "doc_type": "owasp_standard",
"industries": [ "industries": [
"automotive", "all"
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_datenschutz", "rag_collection": "bp_compliance_datenschutz",
"sort_order": 1 "sort_order": 1,
"applicability_note": "Gilt fuer alle Branchen. Jedes Unternehmen das Webanwendungen oder SaaS-Produkte betreibt muss die OWASP Top 10 beachten."
}, },
{ {
"code": "OWASP_API_SECURITY_2023", "code": "OWASP_API_SECURITY_2023",
@@ -3657,9 +3652,7 @@
"full_name": "OWASP API Security Top 10 (2023)", "full_name": "OWASP API Security Top 10 (2023)",
"doc_type": "owasp_standard", "doc_type": "owasp_standard",
"industries": [ "industries": [
"automotive", "all"
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_datenschutz", "rag_collection": "bp_compliance_datenschutz",
@@ -3671,9 +3664,7 @@
"full_name": "OWASP Application Security Verification Standard (ASVS)", "full_name": "OWASP Application Security Verification Standard (ASVS)",
"doc_type": "owasp_standard", "doc_type": "owasp_standard",
"industries": [ "industries": [
"automotive", "all"
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_datenschutz", "rag_collection": "bp_compliance_datenschutz",
@@ -3685,9 +3676,7 @@
"full_name": "OWASP Mobile Application Security Verification Standard (MASVS)", "full_name": "OWASP Mobile Application Security Verification Standard (MASVS)",
"doc_type": "owasp_standard", "doc_type": "owasp_standard",
"industries": [ "industries": [
"automotive", "all"
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_datenschutz", "rag_collection": "bp_compliance_datenschutz",
@@ -3699,9 +3688,7 @@
"full_name": "OWASP Mobile Top 10", "full_name": "OWASP Mobile Top 10",
"doc_type": "owasp_standard", "doc_type": "owasp_standard",
"industries": [ "industries": [
"automotive", "all"
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_datenschutz", "rag_collection": "bp_compliance_datenschutz",
@@ -3713,9 +3700,7 @@
"full_name": "OWASP Software Assurance Maturity Model (SAMM)", "full_name": "OWASP Software Assurance Maturity Model (SAMM)",
"doc_type": "owasp_standard", "doc_type": "owasp_standard",
"industries": [ "industries": [
"automotive", "all"
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_datenschutz", "rag_collection": "bp_compliance_datenschutz",
@@ -3727,13 +3712,12 @@
"full_name": "CISA Secure by Design — Principles and Approaches", "full_name": "CISA Secure by Design — Principles and Approaches",
"doc_type": "enisa_guidance", "doc_type": "enisa_guidance",
"industries": [ "industries": [
"automotive", "all"
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_ce", "rag_collection": "bp_compliance_ce",
"sort_order": 1 "sort_order": 1,
"applicability_note": "Gilt fuer alle Branchen. Secure-by-Design-Prinzipien betreffen jeden Hersteller von Produkten mit digitalen Elementen."
}, },
{ {
"code": "ENISA_ICS_SCADA", "code": "ENISA_ICS_SCADA",
@@ -3741,14 +3725,17 @@
"full_name": "ENISA ICS/SCADA Kommunikationsnetzwerk-Abhaengigkeiten", "full_name": "ENISA ICS/SCADA Kommunikationsnetzwerk-Abhaengigkeiten",
"doc_type": "enisa_guidance", "doc_type": "enisa_guidance",
"industries": [ "industries": [
"energie",
"transport",
"maschinenbau", "maschinenbau",
"elektrotechnik" "elektrotechnik",
"automotive",
"chemie",
"energie",
"transport"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_ce", "rag_collection": "bp_compliance_ce",
"sort_order": 2 "sort_order": 2,
"applicability_note": "Sektorspezifisch: Alle Branchen mit industrieller Steuerungstechnik — Maschinenbau, Elektrotechnik, Automotive, Chemie, Energie, Transport."
}, },
{ {
"code": "ENISA_SUPPLY_CHAIN", "code": "ENISA_SUPPLY_CHAIN",
@@ -3757,16 +3744,13 @@
"doc_type": "enisa_guidance", "doc_type": "enisa_guidance",
"description": "ENISA-Analyse der Bedrohungslandschaft fuer Supply-Chain-Angriffe. Beschreibt Angriffsvektoren, Taxonomie und Empfehlungen zur Absicherung von Software-Lieferketten.", "description": "ENISA-Analyse der Bedrohungslandschaft fuer Supply-Chain-Angriffe. Beschreibt Angriffsvektoren, Taxonomie und Empfehlungen zur Absicherung von Software-Lieferketten.",
"industries": [ "industries": [
"energie", "all"
"transport",
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_ce", "rag_collection": "bp_compliance_ce",
"effective_date": "2021", "effective_date": "2021",
"sort_order": 3, "sort_order": 3,
"applicability_note": "Sektorspezifisch: Energie, Transport, Maschinenbau, Elektrotechnik. ENISA-Empfehlungen zur Absicherung von Software-Lieferketten." "applicability_note": "Gilt fuer alle Branchen. Lieferkettensicherheit ist im Rahmen von CRA und NIS2 fuer alle Hersteller relevant."
}, },
{ {
"code": "ENISA_THREAT_LANDSCAPE", "code": "ENISA_THREAT_LANDSCAPE",
@@ -3774,10 +3758,7 @@
"full_name": "ENISA Threat Landscape fuer Supply Chain Attacks", "full_name": "ENISA Threat Landscape fuer Supply Chain Attacks",
"doc_type": "enisa_guidance", "doc_type": "enisa_guidance",
"industries": [ "industries": [
"energie", "all"
"transport",
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_ce", "rag_collection": "bp_compliance_ce",
@@ -3789,10 +3770,7 @@
"full_name": "ENISA Bericht zum Stand der Cybersicherheit in der EU 2024", "full_name": "ENISA Bericht zum Stand der Cybersicherheit in der EU 2024",
"doc_type": "enisa_guidance", "doc_type": "enisa_guidance",
"industries": [ "industries": [
"energie", "all"
"transport",
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_ce", "rag_collection": "bp_compliance_ce",
@@ -3804,13 +3782,12 @@
"full_name": "CVSS v4.0 — Common Vulnerability Scoring System", "full_name": "CVSS v4.0 — Common Vulnerability Scoring System",
"doc_type": "international", "doc_type": "international",
"industries": [ "industries": [
"automotive", "all"
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_ce", "rag_collection": "bp_compliance_ce",
"sort_order": 1 "sort_order": 1,
"applicability_note": "Gilt fuer alle Branchen. Schwachstellenbewertung ist Pflicht im Rahmen des CRA fuer alle Hersteller vernetzter Produkte."
}, },
{ {
"code": "CYCLONEDX_1_6", "code": "CYCLONEDX_1_6",
@@ -3818,13 +3795,12 @@
"full_name": "CycloneDX 1.6 — SBOM Standard (ECMA-424)", "full_name": "CycloneDX 1.6 — SBOM Standard (ECMA-424)",
"doc_type": "international", "doc_type": "international",
"industries": [ "industries": [
"automotive", "all"
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_ce", "rag_collection": "bp_compliance_ce",
"sort_order": 2 "sort_order": 2,
"applicability_note": "Gilt fuer alle Branchen. SBOM-Standard — der CRA verlangt von allen Herstellern eine Software-Stueckliste."
}, },
{ {
"code": "FDA_HFE", "code": "FDA_HFE",
@@ -3858,8 +3834,7 @@
"full_name": "OpenTelemetry Specification — Observability Framework", "full_name": "OpenTelemetry Specification — Observability Framework",
"doc_type": "international", "doc_type": "international",
"industries": [ "industries": [
"elektrotechnik", "all"
"automotive"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_ce", "rag_collection": "bp_compliance_ce",
@@ -3871,13 +3846,12 @@
"full_name": "SLSA v1.0 — Supply-chain Levels for Software Artifacts", "full_name": "SLSA v1.0 — Supply-chain Levels for Software Artifacts",
"doc_type": "international", "doc_type": "international",
"industries": [ "industries": [
"automotive", "all"
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_ce", "rag_collection": "bp_compliance_ce",
"sort_order": 6 "sort_order": 6,
"applicability_note": "Gilt fuer alle Branchen. Supply-Chain-Integritaet fuer alle Unternehmen die Software bauen und ausliefern."
}, },
{ {
"code": "SPDX_3", "code": "SPDX_3",
@@ -3885,13 +3859,12 @@
"full_name": "SPDX 3.0.1 — Software Package Data Exchange", "full_name": "SPDX 3.0.1 — Software Package Data Exchange",
"doc_type": "international", "doc_type": "international",
"industries": [ "industries": [
"automotive", "all"
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_ce", "rag_collection": "bp_compliance_ce",
"sort_order": 7 "sort_order": 7,
"applicability_note": "Gilt fuer alle Branchen. SBOM-Standard fuer Software-Lizenz- und Abhaengigkeitsdokumentation."
}, },
{ {
"code": "BFDI_VVT", "code": "BFDI_VVT",
@@ -4347,16 +4320,13 @@
"doc_type": "enisa_guidance", "doc_type": "enisa_guidance",
"description": "ENISA-Leitfaden fuer sichere Softwareentwicklung. Beschreibt Best Practices fuer Security by Design, sichere Entwicklungsprozesse und Schwachstellenmanagement.", "description": "ENISA-Leitfaden fuer sichere Softwareentwicklung. Beschreibt Best Practices fuer Security by Design, sichere Entwicklungsprozesse und Schwachstellenmanagement.",
"industries": [ "industries": [
"energie", "all"
"transport",
"maschinenbau",
"elektrotechnik"
], ],
"in_rag": true, "in_rag": true,
"rag_collection": "bp_compliance_ce", "rag_collection": "bp_compliance_ce",
"effective_date": "2023", "effective_date": "2023",
"sort_order": 6, "sort_order": 6,
"applicability_note": "Sektorspezifisch: Energie, Transport, Maschinenbau, Elektrotechnik. ENISA-Leitfaden fuer sichere Softwareentwicklung." "applicability_note": "Gilt fuer alle Branchen. Sichere Softwareentwicklung betrifft jeden Hersteller digitaler Produkte."
} }
] ]
} }