sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

ONB-17 · Compliance-scope capture + pluggable ControlsProvider (OSCAL vs breakpilot RAG) #136

New Issue
Open
opened 2026-07-10 10:32:30 +00:00 by sharang · 0 comments
sharang commented 2026-07-10 10:32:30 +00:00
Owner
Copy Link
Copy Source

Part of #118. Suite-integration workstream. The controls corpus for the mapping engine is a pluggable provider; a tenant may own Benjamin's breakpilot-compliance RAG.

Context

compliance-scanner maps findings → controls → compliance status (CS-C epics; built-in cra-62443-catalog OSCAL). breakpilot-compliance (from Benjamin Bönisch) is a RAG of 300,000+ atomic controls derived from ~400 laws. If the tenant owns it, the mapping engine should query that RAG for far broader coverage.

Scope

  • Onboarding captures a compliance scope: ComplianceProfile on the target — applicable frameworks/jurisdictions (CRA, IEC 62443, GDPR, SOC2, ISO 27001, ...). This drives which controls are relevant and is set during onboarding (with sensible defaults per target type — e.g. firmware → CRA + 62443).
  • ControlsProvider port in compliance-core with impls: built-in OSCAL catalog (default) and breakpilot RAG (when the tenant has it). The mapping engine (CS-C2) queries the provider, not a hardcoded catalog.
  • Seam now: the ComplianceProfile model field + the ControlsProvider trait stub + default-profile-per-target-type. RAG wiring lands later.

Depends on

ONB-01 (#119). Ties to CS-C2 (#107), CS-C3 (#108).

Part of #118. **Suite-integration workstream.** The controls corpus for the mapping engine is a pluggable provider; a tenant may own Benjamin's breakpilot-compliance RAG. ## Context compliance-scanner maps findings → controls → compliance status (CS-C epics; built-in `cra-62443-catalog` OSCAL). **breakpilot-compliance** (from Benjamin Bönisch) is a RAG of 300,000+ atomic controls derived from ~400 laws. If the tenant owns it, the mapping engine should query that RAG for far broader coverage. ## Scope - **Onboarding captures a compliance scope**: `ComplianceProfile` on the target — applicable frameworks/jurisdictions (CRA, IEC 62443, GDPR, SOC2, ISO 27001, ...). This drives which controls are relevant and is set during onboarding (with sensible defaults per target type — e.g. firmware → CRA + 62443). - **`ControlsProvider` port** in compliance-core with impls: built-in OSCAL catalog (default) and breakpilot RAG (when the tenant has it). The mapping engine (CS-C2) queries the provider, not a hardcoded catalog. - Seam now: the `ComplianceProfile` model field + the `ControlsProvider` trait stub + default-profile-per-target-type. RAG wiring lands later. ## Depends on ONB-01 (#119). Ties to CS-C2 (#107), CS-C3 (#108).
sharang added this to the Onboarding v1 milestone 2026-07-10 10:32:30 +00:00
sharang added the onboardingenhancement labels 2026-07-10 10:32:30 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels enhancement onboarding
Milestone
No items
No Milestone Onboarding v1
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#136