@ansvar/eu-regulations-mcp 0.1.0 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (156) hide show
  1. package/LICENSE +190 -21
  2. package/README.md +125 -26
  3. package/data/seed/aifmd.json +432 -0
  4. package/data/seed/applicability/ai-act.json +87 -0
  5. package/data/seed/applicability/aifmd.json +74 -0
  6. package/data/seed/applicability/cbam.json +74 -0
  7. package/data/seed/applicability/cer.json +74 -0
  8. package/data/seed/applicability/cra.json +77 -0
  9. package/data/seed/applicability/csddd.json +74 -0
  10. package/data/seed/applicability/csrd.json +74 -0
  11. package/data/seed/applicability/cyber_solidarity.json +74 -0
  12. package/data/seed/applicability/cybersecurity-act.json +69 -0
  13. package/data/seed/applicability/data-act.json +71 -0
  14. package/data/seed/applicability/dga.json +74 -0
  15. package/data/seed/applicability/dma.json +77 -0
  16. package/data/seed/applicability/dsa.json +71 -0
  17. package/data/seed/applicability/eecc.json +74 -0
  18. package/data/seed/applicability/ehds.json +74 -0
  19. package/data/seed/applicability/eidas2.json +86 -0
  20. package/data/seed/applicability/eprivacy.json +74 -0
  21. package/data/seed/applicability/eu_taxonomy.json +74 -0
  22. package/data/seed/applicability/eucc.json +74 -0
  23. package/data/seed/applicability/eudr.json +74 -0
  24. package/data/seed/applicability/gpsr.json +74 -0
  25. package/data/seed/applicability/ivdr.json +74 -0
  26. package/data/seed/applicability/led.json +74 -0
  27. package/data/seed/applicability/machinery.json +74 -0
  28. package/data/seed/applicability/mdr.json +74 -0
  29. package/data/seed/applicability/mica.json +74 -0
  30. package/data/seed/applicability/mifid2.json +74 -0
  31. package/data/seed/applicability/mifir.json +74 -0
  32. package/data/seed/applicability/pld.json +74 -0
  33. package/data/seed/applicability/psd2.json +74 -0
  34. package/data/seed/applicability/red.json +74 -0
  35. package/data/seed/applicability/sfdr.json +74 -0
  36. package/data/seed/applicability/un-r155.json +68 -0
  37. package/data/seed/applicability/un-r156.json +68 -0
  38. package/data/seed/cbam.json +397 -0
  39. package/data/seed/cer.json +233 -0
  40. package/data/seed/csddd.json +205 -0
  41. package/data/seed/csrd.json +50 -0
  42. package/data/seed/cyber_solidarity.json +252 -0
  43. package/data/seed/data-act.json +517 -0
  44. package/data/seed/dga.json +342 -0
  45. package/data/seed/dma.json +499 -0
  46. package/data/seed/dsa.json +686 -0
  47. package/data/seed/eecc.json +981 -0
  48. package/data/seed/ehds.json +638 -0
  49. package/data/seed/eidas2.json +590 -0
  50. package/data/seed/eprivacy.json +115 -0
  51. package/data/seed/eu_taxonomy.json +285 -0
  52. package/data/seed/eucc.json +386 -0
  53. package/data/seed/eudr.json +401 -0
  54. package/data/seed/gpsr.json +462 -0
  55. package/data/seed/ivdr.json +1036 -0
  56. package/data/seed/led.json +480 -0
  57. package/data/seed/machinery.json +513 -0
  58. package/data/seed/mappings/iso27001-ai-act.json +114 -0
  59. package/data/seed/mappings/iso27001-aifmd.json +50 -0
  60. package/data/seed/mappings/iso27001-cbam.json +26 -0
  61. package/data/seed/mappings/iso27001-cer.json +74 -0
  62. package/data/seed/mappings/iso27001-cra.json +130 -0
  63. package/data/seed/mappings/iso27001-csddd.json +50 -0
  64. package/data/seed/mappings/iso27001-csrd.json +26 -0
  65. package/data/seed/mappings/iso27001-cyber_solidarity.json +82 -0
  66. package/data/seed/mappings/iso27001-cybersecurity-act.json +90 -0
  67. package/data/seed/mappings/iso27001-data-act.json +66 -0
  68. package/data/seed/mappings/iso27001-dga.json +50 -0
  69. package/data/seed/mappings/iso27001-dma.json +50 -0
  70. package/data/seed/mappings/iso27001-dsa.json +58 -0
  71. package/data/seed/mappings/iso27001-eecc.json +74 -0
  72. package/data/seed/mappings/iso27001-ehds.json +90 -0
  73. package/data/seed/mappings/iso27001-eidas2.json +106 -0
  74. package/data/seed/mappings/iso27001-eprivacy.json +66 -0
  75. package/data/seed/mappings/iso27001-eu_taxonomy.json +34 -0
  76. package/data/seed/mappings/iso27001-eucc.json +66 -0
  77. package/data/seed/mappings/iso27001-eudr.json +34 -0
  78. package/data/seed/mappings/iso27001-gpsr.json +42 -0
  79. package/data/seed/mappings/iso27001-ivdr.json +66 -0
  80. package/data/seed/mappings/iso27001-led.json +74 -0
  81. package/data/seed/mappings/iso27001-machinery.json +50 -0
  82. package/data/seed/mappings/iso27001-mdr.json +82 -0
  83. package/data/seed/mappings/iso27001-mica.json +66 -0
  84. package/data/seed/mappings/iso27001-mifid2.json +66 -0
  85. package/data/seed/mappings/iso27001-mifir.json +42 -0
  86. package/data/seed/mappings/iso27001-pld.json +26 -0
  87. package/data/seed/mappings/iso27001-psd2.json +82 -0
  88. package/data/seed/mappings/iso27001-red.json +42 -0
  89. package/data/seed/mappings/iso27001-sfdr.json +50 -0
  90. package/data/seed/mappings/iso27001-un-r155.json +130 -0
  91. package/data/seed/mappings/iso27001-un-r156.json +106 -0
  92. package/data/seed/mappings/nist-csf-ai-act.json +138 -0
  93. package/data/seed/mappings/nist-csf-aifmd.json +58 -0
  94. package/data/seed/mappings/nist-csf-cbam.json +42 -0
  95. package/data/seed/mappings/nist-csf-cer.json +90 -0
  96. package/data/seed/mappings/nist-csf-cra.json +130 -0
  97. package/data/seed/mappings/nist-csf-csddd.json +50 -0
  98. package/data/seed/mappings/nist-csf-csrd.json +34 -0
  99. package/data/seed/mappings/nist-csf-cyber_solidarity.json +90 -0
  100. package/data/seed/mappings/nist-csf-cybersecurity-act.json +90 -0
  101. package/data/seed/mappings/nist-csf-data-act.json +50 -0
  102. package/data/seed/mappings/nist-csf-dga.json +58 -0
  103. package/data/seed/mappings/nist-csf-dma.json +42 -0
  104. package/data/seed/mappings/nist-csf-dora.json +210 -0
  105. package/data/seed/mappings/nist-csf-dsa.json +82 -0
  106. package/data/seed/mappings/nist-csf-eecc.json +90 -0
  107. package/data/seed/mappings/nist-csf-ehds.json +98 -0
  108. package/data/seed/mappings/nist-csf-eidas2.json +114 -0
  109. package/data/seed/mappings/nist-csf-eprivacy.json +58 -0
  110. package/data/seed/mappings/nist-csf-eu_taxonomy.json +34 -0
  111. package/data/seed/mappings/nist-csf-eucc.json +66 -0
  112. package/data/seed/mappings/nist-csf-eudr.json +58 -0
  113. package/data/seed/mappings/nist-csf-gdpr.json +178 -0
  114. package/data/seed/mappings/nist-csf-gpsr.json +58 -0
  115. package/data/seed/mappings/nist-csf-ivdr.json +66 -0
  116. package/data/seed/mappings/nist-csf-led.json +74 -0
  117. package/data/seed/mappings/nist-csf-machinery.json +58 -0
  118. package/data/seed/mappings/nist-csf-mdr.json +66 -0
  119. package/data/seed/mappings/nist-csf-mica.json +98 -0
  120. package/data/seed/mappings/nist-csf-mifid2.json +74 -0
  121. package/data/seed/mappings/nist-csf-mifir.json +50 -0
  122. package/data/seed/mappings/nist-csf-nis2.json +194 -0
  123. package/data/seed/mappings/nist-csf-pld.json +34 -0
  124. package/data/seed/mappings/nist-csf-psd2.json +98 -0
  125. package/data/seed/mappings/nist-csf-red.json +58 -0
  126. package/data/seed/mappings/nist-csf-sfdr.json +42 -0
  127. package/data/seed/mappings/nist-csf-un-r155.json +130 -0
  128. package/data/seed/mappings/nist-csf-un-r156.json +98 -0
  129. package/data/seed/mdr.json +1066 -0
  130. package/data/seed/mica.json +1003 -0
  131. package/data/seed/mifid2.json +906 -0
  132. package/data/seed/mifir.json +512 -0
  133. package/data/seed/pld.json +244 -0
  134. package/data/seed/psd2.json +827 -0
  135. package/data/seed/red.json +452 -0
  136. package/data/seed/sfdr.json +228 -0
  137. package/data/seed/un-r155.json +166 -0
  138. package/data/seed/un-r156.json +150 -0
  139. package/dist/http-server.d.ts +9 -0
  140. package/dist/http-server.d.ts.map +1 -0
  141. package/dist/http-server.js +342 -0
  142. package/dist/http-server.js.map +1 -0
  143. package/dist/index.js +4 -4
  144. package/dist/index.js.map +1 -1
  145. package/dist/tools/map.d.ts +1 -1
  146. package/dist/tools/map.d.ts.map +1 -1
  147. package/dist/tools/map.js +3 -3
  148. package/dist/tools/map.js.map +1 -1
  149. package/package.json +6 -2
  150. package/scripts/build-db.ts +20 -8
  151. package/scripts/check-updates.ts +141 -39
  152. package/scripts/ingest-eurlex.ts +9 -1
  153. package/scripts/ingest-unece.ts +368 -0
  154. package/src/http-server.ts +380 -0
  155. package/src/index.ts +4 -4
  156. package/src/tools/map.ts +4 -4
package/data/seed/mappings/nist-csf-un-r155.json ADDED
@@ -0,0 +1,130 @@
1
+ [
2
+ {
3
+ "control_id": "GV.OC-01",
4
+ "control_name": "Organizational context",
5
+ "regulation": "UN_R155",
6
+ "articles": ["1"],
7
+ "coverage": "full",
8
+ "notes": "Section 1 scope for vehicle cybersecurity type approval"
9
+ },
10
+ {
11
+ "control_id": "GV.RM-01",
12
+ "control_name": "Risk management objectives",
13
+ "regulation": "UN_R155",
14
+ "articles": ["7"],
15
+ "coverage": "full",
16
+ "notes": "Section 7 CSMS requires documented risk management"
17
+ },
18
+ {
19
+ "control_id": "GV.RR-01",
20
+ "control_name": "Organizational roles and responsibilities",
21
+ "regulation": "UN_R155",
22
+ "articles": ["7"],
23
+ "coverage": "full",
24
+ "notes": "Section 7.2.2.2 organizational roles for cybersecurity"
25
+ },
26
+ {
27
+ "control_id": "GV.PO-01",
28
+ "control_name": "Cybersecurity policy",
29
+ "regulation": "UN_R155",
30
+ "articles": ["7"],
31
+ "coverage": "full",
32
+ "notes": "Section 7 requires CSMS policies and procedures"
33
+ },
34
+ {
35
+ "control_id": "GV.SC-01",
36
+ "control_name": "Supply chain risk management program",
37
+ "regulation": "UN_R155",
38
+ "articles": ["7"],
39
+ "coverage": "full",
40
+ "notes": "Section 7.2.2.3 supplier and service provider risk management"
41
+ },
42
+ {
43
+ "control_id": "ID.AM-01",
44
+ "control_name": "Inventories of assets",
45
+ "regulation": "UN_R155",
46
+ "articles": ["7"],
47
+ "coverage": "full",
48
+ "notes": "Section 7 CSMS requires vehicle system inventory"
49
+ },
50
+ {
51
+ "control_id": "ID.RA-01",
52
+ "control_name": "Vulnerabilities in assets are identified",
53
+ "regulation": "UN_R155",
54
+ "articles": ["7", "Annex 5"],
55
+ "coverage": "full",
56
+ "notes": "Section 7.2.2.5 vulnerability identification, Annex 5 threat/vulnerability list"
57
+ },
58
+ {
59
+ "control_id": "ID.RA-03",
60
+ "control_name": "Internal and external threats are identified",
61
+ "regulation": "UN_R155",
62
+ "articles": ["7", "Annex 5"],
63
+ "coverage": "full",
64
+ "notes": "Section 7 threat assessment, Annex 5 comprehensive threat catalogue"
65
+ },
66
+ {
67
+ "control_id": "ID.RA-05",
68
+ "control_name": "Risk responses are identified",
69
+ "regulation": "UN_R155",
70
+ "articles": ["7", "Annex 5"],
71
+ "coverage": "full",
72
+ "notes": "Section 7 risk mitigation, Annex 5 mitigations for each threat"
73
+ },
74
+ {
75
+ "control_id": "PR.DS-01",
76
+ "control_name": "Data-at-rest is protected",
77
+ "regulation": "UN_R155",
78
+ "articles": ["7", "Annex 5"],
79
+ "coverage": "full",
80
+ "notes": "Annex 5 Part A.3.1 data protection mitigations"
81
+ },
82
+ {
83
+ "control_id": "PR.DS-02",
84
+ "control_name": "Data-in-transit is protected",
85
+ "regulation": "UN_R155",
86
+ "articles": ["7", "Annex 5"],
87
+ "coverage": "full",
88
+ "notes": "Annex 5 communication security mitigations"
89
+ },
90
+ {
91
+ "control_id": "PR.PS-01",
92
+ "control_name": "Configuration management practices established",
93
+ "regulation": "UN_R155",
94
+ "articles": ["7"],
95
+ "coverage": "full",
96
+ "notes": "Section 7 CSMS includes secure configuration"
97
+ },
98
+ {
99
+ "control_id": "DE.CM-01",
100
+ "control_name": "Networks and network services are monitored",
101
+ "regulation": "UN_R155",
102
+ "articles": ["7"],
103
+ "coverage": "full",
104
+ "notes": "Section 7.2.2.4 monitoring and threat detection"
105
+ },
106
+ {
107
+ "control_id": "DE.AE-02",
108
+ "control_name": "Potentially adverse events are analyzed",
109
+ "regulation": "UN_R155",
110
+ "articles": ["7"],
111
+ "coverage": "full",
112
+ "notes": "Section 7.2.2.4 analysis of detected threats"
113
+ },
114
+ {
115
+ "control_id": "RS.MA-01",
116
+ "control_name": "Incident response plan is executed",
117
+ "regulation": "UN_R155",
118
+ "articles": ["7"],
119
+ "coverage": "full",
120
+ "notes": "Section 7.2.2.4 response to cyber attacks"
121
+ },
122
+ {
123
+ "control_id": "RC.RP-01",
124
+ "control_name": "Recovery plan is executed",
125
+ "regulation": "UN_R155",
126
+ "articles": ["7"],
127
+ "coverage": "partial",
128
+ "notes": "Section 7 CSMS includes recovery procedures"
129
+ }
130
+ ]
package/data/seed/mappings/nist-csf-un-r156.json ADDED
@@ -0,0 +1,98 @@
1
+ [
2
+ {
3
+ "control_id": "GV.OC-01",
4
+ "control_name": "Organizational context",
5
+ "regulation": "UN_R156",
6
+ "articles": ["1"],
7
+ "coverage": "full",
8
+ "notes": "Section 1 scope for software update type approval"
9
+ },
10
+ {
11
+ "control_id": "GV.RM-01",
12
+ "control_name": "Risk management objectives",
13
+ "regulation": "UN_R156",
14
+ "articles": ["7"],
15
+ "coverage": "full",
16
+ "notes": "Section 7 SUMS requires documented processes"
17
+ },
18
+ {
19
+ "control_id": "GV.RR-01",
20
+ "control_name": "Organizational roles and responsibilities",
21
+ "regulation": "UN_R156",
22
+ "articles": ["7"],
23
+ "coverage": "full",
24
+ "notes": "Section 7.1.2 organizational processes for SUMS"
25
+ },
26
+ {
27
+ "control_id": "GV.PO-01",
28
+ "control_name": "Cybersecurity policy",
29
+ "regulation": "UN_R156",
30
+ "articles": ["7"],
31
+ "coverage": "full",
32
+ "notes": "Section 7 requires SUMS policies for secure updates"
33
+ },
34
+ {
35
+ "control_id": "ID.AM-02",
36
+ "control_name": "Software platforms and applications inventories",
37
+ "regulation": "UN_R156",
38
+ "articles": ["7"],
39
+ "coverage": "full",
40
+ "notes": "Section 7.1.2 RXSWIN for software version tracking"
41
+ },
42
+ {
43
+ "control_id": "ID.RA-01",
44
+ "control_name": "Vulnerabilities in assets are identified",
45
+ "regulation": "UN_R156",
46
+ "articles": ["7"],
47
+ "coverage": "full",
48
+ "notes": "Section 7 security-relevant software update management"
49
+ },
50
+ {
51
+ "control_id": "PR.DS-02",
52
+ "control_name": "Data-in-transit is protected",
53
+ "regulation": "UN_R156",
54
+ "articles": ["7"],
55
+ "coverage": "full",
56
+ "notes": "Section 7.2 secure OTA update transmission"
57
+ },
58
+ {
59
+ "control_id": "PR.PS-01",
60
+ "control_name": "Configuration management practices established",
61
+ "regulation": "UN_R156",
62
+ "articles": ["7"],
63
+ "coverage": "full",
64
+ "notes": "Section 7.1.2 RXSWIN configuration management"
65
+ },
66
+ {
67
+ "control_id": "PR.PS-02",
68
+ "control_name": "Software is maintained and updated",
69
+ "regulation": "UN_R156",
70
+ "articles": ["7"],
71
+ "coverage": "full",
72
+ "notes": "Section 7 entire regulation focused on software updates"
73
+ },
74
+ {
75
+ "control_id": "DE.AE-02",
76
+ "control_name": "Potentially adverse events are analyzed",
77
+ "regulation": "UN_R156",
78
+ "articles": ["7"],
79
+ "coverage": "partial",
80
+ "notes": "Section 7.1.3 documentation of update issues"
81
+ },
82
+ {
83
+ "control_id": "RS.MA-01",
84
+ "control_name": "Incident response plan is executed",
85
+ "regulation": "UN_R156",
86
+ "articles": ["7"],
87
+ "coverage": "partial",
88
+ "notes": "Section 7 update rollback and failure handling"
89
+ },
90
+ {
91
+ "control_id": "RC.RP-01",
92
+ "control_name": "Recovery plan is executed",
93
+ "regulation": "UN_R156",
94
+ "articles": ["7"],
95
+ "coverage": "full",
96
+ "notes": "Section 7.2 safe update failure recovery"
97
+ }
98
+ ]