@ansvar/eu-regulations-mcp 0.1.0

package/data/seed/mappings/iso27001-dora.json

@@ -0,0 +1,106 @@
+[
+  {
+    "control_id": "A.5.1",
+    "control_name": "Policies for information security",
+    "regulation": "DORA",
+    "articles": ["5", "6", "9", "10"],
+    "coverage": "full",
+    "notes": "Art 5-6 governance requirements, Art 9-10 ICT risk management policies"
+  },
+  {
+    "control_id": "A.5.2",
+    "control_name": "Information security roles and responsibilities",
+    "regulation": "DORA",
+    "articles": ["5", "6"],
+    "coverage": "full",
+    "notes": "Art 5 governance and organisation, Art 6 management body responsibilities"
+  },
+  {
+    "control_id": "A.5.23",
+    "control_name": "Information security for use of cloud services",
+    "regulation": "DORA",
+    "articles": ["28", "29", "30", "31"],
+    "coverage": "full",
+    "notes": "Chapter V covers ICT third-party risk management including cloud services"
+  },
+  {
+    "control_id": "A.5.29",
+    "control_name": "Information security during disruption",
+    "regulation": "DORA",
+    "articles": ["11", "12"],
+    "coverage": "full",
+    "notes": "Art 11 response and recovery, Art 12 backup policies and restoration"
+  },
+  {
+    "control_id": "A.5.30",
+    "control_name": "ICT readiness for business continuity",
+    "regulation": "DORA",
+    "articles": ["11", "12", "13"],
+    "coverage": "full",
+    "notes": "Art 11-13 cover business continuity, backup, restoration, and communication"
+  },
+  {
+    "control_id": "A.6.8",
+    "control_name": "Information security event reporting",
+    "regulation": "DORA",
+    "articles": ["17", "18", "19", "20"],
+    "coverage": "full",
+    "notes": "Art 17 incident management, Art 19 major incident reporting (4h initial, 72h intermediate, 1 month final)"
+  },
+  {
+    "control_id": "A.8.2",
+    "control_name": "Privileged access rights",
+    "regulation": "DORA",
+    "articles": ["9"],
+    "coverage": "partial",
+    "notes": "Art 9(4)(c) requires access rights management"
+  },
+  {
+    "control_id": "A.8.5",
+    "control_name": "Secure authentication",
+    "regulation": "DORA",
+    "articles": ["9"],
+    "coverage": "partial",
+    "notes": "Art 9(4)(c) covers authentication mechanisms"
+  },
+  {
+    "control_id": "A.8.8",
+    "control_name": "Management of technical vulnerabilities",
+    "regulation": "DORA",
+    "articles": ["9", "24", "25", "26", "27"],
+    "coverage": "full",
+    "notes": "Art 9 vulnerability management, Chapter IV digital operational resilience testing"
+  },
+  {
+    "control_id": "A.8.16",
+    "control_name": "Monitoring activities",
+    "regulation": "DORA",
+    "articles": ["9", "10"],
+    "coverage": "full",
+    "notes": "Art 9-10 require continuous monitoring of ICT systems"
+  },
+  {
+    "control_id": "A.8.24",
+    "control_name": "Use of cryptography",
+    "regulation": "DORA",
+    "articles": ["9"],
+    "coverage": "partial",
+    "notes": "Art 9(4)(d) covers data protection including cryptographic measures"
+  },
+  {
+    "control_id": "A.8.25",
+    "control_name": "Secure development life cycle",
+    "regulation": "DORA",
+    "articles": ["8"],
+    "coverage": "full",
+    "notes": "Art 8 covers identification of ICT assets including custom-developed systems"
+  },
+  {
+    "control_id": "A.8.29",
+    "control_name": "Security testing in development and acceptance",
+    "regulation": "DORA",
+    "articles": ["24", "25", "26", "27"],
+    "coverage": "full",
+    "notes": "Chapter IV requires comprehensive digital operational resilience testing including TLPT"
+  }
+]

package/data/seed/mappings/iso27001-gdpr.json

@@ -0,0 +1,114 @@
+[
+  {
+    "control_id": "A.5.1",
+    "control_name": "Policies for information security",
+    "regulation": "GDPR",
+    "articles": ["24", "32"],
+    "coverage": "partial",
+    "notes": "GDPR requires appropriate technical and organisational measures (Art 32) and controller responsibility (Art 24)"
+  },
+  {
+    "control_id": "A.5.2",
+    "control_name": "Information security roles and responsibilities",
+    "regulation": "GDPR",
+    "articles": ["24", "37", "38", "39"],
+    "coverage": "partial",
+    "notes": "Controller accountability (Art 24), DPO designation and tasks (Art 37-39)"
+  },
+  {
+    "control_id": "A.5.10",
+    "control_name": "Acceptable use of information and other associated assets",
+    "regulation": "GDPR",
+    "articles": ["5", "6"],
+    "coverage": "full",
+    "notes": "Purpose limitation and lawfulness principles (Art 5, 6)"
+  },
+  {
+    "control_id": "A.5.31",
+    "control_name": "Legal, statutory, regulatory and contractual requirements",
+    "regulation": "GDPR",
+    "articles": ["1", "2", "3"],
+    "coverage": "full",
+    "notes": "GDPR scope and applicability (Art 1-3)"
+  },
+  {
+    "control_id": "A.5.33",
+    "control_name": "Protection of records",
+    "regulation": "GDPR",
+    "articles": ["5", "30"],
+    "coverage": "full",
+    "notes": "Storage limitation principle (Art 5) and records of processing (Art 30)"
+  },
+  {
+    "control_id": "A.5.34",
+    "control_name": "Privacy and protection of PII",
+    "regulation": "GDPR",
+    "articles": ["1", "5", "6", "7", "9", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22"],
+    "coverage": "full",
+    "notes": "Core GDPR requirements for personal data protection"
+  },
+  {
+    "control_id": "A.6.8",
+    "control_name": "Information security event reporting",
+    "regulation": "GDPR",
+    "articles": ["33", "34"],
+    "coverage": "full",
+    "notes": "Personal data breach notification within 72 hours (Art 33) and communication to data subjects (Art 34)"
+  },
+  {
+    "control_id": "A.7.10",
+    "control_name": "Storage media",
+    "regulation": "GDPR",
+    "articles": ["5", "32"],
+    "coverage": "partial",
+    "notes": "Storage limitation (Art 5) and security measures (Art 32)"
+  },
+  {
+    "control_id": "A.8.3",
+    "control_name": "Information access restriction",
+    "regulation": "GDPR",
+    "articles": ["25", "32"],
+    "coverage": "partial",
+    "notes": "Data protection by design and by default (Art 25), security measures (Art 32)"
+  },
+  {
+    "control_id": "A.8.10",
+    "control_name": "Information deletion",
+    "regulation": "GDPR",
+    "articles": ["17"],
+    "coverage": "full",
+    "notes": "Right to erasure ('right to be forgotten') - Art 17"
+  },
+  {
+    "control_id": "A.8.11",
+    "control_name": "Data masking",
+    "regulation": "GDPR",
+    "articles": ["4", "25", "32"],
+    "coverage": "full",
+    "notes": "Pseudonymisation defined (Art 4) and required as security measure (Art 25, 32)"
+  },
+  {
+    "control_id": "A.8.12",
+    "control_name": "Data leakage prevention",
+    "regulation": "GDPR",
+    "articles": ["32", "33"],
+    "coverage": "partial",
+    "notes": "Security of processing (Art 32) and breach notification requirements (Art 33)"
+  },
+  {
+    "control_id": "A.8.24",
+    "control_name": "Use of cryptography",
+    "regulation": "GDPR",
+    "articles": ["32", "34"],
+    "coverage": "partial",
+    "notes": "Encryption mentioned as appropriate measure (Art 32), affects breach notification requirements (Art 34)"
+  },
+  {
+    "control_id": "A.8.28",
+    "control_name": "Secure coding",
+    "regulation": "GDPR",
+    "articles": ["25"],
+    "coverage": "partial",
+    "notes": "Data protection by design and by default (Art 25)"
+  }
+]

package/data/seed/mappings/iso27001-nis2.json

@@ -0,0 +1,98 @@
+[
+  {
+    "control_id": "A.5.1",
+    "control_name": "Policies for information security",
+    "regulation": "NIS2",
+    "articles": ["21"],
+    "coverage": "full",
+    "notes": "Art 21(2)(a) explicitly requires policies on risks and information system security"
+  },
+  {
+    "control_id": "A.5.2",
+    "control_name": "Information security roles and responsibilities",
+    "regulation": "NIS2",
+    "articles": ["20", "21"],
+    "coverage": "full",
+    "notes": "Art 20 requires management body accountability, Art 21 requires governance framework"
+  },
+  {
+    "control_id": "A.5.23",
+    "control_name": "Information security for use of cloud services",
+    "regulation": "NIS2",
+    "articles": ["21"],
+    "coverage": "partial",
+    "notes": "Art 21(2)(d) covers supply chain security including cloud services"
+  },
+  {
+    "control_id": "A.5.29",
+    "control_name": "Information security during disruption",
+    "regulation": "NIS2",
+    "articles": ["21"],
+    "coverage": "full",
+    "notes": "Art 21(2)(c) requires business continuity and crisis management"
+  },
+  {
+    "control_id": "A.5.30",
+    "control_name": "ICT readiness for business continuity",
+    "regulation": "NIS2",
+    "articles": ["21"],
+    "coverage": "full",
+    "notes": "Art 21(2)(c) explicitly covers backup management, disaster recovery, crisis management"
+  },
+  {
+    "control_id": "A.6.8",
+    "control_name": "Information security event reporting",
+    "regulation": "NIS2",
+    "articles": ["23", "24"],
+    "coverage": "full",
+    "notes": "Art 23 requires incident notification: early warning (24h), notification (72h), final report (1 month)"
+  },
+  {
+    "control_id": "A.8.2",
+    "control_name": "Privileged access rights",
+    "regulation": "NIS2",
+    "articles": ["21"],
+    "coverage": "partial",
+    "notes": "Art 21(2)(i) requires access control policies"
+  },
+  {
+    "control_id": "A.8.5",
+    "control_name": "Secure authentication",
+    "regulation": "NIS2",
+    "articles": ["21"],
+    "coverage": "full",
+    "notes": "Art 21(2)(j) explicitly requires multi-factor or continuous authentication"
+  },
+  {
+    "control_id": "A.8.8",
+    "control_name": "Management of technical vulnerabilities",
+    "regulation": "NIS2",
+    "articles": ["21"],
+    "coverage": "full",
+    "notes": "Art 21(2)(e) requires vulnerability handling and disclosure"
+  },
+  {
+    "control_id": "A.8.16",
+    "control_name": "Monitoring activities",
+    "regulation": "NIS2",
+    "articles": ["21"],
+    "coverage": "partial",
+    "notes": "Art 21(2) covers security monitoring as part of risk management measures"
+  },
+  {
+    "control_id": "A.8.24",
+    "control_name": "Use of cryptography",
+    "regulation": "NIS2",
+    "articles": ["21"],
+    "coverage": "full",
+    "notes": "Art 21(2)(h) explicitly requires cryptography and encryption policies"
+  },
+  {
+    "control_id": "A.8.25",
+    "control_name": "Secure development life cycle",
+    "regulation": "NIS2",
+    "articles": ["21"],
+    "coverage": "partial",
+    "notes": "Art 21(2)(e) covers security in acquisition and development"
+  }
+]