@clear-capabilities/agentic-security-scanner 0.133.0 → 0.136.2

package/src/posture/compliance-frameworks/nist-privacy-1-1.json

@@ -0,0 +1,846 @@
+{
+  "id": "nist-privacy-1-1",
+  "name": "NIST Privacy Framework 1.1",
+  "publisher": "NIST",
+  "license": "public-domain (US Federal publication)",
+  "url": "https://www.nist.gov/privacy-framework",
+  "note": "Each control carries NIST's own `codeTestable` rating (yes/partial/no). That rating says whether a control COULD be assessed from source code — it does not say this engine assesses it. `mapsTo` is present only where this engine produces a real signal; a control that NIST rates testable but which this engine cannot see is reported as an ENGINE GAP rather than silently passed.",
+  "controls": [
+    {
+      "id": "ID.IM-P1",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Inventory and Mapping (ID.IM-P)",
+      "summary": "Systems/products/services that process data are inventoried.",
+      "codeTestable": "partial",
+      "mapsTo": [
+        "module:sbom-diff",
+        "module:threat-model-auto"
+      ]
+    },
+    {
+      "id": "ID.IM-P2",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Inventory and Mapping (ID.IM-P)",
+      "summary": "Owners or operators (e.g., the organization or third parties such as service providers, partners, customers, and developers) and their roles with respect to the systems/products/services and components (e.g., internal or external) that process data are inventoried.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "ID.IM-P3",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Inventory and Mapping (ID.IM-P)",
+      "summary": "Categories of individuals (e.g., customers, employees or prospective employees, consumers) whose data are being processed are inventoried.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "ID.IM-P4",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Inventory and Mapping (ID.IM-P)",
+      "summary": "Data actions of the systems/products/services are inventoried.",
+      "codeTestable": "partial",
+      "mapsTo": [
+        "module:privacy-taint"
+      ]
+    },
+    {
+      "id": "ID.IM-P5",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Inventory and Mapping (ID.IM-P)",
+      "summary": "The purposes for the data actions are inventoried.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "ID.IM-P6",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Inventory and Mapping (ID.IM-P)",
+      "summary": "Data elements within the data actions are inventoried.",
+      "codeTestable": "partial",
+      "mapsTo": [
+        "module:privacy-taint"
+      ]
+    },
+    {
+      "id": "ID.IM-P7",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Inventory and Mapping (ID.IM-P)",
+      "summary": "The data processing environment is identified (e.g., geographic location, internal, cloud, third parties).",
+      "codeTestable": "partial",
+      "mapsTo": [
+        "module:threat-model-auto"
+      ]
+    },
+    {
+      "id": "ID.IM-P8",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Inventory and Mapping (ID.IM-P)",
+      "summary": "Data processing is mapped, illustrating the data actions and associated data elements for systems/products/services, including components; roles of the component owners/operators; and interactions of individuals or third parties with the systems/products/services.",
+      "codeTestable": "partial",
+      "mapsTo": [
+        "module:privacy-taint",
+        "module:threat-model-auto"
+      ]
+    },
+    {
+      "id": "ID.BE-P1",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Business Environment (ID.BE-P)",
+      "summary": "The organization’s role(s) in the data processing ecosystem are identified, communicated, and understood.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "ID.BE-P2",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Business Environment (ID.BE-P)",
+      "summary": "The organizational mission is identified, communicated, and understood and informs privacy risk management.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "ID.BE-P3",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Business Environment (ID.BE-P)",
+      "summary": "Systems/products/services that support organizational priorities are identified and key requirements communicated and understood.",
+      "codeTestable": "partial",
+      "mapsTo": [
+        "module:threat-model-auto"
+      ]
+    },
+    {
+      "id": "ID.BE-P4",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Business Environment (ID.BE-P)",
+      "summary": "Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified and prioritized.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "ID.BE-P5",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Business Environment (ID.BE-P)",
+      "summary": "Objectives, capabilities, and services that stakeholders depend on or expect from the organization are identified, communicated, and understood.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "ID.BE-P6",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Business Environment (ID.BE-P)",
+      "summary": "Outcomes, capabilities, and services that the organization depends on are identified, communicated, and understood.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "ID.RA-P1",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Risk Assessment (ID.RA-P)",
+      "summary": "Contextual factors related to the systems/products/services and the data actions are identified (e.g., individuals’ demographics and privacy interests or perceptions, data sensitivity and/or types, visibility of data processing to individuals and third parties).",
+      "codeTestable": "no"
+    },
+    {
+      "id": "ID.RA-P3",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Risk Assessment (ID.RA-P)",
+      "summary": "Potential problematic data actions and associated problems are identified.",
+      "codeTestable": "partial",
+      "mapsTo": [
+        "family:pii-exposure",
+        "module:threat-model-auto"
+      ]
+    },
+    {
+      "id": "ID.RA-P4",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Risk Assessment (ID.RA-P)",
+      "summary": "Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "ID.RA-P5",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Risk Assessment (ID.RA-P)",
+      "summary": "Risk responses are identified, prioritized, and implemented.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "ID.RA-P6",
+      "function": "IDENTIFY-P (ID-P)",
+      "category": "Risk Assessment (ID.RA-P)",
+      "summary": "Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are assessed using a privacy risk assessment process.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.PO-P1",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Governance Policies, Processes, and Procedures (GV.PO-P)",
+      "summary": "Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established, communicated, and enforced.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.PO-P2",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Governance Policies, Processes, and Procedures (GV.PO-P)",
+      "summary": "Processes to instill organizational privacy values within system/product/service development and operations are established and in place.",
+      "codeTestable": "partial",
+      "mapsTo": [
+        "module:compliance-policy"
+      ]
+    },
+    {
+      "id": "GV.PO-P5",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Governance Policies, Processes, and Procedures (GV.PO-P)",
+      "summary": "Legal, regulatory, and contractual requirements regarding privacy are understood and managed.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.PO-P6",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Governance Policies, Processes, and Procedures (GV.PO-P)",
+      "summary": "Governance and enterprise risk management policies, processes, and procedures address privacy risks.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.PO-P7",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Governance Policies, Processes, and Procedures (GV.PO-P)",
+      "summary": "Privacy procedures are included in human resources practices (e.g., deprovisioning, personnel screening).",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.RM-P1",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Risk Management Strategy (GV.RM-P)",
+      "summary": "Risk management objectives and processes are established, managed, and agreed to by organizational stakeholders.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.RM-P2",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Risk Management Strategy (GV.RM-P)",
+      "summary": "The organization’s risk appetite and risk tolerance are determined and communicated and are informed by the organization's role(s) in the data processing ecosystem.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.RM-P4",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Risk Management Strategy (GV.RM-P)",
+      "summary": "Strategic direction that describes appropriate risk response options is established and communicated.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.RM-P5",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Risk Management Strategy (GV.RM-P)",
+      "summary": "Lines of communication across the organization are established for privacy risks, including risks from data processing ecosystem parties.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.RM-P6",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Risk Management Strategy (GV.RM-P)",
+      "summary": "A standardized method for calculating, documenting, categorizing, and prioritizing privacy risks is established and communicated.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.RM-P7",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Risk Management Strategy (GV.RM-P)",
+      "summary": "Strategic opportunities (i.e., positive risks) are characterized and included in organizational privacy risk discussions",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.OV-P1",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Oversight (GV.OV-P)",
+      "summary": "Privacy risk management strategy outcomes are reviewed to inform and adjust strategy and direction.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.OV-P2",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Oversight (GV.OV-P)",
+      "summary": "The privacy risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.OV-P3",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Oversight (GV.OV-P)",
+      "summary": "Organizational privacy risk management performance is measured and reviewed to confirm and adjust strategic direction.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.RR-P1",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Roles, Responsibilities, and Authorities (GV.RR-P)",
+      "summary": "Organizational leadership is responsible and accountable for privacy risk and fosters a culture that is risk-aware, ethical, and continually improving",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.RR-P2",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Roles, Responsibilities, and Authorities (GV.RR-P)",
+      "summary": "Roles and responsibilities for the workforce are established with respect to privacy.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.RR-P3",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Roles, Responsibilities, and Authorities (GV.RR-P)",
+      "summary": "Privacy roles and responsibilities are coordinated and aligned with external stakeholders (e.g., service providers, customers, partners).",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.RR-P4",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Roles, Responsibilities, and Authorities (GV.RR-P)",
+      "summary": "Adequate resources are allocated commensurate with privacy risk strategy, roles and responsibilities, and policies.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.DE-P1",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Data Processing Ecosystem Risk Management (GV.DE-P)",
+      "summary": "Data processing ecosystem risk management strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.DE-P2",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Data Processing Ecosystem Risk Management (GV.DE-P)",
+      "summary": "Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.DE-P3",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Data Processing Ecosystem Risk Management (GV.DE-P)",
+      "summary": "Interoperability frameworks or similar multi-party approaches are used to manage data processing ecosystem privacy risks.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "GV.DE-P4",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Data Processing Ecosystem Risk Management (GV.DE-P)",
+      "summary": "Data processing ecosystem parties are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual, interoperability framework, or other obligations.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.DE-P5",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Data Processing Ecosystem Risk Management (GV.DE-P)",
+      "summary": "Data processing ecosystem risk management is integrated into privacy and enterprise risk management, risk assessment, and improvement processes.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.AT-P1",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Awareness and Training (GV.AT-P)",
+      "summary": "Personnel are provided with awareness and training so that they possess the knowledge and skills to perform privacy-related tasks.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.AT-P2",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Awareness and Training (GV.AT-P)",
+      "summary": "Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform privacy-related tasks.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.MT-P1",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Monitoring and Review (GV.MT-P)",
+      "summary": "Privacy risk is re-evaluated on an ongoing basis and as key factors, including the organization’s business environment (e.g., introduction of new technologies), governance (e.g., legal obligations, risk tolerance), data processing, and systems/products/services change.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.MT-P2",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Monitoring and Review (GV.MT-P)",
+      "summary": "Privacy values, policies, and training are reviewed and any updates are communicated.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.MT-P3",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Monitoring and Review (GV.MT-P)",
+      "summary": "Policies, processes, and procedures for assessing compliance with legal requirements and privacy policies are established and in place.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.MT-P4",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Monitoring and Review (GV.MT-P)",
+      "summary": "Policies, processes, and procedures for communicating progress on managing privacy risks are established and in place.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.MT-P5",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Monitoring and Review (GV.MT-P)",
+      "summary": "Policies, processes, and procedures are established and in place to receive, analyze, and respond to problematic data actions disclosed to the organization from internal and external sources (e.g., internal discovery, privacy researchers, professional events).",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.MT-P6",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Monitoring and Review (GV.MT-P)",
+      "summary": "Policies, processes, and procedures incorporate lessons learned from problematic data actions.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "GV.MT-P7",
+      "function": "GOVERN-P (GV-P)",
+      "category": "Monitoring and Review (GV.MT-P)",
+      "summary": "Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "CT.PO-P1",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Data Processing Policies, Processes, and Procedures (CT.PO-P)",
+      "summary": "Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.",
+      "codeTestable": "partial",
+      "mapsTo": [
+        "module:compliance-policy"
+      ]
+    },
+    {
+      "id": "CT.PO-P2",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Data Processing Policies, Processes, and Procedures (CT.PO-P)",
+      "summary": "Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).",
+      "codeTestable": "partial",
+      "mapsTo": [
+        "module:compliance-policy"
+      ]
+    },
+    {
+      "id": "CT.PO-P3",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Data Processing Policies, Processes, and Procedures (CT.PO-P)",
+      "summary": "Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "CT.PO-P4",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Data Processing Policies, Processes, and Procedures (CT.PO-P)",
+      "summary": "A data life cycle to manage data is aligned and implemented with the system development life cycle to manage systems.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "CT.DM-P1",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Data Processing Management (CT.DM-P)",
+      "summary": "Data elements can be accessed for review.",
+      "codeTestable": "yes"
+    },
+    {
+      "id": "CT.DM-P2",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Data Processing Management (CT.DM-P)",
+      "summary": "Data elements can be accessed for transmission or disclosure.",
+      "codeTestable": "yes"
+    },
+    {
+      "id": "CT.DM-P3",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Data Processing Management (CT.DM-P)",
+      "summary": "Data elements can be accessed for alteration.",
+      "codeTestable": "yes"
+    },
+    {
+      "id": "CT.DM-P4",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Data Processing Management (CT.DM-P)",
+      "summary": "Data elements can be accessed for deletion.",
+      "codeTestable": "yes"
+    },
+    {
+      "id": "CT.DM-P5",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Data Processing Management (CT.DM-P)",
+      "summary": "Data are destroyed according to policy.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "CT.DM-P6",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Data Processing Management (CT.DM-P)",
+      "summary": "Data are transmitted using standardized formats.",
+      "codeTestable": "yes",
+      "mapsTo": [
+        "family:crypto-tls-version",
+        "family:crypto-tls-no-verify"
+      ]
+    },
+    {
+      "id": "CT.DM-P7",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Data Processing Management (CT.DM-P)",
+      "summary": "Mechanisms for transmitting processing permissions are established and in place.",
+      "codeTestable": "yes"
+    },
+    {
+      "id": "CT.DM-P8",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Data Processing Management (CT.DM-P)",
+      "summary": "Mechanisms for transmitting data elements in accordance with processing permissions are established and in place.",
+      "codeTestable": "yes"
+    },
+    {
+      "id": "CT.DM-P9",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Data Processing Management (CT.DM-P)",
+      "summary": "Log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.",
+      "codeTestable": "partial",
+      "mapsTo": [
+        "module:scan-history",
+        "module:mcp-audit"
+      ]
+    },
+    {
+      "id": "CT.DM-P10",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Data Processing Management (CT.DM-P)",
+      "summary": "Technical measures implemented to manage data processing are tested and assessed.",
+      "codeTestable": "yes",
+      "mapsTo": [
+        "module:fix-history"
+      ]
+    },
+    {
+      "id": "CT.DM-P11",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Data Processing Management (CT.DM-P)",
+      "summary": "Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "CT.DP-P1",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Disassociated Processing (CT.DP-P)",
+      "summary": "Data are processed to limit observability, linkability, and singling out (e.g., data actions take place on local devices, privacy-preserving cryptography).",
+      "codeTestable": "yes",
+      "mapsTo": [
+        "family:pii-exposure",
+        "family:data-exposure"
+      ]
+    },
+    {
+      "id": "CT.DP-P2",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Disassociated Processing (CT.DP-P)",
+      "summary": "Data are processed to limit the identification of individuals (e.g., de-identification privacy techniques, tokenization).",
+      "codeTestable": "yes",
+      "mapsTo": [
+        "family:pii-exposure",
+        "module:privacy-taint"
+      ]
+    },
+    {
+      "id": "CT.DP-P3",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Disassociated Processing (CT.DP-P)",
+      "summary": "Data are processed to limit the formulation of inferences about individuals’ behavior or activities (e.g., data processing is decentralized, distributed architectures).",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "CT.DP-P4",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Disassociated Processing (CT.DP-P)",
+      "summary": "System or device configurations permit selective collection or disclosure of data elements.",
+      "codeTestable": "yes",
+      "mapsTo": [
+        "module:privacy-taint"
+      ]
+    },
+    {
+      "id": "CT.DP-P5",
+      "function": "CONTROL-P (CT-P)",
+      "category": "Disassociated Processing (CT.DP-P)",
+      "summary": "Attribute values are substituted with derived attribute values (e.g., providing an \"age older than\" statement rather than the actual age).",
+      "codeTestable": "yes",
+      "mapsTo": [
+        "module:privacy-taint"
+      ]
+    },
+    {
+      "id": "CM.PO-P1",
+      "function": "COMMUNICATE-P (CM-P)",
+      "category": "Communication Policies, Processes, and Procedures (CM.PO-P)",
+      "summary": "Transparency policies, processes, and procedures for communicating data processing purposes, practices, and associated privacy risks are established and in place.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "CM.PO-P2",
+      "function": "COMMUNICATE-P (CM-P)",
+      "category": "Communication Policies, Processes, and Procedures (CM.PO-P)",
+      "summary": "Roles and responsibilities (e.g., public relations) for communicating data processing purposes, practices, and associated privacy risks are established.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "CM.AW-P1",
+      "function": "COMMUNICATE-P (CM-P)",
+      "category": "Data Processing Awareness (CM.AW-P)",
+      "summary": "Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "CM.AW-P2",
+      "function": "COMMUNICATE-P (CM-P)",
+      "category": "Data Processing Awareness (CM.AW-P)",
+      "summary": "Mechanisms for obtaining feedback from individuals (e.g., surveys or focus groups) about data processing and associated privacy risks are established and in place.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "CM.AW-P3",
+      "function": "COMMUNICATE-P (CM-P)",
+      "category": "Data Processing Awareness (CM.AW-P)",
+      "summary": "System/product/service design enables data processing visibility.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "CM.AW-P4",
+      "function": "COMMUNICATE-P (CM-P)",
+      "category": "Data Processing Awareness (CM.AW-P)",
+      "summary": "Records of data disclosures and sharing are maintained and can be accessed for review or transmission/disclosure.",
+      "codeTestable": "yes",
+      "mapsTo": [
+        "module:mcp-audit"
+      ]
+    },
+    {
+      "id": "CM.AW-P5",
+      "function": "COMMUNICATE-P (CM-P)",
+      "category": "Data Processing Awareness (CM.AW-P)",
+      "summary": "Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "CM.AW-P6",
+      "function": "COMMUNICATE-P (CM-P)",
+      "category": "Data Processing Awareness (CM.AW-P)",
+      "summary": "Data provenance and lineage are maintained and can be accessed for review or transmission/disclosure.",
+      "codeTestable": "partial",
+      "mapsTo": [
+        "module:sbom-diff",
+        "module:integrity"
+      ]
+    },
+    {
+      "id": "CM.AW-P7",
+      "function": "COMMUNICATE-P (CM-P)",
+      "category": "Data Processing Awareness (CM.AW-P)",
+      "summary": "Impacted individuals and organizations are notified about a privacy breach or event.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "CM.AW-P8",
+      "function": "COMMUNICATE-P (CM-P)",
+      "category": "Data Processing Awareness (CM.AW-P)",
+      "summary": "Individuals are provided with mitigation mechanisms (e.g., credit monitoring, consent withdrawal, data alteration or deletion) to address impacts of problematic data actions.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "PR.PO-P5",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Data Protection Policies, Processes, and Procedures (PR.PO-P)",
+      "summary": "Improvements to data protection policies, processes, and procedures are identified (e.g., from evaluations, security tests and exercises, execution of policies, processes, and procedures), communicated, and implemented.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "PR.PO-P7",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Data Protection Policies, Processes, and Procedures (PR.PO-P)",
+      "summary": "Incident response and recovery plans are established, communicated, maintained, and improved.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "PR.AA-P1",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Identity Management, Authentication, and Access Control (PR.AA-P)",
+      "summary": "Identities and credentials for authorized individuals, services, and hardware are managed by the organization.",
+      "codeTestable": "yes",
+      "mapsTo": [
+        "family:hardcoded-secret",
+        "family:auth-missing"
+      ]
+    },
+    {
+      "id": "PR.AA-P2",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Identity Management, Authentication, and Access Control (PR.AA-P)",
+      "summary": "Identities are proofed and bound to credentials based on the context of interactions.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "PR.AA-P3",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Identity Management, Authentication, and Access Control (PR.AA-P)",
+      "summary": "Individuals, services, and hardware are authenticated commensurate with risk.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "PR.AA-P4",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Identity Management, Authentication, and Access Control (PR.AA-P)",
+      "summary": "Identity assertions are protected, conveyed, and verified.",
+      "codeTestable": "yes",
+      "mapsTo": [
+        "family:auth-missing",
+        "family:crypto-weak-hash"
+      ]
+    },
+    {
+      "id": "PR.AA-05",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Identity Management, Authentication, and Access Control (PR.AA-P)",
+      "summary": "Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties.",
+      "codeTestable": "yes",
+      "mapsTo": [
+        "family:authz",
+        "family:idor",
+        "family:iam-overpermissive"
+      ]
+    },
+    {
+      "id": "PR.AA-P6",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Identity Management, Authentication, and Access Control (PR.AA-P)",
+      "summary": "Physical access to data and devices is managed, monitored, and enforced commensurate with risk.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "PR.DS-P1",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Data Security (PR.DS-P)",
+      "summary": "The confidentiality, integrity, and availability of data-at-rest are protected.",
+      "codeTestable": "yes",
+      "mapsTo": [
+        "family:crypto-weak-cipher",
+        "family:crypto-ecb",
+        "family:crypto-static-iv"
+      ]
+    },
+    {
+      "id": "PR.DS-P2",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Data Security (PR.DS-P)",
+      "summary": "The confidentiality, integrity, and availability of data-in-transit are protected.",
+      "codeTestable": "yes",
+      "mapsTo": [
+        "family:crypto-tls-version",
+        "family:crypto-tls-no-verify",
+        "family:crypto-weak-cipher"
+      ]
+    },
+    {
+      "id": "PR.DS-P3",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Data Security (PR.DS-P)",
+      "summary": "Systems/products/services and associated data are managed throughout their life cycle.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "PR.DS-P8",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Data Security (PR.DS-P)",
+      "summary": "The authenticity and integrity of hardware and software are assessed prior to acquisition and use.",
+      "codeTestable": "partial",
+      "mapsTo": [
+        "module:sbom-diff",
+        "family:dependency-drift"
+      ]
+    },
+    {
+      "id": "PR.DS-P9",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Data Security (PR.DS-P)",
+      "summary": "The confidentiality, integrity, and availability of data-in-use are protected.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "PR.DS-P10",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Data Security (PR.DS-P)",
+      "summary": "Backups of data are created, protected, maintained, and tested.",
+      "codeTestable": "yes"
+    },
+    {
+      "id": "PR.PS-P1",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Platform Security (PR.PS-P)",
+      "summary": "Configuration management practices are established and applied.",
+      "codeTestable": "yes",
+      "mapsTo": [
+        "family:iam-overpermissive",
+        "family:k8s-pod-security-privileged"
+      ]
+    },
+    {
+      "id": "PR.PS-P2",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Platform Security (PR.PS-P)",
+      "summary": "Software is maintained, replaced, and removed commensurate with risk.",
+      "codeTestable": "partial",
+      "mapsTo": [
+        "family:vulnerable-dependency",
+        "family:dependency-drift"
+      ]
+    },
+    {
+      "id": "PR.PS-P3",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Platform Security (PR.PS-P)",
+      "summary": "Hardware is maintained, replaced, and removed commensurate with risk.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "PR.PS-P4",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Platform Security (PR.PS-P)",
+      "summary": "Installation and execution of unauthorized software are prevented.",
+      "codeTestable": "yes",
+      "mapsTo": [
+        "family:dependency-confusion",
+        "family:vulnerable-dependency"
+      ]
+    },
+    {
+      "id": "PR.PS-P5",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Platform Security (PR.PS-P)",
+      "summary": "Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "PR.IR-P1",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Technology Infrastructure Resilience (PR.IR-P)",
+      "summary": "Networks and environments are protected from unauthorized logical access and usage.",
+      "codeTestable": "yes",
+      "mapsTo": [
+        "family:iam-overpermissive",
+        "family:k8s-rbac-cluster-admin"
+      ]
+    },
+    {
+      "id": "PR.IR-P2",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Technology Infrastructure Resilience (PR.IR-P)",
+      "summary": "The organization’s technology assets, including associated data, are protected from environmental threats.",
+      "codeTestable": "no"
+    },
+    {
+      "id": "PR.IR-P3",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Technology Infrastructure Resilience (PR.IR-P)",
+      "summary": "Mechanisms are implemented to achieve resilience requirements in normal and adverse situations.",
+      "codeTestable": "partial"
+    },
+    {
+      "id": "PR.IR-P4",
+      "function": "PROTECT-P (PR-P)",
+      "category": "Technology Infrastructure Resilience (PR.IR-P)",
+      "summary": "Adequate resource capacity to ensure availability is maintained.",
+      "codeTestable": "yes"
+    }
+  ]
+}