@greenarmor/ges-policy-engine 1.0.0 → 1.1.0

package/README.md

@@ -1,6 +1,6 @@
 # @greenarmor/ges-policy-engine
 
-Policy pack management and enforcement for the [Green Engineering Standard Framework (GESF)](https://github.com/greenarmor/gesf).
+Policy pack management and enforcement for the Green Engineering Standard Framework (GESF).
 
 Manages compliance policy packs for GDPR, OWASP, NIST, CIS, AI systems, blockchain, and government projects. Each policy pack defines the controls and standards applicable to a specific compliance domain.
 
@@ -51,8 +51,8 @@ allPacks.forEach(p => console.log(`${p.id}: ${p.name}`));
 
 ## Related Packages
 
-- [`@greenarmor/ges-core`](https://www.npmjs.com/package/@greenarmor/ges-core) — Types and constants
-- [`@greenarmor/ges-compliance-engine`](https://www.npmjs.com/package/@greenarmor/ges-compliance-engine) — Control evaluation
+- `@greenarmor/ges-core` — Types and constants
+- `@greenarmor/ges-compliance-engine` — Control evaluation
 
 ## License
 

package/dist/index.d.ts

@@ -10,3 +10,6 @@ export { createBlockchainPolicyPack } from "./packs/blockchain.js";
 export { createGovernmentPolicyPack } from "./packs/government.js";
 export { createCISPolicyPack } from "./packs/cis.js";
 export { createNISTPolicyPack } from "./packs/nist.js";
+export { createISO27001PolicyPack } from "./packs/iso27001.js";
+export { createISO27701PolicyPack } from "./packs/iso27701.js";
+export { createHIPAAPolicyPack } from "./packs/hipaa.js";

package/dist/index.js

@@ -5,6 +5,9 @@ import { createBlockchainPolicyPack } from "./packs/blockchain.js";
 import { createGovernmentPolicyPack } from "./packs/government.js";
 import { createCISPolicyPack } from "./packs/cis.js";
 import { createNISTPolicyPack } from "./packs/nist.js";
+import { createISO27001PolicyPack } from "./packs/iso27001.js";
+import { createISO27701PolicyPack } from "./packs/iso27701.js";
+import { createHIPAAPolicyPack } from "./packs/hipaa.js";
 const ALL_PACKS = [
     createGDPRPolicyPack,
     createOWASPPolicyPack,
@@ -13,6 +16,9 @@ const ALL_PACKS = [
     createGovernmentPolicyPack,
     createCISPolicyPack,
     createNISTPolicyPack,
+    createISO27001PolicyPack,
+    createISO27701PolicyPack,
+    createHIPAAPolicyPack,
 ];
 const PACK_MAP = {
     gdpr: createGDPRPolicyPack,
@@ -22,6 +28,9 @@ const PACK_MAP = {
     government: createGovernmentPolicyPack,
     cis: createCISPolicyPack,
     nist: createNISTPolicyPack,
+    iso27001: createISO27001PolicyPack,
+    iso27701: createISO27701PolicyPack,
+    hipaa: createHIPAAPolicyPack,
 };
 export function getAllPacks() {
     return ALL_PACKS.map(fn => fn());
@@ -43,3 +52,6 @@ export { createBlockchainPolicyPack } from "./packs/blockchain.js";
 export { createGovernmentPolicyPack } from "./packs/government.js";
 export { createCISPolicyPack } from "./packs/cis.js";
 export { createNISTPolicyPack } from "./packs/nist.js";
+export { createISO27001PolicyPack } from "./packs/iso27001.js";
+export { createISO27701PolicyPack } from "./packs/iso27701.js";
+export { createHIPAAPolicyPack } from "./packs/hipaa.js";

package/dist/packs/hipaa.d.ts

@@ -0,0 +1,2 @@
+import type { PolicyPack } from "@greenarmor/ges-core";
+export declare function createHIPAAPolicyPack(): PolicyPack;

package/dist/packs/hipaa.js

@@ -0,0 +1,181 @@
+export function createHIPAAPolicyPack() {
+    const controls = [
+        {
+            id: "HIPAA-164.308",
+            name: "Administrative Safeguards",
+            description: "Establish administrative policies and procedures to manage the selection, development, implementation, and maintenance of security measures for ePHI.",
+            category: "security",
+            framework: "HIPAA",
+            article: "45 CFR 164.308",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Assign a Security Officer. Implement workforce security training. Establish access management procedures. Conduct periodic security evaluations. Maintain contingency plans.",
+            checks: [
+                { id: "HIPAA-164.308-C1", description: "Security Officer designated", status: "not-implemented" },
+                { id: "HIPAA-164.308-C2", description: "Workforce security training program", status: "not-implemented" },
+                { id: "HIPAA-164.308-C3", description: "Access management procedures documented", status: "not-implemented" },
+                { id: "HIPAA-164.308-C4", description: "Periodic security evaluations conducted", status: "not-implemented" },
+                { id: "HIPAA-164.308-C5", description: "Contingency plan established", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "HIPAA-164.310",
+            name: "Physical Safeguards",
+            description: "Implement physical policies and procedures to protect electronic information systems, related buildings, and equipment from unauthorized physical access.",
+            category: "security",
+            framework: "HIPAA",
+            article: "45 CFR 164.310",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Implement facility access controls. Document device and media management procedures. Ensure workstation security. Maintain asset disposal procedures for media containing ePHI.",
+            checks: [
+                { id: "HIPAA-164.310-C1", description: "Facility access controls implemented", status: "not-implemented" },
+                { id: "HIPAA-164.310-C2", description: "Workstation security policy documented", status: "not-implemented" },
+                { id: "HIPAA-164.310-C3", description: "Device and media management procedures", status: "not-implemented" },
+                { id: "HIPAA-164.310-C4", description: "Media disposal procedures documented", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "HIPAA-164.312-a",
+            name: "Access Control",
+            description: "Implement technical policies and procedures for electronic information systems that maintain ePHI to allow access only to those persons or software programs with appropriate access rights.",
+            category: "authentication",
+            framework: "HIPAA",
+            article: "45 CFR 164.312(a)",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Implement unique user identification. Enable automatic logoff. Implement encryption and decryption of ePHI. Use role-based access control with least privilege.",
+            checks: [
+                { id: "HIPAA-164.312-a-C1", description: "Unique user identification enforced", status: "not-implemented" },
+                { id: "HIPAA-164.312-a-C2", description: "Automatic logoff configured", status: "not-implemented" },
+                { id: "HIPAA-164.312-a-C3", description: "Encryption and decryption implemented for ePHI", status: "not-implemented" },
+                { id: "HIPAA-164.312-a-C4", description: "Role-based access with least privilege", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "HIPAA-164.312-b",
+            name: "Audit Controls",
+            description: "Implement hardware, software, and procedural mechanisms that record and examine activity in information systems containing ePHI.",
+            category: "audit",
+            framework: "HIPAA",
+            article: "45 CFR 164.312(b)",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Implement comprehensive audit logging for all ePHI access. Log user ID, action, timestamp, resource accessed, and outcome. Protect logs from tampering. Review logs regularly.",
+            checks: [
+                { id: "HIPAA-164.312-b-C1", description: "Audit logging for all ePHI access", status: "not-implemented" },
+                { id: "HIPAA-164.312-b-C2", description: "Logs include user action timestamp resource", status: "not-implemented" },
+                { id: "HIPAA-164.312-b-C3", description: "Logs protected from tampering", status: "not-implemented" },
+                { id: "HIPAA-164.312-b-C4", description: "Regular log review process", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "HIPAA-164.312-c",
+            name: "Integrity Controls",
+            description: "Implement policies and procedures to protect ePHI from improper alteration or destruction.",
+            category: "security",
+            framework: "HIPAA",
+            article: "45 CFR 164.312(c)",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Implement data integrity verification mechanisms. Use cryptographic hashing for ePHI. Detect unauthorized alterations. Maintain data integrity throughout lifecycle.",
+            checks: [
+                { id: "HIPAA-164.312-c-C1", description: "Data integrity verification implemented", status: "not-implemented" },
+                { id: "HIPAA-164.312-c-C2", description: "Cryptographic hashing for ePHI integrity", status: "not-implemented" },
+                { id: "HIPAA-164.312-c-C3", description: "Unauthorized alteration detection", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "HIPAA-164.312-d",
+            name: "Person or Entity Authentication",
+            description: "Implement procedures to verify that a person seeking access to ePHI is the one claimed.",
+            category: "authentication",
+            framework: "HIPAA",
+            article: "45 CFR 164.312(d)",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Implement strong authentication mechanisms. Use MFA for all ePHI system access. Verify identity before granting access. Maintain authentication audit trail.",
+            checks: [
+                { id: "HIPAA-164.312-d-C1", description: "Strong authentication mechanisms implemented", status: "not-implemented" },
+                { id: "HIPAA-164.312-d-C2", description: "MFA for all ePHI system access", status: "not-implemented" },
+                { id: "HIPAA-164.312-d-C3", description: "Authentication audit trail maintained", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "HIPAA-164.312-e",
+            name: "Transmission Security",
+            description: "Implement technical security measures to guard against unauthorized access to ePHI transmitted over electronic communications networks.",
+            category: "encryption",
+            framework: "HIPAA",
+            article: "45 CFR 164.312(e)",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Encrypt all ePHI in transit using TLS 1.2 or higher. Implement integrity controls for transmitted data. Verify endpoints before transmission. Use mutual TLS for system-to-system communication.",
+            checks: [
+                { id: "HIPAA-164.312-e-C1", description: "TLS 1.2 or higher for ePHI transmission", status: "not-implemented" },
+                { id: "HIPAA-164.312-e-C2", description: "Integrity controls for transmitted data", status: "not-implemented" },
+                { id: "HIPAA-164.312-e-C3", description: "Mutual TLS for system-to-system communication", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "HIPAA-164.314",
+            name: "Business Associate Contracts",
+            description: "Establish contracts with business associates that access ePHI to ensure they implement required safeguards.",
+            category: "compliance",
+            framework: "HIPAA",
+            article: "45 CFR 164.314",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Execute Business Associate Agreements (BAAs) with all vendors accessing ePHI. Define permitted uses and disclosures. Include breach notification requirements. Terminate contracts on violation.",
+            checks: [
+                { id: "HIPAA-164.314-C1", description: "BAAs executed with all business associates", status: "not-implemented" },
+                { id: "HIPAA-164.314-C2", description: "Permitted uses and disclosures defined", status: "not-implemented" },
+                { id: "HIPAA-164.314-C3", description: "Breach notification requirements included", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "HIPAA-164.502",
+            name: "Minimum Necessary Standard",
+            description: "Limit access to and use of PHI to the minimum necessary to accomplish the intended purpose.",
+            category: "compliance",
+            framework: "HIPAA",
+            article: "45 CFR 164.502(b)",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Implement role-based access limiting PHI to minimum necessary. Define access levels by job function. Review and audit access patterns. Enforce field-level restrictions where applicable.",
+            checks: [
+                { id: "HIPAA-164.502-C1", description: "Minimum necessary access policies defined", status: "not-implemented" },
+                { id: "HIPAA-164.502-C2", description: "Role-based access levels by job function", status: "not-implemented" },
+                { id: "HIPAA-164.502-C3", description: "Access pattern auditing implemented", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "HIPAA-164.530",
+            name: "Administrative Requirements",
+            description: "Implement administrative requirements for privacy including designated privacy officer, training, and complaint procedures.",
+            category: "compliance",
+            framework: "HIPAA",
+            article: "45 CFR 164.530",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Designate a Privacy Officer. Implement privacy training for all workforce members. Establish complaint procedures. Maintain documentation of privacy policies and procedures for at least 6 years.",
+            checks: [
+                { id: "HIPAA-164.530-C1", description: "Privacy Officer designated", status: "not-implemented" },
+                { id: "HIPAA-164.530-C2", description: "Privacy training program implemented", status: "not-implemented" },
+                { id: "HIPAA-164.530-C3", description: "Complaint procedures established", status: "not-implemented" },
+                { id: "HIPAA-164.530-C4", description: "Documentation retained for 6 years minimum", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "hipaa",
+        name: "HIPAA Healthcare Policy Pack",
+        description: "HIPAA Security Rule and Privacy Rule controls for healthcare systems handling electronic Protected Health Information (ePHI).",
+        version: "1.0.0",
+        project_types: [
+            "healthcare-system", "saas",
+        ],
+        controls,
+        frameworks: ["HIPAA"],
+    };
+}

package/dist/packs/iso27001.d.ts

@@ -0,0 +1,2 @@
+import type { PolicyPack } from "@greenarmor/ges-core";
+export declare function createISO27001PolicyPack(): PolicyPack;

package/dist/packs/iso27001.js

@@ -0,0 +1,177 @@
+export function createISO27001PolicyPack() {
+    const controls = [
+        {
+            id: "ISO27001-A5",
+            name: "Information Security Policies",
+            description: "Management direction and support for information security in accordance with business requirements and relevant laws and regulations.",
+            category: "security",
+            framework: "ISO27001",
+            article: "Annex A.5",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Define, approve, and publish an information security policy. Review at planned intervals. Communicate to employees and relevant external parties.",
+            checks: [
+                { id: "ISO27001-A5-C1", description: "Information security policy documented", status: "not-implemented" },
+                { id: "ISO27001-A5-C2", description: "Policy approved by management", status: "not-implemented" },
+                { id: "ISO27001-A5-C3", description: "Policy reviewed at planned intervals", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27001-A6",
+            name: "Organization of Information Security",
+            description: "Establish management framework to initiate and control implementation and operation of information security within the organization.",
+            category: "security",
+            framework: "ISO27001",
+            article: "Annex A.6",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Define roles and responsibilities for information security. Establish segregation of duties. Establish contact with authorities and special interest groups.",
+            checks: [
+                { id: "ISO27001-A6-C1", description: "Roles and responsibilities defined", status: "not-implemented" },
+                { id: "ISO27001-A6-C2", description: "Segregation of duties implemented", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27001-A8",
+            name: "Asset Management",
+            description: "Identify organizational assets and define appropriate protection responsibilities.",
+            category: "asset-management",
+            framework: "ISO27001",
+            article: "Annex A.8",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Maintain inventory of assets (hardware, software, data, information). Assign ownership. Implement classification scheme. Handle media securely.",
+            checks: [
+                { id: "ISO27001-A8-C1", description: "Asset inventory maintained", status: "not-implemented" },
+                { id: "ISO27001-A8-C2", description: "Information classification scheme defined", status: "not-implemented" },
+                { id: "ISO27001-A8-C3", description: "Media handling procedures in place", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27001-A9",
+            name: "Access Control",
+            description: "Limit access to information and information processing facilities.",
+            category: "authentication",
+            framework: "ISO27001",
+            article: "Annex A.9",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Implement access control policy. Enforce least privilege. Implement unique user IDs. Use MFA. Implement session management and timeout.",
+            checks: [
+                { id: "ISO27001-A9-C1", description: "Access control policy documented", status: "not-implemented" },
+                { id: "ISO27001-A9-C2", description: "Unique user identification enforced", status: "not-implemented" },
+                { id: "ISO27001-A9-C3", description: "MFA implemented for remote access", status: "not-implemented" },
+                { id: "ISO27001-A9-C4", description: "Session timeout configured", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27001-A10",
+            name: "Cryptography",
+            description: "Ensure proper and effective use of cryptography to protect confidentiality, authenticity, or integrity of information.",
+            category: "encryption",
+            framework: "ISO27001",
+            article: "Annex A.10",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Define cryptographic policy. Use approved algorithms (AES-256-GCM, ChaCha20-Poly1305). Use TLS 1.2+. Manage keys via vault or KMS. Plan for key lifecycle.",
+            checks: [
+                { id: "ISO27001-A10-C1", description: "Cryptographic policy defined", status: "not-implemented" },
+                { id: "ISO27001-A10-C2", description: "Key management process in place", status: "not-implemented" },
+                { id: "ISO27001-A10-C3", description: "Approved algorithms only", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27001-A12",
+            name: "Operations Security",
+            description: "Ensure correct and secure operations of information processing facilities.",
+            category: "security",
+            framework: "ISO27001",
+            article: "Annex A.12",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Document operating procedures. Implement malware protection. Maintain audit logging. Synchronize clocks. Protect against technical vulnerabilities.",
+            checks: [
+                { id: "ISO27001-A12-C1", description: "Operating procedures documented", status: "not-implemented" },
+                { id: "ISO27001-A12-C2", description: "Malware protection in place", status: "not-implemented" },
+                { id: "ISO27001-A12-C3", description: "Audit logging implemented", status: "not-implemented" },
+                { id: "ISO27001-A12-C4", description: "Vulnerability management process", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27001-A14",
+            name: "System Acquisition, Development and Maintenance",
+            description: "Ensure information security is an integral part of information systems across the entire lifecycle.",
+            category: "security",
+            framework: "ISO27001",
+            article: "Annex A.14",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Integrate security into SDLC. Implement secure coding practices. Conduct security testing. Perform penetration testing before deployment.",
+            checks: [
+                { id: "ISO27001-A14-C1", description: "Security integrated into SDLC", status: "not-implemented" },
+                { id: "ISO27001-A14-C2", description: "Secure coding practices enforced", status: "not-implemented" },
+                { id: "ISO27001-A14-C3", description: "Security testing in CI/CD", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27001-A16",
+            name: "Incident Management",
+            description: "Ensure a consistent and effective approach to managing information security incidents.",
+            category: "incident-response",
+            framework: "ISO27001",
+            article: "Annex A.16",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Define incident response plan. Establish incident reporting procedures. Assign roles. Conduct post-incident reviews. Collect evidence.",
+            checks: [
+                { id: "ISO27001-A16-C1", description: "Incident response plan documented", status: "not-implemented" },
+                { id: "ISO27001-A16-C2", description: "Incident reporting procedures defined", status: "not-implemented" },
+                { id: "ISO27001-A16-C3", description: "Post-incident review process", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27001-A17",
+            name: "Business Continuity",
+            description: "Ensure availability of information processing facilities during disruptions.",
+            category: "backup",
+            framework: "ISO27001",
+            article: "Annex A.17",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Implement business continuity plans. Define RTO and RPO. Maintain backups. Test recovery procedures. Implement disaster recovery.",
+            checks: [
+                { id: "ISO27001-A17-C1", description: "Business continuity plan documented", status: "not-implemented" },
+                { id: "ISO27001-A17-C2", description: "Backups tested regularly", status: "not-implemented" },
+                { id: "ISO27001-A17-C3", description: "Disaster recovery procedures tested", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27001-A18",
+            name: "Compliance",
+            description: "Avoid breaches of legal, statutory, regulatory, or contractual obligations related to information security.",
+            category: "audit",
+            framework: "ISO27001",
+            article: "Annex A.18",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Identify applicable legal and regulatory requirements. Conduct regular compliance reviews. Maintain records. Implement privacy protection measures.",
+            checks: [
+                { id: "ISO27001-A18-C1", description: "Legal requirements identified", status: "not-implemented" },
+                { id: "ISO27001-A18-C2", description: "Regular compliance reviews scheduled", status: "not-implemented" },
+                { id: "ISO27001-A18-C3", description: "Privacy protection measures in place", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "iso27001",
+        name: "ISO 27001 Information Security Management Policy Pack",
+        description: "ISO/IEC 27001:2022 Annex A controls covering information security management system requirements.",
+        version: "1.0.0",
+        project_types: [
+            "saas", "government-system", "healthcare-system",
+            "generic-web-application", "api-backend",
+        ],
+        controls,
+        frameworks: ["ISO27001"],
+    };
+}

package/dist/packs/iso27701.d.ts

@@ -0,0 +1,2 @@
+import type { PolicyPack } from "@greenarmor/ges-core";
+export declare function createISO27701PolicyPack(): PolicyPack;

package/dist/packs/iso27701.js

@@ -0,0 +1,191 @@
+export function createISO27701PolicyPack() {
+    const controls = [
+        {
+            id: "ISO27701-5.2",
+            name: "Information Privacy Policies",
+            description: "Define, approve, and publish privacy policies that are appropriate for the organization's role as PII controller and/or processor.",
+            category: "privacy",
+            framework: "ISO27701",
+            article: "Clause 5.2",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Document privacy policies covering collection, processing, sharing, retention, and deletion of PII. Review at planned intervals. Communicate to data subjects.",
+            checks: [
+                { id: "ISO27701-5.2-C1", description: "Privacy policy documented and approved", status: "not-implemented" },
+                { id: "ISO27701-5.2-C2", description: "Policy reviewed at planned intervals", status: "not-implemented" },
+                { id: "ISO27701-5.2-C3", description: "Policy communicated to data subjects", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27701-5.3",
+            name: "Roles and Responsibilities for PII",
+            description: "Assign roles and responsibilities for privacy and PII protection aligned with controller/processor obligations.",
+            category: "privacy",
+            framework: "ISO27701",
+            article: "Clause 5.3",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Identify PII controller vs processor roles. Assign a Data Protection Officer (DPO) where required. Define privacy responsibilities for all roles handling PII.",
+            checks: [
+                { id: "ISO27701-5.3-C1", description: "Controller/processor role identified", status: "not-implemented" },
+                { id: "ISO27701-5.3-C2", description: "DPO or privacy owner assigned", status: "not-implemented" },
+                { id: "ISO27701-5.3-C3", description: "Privacy responsibilities documented per role", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27701-5.4",
+            name: "Privacy Risk Assessment",
+            description: "Conduct privacy impact assessments (PIA/DPIA) for processing activities likely to result in high risk to data subjects.",
+            category: "privacy",
+            framework: "ISO27701",
+            article: "Clause 5.4",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Establish a PIA/DPIA process. Identify privacy risks for new processing activities. Document mitigations. Review periodically.",
+            checks: [
+                { id: "ISO27701-5.4-C1", description: "PIA/DPIA process established", status: "not-implemented" },
+                { id: "ISO27701-5.4-C2", description: "PIAs conducted for high-risk processing", status: "not-implemented" },
+                { id: "ISO27701-5.4-C3", description: "Risks documented with mitigations", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27701-6.2",
+            name: "PII Identification and Classification",
+            description: "Identify and classify PII within information systems to apply appropriate controls.",
+            category: "privacy",
+            framework: "ISO27701",
+            article: "Clause 6.2",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Maintain a data inventory of all PII. Classify PII by sensitivity (standard, sensitive, special category). Map data flows.",
+            checks: [
+                { id: "ISO27701-6.2-C1", description: "PII inventory maintained", status: "not-implemented" },
+                { id: "ISO27701-6.2-C2", description: "PII classified by sensitivity", status: "not-implemented" },
+                { id: "ISO27701-6.2-C3", description: "Data flow maps documented", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27701-6.4",
+            name: "PII De-identification and Anonymization",
+            description: "Implement de-identification, pseudonymization, and anonymization techniques to reduce privacy risk.",
+            category: "privacy",
+            framework: "ISO27701",
+            article: "Clause 6.4",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Use pseudonymization for analytics. Implement anonymization where re-identification is not required. Document techniques used.",
+            checks: [
+                { id: "ISO27701-6.4-C1", description: "De-identification techniques applied", status: "not-implemented" },
+                { id: "ISO27701-6.4-C2", description: "Pseudonymization used where feasible", status: "not-implemented" },
+                { id: "ISO27701-6.4-C3", description: "Re-identification risk assessed", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27701-6.5",
+            name: "PII Segregation",
+            description: "Segregate PII from other data to limit access and reduce exposure.",
+            category: "privacy",
+            framework: "ISO27701",
+            article: "Clause 6.5",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Store PII in separate databases or schemas. Apply stricter access controls. Use encryption at rest for PII stores.",
+            checks: [
+                { id: "ISO27701-6.5-C1", description: "PII segregated from non-PII data", status: "not-implemented" },
+                { id: "ISO27701-6.5-C2", description: "Stricter access controls on PII stores", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27701-6.7",
+            name: "PII Retention and Disposal",
+            description: "Define and enforce retention periods and secure disposal procedures for PII.",
+            category: "privacy",
+            framework: "ISO27701",
+            article: "Clause 6.7",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Define retention schedules per PII category. Implement automated deletion. Document secure disposal methods.",
+            checks: [
+                { id: "ISO27701-6.7-C1", description: "Retention schedule defined per PII category", status: "not-implemented" },
+                { id: "ISO27701-6.7-C2", description: "Automated deletion implemented", status: "not-implemented" },
+                { id: "ISO27701-6.7-C3", description: "Secure disposal documented", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27701-6.9",
+            name: "PII Transfer Controls",
+            description: "Control and document transfers of PII between systems, organizations, and jurisdictions.",
+            category: "privacy",
+            framework: "ISO27701",
+            article: "Clause 6.9",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Document all PII transfers. Ensure legal basis for cross-border transfers. Use encryption in transit. Maintain transfer logs.",
+            checks: [
+                { id: "ISO27701-6.9-C1", description: "PII transfers documented", status: "not-implemented" },
+                { id: "ISO27701-6.9-C2", description: "Cross-border legal basis confirmed", status: "not-implemented" },
+                { id: "ISO27701-6.9-C3", description: "Transfer logging implemented", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27701-7.3",
+            name: "PII Controller Obligations",
+            description: "Fulfill controller obligations including consent management, data subject rights, and transparency.",
+            category: "privacy",
+            framework: "ISO27701",
+            article: "Clause 7.3",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Implement consent capture and management. Provide data subject rights (access, rectification, erasure, portability). Maintain processing records.",
+            checks: [
+                { id: "ISO27701-7.3-C1", description: "Consent management system in place", status: "not-implemented" },
+                { id: "ISO27701-7.3-C2", description: "Data subject rights process documented", status: "not-implemented" },
+                { id: "ISO27701-7.3-C3", description: "Processing records maintained (Art 30)", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27701-7.5",
+            name: "PII Processor Obligations",
+            description: "When acting as processor, only process PII per controller instructions and maintain subprocessor controls.",
+            category: "privacy",
+            framework: "ISO27701",
+            article: "Clause 7.5",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Process PII only per documented controller instructions. Maintain DPAs with all subprocessors. Notify controllers of breaches.",
+            checks: [
+                { id: "ISO27701-7.5-C1", description: "Processing limited to controller instructions", status: "not-implemented" },
+                { id: "ISO27701-7.5-C2", description: "DPAs with subprocessors maintained", status: "not-implemented" },
+                { id: "ISO27701-7.5-C3", description: "Breach notification to controllers defined", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "ISO27701-8.4",
+            name: "Privacy by Design",
+            description: "Integrate privacy considerations into the design and development of systems, products, and services.",
+            category: "privacy",
+            framework: "ISO27701",
+            article: "Clause 8.4",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Apply privacy by design principles. Conduct privacy reviews in SDLC. Minimize PII collection. Default to privacy-protective settings.",
+            checks: [
+                { id: "ISO27701-8.4-C1", description: "Privacy by design principles applied", status: "not-implemented" },
+                { id: "ISO27701-8.4-C2", description: "Privacy reviews in SDLC", status: "not-implemented" },
+                { id: "ISO27701-8.4-C3", description: "Privacy-protective defaults configured", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "iso27701",
+        name: "ISO 27701 Privacy Information Management Policy Pack",
+        description: "ISO/IEC 27701:2019 controls for Privacy Information Management Systems (PIMS), extending ISO 27001 with privacy and PII protection requirements.",
+        version: "1.0.0",
+        project_types: [
+            "saas", "ai-application", "government-system", "healthcare-system",
+            "generic-web-application", "api-backend", "mobile-application",
+        ],
+        controls,
+        frameworks: ["ISO27701"],
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@greenarmor/ges-policy-engine",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "type": "module",
   "description": "GESF Policy Engine - Policy packs management and enforcement",
   "main": "./dist/index.js",
@@ -11,17 +11,18 @@
       "default": "./dist/index.js"
     }
   },
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo",
+    "test": "vitest run"
+  },
   "dependencies": {
-    "@greenarmor/ges-core": "1.0.0",
-    "@greenarmor/ges-compliance-engine": "1.0.0"
+    "@greenarmor/ges-core": "workspace:*",
+    "@greenarmor/ges-compliance-engine": "workspace:*"
   },
   "devDependencies": {
     "typescript": "^6.0.0",
-    "@types/node": "^22.0.0"
-  },
-  "scripts": {
-    "build": "tsc",
-    "clean": "rm -rf dist tsconfig.tsbuildinfo",
-    "test": "echo \"no tests yet\""
+    "@types/node": "^22.0.0",
+    "vitest": "^4.1.8"
   }
-}
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2025–2026 greenarmor
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.