@portll/cobolwork 0.4.0 → 0.5.0

package/rules/compliance-cobit2019.json

@@ -1522,6 +1522,102 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-calls-security-product",
+   "framework": "cobit-2019",
+   "clause": "BAI09.01",
+   "rationale": "The rule reports: Assembler source calls the security product directly. That is a component the record of assets does not account for, which this practice requires be identified and recorded.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-cross-memory-service",
+   "framework": "cobit-2019",
+   "clause": "DSS05.04",
+   "rationale": "The rule reports: Assembler source uses a cross-memory instruction, reaching another address space or another authority. That is access or authentication handled outside the managed identity and logical access this practice requires.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-executes-built-instruction",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: Assembler source runs an instruction whose length or mask comes from a register at run time. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-provides-called-module",
+   "framework": "cobit-2019",
+   "clause": "BAI09.01",
+   "rationale": "The rule reports: An assembler CSECT or ENTRY is a module a COBOL program in this tree CALLs. That is a component the record of assets does not account for, which this practice requires be identified and recorded.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-supervisor-state-change",
+   "framework": "cobit-2019",
+   "clause": "DSS05.04",
+   "rationale": "The rule reports: Assembler source switches to PSW key zero or supervisor state. That is access or authentication handled outside the managed identity and logical access this practice requires.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-fixed-initialization-vector",
+   "framework": "cobit-2019",
+   "clause": "DSS06.06",
+   "rationale": "The rule reports: A program enciphers through ICSF with an initialization vector that never changes. That is information released to people it was never meant for, which this practice requires be secured.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-single-length-des-key",
+   "framework": "cobit-2019",
+   "clause": "DSS06.06",
+   "rationale": "The rule reports: A program generates a single-length DES key through ICSF. That is information released to people it was never meant for, which this practice requires be secured.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-weak-hash",
+   "framework": "cobit-2019",
+   "clause": "DSS06.06",
+   "rationale": "The rule reports: A program hashes with MD5 or SHA-1 through ICSF. That is information released to people it was never meant for, which this practice requires be secured.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "input-causes-abend",
@@ -2002,6 +2098,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-racf-new-password",
+   "framework": "cobit-2019",
+   "clause": "DSS05.04",
+   "rationale": "The rule reports: Credential pattern: jcl racf new password. That is access or authentication handled outside the managed identity and logical access this practice requires.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "job-loads-from-an-authorised-library",
@@ -2302,6 +2410,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-client-opens-cleartext",
+   "framework": "cobit-2019",
+   "clause": "DSS05.02",
+   "rationale": "The rule reports: A program opens an outbound HTTP connection without TLS. That is information or a credential crossing a connection with nothing protecting it, which this practice requires be secured.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-cookie-without-secure-attributes",
@@ -2326,6 +2446,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-receive-length-exceeds-area",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A web receive lets CICS write more bytes than the area it writes into. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-request-changes-state-without-a-token",

package/rules/compliance-dora.json

@@ -1640,6 +1640,110 @@
     "quote": "minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-calls-security-product",
+   "framework": "dora",
+   "clause": "Article 8(4)",
+   "title": "Identification",
+   "rationale": "The rule reports: Assembler source calls the security product directly. That is an interdependency between assets which no single file records, and mapping it is what this clause asks for.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "map the configuration of the information assets and ICT assets and the links and interdependencies between the different information assets and ICT assets"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-cross-memory-service",
+   "framework": "dora",
+   "clause": "Article 9(4)(c)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: Assembler source uses a cross-memory instruction, reaching another address space or another authority. That grants or alters access rights outside the policy controls this clause requires be soundly administered.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-executes-built-instruction",
+   "framework": "dora",
+   "clause": "Article 9(3)(b)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: Assembler source runs an instruction whose length or mask comes from a register at run time. That is a technical flaw permitting unauthorised access or data corruption, which this clause requires be minimised.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-provides-called-module",
+   "framework": "dora",
+   "clause": "Article 8(4)",
+   "title": "Identification",
+   "rationale": "The rule reports: An assembler CSECT or ENTRY is a module a COBOL program in this tree CALLs. That is an interdependency between assets which no single file records, and mapping it is what this clause asks for.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "map the configuration of the information assets and ICT assets and the links and interdependencies between the different information assets and ICT assets"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-supervisor-state-change",
+   "framework": "dora",
+   "clause": "Article 9(4)(c)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: Assembler source switches to PSW key zero or supervisor state. That grants or alters access rights outside the policy controls this clause requires be soundly administered.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-fixed-initialization-vector",
+   "framework": "dora",
+   "clause": "Article 9(3)(c)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: A program enciphers through ICSF with an initialization vector that never changes. That risks the loss of data and the impairment of its integrity, which this clause requires be prevented.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "prevent the lack of availability, the impairment of the authenticity and integrity, the breaches of confidentiality and the loss of data"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-single-length-des-key",
+   "framework": "dora",
+   "clause": "Article 9(3)(c)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: A program generates a single-length DES key through ICSF. That risks the loss of data and the impairment of its integrity, which this clause requires be prevented.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "prevent the lack of availability, the impairment of the authenticity and integrity, the breaches of confidentiality and the loss of data"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-weak-hash",
+   "framework": "dora",
+   "clause": "Article 9(3)(c)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: A program hashes with MD5 or SHA-1 through ICSF. That risks the loss of data and the impairment of its integrity, which this clause requires be prevented.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "prevent the lack of availability, the impairment of the authenticity and integrity, the breaches of confidentiality and the loss of data"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "input-causes-abend",
@@ -2160,6 +2264,19 @@
     "quote": "implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-racf-new-password",
+   "framework": "dora",
+   "clause": "Article 9(4)(d)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: Credential pattern: jcl racf new password. That exposes an authentication secret in a file, defeating the authentication mechanisms and key protection this clause requires.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "job-loads-from-an-authorised-library",
@@ -2511,6 +2628,19 @@
     "quote": "implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-client-opens-cleartext",
+   "framework": "dora",
+   "clause": "Article 9(3)(a)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: A program opens an outbound HTTP connection without TLS. That is data leaving through a channel the program opened itself, which bears directly on the security of the means of transfer.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "ensure the security of the means of transfer of data"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-cookie-without-secure-attributes",
@@ -2537,6 +2667,19 @@
     "quote": "minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-receive-length-exceeds-area",
+   "framework": "dora",
+   "clause": "Article 9(3)(b)",
+   "title": "Protection and prevention",
+   "rationale": "The rule reports: A web receive lets CICS write more bytes than the area it writes into. That is a technical flaw permitting unauthorised access or data corruption, which this clause requires be minimised.",
+   "source": {
+    "doc": "dora",
+    "retrieved": "2026-09-20",
+    "quote": "minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-request-changes-state-without-a-token",

package/rules/compliance-ffiec.json

@@ -1649,6 +1649,110 @@
     "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-calls-security-product",
+   "framework": "ffiec",
+   "clause": "DA&M IV",
+   "title": "Common Development, Acquisition, and Maintenance Practices",
+   "rationale": "The rule reports: Assembler source calls the security product directly. That is a component or dependency the inventory does not accurately account for, which this practice requires be catalogued.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Inventory of all systems and components (e.g., open-source, proprietary, application programming interfaces [API], and container images and registries), including related licenses, and data as part of IT asset management (ITAM)."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-cross-memory-service",
+   "framework": "ffiec",
+   "clause": "IS II.C.7",
+   "title": "User Security Controls",
+   "rationale": "The rule reports: Assembler source uses a cross-memory instruction, reaching another address space or another authority. That is authority granted or exercised beyond job necessity, which the principle of least privilege exists to constrain.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Principle of least privilege, which recommends minimum user profile privileges for both physical and logical access based on job necessity."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-executes-built-instruction",
+   "framework": "ffiec",
+   "clause": "DA&M V",
+   "title": "Development",
+   "rationale": "The rule reports: Assembler source runs an instruction whose length or mask comes from a register at run time. That is a source code-related vulnerability of the kind secure coding practices exist to minimise.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-provides-called-module",
+   "framework": "ffiec",
+   "clause": "DA&M IV",
+   "title": "Common Development, Acquisition, and Maintenance Practices",
+   "rationale": "The rule reports: An assembler CSECT or ENTRY is a module a COBOL program in this tree CALLs. That is a component or dependency the inventory does not accurately account for, which this practice requires be catalogued.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Inventory of all systems and components (e.g., open-source, proprietary, application programming interfaces [API], and container images and registries), including related licenses, and data as part of IT asset management (ITAM)."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-supervisor-state-change",
+   "framework": "ffiec",
+   "clause": "IS II.C.7",
+   "title": "User Security Controls",
+   "rationale": "The rule reports: Assembler source switches to PSW key zero or supervisor state. That is authority granted or exercised beyond job necessity, which the principle of least privilege exists to constrain.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Principle of least privilege, which recommends minimum user profile privileges for both physical and logical access based on job necessity."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-fixed-initialization-vector",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: A program enciphers through ICSF with an initialization vector that never changes. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-single-length-des-key",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: A program generates a single-length DES key through ICSF. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-weak-hash",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: A program hashes with MD5 or SHA-1 through ICSF. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "input-causes-abend",
@@ -2169,6 +2273,19 @@
     "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-racf-new-password",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: Credential pattern: jcl racf new password. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "job-loads-from-an-authorised-library",
@@ -2494,6 +2611,19 @@
     "quote": "Principle of least privilege, which recommends minimum user profile privileges for both physical and logical access based on job necessity."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-client-opens-cleartext",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: A program opens an outbound HTTP connection without TLS. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-cookie-without-secure-attributes",
@@ -2520,6 +2650,19 @@
     "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-receive-length-exceeds-area",
+   "framework": "ffiec",
+   "clause": "DA&M V",
+   "title": "Development",
+   "rationale": "The rule reports: A web receive lets CICS write more bytes than the area it writes into. That is a source code-related vulnerability of the kind secure coding practices exist to minimise.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-request-changes-state-without-a-token",

package/rules/compliance-nist80053.json

@@ -1649,6 +1649,110 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-calls-security-product",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: Assembler source calls the security product directly. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-cross-memory-service",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: Assembler source uses a cross-memory instruction, reaching another address space or another authority. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-executes-built-instruction",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Assembler source runs an instruction whose length or mask comes from a register at run time. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-provides-called-module",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: An assembler CSECT or ENTRY is a module a COBOL program in this tree CALLs. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-supervisor-state-change",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: Assembler source switches to PSW key zero or supervisor state. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-fixed-initialization-vector",
+   "framework": "nist-800-53r5",
+   "clause": "SC-13",
+   "title": "Cryptographic Protection",
+   "rationale": "The rule reports: A program enciphers through ICSF with an initialization vector that never changes. That is cryptography too weak for the use it is put to, which this control requires be chosen for each use and implemented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Implement the following types of cryptography required for each specified cryptographic use"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-single-length-des-key",
+   "framework": "nist-800-53r5",
+   "clause": "SC-13",
+   "title": "Cryptographic Protection",
+   "rationale": "The rule reports: A program generates a single-length DES key through ICSF. That is cryptography too weak for the use it is put to, which this control requires be chosen for each use and implemented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Implement the following types of cryptography required for each specified cryptographic use"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-weak-hash",
+   "framework": "nist-800-53r5",
+   "clause": "SC-13",
+   "title": "Cryptographic Protection",
+   "rationale": "The rule reports: A program hashes with MD5 or SHA-1 through ICSF. That is cryptography too weak for the use it is put to, which this control requires be chosen for each use and implemented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Implement the following types of cryptography required for each specified cryptographic use"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "input-causes-abend",
@@ -2169,6 +2273,19 @@
     "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-racf-new-password",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: Credential pattern: jcl racf new password. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "job-loads-from-an-authorised-library",
@@ -2494,6 +2611,19 @@
     "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-client-opens-cleartext",
+   "framework": "nist-800-53r5",
+   "clause": "SC-8",
+   "title": "Transmission Confidentiality and Integrity",
+   "rationale": "The rule reports: A program opens an outbound HTTP connection without TLS. That is information crossing a network with nothing protecting it, which this control requires be protected in transit.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Protect the {{ insert: param, sc-08_odp }} of transmitted information."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-cookie-without-secure-attributes",
@@ -2520,6 +2650,19 @@
     "quote": "Protect the authenticity of communications sessions."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-receive-length-exceeds-area",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A web receive lets CICS write more bytes than the area it writes into. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-request-changes-state-without-a-token",