@portll/cobolwork 0.4.0 → 0.6.0

package/rules/compliance-ffiec.json

@@ -388,6 +388,19 @@
     "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-new-password",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: Credential pattern: cics new password. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "cics-protected-field-to-record-key",
@@ -1077,6 +1090,19 @@
     "quote": "Inventory of all systems and components (e.g., open-source, proprietary, application programming interfaces [API], and container images and registries), including related licenses, and data as part of IT asset management (ITAM)."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "credential-in-source",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: A credential is written into the source. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "csd-defines-diagnostic-transaction",
@@ -1649,6 +1675,123 @@
     "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-calls-security-product",
+   "framework": "ffiec",
+   "clause": "DA&M IV",
+   "title": "Common Development, Acquisition, and Maintenance Practices",
+   "rationale": "The rule reports: Assembler source calls the security product directly. That is a component or dependency the inventory does not accurately account for, which this practice requires be catalogued.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Inventory of all systems and components (e.g., open-source, proprietary, application programming interfaces [API], and container images and registries), including related licenses, and data as part of IT asset management (ITAM)."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-cross-memory-service",
+   "framework": "ffiec",
+   "clause": "IS II.C.7",
+   "title": "User Security Controls",
+   "rationale": "The rule reports: Assembler source uses a cross-memory instruction, reaching another address space or another authority. That is authority granted or exercised beyond job necessity, which the principle of least privilege exists to constrain.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Principle of least privilege, which recommends minimum user profile privileges for both physical and logical access based on job necessity."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-executes-built-instruction",
+   "framework": "ffiec",
+   "clause": "DA&M V",
+   "title": "Development",
+   "rationale": "The rule reports: Assembler source runs an instruction whose length or mask comes from a register at run time. That is a source code-related vulnerability of the kind secure coding practices exist to minimise.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-provides-called-module",
+   "framework": "ffiec",
+   "clause": "DA&M IV",
+   "title": "Common Development, Acquisition, and Maintenance Practices",
+   "rationale": "The rule reports: An assembler CSECT or ENTRY is a module a COBOL program in this tree CALLs. That is a component or dependency the inventory does not accurately account for, which this practice requires be catalogued.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Inventory of all systems and components (e.g., open-source, proprietary, application programming interfaces [API], and container images and registries), including related licenses, and data as part of IT asset management (ITAM)."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-supervisor-state-change",
+   "framework": "ffiec",
+   "clause": "IS II.C.7",
+   "title": "User Security Controls",
+   "rationale": "The rule reports: Assembler source switches to PSW key zero or supervisor state. That is authority granted or exercised beyond job necessity, which the principle of least privilege exists to constrain.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Principle of least privilege, which recommends minimum user profile privileges for both physical and logical access based on job necessity."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-runtime-module-name",
+   "framework": "ffiec",
+   "clause": "DA&M V",
+   "title": "Development",
+   "rationale": "The rule reports: Assembler source loads or calls a module whose name it reads from storage at run time. That is a source code-related vulnerability of the kind secure coding practices exist to minimise.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-fixed-initialization-vector",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: A program enciphers through ICSF with an initialization vector that never changes. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-single-length-des-key",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: A program generates a single-length DES key through ICSF. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-weak-hash",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: A program hashes with MD5 or SHA-1 through ICSF. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "input-causes-abend",
@@ -1662,6 +1805,32 @@
     "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-hang",
+   "framework": "ffiec",
+   "clause": "DA&M V",
+   "title": "Development",
+   "rationale": "The rule reports: An input the program accepts keeps a loop running past the statement limit that stands in for its time limit (S322). That is a source code-related vulnerability of the kind secure coding practices exist to minimise.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-selects-program",
+   "framework": "ffiec",
+   "clause": "DA&M V",
+   "title": "Development",
+   "rationale": "The rule reports: An input the program accepts chooses the program a CALL loads. That is a source code-related vulnerability of the kind secure coding practices exist to minimise.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "input-causes-abend-s0c4",
@@ -2169,6 +2338,19 @@
     "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-racf-new-password",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: Credential pattern: jcl racf new password. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "job-loads-from-an-authorised-library",
@@ -2351,6 +2533,19 @@
     "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "racf-command-new-password",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: Credential pattern: racf command new password. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "racf-command-password",
@@ -2468,6 +2663,19 @@
     "quote": "Inventory of all systems and components (e.g., open-source, proprietary, application programming interfaces [API], and container images and registries), including related licenses, and data as part of IT asset management (ITAM)."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "tso-logon-new-password",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: Credential pattern: tso logon new password. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "tso-logon-password",
@@ -2494,6 +2702,19 @@
     "quote": "Principle of least privilege, which recommends minimum user profile privileges for both physical and logical access based on job necessity."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-client-opens-cleartext",
+   "framework": "ffiec",
+   "clause": "IS II.C.19",
+   "title": "Encryption",
+   "rationale": "The rule reports: A program opens an outbound HTTP connection without TLS. That is an authentication credential or sensitive data left unprotected, which this control requires be encrypted in storage and in transit.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Encryption is used to secure communications and data storage, particularly authentication credentials and the transmission of sensitive information."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-cookie-without-secure-attributes",
@@ -2520,6 +2741,19 @@
     "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-receive-length-exceeds-area",
+   "framework": "ffiec",
+   "clause": "DA&M V",
+   "title": "Development",
+   "rationale": "The rule reports: A web receive lets CICS write more bytes than the area it writes into. That is a source code-related vulnerability of the kind secure coding practices exist to minimise.",
+   "source": {
+    "doc": "ffiec",
+    "retrieved": "2026-09-20",
+    "quote": "Secure coding practices help developers minimize the potential for known source code-related vulnerabilities in the development phase."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-request-changes-state-without-a-token",

package/rules/compliance-nist80053.json

@@ -388,6 +388,19 @@
     "quote": "Protect the {{ insert: param, sc-08_odp }} of transmitted information."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-new-password",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: Credential pattern: cics new password. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "cics-protected-field-to-record-key",
@@ -1077,6 +1090,19 @@
     "quote": "Develop and document an inventory of system components"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "credential-in-source",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: A credential is written into the source. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "csd-defines-diagnostic-transaction",
@@ -1649,6 +1675,123 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-calls-security-product",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: Assembler source calls the security product directly. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-cross-memory-service",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: Assembler source uses a cross-memory instruction, reaching another address space or another authority. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-executes-built-instruction",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Assembler source runs an instruction whose length or mask comes from a register at run time. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-provides-called-module",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: An assembler CSECT or ENTRY is a module a COBOL program in this tree CALLs. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-supervisor-state-change",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: Assembler source switches to PSW key zero or supervisor state. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-runtime-module-name",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Assembler source loads or calls a module whose name it reads from storage at run time. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-fixed-initialization-vector",
+   "framework": "nist-800-53r5",
+   "clause": "SC-13",
+   "title": "Cryptographic Protection",
+   "rationale": "The rule reports: A program enciphers through ICSF with an initialization vector that never changes. That is cryptography too weak for the use it is put to, which this control requires be chosen for each use and implemented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Implement the following types of cryptography required for each specified cryptographic use"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-single-length-des-key",
+   "framework": "nist-800-53r5",
+   "clause": "SC-13",
+   "title": "Cryptographic Protection",
+   "rationale": "The rule reports: A program generates a single-length DES key through ICSF. That is cryptography too weak for the use it is put to, which this control requires be chosen for each use and implemented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Implement the following types of cryptography required for each specified cryptographic use"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-weak-hash",
+   "framework": "nist-800-53r5",
+   "clause": "SC-13",
+   "title": "Cryptographic Protection",
+   "rationale": "The rule reports: A program hashes with MD5 or SHA-1 through ICSF. That is cryptography too weak for the use it is put to, which this control requires be chosen for each use and implemented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Implement the following types of cryptography required for each specified cryptographic use"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "input-causes-abend",
@@ -1662,6 +1805,32 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-hang",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: An input the program accepts keeps a loop running past the statement limit that stands in for its time limit (S322). That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-selects-program",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: An input the program accepts chooses the program a CALL loads. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "input-causes-abend-s0c4",
@@ -2169,6 +2338,19 @@
     "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-racf-new-password",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: Credential pattern: jcl racf new password. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "job-loads-from-an-authorised-library",
@@ -2351,6 +2533,19 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "racf-command-new-password",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: Credential pattern: racf command new password. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "racf-command-password",
@@ -2468,6 +2663,19 @@
     "quote": "Develop and document an inventory of system components"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "tso-logon-new-password",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: Credential pattern: tso logon new password. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "tso-logon-password",
@@ -2494,6 +2702,19 @@
     "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-client-opens-cleartext",
+   "framework": "nist-800-53r5",
+   "clause": "SC-8",
+   "title": "Transmission Confidentiality and Integrity",
+   "rationale": "The rule reports: A program opens an outbound HTTP connection without TLS. That is information crossing a network with nothing protecting it, which this control requires be protected in transit.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Protect the {{ insert: param, sc-08_odp }} of transmitted information."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-cookie-without-secure-attributes",
@@ -2520,6 +2741,19 @@
     "quote": "Protect the authenticity of communications sessions."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-receive-length-exceeds-area",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A web receive lets CICS write more bytes than the area it writes into. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-request-changes-state-without-a-token",