@portll/cobolwork 0.6.0 → 0.7.0

package/rules/compliance-cobit2019.json

@@ -1342,6 +1342,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-cics-dynamic-transfer",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A CICS queue item decides which program CICS transfers to. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-cics-sysid",
@@ -1354,6 +1366,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-cics-sysid",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A CICS queue item decides which region a CICS command is shipped to. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-cics-system-resource",
@@ -1366,6 +1390,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-cics-system-resource",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A CICS queue item names the resource an EXEC CICS SET changes. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-dynamic-file-path",
@@ -1378,6 +1414,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-dynamic-file-path",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A CICS queue item decides which file is opened. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-dynamic-program-load",
@@ -1390,6 +1438,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-dynamic-program-load",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A CICS queue item decides which program is called. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-dynamic-sql",
@@ -1402,6 +1462,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-dynamic-sql",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A CICS queue item reaches dynamic SQL. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-extrapartition-queue",
@@ -1414,6 +1486,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-extrapartition-queue",
+   "framework": "cobit-2019",
+   "clause": "DSS05.02",
+   "rationale": "The rule reports: A CICS queue item is written to a transient-data queue that leaves the region. That is information or a credential crossing a connection with nothing protecting it, which this practice requires be secured.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-http-header",
@@ -1426,6 +1510,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-http-header",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A CICS queue item is written into a header of the response. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-internal-reader",
@@ -1438,6 +1534,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-internal-reader",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A CICS queue item is written into a job the internal reader submits. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-message-queue",
@@ -1450,6 +1558,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-message-queue",
+   "framework": "cobit-2019",
+   "clause": "DSS05.02",
+   "rationale": "The rule reports: A CICS queue item is put on a message queue. That is information or a credential crossing a connection with nothing protecting it, which this practice requires be secured.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-os-command",
@@ -1462,6 +1582,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-os-command",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A CICS queue item reaches an operating-system command routine. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-outbound-host",
@@ -1474,6 +1606,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-outbound-host",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A CICS queue item decides the host or path this program sends a request to. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-outbound-http",
@@ -1486,6 +1630,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-outbound-http",
+   "framework": "cobit-2019",
+   "clause": "DSS05.02",
+   "rationale": "The rule reports: A CICS queue item is sent to a remote server over HTTP. That is information or a credential crossing a connection with nothing protecting it, which this practice requires be secured.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-queue-name",
@@ -1498,6 +1654,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-queue-name",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A CICS queue item names the queue a command reads, writes or deletes. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-socket-send",
@@ -1510,6 +1678,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-socket-send",
+   "framework": "cobit-2019",
+   "clause": "DSS05.02",
+   "rationale": "The rule reports: A CICS queue item is written to a network socket. That is information or a credential crossing a connection with nothing protecting it, which this practice requires be secured.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "file-record-to-web-response",
@@ -1522,6 +1702,18 @@
     "idsOnly": true
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "cics-queue-to-web-response",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A CICS queue item is written into the response this program returns. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "hidden-payload-in-identification-area",
@@ -1599,7 +1791,7 @@
    "ruleId": "hlasm-supervisor-state-change",
    "framework": "cobit-2019",
    "clause": "DSS05.04",
-   "rationale": "The rule reports: Assembler source switches to PSW key zero or supervisor state. That is access or authentication handled outside the managed identity and logical access this practice requires.",
+   "rationale": "The rule reports: Assembler source switches to PSW key zero, another system key, or supervisor state. That is access or authentication handled outside the managed identity and logical access this practice requires.",
    "source": {
     "doc": "cobit2019",
     "retrieved": "2026-09-20",
@@ -2697,6 +2889,245 @@
     "retrieved": "2026-09-20",
     "idsOnly": true
    }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "db2-exit-routine-declared",
+   "framework": "cobit-2019",
+   "clause": "BAI09.01",
+   "rationale": "The rule reports: A table names an exit routine that runs inside Db2. That is a component the record of assets does not account for, which this practice requires be identified and recorded.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "db2-external-routine",
+   "framework": "cobit-2019",
+   "clause": "BAI09.01",
+   "rationale": "The rule reports: A procedure or function runs an external load module. That is a component the record of assets does not account for, which this practice requires be identified and recorded.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "db2-grant-to-public",
+   "framework": "cobit-2019",
+   "clause": "DSS05.04",
+   "rationale": "The rule reports: A GRANT gives privileges to PUBLIC, every authorization ID. That is access or authentication handled outside the managed identity and logical access this practice requires.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "db2-grant-with-grant-option",
+   "framework": "cobit-2019",
+   "clause": "DSS05.04",
+   "rationale": "The rule reports: WITH GRANT OPTION lets the grantee grant the privilege to others. That is access or authentication handled outside the managed identity and logical access this practice requires.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "db2-system-authority-granted",
+   "framework": "cobit-2019",
+   "clause": "DSS05.04",
+   "rationale": "The rule reports: A system or database authority is granted. That is access or authentication handled outside the managed identity and logical access this practice requires.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "ims-definition-inconsistent",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A DBD or PSB holds what DBDGEN, PSBGEN or ACBGEN refuses. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "ims-pcb-procopt-all",
+   "framework": "cobit-2019",
+   "clause": "DSS05.04",
+   "rationale": "The rule reports: A database PCB lets the program get, insert, replace and delete its sensitive segments. That is access or authentication handled outside the managed identity and logical access this practice requires.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "ims-senseg-unknown-segment",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A SENSEG names a segment its PCB's DBD does not define, which ends the program with abend U0914. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "pli-based-storage-addressing",
+   "framework": "cobit-2019",
+   "clause": "BAI09.01",
+   "rationale": "The rule reports: A program addresses storage through a pointer, so data flow through it is not followed. That is a component the record of assets does not account for, which this practice requires be identified and recorded.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "pli-entry-variable-call",
+   "framework": "cobit-2019",
+   "clause": "BAI09.01",
+   "rationale": "The rule reports: A CALL through an entry variable dispatches to a procedure chosen at run time, so the callee is not known statically. That is a component the record of assets does not account for, which this practice requires be identified and recorded.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "pli-error-condition-ignored",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: An ON unit for a condition does nothing with it, so the condition is silently ignored. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "pli-fetch-title-variable",
+   "framework": "cobit-2019",
+   "clause": "DSS06.02",
+   "rationale": "The rule reports: A FETCH whose TITLE is not a literal names the module to load at run time. That is information processed without the control that keeps it valid, authorised and accurate, which is what this practice asks of business process controls.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "pli-preprocessor-in-use",
+   "framework": "cobit-2019",
+   "clause": "BAI09.01",
+   "rationale": "The rule reports: A program uses PL/I preprocessor directives, so the source text is not the code that is compiled. That is a component the record of assets does not account for, which this practice requires be identified and recorded.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "ims-procopt-broader-than-used",
+   "framework": "cobit-2019",
+   "clause": "DSS05.04",
+   "rationale": "The rule reports: A PSB grants a processing option that no DL/I call of the program it is named for uses. That is access or authentication handled outside the managed identity and logical access this practice requires.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  }
+ ],
+ "evidence": [
+  {
+   "kind": "evidence",
+   "evidenceId": "journal-records",
+   "tools": [
+    "cobolwork",
+    "ironwork"
+   ],
+   "framework": "cobit-2019",
+   "clause": "DSS06.05",
+   "rationale": "The evidence is a run journal's records, one per event: what ran and with which arguments, the inputs and DD files it read, the programs it called, where data left it, and how and when it ended. That makes the events of a run traceable afterwards, to what ran, on what and with what result, which this practice requires of information events.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "evidence",
+   "evidenceId": "journal-chain",
+   "tools": [
+    "cobolwork",
+    "ironwork"
+   ],
+   "framework": "cobit-2019",
+   "clause": "DSS06.05",
+   "rationale": "The evidence is the SHA-256 chain through each run journal and the ledger that names every run, which `cobolwork evidence verify` recomputes, so a record changed, removed or reordered after it was written is found. That makes the events of a run traceable afterwards, to what ran, on what and with what result, which this practice requires of information events.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "evidence",
+   "evidenceId": "provenance",
+   "tools": [
+    "cobolwork",
+    "ironwork"
+   ],
+   "framework": "cobit-2019",
+   "clause": "DSS06.05",
+   "rationale": "The evidence is the in-toto SLSA provenance statement of a run, naming its output and the sources it was built from by digest, the tool, and the tip of its journal. That makes the events of a run traceable afterwards, to what ran, on what and with what result, which this practice requires of information events.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  },
+  {
+   "kind": "evidence",
+   "evidenceId": "options-in-force",
+   "tools": [
+    "ironwork"
+   ],
+   "framework": "cobit-2019",
+   "clause": "BAI10.04",
+   "rationale": "The evidence is the options a compile or run used, its compliance level and dialect among them, in the provenance statement's optionsInForce and the journal's open record. That reports the configuration each compile and run used, which this practice requires be produced.",
+   "source": {
+    "doc": "cobit2019",
+    "retrieved": "2026-09-20",
+    "idsOnly": true
+   }
+  }
+ ],
+ "unmappedEvidence": [
+  {
+   "evidenceId": "assumptions-register",
+   "why": "No COBIT 2019 practice is about how a compiler resolves what its language leaves open, for the reason NIST declines it."
   }
  ]
 }