@shiftleftpt/sbd-toe-mcp 0.10.2 → 0.10.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (28) hide show
  1. package/consumed-bundle.json +11 -11
  2. package/data/entities/proportionality.json +3 -3
  3. package/data/entities/sdlc_integration.json +3 -3
  4. package/data/publish/indexes/bundle_catalog.jsonl +1 -1
  5. package/data/publish/indexes/canonical_chunks.jsonl +4903 -4902
  6. package/data/publish/indexes/chunk_entity_mentions.jsonl +9 -25
  7. package/data/publish/indexes/mcp_chunks.jsonl +125 -124
  8. package/data/publish/indexes/publication_manifest.json +8 -8
  9. package/data/publish/overlay/framework_overlay_index.json +18 -0
  10. package/data/publish/overlay/overlay_mappings.jsonl +120 -45
  11. package/data/publish/runtime/controls.json +27 -25
  12. package/data/publish/runtime/deterministic_manifest.json +1 -1
  13. package/data/publish/runtime/evidence_patterns.json +24 -24
  14. package/data/publish/runtime/requirement_control_links.json +334 -162
  15. package/data/publish/runtime/v1/manual_maturity_progression.jsonl +336 -336
  16. package/data/publish/runtime/v1/manual_rastreabilidade.jsonl +1105 -1105
  17. package/data/publish/runtime/v1/manual_threat_mitigation.jsonl +523 -523
  18. package/data/publish/runtime/v1/v1_manifest.json +5 -5
  19. package/data/reports/run_manifest.json +8 -8
  20. package/dist/index.js +4 -4
  21. package/dist/index.js.map +1 -1
  22. package/dist/tools/plan-repo-governance.d.ts +1 -2
  23. package/dist/tools/plan-repo-governance.js +19 -49
  24. package/dist/tools/plan-repo-governance.js.map +1 -1
  25. package/dist/tools/structured-tools.d.ts +4 -5
  26. package/dist/tools/structured-tools.js +87 -122
  27. package/dist/tools/structured-tools.js.map +1 -1
  28. package/package.json +3 -2
package/data/publish/overlay/overlay_mappings.jsonl CHANGED
@@ -63,6 +63,7 @@
63
63
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-02-requisitos-seguranca-gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "02-requisitos-seguranca:gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "target_type": "Practice"}
64
64
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-02-requisitos-seguranca-geracao-de-sbom-e-assinatura-de-artefactos-de-build", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "02-requisitos-seguranca:geracao-de-sbom-e-assinatura-de-artefactos-de-build", "target_type": "Practice"}
65
65
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-02-requisitos-seguranca-gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "02-requisitos-seguranca:gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "target_type": "Practice"}
66
+ {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-02-requisitos-seguranca-incorporacao-de-restricoes-legais-normativas-e-contratuais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "02-requisitos-seguranca:incorporacao-de-restricoes-legais-normativas-e-contratuais", "target_type": "Practice"}
66
67
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-02-requisitos-seguranca-intent-declaration-por-tool-call-destrutivo-de-agente-ai", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "02-requisitos-seguranca:intent-declaration-por-tool-call-destrutivo-de-agente-ai", "target_type": "Practice"}
67
68
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-02-requisitos-seguranca-politica-formacao-e-procedimentos-operacionais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "02-requisitos-seguranca:politica-formacao-e-procedimentos-operacionais", "target_type": "Practice"}
68
69
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-02-requisitos-seguranca-rastreabilidade-de-requisitos", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "02-requisitos-seguranca:rastreabilidade-de-requisitos", "target_type": "Practice"}
@@ -86,10 +87,10 @@
86
87
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-04-arquitetura-segura-identificacao-e-governacao-de-componentes-nao-deterministicos", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:identificacao-e-governacao-de-componentes-nao-deterministicos", "target_type": "Practice"}
87
88
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-04-arquitetura-segura-padroes-arquitetonicos-para-sistemas-ai-ml-nao-agentic", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:padroes-arquitetonicos-para-sistemas-ai-ml-nao-agentic", "target_type": "Practice"}
88
89
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-04-arquitetura-segura-revisao-de-arquitectura-para-agente-ai-em-a2-us-16", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:revisao-de-arquitectura-para-agente-ai-em-a2-us-16", "target_type": "Practice"}
89
- {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-04-arquitetura-segura-revisao-de-fronteiras-de-confianca-e-integracoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:revisao-de-fronteiras-de-confianca-e-integracoes", "target_type": "Practice"}
90
+ {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-04-arquitetura-segura-revisao-de-fronteiras-de-confianca-e-integracoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:revisao-de-fronteiras-de-confianca-e-integracoes", "target_type": "Practice"}
90
91
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-04-arquitetura-segura-revisao-formal-de-arquitetura-para-l3-governacao-reforcada", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:revisao-formal-de-arquitetura-para-l3-governacao-reforcada", "target_type": "Practice"}
91
92
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-04-arquitetura-segura-revisao-formal-do-design-arquitetural", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:revisao-formal-do-design-arquitetural", "target_type": "Practice"}
92
- {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-04-arquitetura-segura-segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "target_type": "Practice"}
93
+ {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-04-arquitetura-segura-segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "target_type": "Practice"}
93
94
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-04-arquitetura-segura-sincronizacao-threat-modeling-arquitetura", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:sincronizacao-threat-modeling-arquitetura", "target_type": "Practice"}
94
95
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-04-arquitetura-segura-triggers-de-arquitetura-viva-e-disciplina-de-revisao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:triggers-de-arquitetura-viva-e-disciplina-de-revisao", "target_type": "Practice"}
95
96
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-04-arquitetura-segura-validacao-arquitetural-automatizavel-no-ci-cd-quando-aplicavel", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:validacao-arquitetural-automatizavel-no-ci-cd-quando-aplicavel", "target_type": "Practice"}
@@ -206,15 +207,25 @@
206
207
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-13-formacao-onboarding-war-room-e-simulacoes-de-incidentes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "13-formacao-onboarding:war-room-e-simulacoes-de-incidentes", "target_type": "Practice"}
207
208
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "target_type": "Practice"}
208
209
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "target_type": "Practice"}
210
+ {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-clausulas-contratuais-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:clausulas-contratuais-de-seguranca", "target_type": "Practice"}
211
+ {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-consolidacao-de-kpis-de-governacao-e-maturidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:consolidacao-de-kpis-de-governacao-e-maturidade", "target_type": "Practice"}
212
+ {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-contratacao-de-provedores-de-modelos-ai-us-21", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:contratacao-de-provedores-de-modelos-ai-us-21", "target_type": "Practice"}
209
213
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "target_type": "Practice"}
210
214
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-designacao-formal-de-owners-de-seguranca-por-aplicacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:designacao-formal-de-owners-de-seguranca-por-aplicacao", "target_type": "Practice"}
215
+ {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-execucao-de-fluxo-formal-de-validacao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:execucao-de-fluxo-formal-de-validacao-de-fornecedores", "target_type": "Practice"}
216
+ {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-feedback-pos-projeto-e-rating-de-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:feedback-pos-projeto-e-rating-de-contractors", "target_type": "Practice"}
211
217
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "target_type": "Practice"}
218
+ {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-kpis-de-governacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:kpis-de-governacao", "target_type": "Practice"}
219
+ {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "target_type": "Practice"}
220
+ {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "target_type": "Practice"}
212
221
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "target_type": "Practice"}
213
222
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "target_type": "Practice"}
214
223
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-rastreabilidade-organizacional", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:rastreabilidade-organizacional", "target_type": "Practice"}
224
+ {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "target_type": "Practice"}
215
225
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "target_type": "Practice"}
216
226
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-revisao-trimestral-de-acesso-de-contractors-least-privilege", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:revisao-trimestral-de-acesso-de-contractors-least-privilege", "target_type": "Practice"}
217
227
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-trilho-de-formacao-obrigatoria-pre-acesso-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:trilho-de-formacao-obrigatoria-pre-acesso-contractors", "target_type": "Practice"}
228
+ {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-validacao-continua-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:validacao-continua-de-fornecedores", "target_type": "Practice"}
218
229
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.87, "framework_id": "EXT-AI-ACT", "justification": "control_practice_projection", "mapping_id": "MAP-ext-ai-act-obl-11-14-governanca-contratacao-validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "target_type": "Practice"}
219
230
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.93, "framework_id": "EXT-AI-ACT", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-ai-act-obl-11-acc-001", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "ACC-001", "target_type": "Requirement"}
220
231
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.93, "framework_id": "EXT-AI-ACT", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-ai-act-obl-11-acc-002", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "ACC-002", "target_type": "Requirement"}
@@ -269,9 +280,10 @@
269
280
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.9, "framework_id": "EXT-AI-ACT", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-ai-act-obl-11-ctrl-governance-arquitetura-segura-e-rastreavel-74562442c4", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 04", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "target_type": "Control"}
270
281
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.9, "framework_id": "EXT-AI-ACT", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-ai-act-obl-11-ctrl-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "target_type": "Control"}
271
282
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.9, "framework_id": "EXT-AI-ACT", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-ai-act-obl-11-ctrl-governance-classificacao-e-governacao-por-risco-97aceecf29", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "target_type": "Control"}
283
+ {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.9, "framework_id": "EXT-AI-ACT", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-ai-act-obl-11-ctrl-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "target_type": "Control"}
272
284
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.9, "framework_id": "EXT-AI-ACT", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-ai-act-obl-11-ctrl-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "target_type": "Control"}
273
285
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.9, "framework_id": "EXT-AI-ACT", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-ai-act-obl-11-ctrl-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "target_type": "Control"}
274
- {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.9, "framework_id": "EXT-AI-ACT", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-ai-act-obl-11-ctrl-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 04", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "target_type": "Control"}
286
+ {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.9, "framework_id": "EXT-AI-ACT", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-ai-act-obl-11-ctrl-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "target_type": "Control"}
275
287
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.9, "framework_id": "EXT-AI-ACT", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-ai-act-obl-11-ctrl-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "target_type": "Control"}
276
288
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.9, "framework_id": "EXT-AI-ACT", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-ai-act-obl-11-ctrl-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "target_type": "Control"}
277
289
  {"authority_class": "external_normative_overlay", "citation": "11 / Anexo IV", "confidence": 0.9, "framework_id": "EXT-AI-ACT", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-ai-act-obl-11-ctrl-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-AI-ACT-OBL-11", "playbook_id": "OVR-AI-ACT-playbook", "source_document_id": "002-cross-check-normativo-ai-act-02-playbook", "source_lines": [4], "target_id": "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "target_type": "Control"}
@@ -829,6 +841,7 @@
829
841
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-02-requisitos-seguranca-gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "target_type": "Practice"}
830
842
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-02-requisitos-seguranca-geracao-de-sbom-e-assinatura-de-artefactos-de-build", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:geracao-de-sbom-e-assinatura-de-artefactos-de-build", "target_type": "Practice"}
831
843
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-02-requisitos-seguranca-gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "target_type": "Practice"}
844
+ {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-02-requisitos-seguranca-incorporacao-de-restricoes-legais-normativas-e-contratuais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:incorporacao-de-restricoes-legais-normativas-e-contratuais", "target_type": "Practice"}
832
845
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-02-requisitos-seguranca-intent-declaration-por-tool-call-destrutivo-de-agente-ai", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:intent-declaration-por-tool-call-destrutivo-de-agente-ai", "target_type": "Practice"}
833
846
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-02-requisitos-seguranca-politica-formacao-e-procedimentos-operacionais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:politica-formacao-e-procedimentos-operacionais", "target_type": "Practice"}
834
847
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-02-requisitos-seguranca-rastreabilidade-de-requisitos", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:rastreabilidade-de-requisitos", "target_type": "Practice"}
@@ -840,6 +853,8 @@
840
853
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-02-requisitos-seguranca-validacao-de-tags-sec-lx-e-requisitos-no-pipeline", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:validacao-de-tags-sec-lx-e-requisitos-no-pipeline", "target_type": "Practice"}
841
854
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-02-requisitos-seguranca-validacao-e-aprovacao-final", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:validacao-e-aprovacao-final", "target_type": "Practice"}
842
855
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-02-requisitos-seguranca-validacao-por-requisito-dominio-req-xxx-evidencia", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:validacao-por-requisito-dominio-req-xxx-evidencia", "target_type": "Practice"}
856
+ {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-04-arquitetura-segura-revisao-de-fronteiras-de-confianca-e-integracoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "04-arquitetura-segura:revisao-de-fronteiras-de-confianca-e-integracoes", "target_type": "Practice"}
857
+ {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-04-arquitetura-segura-segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "04-arquitetura-segura:segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "target_type": "Practice"}
843
858
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-05-dependencias-sbom-sca-ai-bom-e-gestao-de-providers-de-modelos-ai-us-14", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "05-dependencias-sbom-sca:ai-bom-e-gestao-de-providers-de-modelos-ai-us-14", "target_type": "Practice"}
844
859
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-05-dependencias-sbom-sca-alertas-sobre-vulnerabilidades-em-componentes-usados", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "05-dependencias-sbom-sca:alertas-sobre-vulnerabilidades-em-componentes-usados", "target_type": "Practice"}
845
860
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-05-dependencias-sbom-sca-auditoria-periodica-de-bibliotecas-copiadas-manualmente", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "05-dependencias-sbom-sca:auditoria-periodica-de-bibliotecas-copiadas-manualmente", "target_type": "Practice"}
@@ -989,15 +1004,25 @@
989
1004
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-13-formacao-onboarding-war-room-e-simulacoes-de-incidentes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "13-formacao-onboarding:war-room-e-simulacoes-de-incidentes", "target_type": "Practice"}
990
1005
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "target_type": "Practice"}
991
1006
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "target_type": "Practice"}
1007
+ {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-clausulas-contratuais-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:clausulas-contratuais-de-seguranca", "target_type": "Practice"}
1008
+ {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-consolidacao-de-kpis-de-governacao-e-maturidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:consolidacao-de-kpis-de-governacao-e-maturidade", "target_type": "Practice"}
1009
+ {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-contratacao-de-provedores-de-modelos-ai-us-21", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:contratacao-de-provedores-de-modelos-ai-us-21", "target_type": "Practice"}
992
1010
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "target_type": "Practice"}
993
1011
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-designacao-formal-de-owners-de-seguranca-por-aplicacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:designacao-formal-de-owners-de-seguranca-por-aplicacao", "target_type": "Practice"}
1012
+ {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-execucao-de-fluxo-formal-de-validacao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:execucao-de-fluxo-formal-de-validacao-de-fornecedores", "target_type": "Practice"}
1013
+ {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-feedback-pos-projeto-e-rating-de-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:feedback-pos-projeto-e-rating-de-contractors", "target_type": "Practice"}
994
1014
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "target_type": "Practice"}
1015
+ {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-kpis-de-governacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:kpis-de-governacao", "target_type": "Practice"}
1016
+ {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "target_type": "Practice"}
1017
+ {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "target_type": "Practice"}
995
1018
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "target_type": "Practice"}
996
1019
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "target_type": "Practice"}
997
1020
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-rastreabilidade-organizacional", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:rastreabilidade-organizacional", "target_type": "Practice"}
1021
+ {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "target_type": "Practice"}
998
1022
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "target_type": "Practice"}
999
1023
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-revisao-trimestral-de-acesso-de-contractors-least-privilege", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:revisao-trimestral-de-acesso-de-contractors-least-privilege", "target_type": "Practice"}
1000
1024
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-trilho-de-formacao-obrigatoria-pre-acesso-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:trilho-de-formacao-obrigatoria-pre-acesso-contractors", "target_type": "Practice"}
1025
+ {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-validacao-continua-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:validacao-continua-de-fornecedores", "target_type": "Practice"}
1001
1026
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-14-governanca-contratacao-validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "target_type": "Practice"}
1002
1027
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.93, "framework_id": "EXT-CRA", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-acc-001", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "ACC-001", "target_type": "Requirement"}
1003
1028
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.93, "framework_id": "EXT-CRA", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-acc-002", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "ACC-002", "target_type": "Requirement"}
@@ -1047,9 +1072,11 @@
1047
1072
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-ctrl-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 07", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "target_type": "Control"}
1048
1073
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-ctrl-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "target_type": "Control"}
1049
1074
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-ctrl-governance-classificacao-e-governacao-por-risco-97aceecf29", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "target_type": "Control"}
1075
+ {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-ctrl-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "target_type": "Control"}
1050
1076
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-ctrl-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "target_type": "Control"}
1051
1077
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-ctrl-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 11", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "target_type": "Control"}
1052
1078
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-ctrl-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "target_type": "Control"}
1079
+ {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-ctrl-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "target_type": "Control"}
1053
1080
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-ctrl-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "target_type": "Control"}
1054
1081
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-ctrl-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "target_type": "Control"}
1055
1082
  {"authority_class": "external_normative_overlay", "citation": "Ciclo de Vida Seguro", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-ciclo-de-vida-seguro-ctrl-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-ciclo-de-vida-seguro", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [1], "target_id": "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "target_type": "Control"}
@@ -1389,7 +1416,7 @@
1389
1416
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-02-requisitos-seguranca-gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "02-requisitos-seguranca:gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "target_type": "Practice"}
1390
1417
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-02-requisitos-seguranca-geracao-de-sbom-e-assinatura-de-artefactos-de-build", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "02-requisitos-seguranca:geracao-de-sbom-e-assinatura-de-artefactos-de-build", "target_type": "Practice"}
1391
1418
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-02-requisitos-seguranca-gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "02-requisitos-seguranca:gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "target_type": "Practice"}
1392
- {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-02-requisitos-seguranca-incorporacao-de-restricoes-legais-normativas-e-contratuais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "02-requisitos-seguranca:incorporacao-de-restricoes-legais-normativas-e-contratuais", "target_type": "Practice"}
1419
+ {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-02-requisitos-seguranca-incorporacao-de-restricoes-legais-normativas-e-contratuais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "02-requisitos-seguranca:incorporacao-de-restricoes-legais-normativas-e-contratuais", "target_type": "Practice"}
1393
1420
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-02-requisitos-seguranca-intent-declaration-por-tool-call-destrutivo-de-agente-ai", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "02-requisitos-seguranca:intent-declaration-por-tool-call-destrutivo-de-agente-ai", "target_type": "Practice"}
1394
1421
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-02-requisitos-seguranca-politica-formacao-e-procedimentos-operacionais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "02-requisitos-seguranca:politica-formacao-e-procedimentos-operacionais", "target_type": "Practice"}
1395
1422
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-02-requisitos-seguranca-rastreabilidade-de-requisitos", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "02-requisitos-seguranca:rastreabilidade-de-requisitos", "target_type": "Practice"}
@@ -1401,6 +1428,8 @@
1401
1428
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-02-requisitos-seguranca-validacao-de-tags-sec-lx-e-requisitos-no-pipeline", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "02-requisitos-seguranca:validacao-de-tags-sec-lx-e-requisitos-no-pipeline", "target_type": "Practice"}
1402
1429
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-02-requisitos-seguranca-validacao-e-aprovacao-final", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "02-requisitos-seguranca:validacao-e-aprovacao-final", "target_type": "Practice"}
1403
1430
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-02-requisitos-seguranca-validacao-por-requisito-dominio-req-xxx-evidencia", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "02-requisitos-seguranca:validacao-por-requisito-dominio-req-xxx-evidencia", "target_type": "Practice"}
1431
+ {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-04-arquitetura-segura-revisao-de-fronteiras-de-confianca-e-integracoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "04-arquitetura-segura:revisao-de-fronteiras-de-confianca-e-integracoes", "target_type": "Practice"}
1432
+ {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-04-arquitetura-segura-segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "04-arquitetura-segura:segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "target_type": "Practice"}
1404
1433
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-05-dependencias-sbom-sca-ai-bom-e-gestao-de-providers-de-modelos-ai-us-14", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "05-dependencias-sbom-sca:ai-bom-e-gestao-de-providers-de-modelos-ai-us-14", "target_type": "Practice"}
1405
1434
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-05-dependencias-sbom-sca-alertas-sobre-vulnerabilidades-em-componentes-usados", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "05-dependencias-sbom-sca:alertas-sobre-vulnerabilidades-em-componentes-usados", "target_type": "Practice"}
1406
1435
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-05-dependencias-sbom-sca-auditoria-periodica-de-bibliotecas-copiadas-manualmente", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "05-dependencias-sbom-sca:auditoria-periodica-de-bibliotecas-copiadas-manualmente", "target_type": "Practice"}
@@ -1515,25 +1544,25 @@
1515
1544
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.97, "framework_id": "EXT-CRA", "justification": "curated_playbook_table", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao", "mapping_type": "obligation_maps_to_bundle", "matched_label": "Cap. 14", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao", "target_type": "KnowledgeBundle"}
1516
1545
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "target_type": "Practice"}
1517
1546
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "target_type": "Practice"}
1518
- {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-clausulas-contratuais-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:clausulas-contratuais-de-seguranca", "target_type": "Practice"}
1519
- {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-consolidacao-de-kpis-de-governacao-e-maturidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:consolidacao-de-kpis-de-governacao-e-maturidade", "target_type": "Practice"}
1520
- {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-contratacao-de-provedores-de-modelos-ai-us-21", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:contratacao-de-provedores-de-modelos-ai-us-21", "target_type": "Practice"}
1547
+ {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-clausulas-contratuais-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:clausulas-contratuais-de-seguranca", "target_type": "Practice"}
1548
+ {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-consolidacao-de-kpis-de-governacao-e-maturidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:consolidacao-de-kpis-de-governacao-e-maturidade", "target_type": "Practice"}
1549
+ {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-contratacao-de-provedores-de-modelos-ai-us-21", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:contratacao-de-provedores-de-modelos-ai-us-21", "target_type": "Practice"}
1521
1550
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "target_type": "Practice"}
1522
1551
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-designacao-formal-de-owners-de-seguranca-por-aplicacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:designacao-formal-de-owners-de-seguranca-por-aplicacao", "target_type": "Practice"}
1523
- {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-execucao-de-fluxo-formal-de-validacao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:execucao-de-fluxo-formal-de-validacao-de-fornecedores", "target_type": "Practice"}
1524
- {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-feedback-pos-projeto-e-rating-de-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:feedback-pos-projeto-e-rating-de-contractors", "target_type": "Practice"}
1552
+ {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-execucao-de-fluxo-formal-de-validacao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:execucao-de-fluxo-formal-de-validacao-de-fornecedores", "target_type": "Practice"}
1553
+ {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-feedback-pos-projeto-e-rating-de-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:feedback-pos-projeto-e-rating-de-contractors", "target_type": "Practice"}
1525
1554
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "target_type": "Practice"}
1526
- {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-kpis-de-governacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:kpis-de-governacao", "target_type": "Practice"}
1527
- {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "target_type": "Practice"}
1528
- {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "target_type": "Practice"}
1555
+ {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-kpis-de-governacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:kpis-de-governacao", "target_type": "Practice"}
1556
+ {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "target_type": "Practice"}
1557
+ {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "target_type": "Practice"}
1529
1558
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "target_type": "Practice"}
1530
1559
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "target_type": "Practice"}
1531
1560
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-rastreabilidade-organizacional", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:rastreabilidade-organizacional", "target_type": "Practice"}
1532
- {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "target_type": "Practice"}
1561
+ {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "target_type": "Practice"}
1533
1562
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "target_type": "Practice"}
1534
1563
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-revisao-trimestral-de-acesso-de-contractors-least-privilege", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:revisao-trimestral-de-acesso-de-contractors-least-privilege", "target_type": "Practice"}
1535
1564
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-trilho-de-formacao-obrigatoria-pre-acesso-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:trilho-de-formacao-obrigatoria-pre-acesso-contractors", "target_type": "Practice"}
1536
- {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-validacao-continua-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:validacao-continua-de-fornecedores", "target_type": "Practice"}
1565
+ {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-validacao-continua-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:validacao-continua-de-fornecedores", "target_type": "Practice"}
1537
1566
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.87, "framework_id": "EXT-CRA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-14-governanca-contratacao-validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "14-governanca-contratacao:validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "target_type": "Practice"}
1538
1567
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.93, "framework_id": "EXT-CRA", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-cra-obl-excecoes-acc-001", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "ACC-001", "target_type": "Requirement"}
1539
1568
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.93, "framework_id": "EXT-CRA", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-cra-obl-excecoes-acc-002", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "ACC-002", "target_type": "Requirement"}
@@ -1572,9 +1601,10 @@
1572
1601
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-ctrl-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "target_type": "Control"}
1573
1602
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-ctrl-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "target_type": "Control"}
1574
1603
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-ctrl-governance-classificacao-e-governacao-por-risco-97aceecf29", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "target_type": "Control"}
1575
- {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-ctrl-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 14", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "target_type": "Control"}
1604
+ {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-ctrl-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "target_type": "Control"}
1576
1605
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-ctrl-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "target_type": "Control"}
1577
1606
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-ctrl-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "target_type": "Control"}
1607
+ {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-ctrl-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "target_type": "Control"}
1578
1608
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-ctrl-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "target_type": "Control"}
1579
1609
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-ctrl-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "target_type": "Control"}
1580
1610
  {"authority_class": "external_normative_overlay", "citation": "Exceções", "confidence": 0.9, "framework_id": "EXT-CRA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-cra-obl-excecoes-ctrl-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-CRA-OBL-excecoes", "playbook_id": "OVR-CRA-playbook", "source_document_id": "002-cross-check-normativo-cra-02-playbook", "source_lines": [7], "target_id": "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "target_type": "Control"}
@@ -2670,7 +2700,7 @@
2670
2700
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-02-requisitos-seguranca-gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 01", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "target_type": "Practice"}
2671
2701
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-02-requisitos-seguranca-geracao-de-sbom-e-assinatura-de-artefactos-de-build", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:geracao-de-sbom-e-assinatura-de-artefactos-de-build", "target_type": "Practice"}
2672
2702
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-02-requisitos-seguranca-gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "target_type": "Practice"}
2673
- {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-02-requisitos-seguranca-incorporacao-de-restricoes-legais-normativas-e-contratuais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:incorporacao-de-restricoes-legais-normativas-e-contratuais", "target_type": "Practice"}
2703
+ {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-02-requisitos-seguranca-incorporacao-de-restricoes-legais-normativas-e-contratuais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:incorporacao-de-restricoes-legais-normativas-e-contratuais", "target_type": "Practice"}
2674
2704
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-02-requisitos-seguranca-intent-declaration-por-tool-call-destrutivo-de-agente-ai", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 01", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:intent-declaration-por-tool-call-destrutivo-de-agente-ai", "target_type": "Practice"}
2675
2705
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-02-requisitos-seguranca-politica-formacao-e-procedimentos-operacionais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:politica-formacao-e-procedimentos-operacionais", "target_type": "Practice"}
2676
2706
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-02-requisitos-seguranca-rastreabilidade-de-requisitos", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 01", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:rastreabilidade-de-requisitos", "target_type": "Practice"}
@@ -2682,6 +2712,8 @@
2682
2712
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-02-requisitos-seguranca-validacao-de-tags-sec-lx-e-requisitos-no-pipeline", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:validacao-de-tags-sec-lx-e-requisitos-no-pipeline", "target_type": "Practice"}
2683
2713
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-02-requisitos-seguranca-validacao-e-aprovacao-final", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:validacao-e-aprovacao-final", "target_type": "Practice"}
2684
2714
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-02-requisitos-seguranca-validacao-por-requisito-dominio-req-xxx-evidencia", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:validacao-por-requisito-dominio-req-xxx-evidencia", "target_type": "Practice"}
2715
+ {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-04-arquitetura-segura-revisao-de-fronteiras-de-confianca-e-integracoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "04-arquitetura-segura:revisao-de-fronteiras-de-confianca-e-integracoes", "target_type": "Practice"}
2716
+ {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-04-arquitetura-segura-segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "04-arquitetura-segura:segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "target_type": "Practice"}
2685
2717
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-05-dependencias-sbom-sca-ai-bom-e-gestao-de-providers-de-modelos-ai-us-14", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "05-dependencias-sbom-sca:ai-bom-e-gestao-de-providers-de-modelos-ai-us-14", "target_type": "Practice"}
2686
2718
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-05-dependencias-sbom-sca-alertas-sobre-vulnerabilidades-em-componentes-usados", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "05-dependencias-sbom-sca:alertas-sobre-vulnerabilidades-em-componentes-usados", "target_type": "Practice"}
2687
2719
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-05-dependencias-sbom-sca-auditoria-periodica-de-bibliotecas-copiadas-manualmente", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "05-dependencias-sbom-sca:auditoria-periodica-de-bibliotecas-copiadas-manualmente", "target_type": "Practice"}
@@ -2796,25 +2828,25 @@
2796
2828
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.97, "framework_id": "EXT-DORA", "justification": "curated_playbook_table", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao", "mapping_type": "obligation_maps_to_bundle", "matched_label": "Cap. 14", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao", "target_type": "KnowledgeBundle"}
2797
2829
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "target_type": "Practice"}
2798
2830
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "target_type": "Practice"}
2799
- {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-clausulas-contratuais-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:clausulas-contratuais-de-seguranca", "target_type": "Practice"}
2800
- {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-consolidacao-de-kpis-de-governacao-e-maturidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:consolidacao-de-kpis-de-governacao-e-maturidade", "target_type": "Practice"}
2801
- {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-contratacao-de-provedores-de-modelos-ai-us-21", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:contratacao-de-provedores-de-modelos-ai-us-21", "target_type": "Practice"}
2831
+ {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-clausulas-contratuais-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:clausulas-contratuais-de-seguranca", "target_type": "Practice"}
2832
+ {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-consolidacao-de-kpis-de-governacao-e-maturidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:consolidacao-de-kpis-de-governacao-e-maturidade", "target_type": "Practice"}
2833
+ {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-contratacao-de-provedores-de-modelos-ai-us-21", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:contratacao-de-provedores-de-modelos-ai-us-21", "target_type": "Practice"}
2802
2834
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "target_type": "Practice"}
2803
2835
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-designacao-formal-de-owners-de-seguranca-por-aplicacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:designacao-formal-de-owners-de-seguranca-por-aplicacao", "target_type": "Practice"}
2804
- {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-execucao-de-fluxo-formal-de-validacao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:execucao-de-fluxo-formal-de-validacao-de-fornecedores", "target_type": "Practice"}
2805
- {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-feedback-pos-projeto-e-rating-de-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:feedback-pos-projeto-e-rating-de-contractors", "target_type": "Practice"}
2836
+ {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-execucao-de-fluxo-formal-de-validacao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:execucao-de-fluxo-formal-de-validacao-de-fornecedores", "target_type": "Practice"}
2837
+ {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-feedback-pos-projeto-e-rating-de-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:feedback-pos-projeto-e-rating-de-contractors", "target_type": "Practice"}
2806
2838
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "target_type": "Practice"}
2807
- {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-kpis-de-governacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:kpis-de-governacao", "target_type": "Practice"}
2808
- {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "target_type": "Practice"}
2809
- {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "target_type": "Practice"}
2839
+ {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-kpis-de-governacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:kpis-de-governacao", "target_type": "Practice"}
2840
+ {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "target_type": "Practice"}
2841
+ {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "target_type": "Practice"}
2810
2842
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "target_type": "Practice"}
2811
2843
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "target_type": "Practice"}
2812
2844
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-rastreabilidade-organizacional", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:rastreabilidade-organizacional", "target_type": "Practice"}
2813
- {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "target_type": "Practice"}
2845
+ {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "target_type": "Practice"}
2814
2846
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "target_type": "Practice"}
2815
2847
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-revisao-trimestral-de-acesso-de-contractors-least-privilege", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:revisao-trimestral-de-acesso-de-contractors-least-privilege", "target_type": "Practice"}
2816
2848
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-trilho-de-formacao-obrigatoria-pre-acesso-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:trilho-de-formacao-obrigatoria-pre-acesso-contractors", "target_type": "Practice"}
2817
- {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-validacao-continua-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:validacao-continua-de-fornecedores", "target_type": "Practice"}
2849
+ {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-validacao-continua-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:validacao-continua-de-fornecedores", "target_type": "Practice"}
2818
2850
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-6-14-governanca-contratacao-validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "target_type": "Practice"}
2819
2851
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.93, "framework_id": "EXT-DORA", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-dora-obl-6-acc-001", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "ACC-001", "target_type": "Requirement"}
2820
2852
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.93, "framework_id": "EXT-DORA", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-dora-obl-6-acc-002", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "ACC-002", "target_type": "Requirement"}
@@ -2861,9 +2893,10 @@
2861
2893
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-6-ctrl-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "target_type": "Control"}
2862
2894
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-6-ctrl-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "target_type": "Control"}
2863
2895
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-6-ctrl-governance-classificacao-e-governacao-por-risco-97aceecf29", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 01", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "target_type": "Control"}
2864
- {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-6-ctrl-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 14", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "target_type": "Control"}
2896
+ {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-6-ctrl-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "target_type": "Control"}
2865
2897
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-6-ctrl-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "target_type": "Control"}
2866
2898
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-6-ctrl-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "target_type": "Control"}
2899
+ {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-6-ctrl-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "target_type": "Control"}
2867
2900
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-6-ctrl-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "target_type": "Control"}
2868
2901
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-6-ctrl-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "target_type": "Control"}
2869
2902
  {"authority_class": "external_normative_overlay", "citation": "6", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-6-ctrl-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-6", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [2], "target_id": "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "target_type": "Control"}
@@ -3103,6 +3136,7 @@
3103
3136
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-02-requisitos-seguranca-gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "02-requisitos-seguranca:gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "target_type": "Practice"}
3104
3137
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-02-requisitos-seguranca-geracao-de-sbom-e-assinatura-de-artefactos-de-build", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "02-requisitos-seguranca:geracao-de-sbom-e-assinatura-de-artefactos-de-build", "target_type": "Practice"}
3105
3138
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-02-requisitos-seguranca-gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "02-requisitos-seguranca:gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "target_type": "Practice"}
3139
+ {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-02-requisitos-seguranca-incorporacao-de-restricoes-legais-normativas-e-contratuais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "02-requisitos-seguranca:incorporacao-de-restricoes-legais-normativas-e-contratuais", "target_type": "Practice"}
3106
3140
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-02-requisitos-seguranca-intent-declaration-por-tool-call-destrutivo-de-agente-ai", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "02-requisitos-seguranca:intent-declaration-por-tool-call-destrutivo-de-agente-ai", "target_type": "Practice"}
3107
3141
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-02-requisitos-seguranca-politica-formacao-e-procedimentos-operacionais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "02-requisitos-seguranca:politica-formacao-e-procedimentos-operacionais", "target_type": "Practice"}
3108
3142
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-02-requisitos-seguranca-rastreabilidade-de-requisitos", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "02-requisitos-seguranca:rastreabilidade-de-requisitos", "target_type": "Practice"}
@@ -3130,6 +3164,8 @@
3130
3164
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-03-threat-modeling-tratamento-explicito-dos-riscos-de-processo-do-threat-modeling", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 03", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "03-threat-modeling:tratamento-explicito-dos-riscos-de-processo-do-threat-modeling", "target_type": "Practice"}
3131
3165
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-03-threat-modeling-validacao-de-arquitetura-com-threat-modeling", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 03", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "03-threat-modeling:validacao-de-arquitetura-com-threat-modeling", "target_type": "Practice"}
3132
3166
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-03-threat-modeling-validacao-de-impacto-no-negocio", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 03", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "03-threat-modeling:validacao-de-impacto-no-negocio", "target_type": "Practice"}
3167
+ {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-04-arquitetura-segura-revisao-de-fronteiras-de-confianca-e-integracoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "04-arquitetura-segura:revisao-de-fronteiras-de-confianca-e-integracoes", "target_type": "Practice"}
3168
+ {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-04-arquitetura-segura-segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "04-arquitetura-segura:segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "target_type": "Practice"}
3133
3169
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.97, "framework_id": "EXT-DORA", "justification": "curated_playbook_table", "mapping_id": "MAP-ext-dora-obl-8-15-05-dependencias-sbom-sca", "mapping_type": "obligation_maps_to_bundle", "matched_label": "Cap. 05", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "05-dependencias-sbom-sca", "target_type": "KnowledgeBundle"}
3134
3170
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-05-dependencias-sbom-sca-ai-bom-e-gestao-de-providers-de-modelos-ai-us-14", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "05-dependencias-sbom-sca:ai-bom-e-gestao-de-providers-de-modelos-ai-us-14", "target_type": "Practice"}
3135
3171
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-05-dependencias-sbom-sca-alertas-sobre-vulnerabilidades-em-componentes-usados", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "05-dependencias-sbom-sca:alertas-sobre-vulnerabilidades-em-componentes-usados", "target_type": "Practice"}
@@ -3282,15 +3318,25 @@
3282
3318
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-13-formacao-onboarding-war-room-e-simulacoes-de-incidentes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "13-formacao-onboarding:war-room-e-simulacoes-de-incidentes", "target_type": "Practice"}
3283
3319
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "target_type": "Practice"}
3284
3320
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "target_type": "Practice"}
3321
+ {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-clausulas-contratuais-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:clausulas-contratuais-de-seguranca", "target_type": "Practice"}
3322
+ {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-consolidacao-de-kpis-de-governacao-e-maturidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:consolidacao-de-kpis-de-governacao-e-maturidade", "target_type": "Practice"}
3323
+ {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-contratacao-de-provedores-de-modelos-ai-us-21", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:contratacao-de-provedores-de-modelos-ai-us-21", "target_type": "Practice"}
3285
3324
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "target_type": "Practice"}
3286
3325
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-designacao-formal-de-owners-de-seguranca-por-aplicacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:designacao-formal-de-owners-de-seguranca-por-aplicacao", "target_type": "Practice"}
3326
+ {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-execucao-de-fluxo-formal-de-validacao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:execucao-de-fluxo-formal-de-validacao-de-fornecedores", "target_type": "Practice"}
3327
+ {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-feedback-pos-projeto-e-rating-de-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:feedback-pos-projeto-e-rating-de-contractors", "target_type": "Practice"}
3287
3328
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "target_type": "Practice"}
3329
+ {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-kpis-de-governacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:kpis-de-governacao", "target_type": "Practice"}
3330
+ {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "target_type": "Practice"}
3331
+ {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "target_type": "Practice"}
3288
3332
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "target_type": "Practice"}
3289
3333
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "target_type": "Practice"}
3290
3334
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-rastreabilidade-organizacional", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:rastreabilidade-organizacional", "target_type": "Practice"}
3335
+ {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "target_type": "Practice"}
3291
3336
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "target_type": "Practice"}
3292
3337
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-revisao-trimestral-de-acesso-de-contractors-least-privilege", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:revisao-trimestral-de-acesso-de-contractors-least-privilege", "target_type": "Practice"}
3293
3338
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-trilho-de-formacao-obrigatoria-pre-acesso-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:trilho-de-formacao-obrigatoria-pre-acesso-contractors", "target_type": "Practice"}
3339
+ {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-validacao-continua-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:validacao-continua-de-fornecedores", "target_type": "Practice"}
3294
3340
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.87, "framework_id": "EXT-DORA", "justification": "control_practice_projection", "mapping_id": "MAP-ext-dora-obl-8-15-14-governanca-contratacao-validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "14-governanca-contratacao:validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "target_type": "Practice"}
3295
3341
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.93, "framework_id": "EXT-DORA", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-dora-obl-8-15-acc-001", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "ACC-001", "target_type": "Requirement"}
3296
3342
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.93, "framework_id": "EXT-DORA", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-dora-obl-8-15-acc-002", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "ACC-002", "target_type": "Requirement"}
@@ -3340,10 +3386,12 @@
3340
3386
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-8-15-ctrl-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 07", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "target_type": "Control"}
3341
3387
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-8-15-ctrl-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "target_type": "Control"}
3342
3388
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-8-15-ctrl-governance-classificacao-e-governacao-por-risco-97aceecf29", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "target_type": "Control"}
3389
+ {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-8-15-ctrl-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "target_type": "Control"}
3343
3390
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-8-15-ctrl-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 03", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0", "target_type": "Control"}
3344
3391
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-8-15-ctrl-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "target_type": "Control"}
3345
3392
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-8-15-ctrl-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 11", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "target_type": "Control"}
3346
3393
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-8-15-ctrl-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "target_type": "Control"}
3394
+ {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-8-15-ctrl-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "target_type": "Control"}
3347
3395
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-8-15-ctrl-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "target_type": "Control"}
3348
3396
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-8-15-ctrl-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "target_type": "Control"}
3349
3397
  {"authority_class": "external_normative_overlay", "citation": "8–15", "confidence": 0.9, "framework_id": "EXT-DORA", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-dora-obl-8-15-ctrl-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-DORA-OBL-8-15", "playbook_id": "OVR-DORA-playbook", "source_document_id": "002-cross-check-normativo-dora-02-playbook", "source_lines": [3], "target_id": "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "target_type": "Control"}
@@ -3868,7 +3916,7 @@
3868
3916
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-02-requisitos-seguranca-gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 01", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "target_type": "Practice"}
3869
3917
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-02-requisitos-seguranca-geracao-de-sbom-e-assinatura-de-artefactos-de-build", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:geracao-de-sbom-e-assinatura-de-artefactos-de-build", "target_type": "Practice"}
3870
3918
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-02-requisitos-seguranca-gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "target_type": "Practice"}
3871
- {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-02-requisitos-seguranca-incorporacao-de-restricoes-legais-normativas-e-contratuais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:incorporacao-de-restricoes-legais-normativas-e-contratuais", "target_type": "Practice"}
3919
+ {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-02-requisitos-seguranca-incorporacao-de-restricoes-legais-normativas-e-contratuais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:incorporacao-de-restricoes-legais-normativas-e-contratuais", "target_type": "Practice"}
3872
3920
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-02-requisitos-seguranca-intent-declaration-por-tool-call-destrutivo-de-agente-ai", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 01", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:intent-declaration-por-tool-call-destrutivo-de-agente-ai", "target_type": "Practice"}
3873
3921
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-02-requisitos-seguranca-politica-formacao-e-procedimentos-operacionais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:politica-formacao-e-procedimentos-operacionais", "target_type": "Practice"}
3874
3922
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-02-requisitos-seguranca-rastreabilidade-de-requisitos", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 01", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "02-requisitos-seguranca:rastreabilidade-de-requisitos", "target_type": "Practice"}
@@ -3896,6 +3944,8 @@
3896
3944
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-03-threat-modeling-tratamento-explicito-dos-riscos-de-processo-do-threat-modeling", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 03", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "03-threat-modeling:tratamento-explicito-dos-riscos-de-processo-do-threat-modeling", "target_type": "Practice"}
3897
3945
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-03-threat-modeling-validacao-de-arquitetura-com-threat-modeling", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 03", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "03-threat-modeling:validacao-de-arquitetura-com-threat-modeling", "target_type": "Practice"}
3898
3946
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-03-threat-modeling-validacao-de-impacto-no-negocio", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 03", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "03-threat-modeling:validacao-de-impacto-no-negocio", "target_type": "Practice"}
3947
+ {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-04-arquitetura-segura-revisao-de-fronteiras-de-confianca-e-integracoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "04-arquitetura-segura:revisao-de-fronteiras-de-confianca-e-integracoes", "target_type": "Practice"}
3948
+ {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-04-arquitetura-segura-segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "04-arquitetura-segura:segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "target_type": "Practice"}
3899
3949
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.97, "framework_id": "EXT-NIS2", "justification": "curated_playbook_table", "mapping_id": "MAP-ext-nis2-obl-21-05-dependencias-sbom-sca", "mapping_type": "obligation_maps_to_bundle", "matched_label": "Cap. 05", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "05-dependencias-sbom-sca", "target_type": "KnowledgeBundle"}
3900
3950
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-05-dependencias-sbom-sca-ai-bom-e-gestao-de-providers-de-modelos-ai-us-14", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "05-dependencias-sbom-sca:ai-bom-e-gestao-de-providers-de-modelos-ai-us-14", "target_type": "Practice"}
3901
3951
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-05-dependencias-sbom-sca-alertas-sobre-vulnerabilidades-em-componentes-usados", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "05-dependencias-sbom-sca:alertas-sobre-vulnerabilidades-em-componentes-usados", "target_type": "Practice"}
@@ -4059,25 +4109,25 @@
4059
4109
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.97, "framework_id": "EXT-NIS2", "justification": "curated_playbook_table", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao", "mapping_type": "obligation_maps_to_bundle", "matched_label": "Cap. 14", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao", "target_type": "KnowledgeBundle"}
4060
4110
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "target_type": "Practice"}
4061
4111
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "target_type": "Practice"}
4062
- {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-clausulas-contratuais-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:clausulas-contratuais-de-seguranca", "target_type": "Practice"}
4063
- {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-consolidacao-de-kpis-de-governacao-e-maturidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:consolidacao-de-kpis-de-governacao-e-maturidade", "target_type": "Practice"}
4064
- {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-contratacao-de-provedores-de-modelos-ai-us-21", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:contratacao-de-provedores-de-modelos-ai-us-21", "target_type": "Practice"}
4112
+ {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-clausulas-contratuais-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:clausulas-contratuais-de-seguranca", "target_type": "Practice"}
4113
+ {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-consolidacao-de-kpis-de-governacao-e-maturidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:consolidacao-de-kpis-de-governacao-e-maturidade", "target_type": "Practice"}
4114
+ {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-contratacao-de-provedores-de-modelos-ai-us-21", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:contratacao-de-provedores-de-modelos-ai-us-21", "target_type": "Practice"}
4065
4115
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "target_type": "Practice"}
4066
4116
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-designacao-formal-de-owners-de-seguranca-por-aplicacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:designacao-formal-de-owners-de-seguranca-por-aplicacao", "target_type": "Practice"}
4067
- {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-execucao-de-fluxo-formal-de-validacao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:execucao-de-fluxo-formal-de-validacao-de-fornecedores", "target_type": "Practice"}
4068
- {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-feedback-pos-projeto-e-rating-de-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:feedback-pos-projeto-e-rating-de-contractors", "target_type": "Practice"}
4117
+ {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-execucao-de-fluxo-formal-de-validacao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:execucao-de-fluxo-formal-de-validacao-de-fornecedores", "target_type": "Practice"}
4118
+ {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-feedback-pos-projeto-e-rating-de-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:feedback-pos-projeto-e-rating-de-contractors", "target_type": "Practice"}
4069
4119
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "target_type": "Practice"}
4070
- {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-kpis-de-governacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:kpis-de-governacao", "target_type": "Practice"}
4071
- {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "target_type": "Practice"}
4072
- {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "target_type": "Practice"}
4120
+ {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-kpis-de-governacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:kpis-de-governacao", "target_type": "Practice"}
4121
+ {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "target_type": "Practice"}
4122
+ {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "target_type": "Practice"}
4073
4123
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "target_type": "Practice"}
4074
4124
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "target_type": "Practice"}
4075
4125
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-rastreabilidade-organizacional", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:rastreabilidade-organizacional", "target_type": "Practice"}
4076
- {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "target_type": "Practice"}
4126
+ {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "target_type": "Practice"}
4077
4127
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "target_type": "Practice"}
4078
4128
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-revisao-trimestral-de-acesso-de-contractors-least-privilege", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:revisao-trimestral-de-acesso-de-contractors-least-privilege", "target_type": "Practice"}
4079
4129
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-trilho-de-formacao-obrigatoria-pre-acesso-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:trilho-de-formacao-obrigatoria-pre-acesso-contractors", "target_type": "Practice"}
4080
- {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-validacao-continua-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 14", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:validacao-continua-de-fornecedores", "target_type": "Practice"}
4130
+ {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-validacao-continua-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:validacao-continua-de-fornecedores", "target_type": "Practice"}
4081
4131
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.87, "framework_id": "EXT-NIS2", "justification": "control_practice_projection", "mapping_id": "MAP-ext-nis2-obl-21-14-governanca-contratacao-validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "14-governanca-contratacao:validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "target_type": "Practice"}
4082
4132
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.93, "framework_id": "EXT-NIS2", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-nis2-obl-21-acc-001", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "ACC-001", "target_type": "Requirement"}
4083
4133
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.93, "framework_id": "EXT-NIS2", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-nis2-obl-21-acc-002", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "ACC-002", "target_type": "Requirement"}
@@ -4135,10 +4185,11 @@
4135
4185
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.9, "framework_id": "EXT-NIS2", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-nis2-obl-21-ctrl-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 07", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "target_type": "Control"}
4136
4186
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.9, "framework_id": "EXT-NIS2", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-nis2-obl-21-ctrl-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "target_type": "Control"}
4137
4187
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.9, "framework_id": "EXT-NIS2", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-nis2-obl-21-ctrl-governance-classificacao-e-governacao-por-risco-97aceecf29", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 01", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "target_type": "Control"}
4138
- {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.9, "framework_id": "EXT-NIS2", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-nis2-obl-21-ctrl-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 14", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "target_type": "Control"}
4188
+ {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.9, "framework_id": "EXT-NIS2", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-nis2-obl-21-ctrl-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "target_type": "Control"}
4139
4189
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.9, "framework_id": "EXT-NIS2", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-nis2-obl-21-ctrl-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 03", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0", "target_type": "Control"}
4140
4190
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.9, "framework_id": "EXT-NIS2", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-nis2-obl-21-ctrl-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "target_type": "Control"}
4141
4191
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.9, "framework_id": "EXT-NIS2", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-nis2-obl-21-ctrl-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "target_type": "Control"}
4192
+ {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.9, "framework_id": "EXT-NIS2", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-nis2-obl-21-ctrl-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "target_type": "Control"}
4142
4193
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.9, "framework_id": "EXT-NIS2", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-nis2-obl-21-ctrl-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "target_type": "Control"}
4143
4194
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.9, "framework_id": "EXT-NIS2", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-nis2-obl-21-ctrl-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "target_type": "Control"}
4144
4195
  {"authority_class": "external_normative_overlay", "citation": "21", "confidence": 0.9, "framework_id": "EXT-NIS2", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-nis2-obl-21-ctrl-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-NIS2-OBL-21", "playbook_id": "OVR-NIS2-playbook", "source_document_id": "002-cross-check-normativo-nis2-02-playbook", "source_lines": [2], "target_id": "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "target_type": "Control"}
@@ -5107,6 +5158,7 @@
5107
5158
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-02-requisitos-seguranca-gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "02-requisitos-seguranca:gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "target_type": "Practice"}
5108
5159
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-02-requisitos-seguranca-geracao-de-sbom-e-assinatura-de-artefactos-de-build", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "02-requisitos-seguranca:geracao-de-sbom-e-assinatura-de-artefactos-de-build", "target_type": "Practice"}
5109
5160
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-02-requisitos-seguranca-gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "02-requisitos-seguranca:gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "target_type": "Practice"}
5161
+ {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-02-requisitos-seguranca-incorporacao-de-restricoes-legais-normativas-e-contratuais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "02-requisitos-seguranca:incorporacao-de-restricoes-legais-normativas-e-contratuais", "target_type": "Practice"}
5110
5162
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-02-requisitos-seguranca-intent-declaration-por-tool-call-destrutivo-de-agente-ai", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "02-requisitos-seguranca:intent-declaration-por-tool-call-destrutivo-de-agente-ai", "target_type": "Practice"}
5111
5163
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-02-requisitos-seguranca-politica-formacao-e-procedimentos-operacionais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "02-requisitos-seguranca:politica-formacao-e-procedimentos-operacionais", "target_type": "Practice"}
5112
5164
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-02-requisitos-seguranca-rastreabilidade-de-requisitos", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "02-requisitos-seguranca:rastreabilidade-de-requisitos", "target_type": "Practice"}
@@ -5130,10 +5182,10 @@
5130
5182
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-04-arquitetura-segura-identificacao-e-governacao-de-componentes-nao-deterministicos", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:identificacao-e-governacao-de-componentes-nao-deterministicos", "target_type": "Practice"}
5131
5183
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-04-arquitetura-segura-padroes-arquitetonicos-para-sistemas-ai-ml-nao-agentic", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:padroes-arquitetonicos-para-sistemas-ai-ml-nao-agentic", "target_type": "Practice"}
5132
5184
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-04-arquitetura-segura-revisao-de-arquitectura-para-agente-ai-em-a2-us-16", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:revisao-de-arquitectura-para-agente-ai-em-a2-us-16", "target_type": "Practice"}
5133
- {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-04-arquitetura-segura-revisao-de-fronteiras-de-confianca-e-integracoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:revisao-de-fronteiras-de-confianca-e-integracoes", "target_type": "Practice"}
5185
+ {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-04-arquitetura-segura-revisao-de-fronteiras-de-confianca-e-integracoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:revisao-de-fronteiras-de-confianca-e-integracoes", "target_type": "Practice"}
5134
5186
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-04-arquitetura-segura-revisao-formal-de-arquitetura-para-l3-governacao-reforcada", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:revisao-formal-de-arquitetura-para-l3-governacao-reforcada", "target_type": "Practice"}
5135
5187
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-04-arquitetura-segura-revisao-formal-do-design-arquitetural", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:revisao-formal-do-design-arquitetural", "target_type": "Practice"}
5136
- {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-04-arquitetura-segura-segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "target_type": "Practice"}
5188
+ {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-04-arquitetura-segura-segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "target_type": "Practice"}
5137
5189
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-04-arquitetura-segura-sincronizacao-threat-modeling-arquitetura", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:sincronizacao-threat-modeling-arquitetura", "target_type": "Practice"}
5138
5190
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-04-arquitetura-segura-triggers-de-arquitetura-viva-e-disciplina-de-revisao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:triggers-de-arquitetura-viva-e-disciplina-de-revisao", "target_type": "Practice"}
5139
5191
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-04-arquitetura-segura-validacao-arquitetural-automatizavel-no-ci-cd-quando-aplicavel", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "04-arquitetura-segura:validacao-arquitetural-automatizavel-no-ci-cd-quando-aplicavel", "target_type": "Practice"}
@@ -5275,15 +5327,25 @@
5275
5327
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-13-formacao-onboarding-war-room-e-simulacoes-de-incidentes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "13-formacao-onboarding:war-room-e-simulacoes-de-incidentes", "target_type": "Practice"}
5276
5328
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "target_type": "Practice"}
5277
5329
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "target_type": "Practice"}
5330
+ {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-clausulas-contratuais-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:clausulas-contratuais-de-seguranca", "target_type": "Practice"}
5331
+ {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-consolidacao-de-kpis-de-governacao-e-maturidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:consolidacao-de-kpis-de-governacao-e-maturidade", "target_type": "Practice"}
5332
+ {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-contratacao-de-provedores-de-modelos-ai-us-21", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:contratacao-de-provedores-de-modelos-ai-us-21", "target_type": "Practice"}
5278
5333
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "target_type": "Practice"}
5279
5334
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-designacao-formal-de-owners-de-seguranca-por-aplicacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:designacao-formal-de-owners-de-seguranca-por-aplicacao", "target_type": "Practice"}
5335
+ {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-execucao-de-fluxo-formal-de-validacao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:execucao-de-fluxo-formal-de-validacao-de-fornecedores", "target_type": "Practice"}
5336
+ {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-feedback-pos-projeto-e-rating-de-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:feedback-pos-projeto-e-rating-de-contractors", "target_type": "Practice"}
5280
5337
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "target_type": "Practice"}
5338
+ {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-kpis-de-governacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:kpis-de-governacao", "target_type": "Practice"}
5339
+ {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "target_type": "Practice"}
5340
+ {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "target_type": "Practice"}
5281
5341
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "target_type": "Practice"}
5282
5342
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "target_type": "Practice"}
5283
5343
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-rastreabilidade-organizacional", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:rastreabilidade-organizacional", "target_type": "Practice"}
5344
+ {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "target_type": "Practice"}
5284
5345
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "target_type": "Practice"}
5285
5346
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-revisao-trimestral-de-acesso-de-contractors-least-privilege", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:revisao-trimestral-de-acesso-de-contractors-least-privilege", "target_type": "Practice"}
5286
5347
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-trilho-de-formacao-obrigatoria-pre-acesso-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:trilho-de-formacao-obrigatoria-pre-acesso-contractors", "target_type": "Practice"}
5348
+ {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-validacao-continua-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:validacao-continua-de-fornecedores", "target_type": "Practice"}
5287
5349
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-32-14-governanca-contratacao-validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "14-governanca-contratacao:validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "target_type": "Practice"}
5288
5350
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.93, "framework_id": "EXT-RGPD", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-rgpd-obl-32-acc-001", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "ACC-001", "target_type": "Requirement"}
5289
5351
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.93, "framework_id": "EXT-RGPD", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-rgpd-obl-32-acc-002", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "ACC-002", "target_type": "Requirement"}
@@ -5338,9 +5400,10 @@
5338
5400
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-32-ctrl-governance-arquitetura-segura-e-rastreavel-74562442c4", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "target_type": "Control"}
5339
5401
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-32-ctrl-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "target_type": "Control"}
5340
5402
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-32-ctrl-governance-classificacao-e-governacao-por-risco-97aceecf29", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "target_type": "Control"}
5403
+ {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-32-ctrl-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "target_type": "Control"}
5341
5404
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-32-ctrl-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "target_type": "Control"}
5342
5405
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-32-ctrl-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "target_type": "Control"}
5343
- {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-32-ctrl-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "target_type": "Control"}
5406
+ {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-32-ctrl-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "target_type": "Control"}
5344
5407
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-32-ctrl-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "target_type": "Control"}
5345
5408
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-32-ctrl-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "target_type": "Control"}
5346
5409
  {"authority_class": "external_normative_overlay", "citation": "32", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-32-ctrl-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-32", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [4], "target_id": "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "target_type": "Control"}
@@ -5852,6 +5915,7 @@
5852
5915
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-02-requisitos-seguranca-gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 01", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:gates-automaticos-em-ci-cd-para-requisitos-de-seguranca", "target_type": "Practice"}
5853
5916
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-02-requisitos-seguranca-geracao-de-sbom-e-assinatura-de-artefactos-de-build", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:geracao-de-sbom-e-assinatura-de-artefactos-de-build", "target_type": "Practice"}
5854
5917
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-02-requisitos-seguranca-gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:gestao-de-excecoes-com-ttl-e-revalidacao-obrigatoria", "target_type": "Practice"}
5918
+ {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-02-requisitos-seguranca-incorporacao-de-restricoes-legais-normativas-e-contratuais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:incorporacao-de-restricoes-legais-normativas-e-contratuais", "target_type": "Practice"}
5855
5919
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-02-requisitos-seguranca-intent-declaration-por-tool-call-destrutivo-de-agente-ai", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 01", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:intent-declaration-por-tool-call-destrutivo-de-agente-ai", "target_type": "Practice"}
5856
5920
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-02-requisitos-seguranca-politica-formacao-e-procedimentos-operacionais", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:politica-formacao-e-procedimentos-operacionais", "target_type": "Practice"}
5857
5921
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-02-requisitos-seguranca-rastreabilidade-de-requisitos", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 01", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "02-requisitos-seguranca:rastreabilidade-de-requisitos", "target_type": "Practice"}
@@ -5875,10 +5939,10 @@
5875
5939
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-04-arquitetura-segura-identificacao-e-governacao-de-componentes-nao-deterministicos", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "04-arquitetura-segura:identificacao-e-governacao-de-componentes-nao-deterministicos", "target_type": "Practice"}
5876
5940
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-04-arquitetura-segura-padroes-arquitetonicos-para-sistemas-ai-ml-nao-agentic", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "04-arquitetura-segura:padroes-arquitetonicos-para-sistemas-ai-ml-nao-agentic", "target_type": "Practice"}
5877
5941
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-04-arquitetura-segura-revisao-de-arquitectura-para-agente-ai-em-a2-us-16", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "04-arquitetura-segura:revisao-de-arquitectura-para-agente-ai-em-a2-us-16", "target_type": "Practice"}
5878
- {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-04-arquitetura-segura-revisao-de-fronteiras-de-confianca-e-integracoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "04-arquitetura-segura:revisao-de-fronteiras-de-confianca-e-integracoes", "target_type": "Practice"}
5942
+ {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-04-arquitetura-segura-revisao-de-fronteiras-de-confianca-e-integracoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "04-arquitetura-segura:revisao-de-fronteiras-de-confianca-e-integracoes", "target_type": "Practice"}
5879
5943
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-04-arquitetura-segura-revisao-formal-de-arquitetura-para-l3-governacao-reforcada", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "04-arquitetura-segura:revisao-formal-de-arquitetura-para-l3-governacao-reforcada", "target_type": "Practice"}
5880
5944
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-04-arquitetura-segura-revisao-formal-do-design-arquitetural", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "04-arquitetura-segura:revisao-formal-do-design-arquitetural", "target_type": "Practice"}
5881
- {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-04-arquitetura-segura-segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "04-arquitetura-segura:segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "target_type": "Practice"}
5945
+ {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-04-arquitetura-segura-segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "04-arquitetura-segura:segmentacao-de-ambientes-e-validacao-de-topologia-como-codigo-l3", "target_type": "Practice"}
5882
5946
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-04-arquitetura-segura-sincronizacao-threat-modeling-arquitetura", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "04-arquitetura-segura:sincronizacao-threat-modeling-arquitetura", "target_type": "Practice"}
5883
5947
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-04-arquitetura-segura-triggers-de-arquitetura-viva-e-disciplina-de-revisao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "04-arquitetura-segura:triggers-de-arquitetura-viva-e-disciplina-de-revisao", "target_type": "Practice"}
5884
5948
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-04-arquitetura-segura-validacao-arquitetural-automatizavel-no-ci-cd-quando-aplicavel", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "04-arquitetura-segura:validacao-arquitetural-automatizavel-no-ci-cd-quando-aplicavel", "target_type": "Practice"}
@@ -6007,15 +6071,25 @@
6007
6071
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-13-formacao-onboarding-war-room-e-simulacoes-de-incidentes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "13-formacao-onboarding:war-room-e-simulacoes-de-incidentes", "target_type": "Practice"}
6008
6072
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:aprovacao-formal-e-auditoria-periodica-das-politicas-organizacionais-us-22", "target_type": "Practice"}
6009
6073
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:ciclo-continuo-de-revisao-e-reavaliacao-de-excecoes", "target_type": "Practice"}
6074
+ {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-clausulas-contratuais-de-seguranca", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:clausulas-contratuais-de-seguranca", "target_type": "Practice"}
6075
+ {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-consolidacao-de-kpis-de-governacao-e-maturidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:consolidacao-de-kpis-de-governacao-e-maturidade", "target_type": "Practice"}
6076
+ {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-contratacao-de-provedores-de-modelos-ai-us-21", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:contratacao-de-provedores-de-modelos-ai-us-21", "target_type": "Practice"}
6010
6077
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:controlo-sistematico-e-periodico-por-capitulo-sbd-toe", "target_type": "Practice"}
6011
6078
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-designacao-formal-de-owners-de-seguranca-por-aplicacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:designacao-formal-de-owners-de-seguranca-por-aplicacao", "target_type": "Practice"}
6079
+ {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-execucao-de-fluxo-formal-de-validacao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:execucao-de-fluxo-formal-de-validacao-de-fornecedores", "target_type": "Practice"}
6080
+ {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-feedback-pos-projeto-e-rating-de-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:feedback-pos-projeto-e-rating-de-contractors", "target_type": "Practice"}
6012
6081
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:formalizacao-de-modelo-de-governacao-por-nivel-de-risco", "target_type": "Practice"}
6082
+ {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-kpis-de-governacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:kpis-de-governacao", "target_type": "Practice"}
6083
+ {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:monitorizacao-continua-de-conformidade-de-fornecedores-alertas-e-escalacao", "target_type": "Practice"}
6084
+ {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:offboarding-seguro-de-contractors-e-rescisao-de-fornecedores", "target_type": "Practice"}
6013
6085
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:preparacao-tecnica-e-validacao-de-contractors-pre-acesso", "target_type": "Practice"}
6014
6086
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:processo-formal-de-excecoes-com-alcadas-por-nivel-de-risco", "target_type": "Practice"}
6015
6087
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-rastreabilidade-organizacional", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:rastreabilidade-organizacional", "target_type": "Practice"}
6088
+ {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:reavaliacao-continua-e-rotacao-de-fornecedores-pos-onboarding", "target_type": "Practice"}
6016
6089
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:repositorio-de-conformidade-por-aplicacao-controlo-sistematico", "target_type": "Practice"}
6017
6090
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-revisao-trimestral-de-acesso-de-contractors-least-privilege", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:revisao-trimestral-de-acesso-de-contractors-least-privilege", "target_type": "Practice"}
6018
6091
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-trilho-de-formacao-obrigatoria-pre-acesso-contractors", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:trilho-de-formacao-obrigatoria-pre-acesso-contractors", "target_type": "Practice"}
6092
+ {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-validacao-continua-de-fornecedores", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:validacao-continua-de-fornecedores", "target_type": "Practice"}
6019
6093
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.87, "framework_id": "EXT-RGPD", "justification": "control_practice_projection", "mapping_id": "MAP-ext-rgpd-obl-5-14-governanca-contratacao-validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "mapping_type": "obligation_maps_to_practice", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "14-governanca-contratacao:validacao-periodica-de-aplicacoes-ciclo-de-conformidade", "target_type": "Practice"}
6020
6094
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.93, "framework_id": "EXT-RGPD", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-rgpd-obl-5-acc-001", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "ACC-001", "target_type": "Requirement"}
6021
6095
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.93, "framework_id": "EXT-RGPD", "justification": "derived_from_curated_bundle_mapping", "mapping_id": "MAP-ext-rgpd-obl-5-acc-002", "mapping_type": "obligation_maps_to_requirement", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "ACC-002", "target_type": "Requirement"}
@@ -6078,10 +6152,11 @@
6078
6152
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-5-ctrl-governance-arquitetura-segura-e-rastreavel-74562442c4", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "target_type": "Control"}
6079
6153
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-5-ctrl-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf", "target_type": "Control"}
6080
6154
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-5-ctrl-governance-classificacao-e-governacao-por-risco-97aceecf29", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 01", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "target_type": "Control"}
6155
+ {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-5-ctrl-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "target_type": "Control"}
6081
6156
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-5-ctrl-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "target_type": "Control"}
6082
6157
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-5-ctrl-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 11", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "target_type": "Control"}
6083
6158
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-5-ctrl-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "target_type": "Control"}
6084
- {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-5-ctrl-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 04", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "target_type": "Control"}
6159
+ {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-5-ctrl-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b", "target_type": "Control"}
6085
6160
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-5-ctrl-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "target_type": "Control"}
6086
6161
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-5-ctrl-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "target_type": "Control"}
6087
6162
  {"authority_class": "external_normative_overlay", "citation": "5", "confidence": 0.9, "framework_id": "EXT-RGPD", "justification": "requirement_control_projection", "mapping_id": "MAP-ext-rgpd-obl-5-ctrl-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "mapping_type": "obligation_maps_to_control", "matched_label": "Cap. 02", "obligation_id": "EXT-RGPD-OBL-5", "playbook_id": "OVR-GDPR-playbook", "source_document_id": "002-cross-check-normativo-gdpr-02-playbook", "source_lines": [1], "target_id": "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb", "target_type": "Control"}