@threatcaptain/tc-reports 0.2.14 → 0.2.15

package/dist/index.cjs

@@ -51360,6 +51360,44 @@ const MitreAttack = ({ breachData, overallLikelihood }) => {
     ] })
   ] });
 };
+const groupTitles = {
+  basic: "Basic Controls (Implementation Group 1)",
+  foundational: "Foundational Controls (Implementation Group 2)",
+  organizational: "Organizational Controls (Implementation Group 3)"
+};
+const groupDescriptions = {
+  basic: "Must-have cybersecurity hygiene controls that should be implemented by all organizations (Controls 1-6).",
+  foundational: "Deeper technical safeguards for organizations with moderate cybersecurity programs (Controls 7-16).",
+  organizational: "Governance and process controls for mature organizations with dedicated security teams (Controls 17-18)."
+};
+const controlLevels = {
+  basic: [1, 2, 3, 4, 5, 6],
+  // IG1 - Basic hygiene controls
+  foundational: [7, 8, 9, 10, 11, 12, 13, 14, 15, 16],
+  // IG2 - Deeper technical safeguards
+  organizational: [17, 18]
+  // IG3 - Governance and process controls
+};
+const serviceDescriptions = {
+  1: "Maintain an up-to-date, automated inventory of all hardware assets across the client environment, with real-time discovery and change tracking.",
+  2: "Discover and track all installed software, enforce approved application lists, and remove or remediate unauthorized or outdated software.",
+  3: "Implement and manage data encryption, DLP policies, and secure backup processes to safeguard sensitive information in transit and at rest.",
+  4: "Deploy, enforce, and audit standardized hardening baselines for operating systems and applications to eliminate insecure default settings.",
+  5: "Provision, modify, and decommission user and service accounts, enforce password policies, and regularly review privileges.",
+  6: "Configure and maintain least-privilege access, multi-factor authentication, and role-based permissions across systems and applications.",
+  7: "Perform scheduled vulnerability scans, prioritize detected issues, and coordinate patching or mitigation workflows.",
+  8: "Collect, centralize, and analyze system and security logs from endpoints, servers, and network devices for threat detection and compliance.",
+  9: "Deploy and manage email filtering, anti-phishing measures, and web-content filtering to block malicious messages and sites.",
+  10: "Install, configure, and monitor endpoint anti-malware/EDR solutions to detect, quarantine, and remediate malicious code.",
+  11: "Design, implement, and test backup and restore procedures to ensure rapid recovery from data loss or ransomware events.",
+  12: "Monitor, configure, and maintain routers, switches, and firewalls for performance, availability, and secure configurations.",
+  13: "Deploy IDS/IPS or NDR solutions, continuously monitor network traffic for anomalies, and respond to potential intrusions.",
+  14: "Provide ongoing phishing simulations, interactive training modules, and compliance reporting to educate end users.",
+  15: "Assess, onboard, and continuously monitor the security posture of third-party vendors and partners.",
+  16: "Conduct automated and manual code scans, secure code reviews, and application hardening to identify and fix vulnerabilities.",
+  17: "Develop, test, and execute incident response playbooks, coordinate investigations, and manage post-incident reporting.",
+  18: "Perform periodic internal and external penetration tests, simulate real-world attacks, and deliver detailed remediation guidance."
+};
 const BreachLikelihood = ({ reportData }) => {
   var _a;
   const { clientData, securityAssessment, breachData } = reportData;
@@ -51451,70 +51489,23 @@ const BreachLikelihood = ({ reportData }) => {
         /* @__PURE__ */ jsxRuntime.jsx("h2", { className: "text-2xl font-bold text-slate-900 mb-2", children: "Understanding Your Numbers" }),
         /* @__PURE__ */ jsxRuntime.jsx("p", { className: "text-slate-600", children: "How We Calculate Your Risk" })
       ] }),
-      /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "grid grid-cols-3 gap-6 mb-8", children: [
-        /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "border-2 border-slate-200 rounded-lg p-6", children: [
-          /* @__PURE__ */ jsxRuntime.jsx(lucideReact.Target, { className: "w-8 h-8 text-orange-600 mb-4" }),
-          /* @__PURE__ */ jsxRuntime.jsx("h3", { className: "text-lg font-bold mb-3", children: "Attack Likelihood" }),
-          /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "text-sm text-slate-600 space-y-2", children: [
-            /* @__PURE__ */ jsxRuntime.jsxs("p", { children: [
-              /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Based on:" }),
-              " Industry attack statistics + your current protection level"
-            ] }),
-            /* @__PURE__ */ jsxRuntime.jsxs("p", { children: [
-              /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Source:" }),
-              " FBI Internet Crime Reports and cybersecurity research"
-            ] }),
-            /* @__PURE__ */ jsxRuntime.jsxs("p", { children: [
-              /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Your result:" }),
-              " ",
-              attackLikelihood,
-              "% chance based on ",
-              currentProtection,
-              "% protection implementation"
-            ] })
-          ] })
-        ] }),
-        /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "border-2 border-slate-200 rounded-lg p-6", children: [
-          /* @__PURE__ */ jsxRuntime.jsx(lucideReact.DollarSign, { className: "w-8 h-8 text-red-600 mb-4" }),
-          /* @__PURE__ */ jsxRuntime.jsx("h3", { className: "text-lg font-bold mb-3", children: "Financial Impact" }),
-          /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "text-sm text-slate-600 space-y-2", children: [
-            /* @__PURE__ */ jsxRuntime.jsxs("p", { children: [
-              /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Based on:" }),
-              " Average costs for businesses your size in your industry"
-            ] }),
-            /* @__PURE__ */ jsxRuntime.jsxs("p", { children: [
-              /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Source:" }),
-              " IBM Cost of Data Breach Report 2024"
-            ] }),
-            /* @__PURE__ */ jsxRuntime.jsxs("p", { children: [
-              /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Your result:" }),
-              " $",
-              baseCost ? baseCost.toLocaleString() : "510,000",
-              " potential cost for small ",
-              clientData.industry,
-              " business"
-            ] })
-          ] })
-        ] }),
-        /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "border-2 border-slate-200 rounded-lg p-6", children: [
-          /* @__PURE__ */ jsxRuntime.jsx(lucideReact.Shield, { className: "w-8 h-8 text-blue-600 mb-4" }),
-          /* @__PURE__ */ jsxRuntime.jsx("h3", { className: "text-lg font-bold mb-3", children: "Protection Value" }),
-          /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "text-sm text-slate-600 space-y-2", children: [
-            /* @__PURE__ */ jsxRuntime.jsxs("p", { children: [
-              /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Based on:" }),
-              " How much each security control reduces attack success"
-            ] }),
-            /* @__PURE__ */ jsxRuntime.jsxs("p", { children: [
-              /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Source:" }),
-              " NIST Cybersecurity Framework effectiveness data"
-            ] }),
-            /* @__PURE__ */ jsxRuntime.jsxs("p", { children: [
-              /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Your result:" }),
-              " Each control's value calculated from proven risk reduction"
-            ] })
-          ] })
-        ] })
-      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx("div", { className: "space-y-6", children: Object.entries(groupTitles).map(([groupKey, title]) => /* @__PURE__ */ jsxRuntime.jsxs(React.Fragment, { children: [
+        /* @__PURE__ */ jsxRuntime.jsx("h2", { className: "text-lg font-semibold mb-2", children: title }),
+        /* @__PURE__ */ jsxRuntime.jsx("p", { className: "text-gray-600 mb-4", children: groupDescriptions[groupKey] }),
+        /* @__PURE__ */ jsxRuntime.jsx("div", { className: "space-y-2", children: /* @__PURE__ */ jsxRuntime.jsx("ul", { className: "border border-slate-200 bg-slate-50 rounded-lg py-2 px-4 flex flex-col w-full", children: controlLevels[groupKey].map(
+          (control) => /* @__PURE__ */ jsxRuntime.jsxs(
+            "li",
+            {
+              className: "py-2 flex items-center w-full",
+              children: [
+                /* @__PURE__ */ jsxRuntime.jsx("span", { className: "max-h-6 max-w-6 w-full text-sm flex items-center justify-center rounded-full border bg-blue-100 border-blue-900 text-blue-900 font-bold mr-4", children: control }),
+                /* @__PURE__ */ jsxRuntime.jsx("span", { className: "flex leading-tight", children: serviceDescriptions[control] })
+              ]
+            },
+            control
+          )
+        ) }) })
+      ] }, groupKey)) }),
       /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "bg-slate-50 rounded-lg p-6 mb-6", children: [
         /* @__PURE__ */ jsxRuntime.jsx("h3", { className: "text-xl font-bold mb-4", children: "Our Approach" }),
         /* @__PURE__ */ jsxRuntime.jsx("p", { className: "text-sm text-slate-700", children: "We use the same data sources that insurance companies and security professionals rely on. Our calculations are conservative - real attack costs are often higher than our estimates." })