@zerothreatai/vulnerability-registry 9.0.1 → 9.0.2

package/dist/compliance-codes.d.ts

@@ -203,5 +203,11 @@ export declare enum ComplianceCode {
     SANS_TOP_25_CWE_798_HARDCODED_CREDS = "SANS_TOP_25_CWE_798_HARDCODED_CREDS",
     SANS_TOP_25_CWE_190_INTEGER_OVERFLOW = "SANS_TOP_25_CWE_190_INTEGER_OVERFLOW",
     SANS_TOP_25_CWE_400_RESOURCE_CONSUMPTION = "SANS_TOP_25_CWE_400_RESOURCE_CONSUMPTION",
-    SANS_TOP_25_CWE_306_MISSING_AUTH = "SANS_TOP_25_CWE_306_MISSING_AUTH"
+    SANS_TOP_25_CWE_306_MISSING_AUTH = "SANS_TOP_25_CWE_306_MISSING_AUTH",
+    ISO27001_A9_ACCESS_CONTROL = "ISO27001_A9_ACCESS_CONTROL",
+    ISO27001_A10_CRYPTOGRAPHY = "ISO27001_A10_CRYPTOGRAPHY",
+    ISO27001_A12_OPERATIONS_SECURITY = "ISO27001_A12_OPERATIONS_SECURITY",
+    ISO27001_A13_COMMUNICATIONS_SECURITY = "ISO27001_A13_COMMUNICATIONS_SECURITY",
+    ISO27001_A14_SYSTEM_ACQUISITION_DEV = "ISO27001_A14_SYSTEM_ACQUISITION_DEV",
+    ISO27001_A18_COMPLIANCE = "ISO27001_A18_COMPLIANCE"
 }

package/dist/compliance-codes.js

@@ -210,4 +210,11 @@ export var ComplianceCode;
     ComplianceCode["SANS_TOP_25_CWE_190_INTEGER_OVERFLOW"] = "SANS_TOP_25_CWE_190_INTEGER_OVERFLOW";
     ComplianceCode["SANS_TOP_25_CWE_400_RESOURCE_CONSUMPTION"] = "SANS_TOP_25_CWE_400_RESOURCE_CONSUMPTION";
     ComplianceCode["SANS_TOP_25_CWE_306_MISSING_AUTH"] = "SANS_TOP_25_CWE_306_MISSING_AUTH";
+    // --- ISO/IEC 27001 (ComplianceId: 5) ---
+    ComplianceCode["ISO27001_A9_ACCESS_CONTROL"] = "ISO27001_A9_ACCESS_CONTROL";
+    ComplianceCode["ISO27001_A10_CRYPTOGRAPHY"] = "ISO27001_A10_CRYPTOGRAPHY";
+    ComplianceCode["ISO27001_A12_OPERATIONS_SECURITY"] = "ISO27001_A12_OPERATIONS_SECURITY";
+    ComplianceCode["ISO27001_A13_COMMUNICATIONS_SECURITY"] = "ISO27001_A13_COMMUNICATIONS_SECURITY";
+    ComplianceCode["ISO27001_A14_SYSTEM_ACQUISITION_DEV"] = "ISO27001_A14_SYSTEM_ACQUISITION_DEV";
+    ComplianceCode["ISO27001_A18_COMPLIANCE"] = "ISO27001_A18_COMPLIANCE";
 })(ComplianceCode || (ComplianceCode = {}));

package/dist/compliances/compliance-by-vulnerabilities.js

@@ -3,6 +3,7 @@ import { accessControlIds, allAppSecIds as hallAppSecIds, authAndCookieIds as ha
 import { owaspA1Ids, owaspA2Ids, owaspA3Ids, owaspA5Ids, owaspA7Ids, owaspA8Ids } from './owasp.js';
 import { allAppSecIds as pciAllAppSecIds, misconfigIds as pciMisconfigIds, accessControlIds as pciAccessControlIds, cryptoIds as pciCryptoIds, injectionAndXssIds as pciInjectionAndXssIds, authAndCookieIds as pciAuthAndCookieIds } from './pci-dss.js';
 import { authIds as sauthIds, accessControlIds as saccessControlIds, cmdiIds as scmdiIds, deserializationIds as sdeserializationIds, disclosureIds as sdisclosureIds, injectionIds as sinjectionIds, lfiIds as slfiIds, sqliIds, ssrfIds as ssrfids, sstiIds as ssstiIds, xssIds as sxssIds } from './sans-top-25.js';
+import { isoAccessControlIds, isoCryptoIds, isoOpsSecurityIds, isoCommunicationsSecurityIds, isoSecureDevelopmentIds, isoComplianceIds } from './iso27001.js';
 export const COMPLIANCE_BY_VULNERABILITIES = [
     {
         id: 3,
@@ -28,5 +29,10 @@ export const COMPLIANCE_BY_VULNERABILITIES = [
         id: 6,
         title: 'SANS Top 25',
         vulnerabilities: [...sauthIds, ...saccessControlIds, ...scmdiIds, ...sdeserializationIds, ...sdisclosureIds, ...sinjectionIds, ...slfiIds, ...sqliIds, ...ssrfids, ...ssstiIds, ...sxssIds]
+    },
+    {
+        id: 5,
+        title: 'ISO 27001',
+        vulnerabilities: [...isoAccessControlIds, ...isoCryptoIds, ...isoOpsSecurityIds, ...isoCommunicationsSecurityIds, ...isoSecureDevelopmentIds, ...isoComplianceIds]
     }
 ];

package/dist/compliances/index.d.ts

@@ -3,4 +3,5 @@ export { HIPAA_COMPLIANCE } from './hipaa.js';
 export { GDPR_COMPLIANCE } from './gdpr.js';
 export { PCI_DSS_COMPLIANCE } from './pci-dss.js';
 export { SANS_TOP_25_COMPLIANCE } from './sans-top-25.js';
+export { ISO27001_COMPLIANCE } from './iso27001.js';
 export { COMPLIANCE_BY_VULNERABILITIES } from './compliance-by-vulnerabilities.js';

package/dist/compliances/index.js

@@ -3,4 +3,5 @@ export { HIPAA_COMPLIANCE } from './hipaa.js';
 export { GDPR_COMPLIANCE } from './gdpr.js';
 export { PCI_DSS_COMPLIANCE } from './pci-dss.js';
 export { SANS_TOP_25_COMPLIANCE } from './sans-top-25.js';
+export { ISO27001_COMPLIANCE } from './iso27001.js';
 export { COMPLIANCE_BY_VULNERABILITIES } from './compliance-by-vulnerabilities.js';

package/dist/compliances/iso27001.d.ts

@@ -0,0 +1,8 @@
+import { ComplianceRegistry } from '../types';
+export declare const isoAccessControlIds: number[];
+export declare const isoCryptoIds: number[];
+export declare const isoOpsSecurityIds: number[];
+export declare const isoCommunicationsSecurityIds: number[];
+export declare const isoSecureDevelopmentIds: number[];
+export declare const isoComplianceIds: number[];
+export declare const ISO27001_COMPLIANCE: ComplianceRegistry;

package/dist/compliances/iso27001.js

@@ -0,0 +1,91 @@
+import { ComplianceCode } from '../compliance-codes';
+import { ComplianceCategory } from '../types';
+import { idsByCategory, idsByCodePrefix, idsByCodes, mergeIds } from './helpers.js';
+const authIds = idsByCategory('authentication');
+const injectionIds = idsByCategory('injection');
+const xssIds = idsByCategory('xss');
+const ssrfIds = idsByCategory('ssrf');
+const configIds = idsByCategory('configuration');
+const disclosureIds = idsByCategory('information_disclosure');
+const cryptoIds = idsByCategory('cryptographic');
+const accessControlIds = idsByCodePrefix(['BAC_', 'MASSASSIGN_']);
+const jwtIds = idsByCodePrefix(['JWT_']);
+const cookieIds = idsByCodePrefix(['COOKIE_']);
+const dirbrowseIds = idsByCodePrefix(['DIRBROWSE_']);
+const hstsIds = idsByCodes([
+    'HEADER_MISSING_HSTS',
+    'HEADER_HSTS_BAD_MAX_AGE',
+    'HEADER_HSTS_SHORT_MAX_AGE',
+    'HEADER_HSTS_NO_INCLUDESUBDOMAINS',
+    'HEADER_HSTS_PRELOAD_LOW_MAX_AGE',
+    'HEADER_DRIFT_HSTS',
+]);
+const cookieSecureIds = idsByCodes([
+    'COOKIE_SAMESITE_NONE_WITHOUT_SECURE',
+    'COOKIE_SESSION_MISSING_SECURE',
+    'COOKIE_MISSING_SECURE',
+    'COOKIE_HOST_PREFIX_INVALID',
+    'COOKIE_SECURE_PREFIX_INVALID',
+]);
+export const isoAccessControlIds = mergeIds(accessControlIds, authIds, jwtIds, cookieIds);
+export const isoCryptoIds = mergeIds(cryptoIds, hstsIds, cookieSecureIds);
+export const isoOpsSecurityIds = mergeIds(configIds, disclosureIds, dirbrowseIds);
+export const isoCommunicationsSecurityIds = mergeIds(hstsIds, cookieSecureIds);
+export const isoSecureDevelopmentIds = mergeIds(injectionIds, xssIds, ssrfIds);
+export const isoComplianceIds = mergeIds(accessControlIds, configIds, disclosureIds);
+export const ISO27001_COMPLIANCE = {
+    [ComplianceCode.ISO27001_A9_ACCESS_CONTROL]: {
+        id: 206,
+        code: ComplianceCode.ISO27001_A9_ACCESS_CONTROL,
+        title: 'A.9 Access Control',
+        description: 'Access to information and application functions must be restricted based on business and security requirements, ensuring users can only perform authorized actions.',
+        complianceStandard: ComplianceCategory.ISO27001,
+        relatedVulnerabilityIds: isoAccessControlIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.ISO27001_A10_CRYPTOGRAPHY]: {
+        id: 207,
+        code: ComplianceCode.ISO27001_A10_CRYPTOGRAPHY,
+        title: 'A.10 Cryptography',
+        description: 'Cryptographic controls must be used to protect the confidentiality, authenticity, and integrity of information in transit and at rest.',
+        complianceStandard: ComplianceCategory.ISO27001,
+        relatedVulnerabilityIds: isoCryptoIds,
+        isNotApplicable: isoCryptoIds.length === 0,
+    },
+    [ComplianceCode.ISO27001_A12_OPERATIONS_SECURITY]: {
+        id: 208,
+        code: ComplianceCode.ISO27001_A12_OPERATIONS_SECURITY,
+        title: 'A.12 Operations Security',
+        description: 'Operational procedures and controls should prevent misconfiguration and leakage that expose sensitive information or system internals.',
+        complianceStandard: ComplianceCategory.ISO27001,
+        relatedVulnerabilityIds: isoOpsSecurityIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.ISO27001_A13_COMMUNICATIONS_SECURITY]: {
+        id: 209,
+        code: ComplianceCode.ISO27001_A13_COMMUNICATIONS_SECURITY,
+        title: 'A.13 Communications Security',
+        description: 'Network and communications must be protected to prevent interception, downgrade, or weak transport protections.',
+        complianceStandard: ComplianceCategory.ISO27001,
+        relatedVulnerabilityIds: isoCommunicationsSecurityIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.ISO27001_A14_SYSTEM_ACQUISITION_DEV]: {
+        id: 210,
+        code: ComplianceCode.ISO27001_A14_SYSTEM_ACQUISITION_DEV,
+        title: 'A.14 System Acquisition, Development and Maintenance',
+        description: 'Security must be integrated into the software development lifecycle to prevent common injection and input handling flaws.',
+        complianceStandard: ComplianceCategory.ISO27001,
+        relatedVulnerabilityIds: isoSecureDevelopmentIds,
+        isNotApplicable: false,
+    },
+    [ComplianceCode.ISO27001_A18_COMPLIANCE]: {
+        id: 211,
+        code: ComplianceCode.ISO27001_A18_COMPLIANCE,
+        title: 'A.18 Compliance',
+        description: 'Security controls should be verified to ensure regulatory and contractual requirements for access restriction and data protection are met.',
+        complianceStandard: ComplianceCategory.ISO27001,
+        relatedVulnerabilityIds: isoComplianceIds,
+        isNotApplicable: false,
+    },
+};

package/dist/index.d.ts

@@ -14,7 +14,7 @@ import { CONFIG_VULNERABILITIES } from './categories/configuration.js';
 import { SENSITIVE_PATH_VULNERABILITIES } from './categories/sensitive-paths.js';
 import { CATEGORY_REGISTRY } from './category.js';
 import { SCANNER_REGISTRY } from './scanner.js';
-import { OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE, COMPLIANCE_BY_VULNERABILITIES } from './compliances/index.js';
+import { OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE, ISO27001_COMPLIANCE, COMPLIANCE_BY_VULNERABILITIES } from './compliances/index.js';
 /**
  * Get vulnerability definition by code
  */
@@ -45,7 +45,7 @@ export declare function getVulnerabilityCount(): number;
 export declare function createFinding(code: VulnerabilityCode | string, overrides?: Partial<VulnerabilityDefinition>): VulnerabilityDefinition | null;
 export { VulnerabilityCode } from './error-codes.js';
 export type { VulnerabilityDefinition, VulnerabilityLookup, CVSSProfile, CWEReference, OWASPReference, Severity, VulnerabilityCategory, } from './types.js';
-export { INJECTION_VULNERABILITIES, XSS_VULNERABILITIES, SSRF_VULNERABILITIES, AUTH_VULNERABILITIES, CONFIG_VULNERABILITIES, SENSITIVE_PATH_VULNERABILITIES, VULNERABILITY_REGISTRY, OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE, CATEGORY_REGISTRY, SCANNER_REGISTRY, COMPLIANCE_BY_VULNERABILITIES };
+export { INJECTION_VULNERABILITIES, XSS_VULNERABILITIES, SSRF_VULNERABILITIES, AUTH_VULNERABILITIES, CONFIG_VULNERABILITIES, SENSITIVE_PATH_VULNERABILITIES, VULNERABILITY_REGISTRY, OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE, ISO27001_COMPLIANCE, CATEGORY_REGISTRY, SCANNER_REGISTRY, COMPLIANCE_BY_VULNERABILITIES };
 declare const _default: {
     VulnerabilityCode: typeof VulnerabilityCode;
     VULNERABILITY_REGISTRY: Record<string, VulnerabilityDefinition>;
@@ -61,6 +61,7 @@ declare const _default: {
     GDPR_COMPLIANCE: import("./types.js").ComplianceRegistry;
     PCI_DSS_COMPLIANCE: import("./types.js").ComplianceRegistry;
     SANS_TOP_25_COMPLIANCE: import("./types.js").ComplianceRegistry;
+    ISO27001_COMPLIANCE: import("./types.js").ComplianceRegistry;
     CATEGORY_REGISTRY: Record<string, {
         title: string;
     }>;

package/dist/index.js

@@ -13,7 +13,7 @@ import { CONFIG_VULNERABILITIES } from './categories/configuration.js';
 import { SENSITIVE_PATH_VULNERABILITIES } from './categories/sensitive-paths.js';
 import { CATEGORY_REGISTRY } from './category.js';
 import { SCANNER_REGISTRY } from './scanner.js';
-import { OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE, COMPLIANCE_BY_VULNERABILITIES } from './compliances/index.js';
+import { OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE, ISO27001_COMPLIANCE, COMPLIANCE_BY_VULNERABILITIES } from './compliances/index.js';
 /**
  * Get vulnerability definition by code
  */
@@ -70,7 +70,7 @@ export function createFinding(code, overrides) {
 // Re-export all types and enums
 export { VulnerabilityCode } from './error-codes.js';
 // Export category definitions for direct access
-export { INJECTION_VULNERABILITIES, XSS_VULNERABILITIES, SSRF_VULNERABILITIES, AUTH_VULNERABILITIES, CONFIG_VULNERABILITIES, SENSITIVE_PATH_VULNERABILITIES, VULNERABILITY_REGISTRY, OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE, CATEGORY_REGISTRY, SCANNER_REGISTRY, COMPLIANCE_BY_VULNERABILITIES };
+export { INJECTION_VULNERABILITIES, XSS_VULNERABILITIES, SSRF_VULNERABILITIES, AUTH_VULNERABILITIES, CONFIG_VULNERABILITIES, SENSITIVE_PATH_VULNERABILITIES, VULNERABILITY_REGISTRY, OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE, ISO27001_COMPLIANCE, CATEGORY_REGISTRY, SCANNER_REGISTRY, COMPLIANCE_BY_VULNERABILITIES };
 export default {
     VulnerabilityCode,
     VULNERABILITY_REGISTRY,
@@ -86,6 +86,7 @@ export default {
     GDPR_COMPLIANCE,
     PCI_DSS_COMPLIANCE,
     SANS_TOP_25_COMPLIANCE,
+    ISO27001_COMPLIANCE,
     CATEGORY_REGISTRY,
     SCANNER_REGISTRY,
 };

package/dist/types.d.ts

@@ -94,7 +94,8 @@ export declare enum ComplianceCategory {
     HIPAA = "HIPAA",
     GDPR = "GDPR",
     PCIDSS = "PCIDSS",
-    SANS_TOP_25 = "SANS_TOP_25"
+    SANS_TOP_25 = "SANS_TOP_25",
+    ISO27001 = "ISO27001"
 }
 /**
  * Compliance rule definition

package/dist/types.js

@@ -13,4 +13,5 @@ export var ComplianceCategory;
     ComplianceCategory["GDPR"] = "GDPR";
     ComplianceCategory["PCIDSS"] = "PCIDSS";
     ComplianceCategory["SANS_TOP_25"] = "SANS_TOP_25";
+    ComplianceCategory["ISO27001"] = "ISO27001";
 })(ComplianceCategory || (ComplianceCategory = {}));

package/dist-cjs/compliance-codes.js

@@ -213,4 +213,11 @@ var ComplianceCode;
     ComplianceCode["SANS_TOP_25_CWE_190_INTEGER_OVERFLOW"] = "SANS_TOP_25_CWE_190_INTEGER_OVERFLOW";
     ComplianceCode["SANS_TOP_25_CWE_400_RESOURCE_CONSUMPTION"] = "SANS_TOP_25_CWE_400_RESOURCE_CONSUMPTION";
     ComplianceCode["SANS_TOP_25_CWE_306_MISSING_AUTH"] = "SANS_TOP_25_CWE_306_MISSING_AUTH";
+    // --- ISO/IEC 27001 (ComplianceId: 5) ---
+    ComplianceCode["ISO27001_A9_ACCESS_CONTROL"] = "ISO27001_A9_ACCESS_CONTROL";
+    ComplianceCode["ISO27001_A10_CRYPTOGRAPHY"] = "ISO27001_A10_CRYPTOGRAPHY";
+    ComplianceCode["ISO27001_A12_OPERATIONS_SECURITY"] = "ISO27001_A12_OPERATIONS_SECURITY";
+    ComplianceCode["ISO27001_A13_COMMUNICATIONS_SECURITY"] = "ISO27001_A13_COMMUNICATIONS_SECURITY";
+    ComplianceCode["ISO27001_A14_SYSTEM_ACQUISITION_DEV"] = "ISO27001_A14_SYSTEM_ACQUISITION_DEV";
+    ComplianceCode["ISO27001_A18_COMPLIANCE"] = "ISO27001_A18_COMPLIANCE";
 })(ComplianceCode || (exports.ComplianceCode = ComplianceCode = {}));

package/dist-cjs/compliances/compliance-by-vulnerabilities.js

@@ -6,6 +6,7 @@ const hipaa_js_1 = require("./hipaa.js");
 const owasp_js_1 = require("./owasp.js");
 const pci_dss_js_1 = require("./pci-dss.js");
 const sans_top_25_js_1 = require("./sans-top-25.js");
+const iso27001_js_1 = require("./iso27001.js");
 exports.COMPLIANCE_BY_VULNERABILITIES = [
     {
         id: 3,
@@ -31,5 +32,10 @@ exports.COMPLIANCE_BY_VULNERABILITIES = [
         id: 6,
         title: 'SANS Top 25',
         vulnerabilities: [...sans_top_25_js_1.authIds, ...sans_top_25_js_1.accessControlIds, ...sans_top_25_js_1.cmdiIds, ...sans_top_25_js_1.deserializationIds, ...sans_top_25_js_1.disclosureIds, ...sans_top_25_js_1.injectionIds, ...sans_top_25_js_1.lfiIds, ...sans_top_25_js_1.sqliIds, ...sans_top_25_js_1.ssrfIds, ...sans_top_25_js_1.sstiIds, ...sans_top_25_js_1.xssIds]
+    },
+    {
+        id: 5,
+        title: 'ISO 27001',
+        vulnerabilities: [...iso27001_js_1.isoAccessControlIds, ...iso27001_js_1.isoCryptoIds, ...iso27001_js_1.isoOpsSecurityIds, ...iso27001_js_1.isoCommunicationsSecurityIds, ...iso27001_js_1.isoSecureDevelopmentIds, ...iso27001_js_1.isoComplianceIds]
     }
 ];

package/dist-cjs/compliances/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.COMPLIANCE_BY_VULNERABILITIES = exports.SANS_TOP_25_COMPLIANCE = exports.PCI_DSS_COMPLIANCE = exports.GDPR_COMPLIANCE = exports.HIPAA_COMPLIANCE = exports.OWASP_COMPLIANCE = void 0;
+exports.COMPLIANCE_BY_VULNERABILITIES = exports.ISO27001_COMPLIANCE = exports.SANS_TOP_25_COMPLIANCE = exports.PCI_DSS_COMPLIANCE = exports.GDPR_COMPLIANCE = exports.HIPAA_COMPLIANCE = exports.OWASP_COMPLIANCE = void 0;
 var owasp_js_1 = require("./owasp.js");
 Object.defineProperty(exports, "OWASP_COMPLIANCE", { enumerable: true, get: function () { return owasp_js_1.OWASP_COMPLIANCE; } });
 var hipaa_js_1 = require("./hipaa.js");
@@ -11,5 +11,7 @@ var pci_dss_js_1 = require("./pci-dss.js");
 Object.defineProperty(exports, "PCI_DSS_COMPLIANCE", { enumerable: true, get: function () { return pci_dss_js_1.PCI_DSS_COMPLIANCE; } });
 var sans_top_25_js_1 = require("./sans-top-25.js");
 Object.defineProperty(exports, "SANS_TOP_25_COMPLIANCE", { enumerable: true, get: function () { return sans_top_25_js_1.SANS_TOP_25_COMPLIANCE; } });
+var iso27001_js_1 = require("./iso27001.js");
+Object.defineProperty(exports, "ISO27001_COMPLIANCE", { enumerable: true, get: function () { return iso27001_js_1.ISO27001_COMPLIANCE; } });
 var compliance_by_vulnerabilities_js_1 = require("./compliance-by-vulnerabilities.js");
 Object.defineProperty(exports, "COMPLIANCE_BY_VULNERABILITIES", { enumerable: true, get: function () { return compliance_by_vulnerabilities_js_1.COMPLIANCE_BY_VULNERABILITIES; } });

package/dist-cjs/compliances/iso27001.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ISO27001_COMPLIANCE = exports.isoComplianceIds = exports.isoSecureDevelopmentIds = exports.isoCommunicationsSecurityIds = exports.isoOpsSecurityIds = exports.isoCryptoIds = exports.isoAccessControlIds = void 0;
+const compliance_codes_1 = require("../compliance-codes");
+const types_1 = require("../types");
+const helpers_js_1 = require("./helpers.js");
+const authIds = (0, helpers_js_1.idsByCategory)('authentication');
+const injectionIds = (0, helpers_js_1.idsByCategory)('injection');
+const xssIds = (0, helpers_js_1.idsByCategory)('xss');
+const ssrfIds = (0, helpers_js_1.idsByCategory)('ssrf');
+const configIds = (0, helpers_js_1.idsByCategory)('configuration');
+const disclosureIds = (0, helpers_js_1.idsByCategory)('information_disclosure');
+const cryptoIds = (0, helpers_js_1.idsByCategory)('cryptographic');
+const accessControlIds = (0, helpers_js_1.idsByCodePrefix)(['BAC_', 'MASSASSIGN_']);
+const jwtIds = (0, helpers_js_1.idsByCodePrefix)(['JWT_']);
+const cookieIds = (0, helpers_js_1.idsByCodePrefix)(['COOKIE_']);
+const dirbrowseIds = (0, helpers_js_1.idsByCodePrefix)(['DIRBROWSE_']);
+const hstsIds = (0, helpers_js_1.idsByCodes)([
+    'HEADER_MISSING_HSTS',
+    'HEADER_HSTS_BAD_MAX_AGE',
+    'HEADER_HSTS_SHORT_MAX_AGE',
+    'HEADER_HSTS_NO_INCLUDESUBDOMAINS',
+    'HEADER_HSTS_PRELOAD_LOW_MAX_AGE',
+    'HEADER_DRIFT_HSTS',
+]);
+const cookieSecureIds = (0, helpers_js_1.idsByCodes)([
+    'COOKIE_SAMESITE_NONE_WITHOUT_SECURE',
+    'COOKIE_SESSION_MISSING_SECURE',
+    'COOKIE_MISSING_SECURE',
+    'COOKIE_HOST_PREFIX_INVALID',
+    'COOKIE_SECURE_PREFIX_INVALID',
+]);
+exports.isoAccessControlIds = (0, helpers_js_1.mergeIds)(accessControlIds, authIds, jwtIds, cookieIds);
+exports.isoCryptoIds = (0, helpers_js_1.mergeIds)(cryptoIds, hstsIds, cookieSecureIds);
+exports.isoOpsSecurityIds = (0, helpers_js_1.mergeIds)(configIds, disclosureIds, dirbrowseIds);
+exports.isoCommunicationsSecurityIds = (0, helpers_js_1.mergeIds)(hstsIds, cookieSecureIds);
+exports.isoSecureDevelopmentIds = (0, helpers_js_1.mergeIds)(injectionIds, xssIds, ssrfIds);
+exports.isoComplianceIds = (0, helpers_js_1.mergeIds)(accessControlIds, configIds, disclosureIds);
+exports.ISO27001_COMPLIANCE = {
+    [compliance_codes_1.ComplianceCode.ISO27001_A9_ACCESS_CONTROL]: {
+        id: 206,
+        code: compliance_codes_1.ComplianceCode.ISO27001_A9_ACCESS_CONTROL,
+        title: 'A.9 Access Control',
+        description: 'Access to information and application functions must be restricted based on business and security requirements, ensuring users can only perform authorized actions.',
+        complianceStandard: types_1.ComplianceCategory.ISO27001,
+        relatedVulnerabilityIds: exports.isoAccessControlIds,
+        isNotApplicable: false,
+    },
+    [compliance_codes_1.ComplianceCode.ISO27001_A10_CRYPTOGRAPHY]: {
+        id: 207,
+        code: compliance_codes_1.ComplianceCode.ISO27001_A10_CRYPTOGRAPHY,
+        title: 'A.10 Cryptography',
+        description: 'Cryptographic controls must be used to protect the confidentiality, authenticity, and integrity of information in transit and at rest.',
+        complianceStandard: types_1.ComplianceCategory.ISO27001,
+        relatedVulnerabilityIds: exports.isoCryptoIds,
+        isNotApplicable: exports.isoCryptoIds.length === 0,
+    },
+    [compliance_codes_1.ComplianceCode.ISO27001_A12_OPERATIONS_SECURITY]: {
+        id: 208,
+        code: compliance_codes_1.ComplianceCode.ISO27001_A12_OPERATIONS_SECURITY,
+        title: 'A.12 Operations Security',
+        description: 'Operational procedures and controls should prevent misconfiguration and leakage that expose sensitive information or system internals.',
+        complianceStandard: types_1.ComplianceCategory.ISO27001,
+        relatedVulnerabilityIds: exports.isoOpsSecurityIds,
+        isNotApplicable: false,
+    },
+    [compliance_codes_1.ComplianceCode.ISO27001_A13_COMMUNICATIONS_SECURITY]: {
+        id: 209,
+        code: compliance_codes_1.ComplianceCode.ISO27001_A13_COMMUNICATIONS_SECURITY,
+        title: 'A.13 Communications Security',
+        description: 'Network and communications must be protected to prevent interception, downgrade, or weak transport protections.',
+        complianceStandard: types_1.ComplianceCategory.ISO27001,
+        relatedVulnerabilityIds: exports.isoCommunicationsSecurityIds,
+        isNotApplicable: false,
+    },
+    [compliance_codes_1.ComplianceCode.ISO27001_A14_SYSTEM_ACQUISITION_DEV]: {
+        id: 210,
+        code: compliance_codes_1.ComplianceCode.ISO27001_A14_SYSTEM_ACQUISITION_DEV,
+        title: 'A.14 System Acquisition, Development and Maintenance',
+        description: 'Security must be integrated into the software development lifecycle to prevent common injection and input handling flaws.',
+        complianceStandard: types_1.ComplianceCategory.ISO27001,
+        relatedVulnerabilityIds: exports.isoSecureDevelopmentIds,
+        isNotApplicable: false,
+    },
+    [compliance_codes_1.ComplianceCode.ISO27001_A18_COMPLIANCE]: {
+        id: 211,
+        code: compliance_codes_1.ComplianceCode.ISO27001_A18_COMPLIANCE,
+        title: 'A.18 Compliance',
+        description: 'Security controls should be verified to ensure regulatory and contractual requirements for access restriction and data protection are met.',
+        complianceStandard: types_1.ComplianceCategory.ISO27001,
+        relatedVulnerabilityIds: exports.isoComplianceIds,
+        isNotApplicable: false,
+    },
+};

package/dist-cjs/index.js

@@ -5,7 +5,7 @@
  * Exports all vulnerability codes, definitions, and lookup utilities
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.COMPLIANCE_BY_VULNERABILITIES = exports.SCANNER_REGISTRY = exports.CATEGORY_REGISTRY = exports.SANS_TOP_25_COMPLIANCE = exports.PCI_DSS_COMPLIANCE = exports.GDPR_COMPLIANCE = exports.HIPAA_COMPLIANCE = exports.OWASP_COMPLIANCE = exports.VULNERABILITY_REGISTRY = exports.SENSITIVE_PATH_VULNERABILITIES = exports.CONFIG_VULNERABILITIES = exports.AUTH_VULNERABILITIES = exports.SSRF_VULNERABILITIES = exports.XSS_VULNERABILITIES = exports.INJECTION_VULNERABILITIES = exports.VulnerabilityCode = void 0;
+exports.COMPLIANCE_BY_VULNERABILITIES = exports.SCANNER_REGISTRY = exports.CATEGORY_REGISTRY = exports.ISO27001_COMPLIANCE = exports.SANS_TOP_25_COMPLIANCE = exports.PCI_DSS_COMPLIANCE = exports.GDPR_COMPLIANCE = exports.HIPAA_COMPLIANCE = exports.OWASP_COMPLIANCE = exports.VULNERABILITY_REGISTRY = exports.SENSITIVE_PATH_VULNERABILITIES = exports.CONFIG_VULNERABILITIES = exports.AUTH_VULNERABILITIES = exports.SSRF_VULNERABILITIES = exports.XSS_VULNERABILITIES = exports.INJECTION_VULNERABILITIES = exports.VulnerabilityCode = void 0;
 exports.getVulnerabilityDefinition = getVulnerabilityDefinition;
 exports.getVulnerabilitiesByScanner = getVulnerabilitiesByScanner;
 exports.getVulnerabilitiesByCategory = getVulnerabilitiesByCategory;
@@ -38,6 +38,7 @@ Object.defineProperty(exports, "HIPAA_COMPLIANCE", { enumerable: true, get: func
 Object.defineProperty(exports, "GDPR_COMPLIANCE", { enumerable: true, get: function () { return index_js_1.GDPR_COMPLIANCE; } });
 Object.defineProperty(exports, "PCI_DSS_COMPLIANCE", { enumerable: true, get: function () { return index_js_1.PCI_DSS_COMPLIANCE; } });
 Object.defineProperty(exports, "SANS_TOP_25_COMPLIANCE", { enumerable: true, get: function () { return index_js_1.SANS_TOP_25_COMPLIANCE; } });
+Object.defineProperty(exports, "ISO27001_COMPLIANCE", { enumerable: true, get: function () { return index_js_1.ISO27001_COMPLIANCE; } });
 Object.defineProperty(exports, "COMPLIANCE_BY_VULNERABILITIES", { enumerable: true, get: function () { return index_js_1.COMPLIANCE_BY_VULNERABILITIES; } });
 /**
  * Get vulnerability definition by code
@@ -110,6 +111,7 @@ exports.default = {
     GDPR_COMPLIANCE: index_js_1.GDPR_COMPLIANCE,
     PCI_DSS_COMPLIANCE: index_js_1.PCI_DSS_COMPLIANCE,
     SANS_TOP_25_COMPLIANCE: index_js_1.SANS_TOP_25_COMPLIANCE,
+    ISO27001_COMPLIANCE: index_js_1.ISO27001_COMPLIANCE,
     CATEGORY_REGISTRY: category_js_1.CATEGORY_REGISTRY,
     SCANNER_REGISTRY: scanner_js_1.SCANNER_REGISTRY,
 };

package/dist-cjs/types.js

@@ -16,4 +16,5 @@ var ComplianceCategory;
     ComplianceCategory["GDPR"] = "GDPR";
     ComplianceCategory["PCIDSS"] = "PCIDSS";
     ComplianceCategory["SANS_TOP_25"] = "SANS_TOP_25";
+    ComplianceCategory["ISO27001"] = "ISO27001";
 })(ComplianceCategory || (exports.ComplianceCategory = ComplianceCategory = {}));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zerothreatai/vulnerability-registry",
-  "version": "9.0.1",
+  "version": "9.0.2",
   "description": "Centralized vulnerability definitions, CVSS scores, and references for ZeroThreat scanners",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/compliance-codes.ts

@@ -213,4 +213,12 @@ export enum ComplianceCode {
   SANS_TOP_25_CWE_190_INTEGER_OVERFLOW = 'SANS_TOP_25_CWE_190_INTEGER_OVERFLOW',
   SANS_TOP_25_CWE_400_RESOURCE_CONSUMPTION = 'SANS_TOP_25_CWE_400_RESOURCE_CONSUMPTION',
   SANS_TOP_25_CWE_306_MISSING_AUTH = 'SANS_TOP_25_CWE_306_MISSING_AUTH',
+
+  // --- ISO/IEC 27001 (ComplianceId: 5) ---
+  ISO27001_A9_ACCESS_CONTROL = 'ISO27001_A9_ACCESS_CONTROL',
+  ISO27001_A10_CRYPTOGRAPHY = 'ISO27001_A10_CRYPTOGRAPHY',
+  ISO27001_A12_OPERATIONS_SECURITY = 'ISO27001_A12_OPERATIONS_SECURITY',
+  ISO27001_A13_COMMUNICATIONS_SECURITY = 'ISO27001_A13_COMMUNICATIONS_SECURITY',
+  ISO27001_A14_SYSTEM_ACQUISITION_DEV = 'ISO27001_A14_SYSTEM_ACQUISITION_DEV',
+  ISO27001_A18_COMPLIANCE = 'ISO27001_A18_COMPLIANCE',
 }

package/src/compliances/compliance-by-vulnerabilities.ts

@@ -1,13 +1,14 @@
-import {accessRestrictionIds,allAppSecIds,authAndCookieIds,cryptoPolicyIds,infoLeakageIds,inputValidationIds,outputValidationIds } from './gdpr.js'
-import {accessControlIds,allAppSecIds as hallAppSecIds,authAndCookieIds as hauthAnCookieIds,cryptoIds,integrityIds} from './hipaa.js'
-import {owaspA1Ids,owaspA2Ids,owaspA3Ids,owaspA5Ids,owaspA7Ids,owaspA8Ids} from './owasp.js'
-import {allAppSecIds as pciAllAppSecIds,misconfigIds as pciMisconfigIds,accessControlIds as pciAccessControlIds,cryptoIds as pciCryptoIds,injectionAndXssIds as pciInjectionAndXssIds,authAndCookieIds as pciAuthAndCookieIds} from './pci-dss.js'
-import { authIds as sauthIds,accessControlIds as saccessControlIds,cmdiIds as scmdiIds,deserializationIds as sdeserializationIds,disclosureIds as sdisclosureIds,injectionIds as sinjectionIds,lfiIds as slfiIds,sqliIds,ssrfIds as ssrfids ,sstiIds as ssstiIds,xssIds as sxssIds} from './sans-top-25.js'
-export const COMPLIANCE_BY_VULNERABILITIES = [
-    {
-        id:3,
-        title:'GDPR',
-        vulnerabilities:[...accessRestrictionIds,...allAppSecIds,...authAndCookieIds,...cryptoPolicyIds,...infoLeakageIds,...inputValidationIds,...outputValidationIds]
+import {accessRestrictionIds,allAppSecIds,authAndCookieIds,cryptoPolicyIds,infoLeakageIds,inputValidationIds,outputValidationIds } from './gdpr.js'
+import {accessControlIds,allAppSecIds as hallAppSecIds,authAndCookieIds as hauthAnCookieIds,cryptoIds,integrityIds} from './hipaa.js'
+import {owaspA1Ids,owaspA2Ids,owaspA3Ids,owaspA5Ids,owaspA7Ids,owaspA8Ids} from './owasp.js'
+import {allAppSecIds as pciAllAppSecIds,misconfigIds as pciMisconfigIds,accessControlIds as pciAccessControlIds,cryptoIds as pciCryptoIds,injectionAndXssIds as pciInjectionAndXssIds,authAndCookieIds as pciAuthAndCookieIds} from './pci-dss.js'
+import { authIds as sauthIds,accessControlIds as saccessControlIds,cmdiIds as scmdiIds,deserializationIds as sdeserializationIds,disclosureIds as sdisclosureIds,injectionIds as sinjectionIds,lfiIds as slfiIds,sqliIds,ssrfIds as ssrfids ,sstiIds as ssstiIds,xssIds as sxssIds} from './sans-top-25.js'
+import { isoAccessControlIds, isoCryptoIds, isoOpsSecurityIds, isoCommunicationsSecurityIds, isoSecureDevelopmentIds, isoComplianceIds } from './iso27001.js'
+export const COMPLIANCE_BY_VULNERABILITIES = [
+    {
+        id:3,
+        title:'GDPR',
+        vulnerabilities:[...accessRestrictionIds,...allAppSecIds,...authAndCookieIds,...cryptoPolicyIds,...infoLeakageIds,...inputValidationIds,...outputValidationIds]
     },
     {
         id:2,
@@ -24,9 +25,14 @@ export const COMPLIANCE_BY_VULNERABILITIES = [
         title:'PCI-DSS',
         vulnerabilities:[...pciAllAppSecIds,...pciMisconfigIds,...pciAccessControlIds,...pciCryptoIds,...pciInjectionAndXssIds,...pciAuthAndCookieIds]
     },
-    {
-        id:6,
-        title:'SANS Top 25',
-        vulnerabilities:[...sauthIds,...saccessControlIds,...scmdiIds,...sdeserializationIds,...sdisclosureIds,...sinjectionIds,...slfiIds,...sqliIds,...ssrfids,...ssstiIds,...sxssIds]
-    }
-];
+    {
+        id:6,
+        title:'SANS Top 25',
+        vulnerabilities:[...sauthIds,...saccessControlIds,...scmdiIds,...sdeserializationIds,...sdisclosureIds,...sinjectionIds,...slfiIds,...sqliIds,...ssrfids,...ssstiIds,...sxssIds]
+    },
+    {
+        id:5,
+        title:'ISO 27001',
+        vulnerabilities:[...isoAccessControlIds,...isoCryptoIds,...isoOpsSecurityIds,...isoCommunicationsSecurityIds,...isoSecureDevelopmentIds,...isoComplianceIds]
+    }
+];

package/src/compliances/index.ts

@@ -3,4 +3,5 @@ export { HIPAA_COMPLIANCE } from './hipaa.js';
 export { GDPR_COMPLIANCE } from './gdpr.js';
 export { PCI_DSS_COMPLIANCE } from './pci-dss.js';
 export { SANS_TOP_25_COMPLIANCE } from './sans-top-25.js';
+export { ISO27001_COMPLIANCE } from './iso27001.js';
 export { COMPLIANCE_BY_VULNERABILITIES } from './compliance-by-vulnerabilities.js';

package/src/compliances/iso27001.ts

@@ -0,0 +1,97 @@
+import { ComplianceCode } from '../compliance-codes';
+import { ComplianceCategory, ComplianceRegistry } from '../types';
+import { idsByCategory, idsByCodePrefix, idsByCodes, mergeIds } from './helpers.js';
+
+const authIds = idsByCategory('authentication');
+const injectionIds = idsByCategory('injection');
+const xssIds = idsByCategory('xss');
+const ssrfIds = idsByCategory('ssrf');
+const configIds = idsByCategory('configuration');
+const disclosureIds = idsByCategory('information_disclosure');
+const cryptoIds = idsByCategory('cryptographic');
+
+const accessControlIds = idsByCodePrefix(['BAC_', 'MASSASSIGN_']);
+const jwtIds = idsByCodePrefix(['JWT_']);
+const cookieIds = idsByCodePrefix(['COOKIE_']);
+const dirbrowseIds = idsByCodePrefix(['DIRBROWSE_']);
+
+const hstsIds = idsByCodes([
+  'HEADER_MISSING_HSTS',
+  'HEADER_HSTS_BAD_MAX_AGE',
+  'HEADER_HSTS_SHORT_MAX_AGE',
+  'HEADER_HSTS_NO_INCLUDESUBDOMAINS',
+  'HEADER_HSTS_PRELOAD_LOW_MAX_AGE',
+  'HEADER_DRIFT_HSTS',
+]);
+
+const cookieSecureIds = idsByCodes([
+  'COOKIE_SAMESITE_NONE_WITHOUT_SECURE',
+  'COOKIE_SESSION_MISSING_SECURE',
+  'COOKIE_MISSING_SECURE',
+  'COOKIE_HOST_PREFIX_INVALID',
+  'COOKIE_SECURE_PREFIX_INVALID',
+]);
+
+export const isoAccessControlIds = mergeIds(accessControlIds, authIds, jwtIds, cookieIds);
+export const isoCryptoIds = mergeIds(cryptoIds, hstsIds, cookieSecureIds);
+export const isoOpsSecurityIds = mergeIds(configIds, disclosureIds, dirbrowseIds);
+export const isoCommunicationsSecurityIds = mergeIds(hstsIds, cookieSecureIds);
+export const isoSecureDevelopmentIds = mergeIds(injectionIds, xssIds, ssrfIds);
+export const isoComplianceIds = mergeIds(accessControlIds, configIds, disclosureIds);
+
+export const ISO27001_COMPLIANCE: ComplianceRegistry = {
+  [ComplianceCode.ISO27001_A9_ACCESS_CONTROL]: {
+    id: 206,
+    code: ComplianceCode.ISO27001_A9_ACCESS_CONTROL,
+    title: 'A.9 Access Control',
+    description: 'Access to information and application functions must be restricted based on business and security requirements, ensuring users can only perform authorized actions.',
+    complianceStandard: ComplianceCategory.ISO27001,
+    relatedVulnerabilityIds: isoAccessControlIds,
+    isNotApplicable: false,
+  },
+  [ComplianceCode.ISO27001_A10_CRYPTOGRAPHY]: {
+    id: 207,
+    code: ComplianceCode.ISO27001_A10_CRYPTOGRAPHY,
+    title: 'A.10 Cryptography',
+    description: 'Cryptographic controls must be used to protect the confidentiality, authenticity, and integrity of information in transit and at rest.',
+    complianceStandard: ComplianceCategory.ISO27001,
+    relatedVulnerabilityIds: isoCryptoIds,
+    isNotApplicable: isoCryptoIds.length === 0,
+  },
+  [ComplianceCode.ISO27001_A12_OPERATIONS_SECURITY]: {
+    id: 208,
+    code: ComplianceCode.ISO27001_A12_OPERATIONS_SECURITY,
+    title: 'A.12 Operations Security',
+    description: 'Operational procedures and controls should prevent misconfiguration and leakage that expose sensitive information or system internals.',
+    complianceStandard: ComplianceCategory.ISO27001,
+    relatedVulnerabilityIds: isoOpsSecurityIds,
+    isNotApplicable: false,
+  },
+  [ComplianceCode.ISO27001_A13_COMMUNICATIONS_SECURITY]: {
+    id: 209,
+    code: ComplianceCode.ISO27001_A13_COMMUNICATIONS_SECURITY,
+    title: 'A.13 Communications Security',
+    description: 'Network and communications must be protected to prevent interception, downgrade, or weak transport protections.',
+    complianceStandard: ComplianceCategory.ISO27001,
+    relatedVulnerabilityIds: isoCommunicationsSecurityIds,
+    isNotApplicable: false,
+  },
+  [ComplianceCode.ISO27001_A14_SYSTEM_ACQUISITION_DEV]: {
+    id: 210,
+    code: ComplianceCode.ISO27001_A14_SYSTEM_ACQUISITION_DEV,
+    title: 'A.14 System Acquisition, Development and Maintenance',
+    description: 'Security must be integrated into the software development lifecycle to prevent common injection and input handling flaws.',
+    complianceStandard: ComplianceCategory.ISO27001,
+    relatedVulnerabilityIds: isoSecureDevelopmentIds,
+    isNotApplicable: false,
+  },
+  [ComplianceCode.ISO27001_A18_COMPLIANCE]: {
+    id: 211,
+    code: ComplianceCode.ISO27001_A18_COMPLIANCE,
+    title: 'A.18 Compliance',
+    description: 'Security controls should be verified to ensure regulatory and contractual requirements for access restriction and data protection are met.',
+    complianceStandard: ComplianceCategory.ISO27001,
+    relatedVulnerabilityIds: isoComplianceIds,
+    isNotApplicable: false,
+  },
+};

package/src/index.ts

@@ -15,7 +15,7 @@ import { CONFIG_VULNERABILITIES } from './categories/configuration.js';
 import { SENSITIVE_PATH_VULNERABILITIES } from './categories/sensitive-paths.js';
 import { CATEGORY_REGISTRY } from './category.js';
 import { SCANNER_REGISTRY } from './scanner.js';
-import { OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE,COMPLIANCE_BY_VULNERABILITIES } from './compliances/index.js';
+import { OWASP_COMPLIANCE, HIPAA_COMPLIANCE, GDPR_COMPLIANCE, PCI_DSS_COMPLIANCE, SANS_TOP_25_COMPLIANCE, ISO27001_COMPLIANCE, COMPLIANCE_BY_VULNERABILITIES } from './compliances/index.js';
 
 /**
  * Get vulnerability definition by code
@@ -102,15 +102,16 @@ export {
     CONFIG_VULNERABILITIES,
     SENSITIVE_PATH_VULNERABILITIES,
     VULNERABILITY_REGISTRY,
-    OWASP_COMPLIANCE,
-    HIPAA_COMPLIANCE,
-    GDPR_COMPLIANCE,
-    PCI_DSS_COMPLIANCE,
-    SANS_TOP_25_COMPLIANCE,
-    CATEGORY_REGISTRY,
-    SCANNER_REGISTRY,
-    COMPLIANCE_BY_VULNERABILITIES
-};
+    OWASP_COMPLIANCE,
+    HIPAA_COMPLIANCE,
+    GDPR_COMPLIANCE,
+    PCI_DSS_COMPLIANCE,
+    SANS_TOP_25_COMPLIANCE,
+    ISO27001_COMPLIANCE,
+    CATEGORY_REGISTRY,
+    SCANNER_REGISTRY,
+    COMPLIANCE_BY_VULNERABILITIES
+};
 
 export default {
     VulnerabilityCode,
@@ -122,11 +123,12 @@ export default {
     getAllVulnerabilityCodes,
     getVulnerabilityCount,
     createFinding,
-    OWASP_COMPLIANCE,
-    HIPAA_COMPLIANCE,
-    GDPR_COMPLIANCE,
-    PCI_DSS_COMPLIANCE,
-    SANS_TOP_25_COMPLIANCE,
-    CATEGORY_REGISTRY,
-    SCANNER_REGISTRY,
-};
+    OWASP_COMPLIANCE,
+    HIPAA_COMPLIANCE,
+    GDPR_COMPLIANCE,
+    PCI_DSS_COMPLIANCE,
+    SANS_TOP_25_COMPLIANCE,
+    ISO27001_COMPLIANCE,
+    CATEGORY_REGISTRY,
+    SCANNER_REGISTRY,
+};

package/src/types.ts

@@ -119,6 +119,7 @@ export enum ComplianceCategory {
     GDPR = 'GDPR',
     PCIDSS = 'PCIDSS',
     SANS_TOP_25 = 'SANS_TOP_25',
+    ISO27001 = 'ISO27001',
 }
 
 /**