monora-ai 2.1.0 → 2.1.4

package/templates/controls/soc2_control_catalog.json

@@ -0,0 +1,163 @@
+{
+  "catalog_id": "soc2_gap_catalog_monora",
+  "standard": "SOC2",
+  "version": "0.1.0",
+  "generated_at": "2026-02-16T00:00:00+00:00",
+  "notes": "Default SOC 2 Trust Services Criteria control catalog for workflow coverage and gap prioritization.",
+  "controls": [
+    {
+      "control_id": "CC1",
+      "clause": "CC",
+      "title": "Control Environment",
+      "requirement": "Establish integrity and ethical values.",
+      "guidance": "Document governance and accountability structure.",
+      "evidence_types": ["governance_charter", "policy_document"],
+      "frequency": "annual",
+      "owner": "Compliance Lead",
+      "system": "governance",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "CC2",
+      "clause": "CC",
+      "title": "Communication and Information",
+      "requirement": "Maintain internal/external communication for controls.",
+      "guidance": "Document control communication channels.",
+      "evidence_types": ["communication_plan", "review_minutes"],
+      "frequency": "quarterly",
+      "owner": "Compliance Lead",
+      "system": "governance",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "medium"
+    },
+    {
+      "control_id": "CC3",
+      "clause": "CC",
+      "title": "Risk Assessment",
+      "requirement": "Identify and analyze risks.",
+      "guidance": "Maintain risk register and periodic reviews.",
+      "evidence_types": ["risk_register", "risk_review_minutes"],
+      "frequency": "quarterly",
+      "owner": "Risk Lead",
+      "system": "risk_management",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "CC4",
+      "clause": "CC",
+      "title": "Monitoring Activities",
+      "requirement": "Monitor controls and remediate deficiencies.",
+      "guidance": "Track monitoring outcomes and corrective actions.",
+      "evidence_types": ["monitoring_report", "corrective_action_log"],
+      "frequency": "monthly",
+      "owner": "Internal Audit Lead",
+      "system": "monitoring",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "CC5",
+      "clause": "CC",
+      "title": "Control Activities",
+      "requirement": "Implement and enforce control procedures.",
+      "guidance": "Enforce policies and document exceptions.",
+      "evidence_types": ["policy_configuration", "exception_log"],
+      "frequency": "monthly",
+      "owner": "Security Lead",
+      "system": "policy_enforcement",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "CC6",
+      "clause": "CC",
+      "title": "Logical and Physical Access Controls",
+      "requirement": "Restrict system access to authorized users.",
+      "guidance": "Track identity controls and least-privilege access.",
+      "evidence_types": ["identity_and_mfa_report", "access_review"],
+      "frequency": "monthly",
+      "owner": "Security Lead",
+      "system": "access_control",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "critical"
+    },
+    {
+      "control_id": "CC7",
+      "clause": "CC",
+      "title": "System Operations",
+      "requirement": "Detect and respond to operational anomalies.",
+      "guidance": "Track runtime integrity and incident response.",
+      "evidence_types": ["runtime_observability_report", "incident_response_record"],
+      "frequency": "monthly",
+      "owner": "Operations Lead",
+      "system": "operations",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "CC8",
+      "clause": "CC",
+      "title": "Change Management",
+      "requirement": "Manage changes through controlled workflow.",
+      "guidance": "Document approvals and deployment controls.",
+      "evidence_types": ["change_approval_record", "deployment_approval_records"],
+      "frequency": "monthly",
+      "owner": "Engineering Lead",
+      "system": "change_management",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "medium"
+    },
+    {
+      "control_id": "CC9",
+      "clause": "CC",
+      "title": "Risk Mitigation",
+      "requirement": "Mitigate identified risks with documented actions.",
+      "guidance": "Track mitigation plans and completion.",
+      "evidence_types": ["risk_register", "mitigation_plan"],
+      "frequency": "quarterly",
+      "owner": "Risk Lead",
+      "system": "risk_management",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "P_SERIES",
+      "clause": "P",
+      "title": "Privacy",
+      "requirement": "Operate in accordance with privacy commitments.",
+      "guidance": "Document notices, consent, and subject rights handling.",
+      "evidence_types": ["privacy_notice", "data_subject_request_log"],
+      "frequency": "quarterly",
+      "owner": "Privacy Officer",
+      "system": "privacy_program",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "PI_SERIES",
+      "clause": "PI",
+      "title": "Processing Integrity",
+      "requirement": "Ensure complete, valid, and accurate processing.",
+      "guidance": "Track processing controls and integrity validation.",
+      "evidence_types": ["processing_integrity_report", "integrity_validation_log"],
+      "frequency": "monthly",
+      "owner": "Operations Lead",
+      "system": "processing_integrity",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "high"
+    }
+  ]
+}

package/templates/standards/iso42001_claims.json

@@ -0,0 +1,72 @@
+{
+  "report": {
+    "standard": "ISO42001",
+    "title": "ISO/IEC 42001 AIMS Claims Report",
+    "version": "2026-01",
+    "source": "Customer-provided report"
+  },
+  "excerpts": [],
+  "claims": [
+    {
+      "id": "ISO42001-A5",
+      "standard": "ISO42001",
+      "section": "A.5",
+      "statement": "AI risk and impact assessment workflows are enabled.",
+      "requires_excerpts": true,
+      "evidence_excerpts": [],
+      "checks": [
+        { "type": "config_required", "path": "risk_register.enabled", "equals": true },
+        { "type": "config_required", "path": "bias.enabled", "equals": true }
+      ]
+    },
+    {
+      "id": "ISO42001-A6",
+      "standard": "ISO42001",
+      "section": "A.6",
+      "statement": "Lifecycle and operational controls are tracked with immutable evidence.",
+      "requires_excerpts": true,
+      "evidence_excerpts": [],
+      "checks": [
+        { "type": "config_required", "path": "lifecycle.enabled", "equals": true },
+        { "type": "hash_chain_status", "status": "verified" },
+        { "type": "sequence_gaps_max", "max": 0 }
+      ]
+    },
+    {
+      "id": "ISO42001-A7",
+      "standard": "ISO42001",
+      "section": "A.7",
+      "statement": "Data governance controls are enabled for AI system data.",
+      "requires_excerpts": true,
+      "evidence_excerpts": [],
+      "checks": [
+        { "type": "config_required", "path": "data_governance.enabled", "equals": true },
+        { "type": "config_required", "path": "data_handling.enabled", "equals": true }
+      ]
+    },
+    {
+      "id": "ISO42001-A8",
+      "standard": "ISO42001",
+      "section": "A.8",
+      "statement": "Human oversight and policy governance are documented.",
+      "requires_excerpts": true,
+      "evidence_excerpts": [],
+      "checks": [
+        { "type": "config_required", "path": "human_oversight.enabled", "equals": true },
+        { "type": "config_required", "path": "policies.enforce", "equals": true }
+      ]
+    },
+    {
+      "id": "ISO42001-AIMS-INTEGRITY",
+      "standard": "ISO42001",
+      "section": "Clause 9/10",
+      "statement": "Governance evidence supports verifiable integrity for audit reporting.",
+      "requires_excerpts": true,
+      "evidence_excerpts": [],
+      "checks": [
+        { "type": "signatures_status", "status": "verified" },
+        { "type": "errors_max", "max": 0 }
+      ]
+    }
+  ]
+}