vaspera 2.5.0

package/dist/compliance/cis.js

@@ -0,0 +1,316 @@
+/**
+ * CIS Critical Security Controls v8
+ *
+ * Center for Internet Security Controls
+ *
+ * @module compliance/cis
+ */
+/**
+ * CIS control categories (Implementation Groups)
+ */
+export const CIS_CATEGORIES = [
+    "Inventory and Control of Enterprise Assets",
+    "Inventory and Control of Software Assets",
+    "Data Protection",
+    "Secure Configuration",
+    "Account Management",
+    "Access Control Management",
+    "Continuous Vulnerability Management",
+    "Audit Log Management",
+    "Email and Web Browser Protections",
+    "Malware Defenses",
+    "Data Recovery",
+    "Network Infrastructure Management",
+    "Network Monitoring and Defense",
+    "Security Awareness Training",
+    "Service Provider Management",
+    "Application Software Security",
+    "Incident Response Management",
+    "Penetration Testing",
+];
+/**
+ * CIS Controls v8 relevant to code security
+ */
+export const CIS_CONTROLS = [
+    // Control 2: Inventory and Control of Software Assets
+    {
+        id: "2.1",
+        framework: "CIS",
+        category: "Inventory and Control of Software Assets",
+        title: "Establish and Maintain a Software Inventory",
+        description: "Establish and maintain a detailed inventory of all licensed software installed on enterprise assets.",
+        keywords: ["inventory", "SBOM", "software", "dependencies"],
+        findingCategories: ["dependencies", "sbom"],
+    },
+    {
+        id: "2.2",
+        framework: "CIS",
+        category: "Inventory and Control of Software Assets",
+        title: "Ensure Authorized Software is Currently Supported",
+        description: "Ensure that only currently supported software is designated as authorized.",
+        keywords: ["supported", "EOL", "outdated", "deprecated"],
+        findingCategories: ["dependencies", "vulnerabilities"],
+    },
+    {
+        id: "2.5",
+        framework: "CIS",
+        category: "Inventory and Control of Software Assets",
+        title: "Allowlist Authorized Software",
+        description: "Use technical controls to ensure only authorized software can execute.",
+        keywords: ["allowlist", "whitelist", "authorized"],
+        findingCategories: ["security", "configuration"],
+    },
+    // Control 3: Data Protection
+    {
+        id: "3.1",
+        framework: "CIS",
+        category: "Data Protection",
+        title: "Establish and Maintain a Data Management Process",
+        description: "Establish and maintain a data management process that addresses data sensitivity, ownership, and handling.",
+        keywords: ["data", "management", "classification"],
+        findingCategories: ["data-exposure", "data-protection"],
+    },
+    {
+        id: "3.10",
+        framework: "CIS",
+        category: "Data Protection",
+        title: "Encrypt Sensitive Data in Transit",
+        description: "Encrypt sensitive data in transit using strong encryption.",
+        keywords: ["encryption", "transit", "TLS", "HTTPS"],
+        findingCategories: ["encryption", "transport-security"],
+        cweIds: ["CWE-319"],
+    },
+    {
+        id: "3.11",
+        framework: "CIS",
+        category: "Data Protection",
+        title: "Encrypt Sensitive Data at Rest",
+        description: "Encrypt sensitive data at rest using strong encryption.",
+        keywords: ["encryption", "rest", "storage", "cryptography"],
+        findingCategories: ["encryption", "data-protection"],
+        cweIds: ["CWE-311", "CWE-312"],
+    },
+    // Control 4: Secure Configuration
+    {
+        id: "4.1",
+        framework: "CIS",
+        category: "Secure Configuration",
+        title: "Establish Secure Configuration Process",
+        description: "Establish and maintain a secure configuration process for enterprise assets.",
+        keywords: ["configuration", "hardening", "baseline"],
+        findingCategories: ["configuration", "security"],
+    },
+    {
+        id: "4.7",
+        framework: "CIS",
+        category: "Secure Configuration",
+        title: "Manage Default Accounts",
+        description: "Manage default accounts on enterprise assets and software.",
+        keywords: ["default", "accounts", "credentials"],
+        findingCategories: ["authentication", "secrets"],
+        cweIds: ["CWE-798"],
+    },
+    // Control 5: Account Management
+    {
+        id: "5.1",
+        framework: "CIS",
+        category: "Account Management",
+        title: "Establish Account Management Process",
+        description: "Establish and maintain an inventory of all accounts managed in the enterprise.",
+        keywords: ["accounts", "inventory", "management"],
+        findingCategories: ["authentication", "identity"],
+    },
+    {
+        id: "5.2",
+        framework: "CIS",
+        category: "Account Management",
+        title: "Use Unique Passwords",
+        description: "Use unique passwords for all enterprise assets.",
+        keywords: ["passwords", "unique", "credentials"],
+        findingCategories: ["authentication", "secrets"],
+        cweIds: ["CWE-521"],
+    },
+    // Control 6: Access Control Management
+    {
+        id: "6.1",
+        framework: "CIS",
+        category: "Access Control Management",
+        title: "Establish Access Granting Process",
+        description: "Establish and maintain an access granting process for enterprise assets.",
+        keywords: ["access", "granting", "authorization"],
+        findingCategories: ["authorization", "access-control"],
+        cweIds: ["CWE-284"],
+    },
+    {
+        id: "6.3",
+        framework: "CIS",
+        category: "Access Control Management",
+        title: "Require MFA for Externally-Exposed Applications",
+        description: "Require MFA for externally-exposed enterprise or third-party applications.",
+        keywords: ["MFA", "authentication", "external"],
+        findingCategories: ["authentication", "mfa"],
+        cweIds: ["CWE-308"],
+    },
+    {
+        id: "6.5",
+        framework: "CIS",
+        category: "Access Control Management",
+        title: "Require MFA for Administrative Access",
+        description: "Require MFA for all administrative access accounts.",
+        keywords: ["MFA", "admin", "administrative"],
+        findingCategories: ["authentication", "mfa"],
+        cweIds: ["CWE-308"],
+    },
+    // Control 7: Continuous Vulnerability Management
+    {
+        id: "7.1",
+        framework: "CIS",
+        category: "Continuous Vulnerability Management",
+        title: "Establish Vulnerability Management Process",
+        description: "Establish and maintain a documented vulnerability management process.",
+        keywords: ["vulnerability", "management", "process"],
+        findingCategories: ["vulnerabilities", "security"],
+    },
+    {
+        id: "7.3",
+        framework: "CIS",
+        category: "Continuous Vulnerability Management",
+        title: "Perform Automated Vulnerability Scans",
+        description: "Perform automated vulnerability scans of internal enterprise assets.",
+        keywords: ["scanning", "automated", "vulnerability"],
+        findingCategories: ["vulnerabilities", "security"],
+    },
+    {
+        id: "7.4",
+        framework: "CIS",
+        category: "Continuous Vulnerability Management",
+        title: "Remediate Detected Vulnerabilities",
+        description: "Remediate detected vulnerabilities in software through processes and tooling.",
+        keywords: ["remediation", "patching", "fixing"],
+        findingCategories: ["vulnerabilities", "dependencies"],
+        cweIds: ["CWE-1035"],
+    },
+    // Control 8: Audit Log Management
+    {
+        id: "8.2",
+        framework: "CIS",
+        category: "Audit Log Management",
+        title: "Collect Audit Logs",
+        description: "Collect audit logs from all enterprise assets capable of generating them.",
+        keywords: ["logging", "audit", "collection"],
+        findingCategories: ["logging", "audit"],
+        cweIds: ["CWE-778"],
+    },
+    {
+        id: "8.5",
+        framework: "CIS",
+        category: "Audit Log Management",
+        title: "Collect Detailed Audit Logs",
+        description: "Configure detailed audit logging for enterprise assets containing sensitive data.",
+        keywords: ["detailed", "logging", "sensitive"],
+        findingCategories: ["logging", "audit"],
+    },
+    // Control 16: Application Software Security
+    {
+        id: "16.1",
+        framework: "CIS",
+        category: "Application Software Security",
+        title: "Establish Application Security Process",
+        description: "Establish and maintain a secure application development process.",
+        keywords: ["application", "security", "SDLC"],
+        findingCategories: ["security", "code-quality"],
+    },
+    {
+        id: "16.2",
+        framework: "CIS",
+        category: "Application Software Security",
+        title: "Establish Process for Third-Party Libraries",
+        description: "Establish and maintain a process to accept and address reports of software vulnerabilities.",
+        keywords: ["third-party", "libraries", "dependencies"],
+        findingCategories: ["dependencies", "vulnerabilities"],
+    },
+    {
+        id: "16.4",
+        framework: "CIS",
+        category: "Application Software Security",
+        title: "Perform Root Cause Analysis",
+        description: "Conduct root cause analysis on security vulnerabilities.",
+        keywords: ["root-cause", "analysis", "vulnerabilities"],
+        findingCategories: ["security", "vulnerabilities"],
+    },
+    {
+        id: "16.5",
+        framework: "CIS",
+        category: "Application Software Security",
+        title: "Use Up-to-Date Components",
+        description: "Use up-to-date and trusted third-party software components.",
+        keywords: ["components", "up-to-date", "dependencies"],
+        findingCategories: ["dependencies", "vulnerabilities"],
+        cweIds: ["CWE-1035"],
+    },
+    {
+        id: "16.6",
+        framework: "CIS",
+        category: "Application Software Security",
+        title: "Establish Code Repository Security",
+        description: "Establish and maintain a process to protect code repositories.",
+        keywords: ["repository", "code", "security"],
+        findingCategories: ["secrets", "security"],
+    },
+    {
+        id: "16.9",
+        framework: "CIS",
+        category: "Application Software Security",
+        title: "Train Developers on Security",
+        description: "Ensure developers are trained in application security topics.",
+        keywords: ["training", "developers", "security"],
+        findingCategories: ["security"],
+    },
+    {
+        id: "16.10",
+        framework: "CIS",
+        category: "Application Software Security",
+        title: "Apply Secure Design Principles",
+        description: "Apply secure design principles in application architectures.",
+        keywords: ["secure-design", "architecture", "principles"],
+        findingCategories: ["security", "architecture"],
+    },
+    {
+        id: "16.11",
+        framework: "CIS",
+        category: "Application Software Security",
+        title: "Implement Web Application Firewalls",
+        description: "Implement a Web Application Firewall (WAF) for web applications.",
+        keywords: ["WAF", "firewall", "web"],
+        findingCategories: ["security", "injection", "xss"],
+        cweIds: ["CWE-89", "CWE-79"],
+    },
+    {
+        id: "16.12",
+        framework: "CIS",
+        category: "Application Software Security",
+        title: "Implement Code-Level Security Checks",
+        description: "Apply static and dynamic application security testing tools.",
+        keywords: ["SAST", "DAST", "testing", "security"],
+        findingCategories: ["security", "code-quality"],
+    },
+];
+/**
+ * Get all CIS controls
+ */
+export function getCISControls() {
+    return CIS_CONTROLS;
+}
+/**
+ * Get CIS controls by category
+ */
+export function getCISControlsByCategory(category) {
+    return CIS_CONTROLS.filter((c) => c.category === category);
+}
+/**
+ * Get CIS categories
+ */
+export function getCISCategories() {
+    return CIS_CATEGORIES;
+}
+//# sourceMappingURL=cis.js.map

package/dist/compliance/cis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cis.js","sourceRoot":"","sources":["../../src/compliance/cis.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,4CAA4C;IAC5C,0CAA0C;IAC1C,iBAAiB;IACjB,sBAAsB;IACtB,oBAAoB;IACpB,2BAA2B;IAC3B,qCAAqC;IACrC,sBAAsB;IACtB,mCAAmC;IACnC,kBAAkB;IAClB,eAAe;IACf,mCAAmC;IACnC,gCAAgC;IAChC,6BAA6B;IAC7B,6BAA6B;IAC7B,+BAA+B;IAC/B,8BAA8B;IAC9B,qBAAqB;CACb,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAwB;IAC/C,sDAAsD;IACtD;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,0CAA0C;QACpD,KAAK,EAAE,6CAA6C;QACpD,WAAW,EACT,sGAAsG;QACxG,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC;QAC3D,iBAAiB,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC;KAC5C;IACD;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,0CAA0C;QACpD,KAAK,EAAE,mDAAmD;QAC1D,WAAW,EACT,4EAA4E;QAC9E,QAAQ,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC;QACxD,iBAAiB,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;KACvD;IACD;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,0CAA0C;QACpD,KAAK,EAAE,+BAA+B;QACtC,WAAW,EACT,wEAAwE;QAC1E,QAAQ,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC;QAClD,iBAAiB,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;KACjD;IAED,6BAA6B;IAC7B;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,iBAAiB;QAC3B,KAAK,EAAE,kDAAkD;QACzD,WAAW,EACT,4GAA4G;QAC9G,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,gBAAgB,CAAC;QAClD,iBAAiB,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC;KACxD;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,iBAAiB;QAC3B,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EACT,4DAA4D;QAC9D,QAAQ,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC;QACnD,iBAAiB,EAAE,CAAC,YAAY,EAAE,oBAAoB,CAAC;QACvD,MAAM,EAAE,CAAC,SAAS,CAAC;KACpB;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,iBAAiB;QAC3B,KAAK,EAAE,gCAAgC;QACvC,WAAW,EACT,yDAAyD;QAC3D,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,CAAC;QAC3D,iBAAiB,EAAE,CAAC,YAAY,EAAE,iBAAiB,CAAC;QACpD,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;KAC/B;IAED,kCAAkC;IAClC;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,sBAAsB;QAChC,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EACT,8EAA8E;QAChF,QAAQ,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,UAAU,CAAC;QACpD,iBAAiB,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;KACjD;IACD;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,sBAAsB;QAChC,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,4DAA4D;QAC9D,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC;QAChD,iBAAiB,EAAE,CAAC,gBAAgB,EAAE,SAAS,CAAC;QAChD,MAAM,EAAE,CAAC,SAAS,CAAC;KACpB;IAED,gCAAgC;IAChC;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,oBAAoB;QAC9B,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EACT,gFAAgF;QAClF,QAAQ,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,CAAC;QACjD,iBAAiB,EAAE,CAAC,gBAAgB,EAAE,UAAU,CAAC;KAClD;IACD;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,oBAAoB;QAC9B,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,iDAAiD;QAC9D,QAAQ,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC;QAChD,iBAAiB,EAAE,CAAC,gBAAgB,EAAE,SAAS,CAAC;QAChD,MAAM,EAAE,CAAC,SAAS,CAAC;KACpB;IAED,uCAAuC;IACvC;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,2BAA2B;QACrC,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EACT,0EAA0E;QAC5E,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,eAAe,CAAC;QACjD,iBAAiB,EAAE,CAAC,eAAe,EAAE,gBAAgB,CAAC;QACtD,MAAM,EAAE,CAAC,SAAS,CAAC;KACpB;IACD;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,2BAA2B;QACrC,KAAK,EAAE,iDAAiD;QACxD,WAAW,EACT,4EAA4E;QAC9E,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,CAAC;QAC/C,iBAAiB,EAAE,CAAC,gBAAgB,EAAE,KAAK,CAAC;QAC5C,MAAM,EAAE,CAAC,SAAS,CAAC;KACpB;IACD;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,2BAA2B;QACrC,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EAAE,qDAAqD;QAClE,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC;QAC5C,iBAAiB,EAAE,CAAC,gBAAgB,EAAE,KAAK,CAAC;QAC5C,MAAM,EAAE,CAAC,SAAS,CAAC;KACpB;IAED,iDAAiD;IACjD;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,qCAAqC;QAC/C,KAAK,EAAE,4CAA4C;QACnD,WAAW,EACT,uEAAuE;QACzE,QAAQ,EAAE,CAAC,eAAe,EAAE,YAAY,EAAE,SAAS,CAAC;QACpD,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,UAAU,CAAC;KACnD;IACD;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,qCAAqC;QAC/C,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EACT,sEAAsE;QACxE,QAAQ,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,eAAe,CAAC;QACpD,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,UAAU,CAAC;KACnD;IACD;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,qCAAqC;QAC/C,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,+EAA+E;QACjF,QAAQ,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC;QAC/C,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,cAAc,CAAC;QACtD,MAAM,EAAE,CAAC,UAAU,CAAC;KACrB;IAED,kCAAkC;IAClC;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,sBAAsB;QAChC,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,2EAA2E;QAC7E,QAAQ,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC;QAC5C,iBAAiB,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC;KACpB;IACD;QACE,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,sBAAsB;QAChC,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,mFAAmF;QACrF,QAAQ,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC;QAC9C,iBAAiB,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;KACxC;IAED,4CAA4C;IAC5C;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,+BAA+B;QACzC,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EACT,kEAAkE;QACpE,QAAQ,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,MAAM,CAAC;QAC7C,iBAAiB,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;KAChD;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,+BAA+B;QACzC,KAAK,EAAE,6CAA6C;QACpD,WAAW,EACT,6FAA6F;QAC/F,QAAQ,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,cAAc,CAAC;QACtD,iBAAiB,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;KACvD;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,+BAA+B;QACzC,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,0DAA0D;QAC5D,QAAQ,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,iBAAiB,CAAC;QACvD,iBAAiB,EAAE,CAAC,UAAU,EAAE,iBAAiB,CAAC;KACnD;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,+BAA+B;QACzC,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,6DAA6D;QAC/D,QAAQ,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,cAAc,CAAC;QACtD,iBAAiB,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;QACtD,MAAM,EAAE,CAAC,UAAU,CAAC;KACrB;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,+BAA+B;QACzC,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,gEAAgE;QAClE,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC;QAC5C,iBAAiB,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;KAC3C;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,+BAA+B;QACzC,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,+DAA+D;QACjE,QAAQ,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC;QAChD,iBAAiB,EAAE,CAAC,UAAU,CAAC;KAChC;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,+BAA+B;QACzC,KAAK,EAAE,gCAAgC;QACvC,WAAW,EACT,8DAA8D;QAChE,QAAQ,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,YAAY,CAAC;QACzD,iBAAiB,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;KAChD;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,+BAA+B;QACzC,KAAK,EAAE,qCAAqC;QAC5C,WAAW,EACT,kEAAkE;QACpE,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;QACpC,iBAAiB,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC;QACnD,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;KAC7B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,+BAA+B;QACzC,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EACT,8DAA8D;QAChE,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC;QACjD,iBAAiB,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;KAChD;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,cAAc,CAAC;AACxB,CAAC"}

package/dist/compliance/frameworks/eu-ai-act.d.ts

@@ -0,0 +1,55 @@
+/**
+ * EU AI Act Compliance Framework
+ *
+ * Maps security findings to EU AI Act requirements (Regulation 2024/1689).
+ * The EU AI Act establishes harmonized rules for AI systems within the EU,
+ * with risk-based categorization and specific requirements for high-risk systems.
+ *
+ * @see https://eur-lex.europa.eu/eli/reg/2024/1689
+ * @module compliance/frameworks/eu-ai-act
+ */
+import type { ComplianceControl } from "../types.js";
+/**
+ * EU AI Act Risk Levels
+ */
+export type AIActRiskLevel = "Unacceptable" | "High" | "Limited" | "Minimal";
+/**
+ * EU AI Act System Categories
+ */
+export type AIActCategory = "General Purpose AI" | "High-Risk AI" | "Limited Risk AI" | "Prohibited AI";
+/**
+ * EU AI Act Controls
+ *
+ * Based on EU AI Act (Regulation 2024/1689) requirements.
+ * Controls are organized by Article with focus on high-risk AI requirements.
+ */
+export declare const EU_AI_ACT_CONTROLS: ComplianceControl[];
+/**
+ * Get all EU AI Act controls
+ */
+export declare function getEUAIActControls(): ComplianceControl[];
+/**
+ * Get EU AI Act control by ID
+ */
+export declare function getEUAIActControlById(id: string): ComplianceControl | undefined;
+/**
+ * Get EU AI Act controls by category
+ */
+export declare function getEUAIActControlsByCategory(category: string): ComplianceControl[];
+/**
+ * Get all EU AI Act categories
+ */
+export declare function getEUAIActCategories(): string[];
+/**
+ * Determine AI system risk level based on findings
+ */
+export declare function determineRiskLevel(findingCategories: string[]): AIActRiskLevel;
+/**
+ * Get applicable articles based on AI system type
+ */
+export declare function getApplicableArticles(isHighRisk: boolean, isGPAI: boolean, hasSystemicRisk: boolean): string[];
+/**
+ * Cross-mapping to OWASP LLM Top 10
+ */
+export declare const EU_AI_ACT_TO_OWASP_LLM_MAPPING: Record<string, string[]>;
+//# sourceMappingURL=eu-ai-act.d.ts.map

package/dist/compliance/frameworks/eu-ai-act.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eu-ai-act.d.ts","sourceRoot":"","sources":["../../../src/compliance/frameworks/eu-ai-act.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,cAAc,GACd,MAAM,GACN,SAAS,GACT,SAAS,CAAC;AAEd;;GAEG;AACH,MAAM,MAAM,aAAa,GACrB,oBAAoB,GACpB,cAAc,GACd,iBAAiB,GACjB,eAAe,CAAC;AAEpB;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,iBAAiB,EAijBjD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,iBAAiB,EAAE,CAExD;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAE/E;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAElF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,EAAE,CAE/C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,iBAAiB,EAAE,MAAM,EAAE,GAC1B,cAAc,CAsBhB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,OAAO,EACnB,MAAM,EAAE,OAAO,EACf,eAAe,EAAE,OAAO,GACvB,MAAM,EAAE,CA4BV;AAED;;GAEG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CASnE,CAAC"}