icdev 0.0.3__py3-none-any.whl

args/audit_regimes/cmmc_l2.json

@@ -0,0 +1,906 @@
+{
+  "regime": {
+    "id": "cmmc_l2",
+    "name": "CMMC Level 2",
+    "version": "2.0",
+    "last_updated": "2026-03-09",
+    "description": "Cybersecurity Maturity Model Certification Level 2 — Advanced cyber hygiene for CUI protection",
+    "authority": "DoD / OUSD(A&S)"
+  },
+  "categories": [
+    {
+      "id": "AC",
+      "name": "Access Control",
+      "controls": [
+        {
+          "id": "AC.L2-3.1.1",
+          "title": "Authorized Access Control",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "stig"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "auth|login|session|rbac|user_management"
+            }
+          ],
+          "scoring": {
+            "pass": "Authorized access control enforced for all system users",
+            "partial": "Access control present but not consistently enforced",
+            "fail": "No authorized access control mechanism"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AC-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.1.1"
+            }
+          ]
+        },
+        {
+          "id": "AC.L2-3.1.2",
+          "title": "Transaction and Function Control",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "authorize|permission|role|access_control|rbac"
+            },
+            {
+              "type": "tool",
+              "tool": "sast"
+            }
+          ],
+          "scoring": {
+            "pass": "Transaction-level access enforcement detected",
+            "fail": "No transaction-level access control"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AC-3"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.1.2"
+            }
+          ]
+        },
+        {
+          "id": "AC.L2-3.1.3",
+          "title": "CUI Flow Enforcement",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "firewall|network_policy|ingress|egress|flow_control"
+            }
+          ],
+          "scoring": {
+            "pass": "CUI flow enforcement controls present",
+            "fail": "No CUI flow enforcement detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AC-4"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.1.3"
+            }
+          ]
+        },
+        {
+          "id": "AC.L2-3.1.5",
+          "title": "Least Privilege",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "least_privilege|minimal_permissions|non.?root|read.?only"
+            },
+            {
+              "type": "tool",
+              "tool": "file_permissions"
+            }
+          ],
+          "scoring": {
+            "pass": "Least privilege enforcement detected",
+            "fail": "No least privilege enforcement"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AC-6"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.1.5"
+            }
+          ]
+        },
+        {
+          "id": "AC.L2-3.1.7",
+          "title": "Privileged Functions",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "sudo|admin|privileged|elevat|root_access"
+            },
+            {
+              "type": "tool",
+              "tool": "sast"
+            }
+          ],
+          "scoring": {
+            "pass": "Privileged function access restricted and audited",
+            "fail": "Unrestricted privileged function access"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AC-6(1)"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.1.7"
+            }
+          ]
+        },
+        {
+          "id": "AC.L2-3.1.12",
+          "title": "Remote Access Control",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "vpn|tls|ssh|mTLS|mutual_tls|remote_access"
+            }
+          ],
+          "scoring": {
+            "pass": "Secure remote access mechanism enforced",
+            "fail": "No secure remote access controls"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AC-17"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.1.12"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "AU",
+      "name": "Audit and Accountability",
+      "controls": [
+        {
+          "id": "AU.L2-3.3.1",
+          "title": "System Auditing",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "logging|audit_trail|log_event|audit_log"
+            },
+            {
+              "type": "tool",
+              "tool": "code_patterns"
+            }
+          ],
+          "scoring": {
+            "pass": "System-level audit logging active",
+            "fail": "No system audit logging"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AU-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.3.1"
+            }
+          ]
+        },
+        {
+          "id": "AU.L2-3.3.2",
+          "title": "User Accountability",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "user_id|session_id|actor|principal|attribution"
+            }
+          ],
+          "scoring": {
+            "pass": "Audit records traceable to individual users",
+            "fail": "No user-level audit attribution"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AU-3"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.3.2"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "AT",
+      "name": "Awareness and Training",
+      "controls": [
+        {
+          "id": "AT.L2-3.2.1",
+          "title": "Role-Based Risk Awareness",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "training|awareness|security_brief|onboarding"
+            }
+          ],
+          "scoring": {
+            "pass": "Security awareness training documented",
+            "fail": "No security awareness training evidence"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AT-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.2.1"
+            }
+          ]
+        },
+        {
+          "id": "AT.L2-3.2.2",
+          "title": "Role-Based Training",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "role_training|security_training|developer_training"
+            }
+          ],
+          "scoring": {
+            "pass": "Role-based security training program present",
+            "fail": "No role-based training program"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AT-3"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.2.2"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "CM",
+      "name": "Configuration Management",
+      "controls": [
+        {
+          "id": "CM.L2-3.4.1",
+          "title": "System Baselining",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sbom"
+            },
+            {
+              "type": "tool",
+              "tool": "file_permissions"
+            }
+          ],
+          "scoring": {
+            "pass": "System baseline configuration established and maintained",
+            "fail": "No baseline configuration"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "CM-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.4.1"
+            }
+          ]
+        },
+        {
+          "id": "CM.L2-3.4.2",
+          "title": "Security Configuration Enforcement",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "stig"
+            }
+          ],
+          "scoring": {
+            "pass": "Security configurations enforced per STIG baseline",
+            "fail": "Configuration non-compliance detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "CM-6"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.4.2"
+            }
+          ]
+        },
+        {
+          "id": "CM.L2-3.4.5",
+          "title": "Change Tracking",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "git|version_control|change_request|changelog"
+            }
+          ],
+          "scoring": {
+            "pass": "Configuration change tracking present",
+            "fail": "No change tracking detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "CM-3"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.4.5"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "IA",
+      "name": "Identification and Authentication",
+      "controls": [
+        {
+          "id": "IA.L2-3.5.1",
+          "title": "Identification",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "authenticate|login|credential|identity|user_id"
+            },
+            {
+              "type": "tool",
+              "tool": "code_patterns"
+            }
+          ],
+          "scoring": {
+            "pass": "User identification and authentication system present",
+            "fail": "No user identification system"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "IA-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.5.1"
+            }
+          ]
+        },
+        {
+          "id": "IA.L2-3.5.2",
+          "title": "Authentication",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "secrets"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "mfa|multi_factor|two_factor|totp|fido"
+            }
+          ],
+          "scoring": {
+            "pass": "Multi-factor authentication enforced, no hardcoded secrets",
+            "partial": "Authentication present but no MFA",
+            "fail": "Hardcoded secrets detected or no authentication"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "IA-5"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.5.2"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "IR",
+      "name": "Incident Response",
+      "controls": [
+        {
+          "id": "IR.L2-3.6.1",
+          "title": "Incident Handling",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "incident|alert|escalat|response_plan|playbook"
+            }
+          ],
+          "scoring": {
+            "pass": "Incident handling capability present",
+            "fail": "No incident handling capability"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "IR-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.6.1"
+            }
+          ]
+        },
+        {
+          "id": "IR.L2-3.6.2",
+          "title": "Incident Reporting",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "incident_report|notify|escalat|alert_channel"
+            }
+          ],
+          "scoring": {
+            "pass": "Incident reporting mechanism present",
+            "fail": "No incident reporting mechanism"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "IR-6"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.6.2"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "MA",
+      "name": "Maintenance",
+      "controls": [
+        {
+          "id": "MA.L2-3.7.1",
+          "title": "System Maintenance",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "patch|update|maintenance|upgrade"
+            }
+          ],
+          "scoring": {
+            "pass": "System maintenance procedures and patching active",
+            "fail": "No maintenance procedures detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "MA-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.7.1"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "MP",
+      "name": "Media Protection",
+      "controls": [
+        {
+          "id": "MP.L2-3.8.1",
+          "title": "Media Protection",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "encrypt_at_rest|disk_encryption|media_protect|data_wipe"
+            }
+          ],
+          "scoring": {
+            "pass": "Media protection controls present",
+            "fail": "No media protection controls"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "MP-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.8.1"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "PE",
+      "name": "Physical Protection",
+      "controls": [
+        {
+          "id": "PE.L2-3.10.1",
+          "title": "Physical Access Limitation",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "physical_access|facility|badge|entry_log"
+            }
+          ],
+          "scoring": {
+            "pass": "Physical access controls documented",
+            "fail": "No physical access controls documented"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "PE-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.10.1"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "PS",
+      "name": "Personnel Security",
+      "controls": [
+        {
+          "id": "PS.L2-3.9.1",
+          "title": "Screen Individuals",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "screening|background_check|clearance|personnel_security"
+            }
+          ],
+          "scoring": {
+            "pass": "Personnel screening procedures documented",
+            "fail": "No personnel screening procedures"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "PS-3"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.9.1"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "RA",
+      "name": "Risk Assessment",
+      "controls": [
+        {
+          "id": "RA.L2-3.11.1",
+          "title": "Risk Assessments",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sast"
+            },
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            }
+          ],
+          "scoring": {
+            "pass": "Automated risk assessment tools active",
+            "fail": "No automated risk assessment"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "RA-3"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.11.1"
+            }
+          ]
+        },
+        {
+          "id": "RA.L2-3.11.2",
+          "title": "Vulnerability Scanning",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sast"
+            },
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            }
+          ],
+          "scoring": {
+            "pass": "Vulnerability scanning active with no critical findings",
+            "partial": "Scanning active but findings exist",
+            "fail": "No vulnerability scanning"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "RA-5"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.11.2"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "RE",
+      "name": "Recovery",
+      "controls": [
+        {
+          "id": "RE.L2-3.12.1",
+          "title": "Data Backup",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "backup|snapshot|replicate|disaster_recovery"
+            }
+          ],
+          "scoring": {
+            "pass": "Data backup and recovery procedures present",
+            "fail": "No backup procedures detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "CP-9"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.12.1"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "SC",
+      "name": "Security Assessment",
+      "controls": [
+        {
+          "id": "SC.L2-3.13.1",
+          "title": "Boundary Protection",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "firewall|network_policy|ingress|egress|boundary"
+            }
+          ],
+          "scoring": {
+            "pass": "Boundary protection controls present",
+            "fail": "No boundary protection detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SC-7"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.13.1"
+            }
+          ]
+        },
+        {
+          "id": "SC.L2-3.13.8",
+          "title": "CUI Encryption in Transit",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "TLS|SSL|https|encrypt|mTLS"
+            },
+            {
+              "type": "tool",
+              "tool": "code_patterns"
+            }
+          ],
+          "scoring": {
+            "pass": "CUI encrypted in transit",
+            "fail": "No transmission encryption for CUI"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SC-8"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.13.8"
+            }
+          ]
+        },
+        {
+          "id": "SC.L2-3.13.11",
+          "title": "CUI Encryption at Rest",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "AES|RSA|SHA|FIPS|cryptography|bcrypt|encrypt_at_rest"
+            }
+          ],
+          "scoring": {
+            "pass": "FIPS-validated cryptography for CUI at rest",
+            "fail": "No encryption at rest for CUI"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SC-28"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.13.11"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "SI",
+      "name": "System and Information Integrity",
+      "controls": [
+        {
+          "id": "SI.L2-3.14.1",
+          "title": "Flaw Remediation",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            },
+            {
+              "type": "tool",
+              "tool": "sast"
+            }
+          ],
+          "scoring": {
+            "pass": "No critical/high vulnerabilities, timely remediation",
+            "partial": "Known vulnerabilities with remediation plan",
+            "fail": "Unaddressed critical vulnerabilities"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SI-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.14.1"
+            }
+          ]
+        },
+        {
+          "id": "SI.L2-3.14.2",
+          "title": "Malicious Code Protection",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sast"
+            },
+            {
+              "type": "tool",
+              "tool": "secrets"
+            }
+          ],
+          "scoring": {
+            "pass": "SAST and malicious code protection active",
+            "fail": "No malicious code protection"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SI-3"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.14.2"
+            }
+          ]
+        },
+        {
+          "id": "SI.L2-3.14.6",
+          "title": "Security Alerts and Advisories",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "monitor|alert|advisory|cve|vulnerability_feed"
+            }
+          ],
+          "scoring": {
+            "pass": "Security alert monitoring present",
+            "fail": "No security alert monitoring"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SI-5"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.14.6"
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}