icdev 0.0.3__py3-none-any.whl

args/audit_regimes/fedramp_moderate.json

@@ -0,0 +1,650 @@
+{
+  "regime": {
+    "id": "fedramp_moderate",
+    "name": "FedRAMP Moderate",
+    "version": "5.0",
+    "last_updated": "2025-12-15",
+    "description": "Federal Risk and Authorization Management Program \u00e2\u20ac\u201d Moderate impact baseline",
+    "authority": "FedRAMP PMO / GSA"
+  },
+  "categories": [
+    {
+      "id": "AC",
+      "name": "Access Control",
+      "controls": [
+        {
+          "id": "AC-2",
+          "title": "Account Management",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "stig"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "account_management|user_provisioning|rbac"
+            }
+          ],
+          "scoring": {
+            "pass": "Automated account management with lifecycle",
+            "fail": "No account management"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AC-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.1.1"
+            }
+          ]
+        },
+        {
+          "id": "AC-3",
+          "title": "Access Enforcement",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "authorize|permission|role|access_control"
+            },
+            {
+              "type": "tool",
+              "tool": "sast"
+            }
+          ],
+          "scoring": {
+            "pass": "RBAC/ABAC enforcement detected",
+            "fail": "No access enforcement"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AC-3"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.1.2"
+            }
+          ]
+        },
+        {
+          "id": "AC-6",
+          "title": "Least Privilege",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "least_privilege|minimal|non.?root|read.?only"
+            }
+          ],
+          "scoring": {
+            "pass": "Least privilege enforced",
+            "fail": "No least privilege"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AC-6"
+            }
+          ]
+        },
+        {
+          "id": "AC-17",
+          "title": "Remote Access",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "vpn|tls|ssh|mTLS|remote_access"
+            }
+          ],
+          "scoring": {
+            "pass": "Secure remote access enforced",
+            "fail": "No secure remote access"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AC-17"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "AU",
+      "name": "Audit and Accountability",
+      "controls": [
+        {
+          "id": "AU-2",
+          "title": "Event Logging",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "code_patterns"
+            }
+          ],
+          "scoring": {
+            "pass": "Comprehensive event logging",
+            "fail": "Insufficient logging"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AU-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.3.1"
+            }
+          ]
+        },
+        {
+          "id": "AU-6",
+          "title": "Audit Record Review, Analysis, and Reporting",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "log_analysis|audit_review|alert"
+            }
+          ],
+          "scoring": {
+            "pass": "Audit analysis present",
+            "fail": "No audit analysis"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AU-6"
+            }
+          ]
+        },
+        {
+          "id": "AU-9",
+          "title": "Protection of Audit Information",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "append.?only|immutable|write.?once"
+            }
+          ],
+          "scoring": {
+            "pass": "Audit information protected",
+            "fail": "No audit protection"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AU-9"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "CA",
+      "name": "Assessment, Authorization, and Monitoring",
+      "controls": [
+        {
+          "id": "CA-2",
+          "title": "Control Assessments",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "stig"
+            },
+            {
+              "type": "tool",
+              "tool": "sast"
+            }
+          ],
+          "scoring": {
+            "pass": "Automated control assessments active",
+            "fail": "No control assessments"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "CA-2"
+            }
+          ]
+        },
+        {
+          "id": "CA-7",
+          "title": "Continuous Monitoring",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "monitor|metrics|health_check|continuous"
+            }
+          ],
+          "scoring": {
+            "pass": "Continuous monitoring present",
+            "fail": "No continuous monitoring"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "CA-7"
+            }
+          ]
+        },
+        {
+          "id": "CA-8",
+          "title": "Penetration Testing",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sast"
+            },
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            }
+          ],
+          "scoring": {
+            "pass": "Automated security testing active",
+            "fail": "No penetration/security testing"
+          }
+        }
+      ]
+    },
+    {
+      "id": "CM",
+      "name": "Configuration Management",
+      "controls": [
+        {
+          "id": "CM-2",
+          "title": "Baseline Configuration",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "file_permissions"
+            }
+          ],
+          "scoring": {
+            "pass": "Baseline configuration documented",
+            "fail": "No baseline"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "CM-2"
+            }
+          ]
+        },
+        {
+          "id": "CM-6",
+          "title": "Configuration Settings",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "stig"
+            }
+          ],
+          "scoring": {
+            "pass": "STIG-compliant configuration",
+            "fail": "Non-compliant configuration"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "CM-6"
+            }
+          ]
+        },
+        {
+          "id": "CM-7",
+          "title": "Least Functionality",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            }
+          ],
+          "scoring": {
+            "pass": "Minimal dependencies",
+            "fail": "Excess dependencies"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "CM-7"
+            }
+          ]
+        },
+        {
+          "id": "CM-8",
+          "title": "System Component Inventory",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sbom"
+            }
+          ],
+          "scoring": {
+            "pass": "SBOM with full inventory",
+            "fail": "No component inventory"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "CM-8"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "IA",
+      "name": "Identification and Authentication",
+      "controls": [
+        {
+          "id": "IA-2",
+          "title": "Identification and Authentication (Organizational Users)",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "authenticate|login|identity"
+            }
+          ],
+          "scoring": {
+            "pass": "MFA-capable authentication",
+            "fail": "No authentication"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "IA-2"
+            }
+          ]
+        },
+        {
+          "id": "IA-5",
+          "title": "Authenticator Management",
+          "severity": "critical",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "secrets"
+            }
+          ],
+          "scoring": {
+            "pass": "No hardcoded secrets",
+            "fail": "Hardcoded secrets detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "IA-5"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "RA",
+      "name": "Risk Assessment",
+      "controls": [
+        {
+          "id": "RA-5",
+          "title": "Vulnerability Monitoring and Scanning",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sast"
+            },
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            }
+          ],
+          "scoring": {
+            "pass": "Continuous vulnerability scanning",
+            "fail": "No vulnerability scanning"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "RA-5"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "SA",
+      "name": "System and Services Acquisition",
+      "controls": [
+        {
+          "id": "SA-11",
+          "title": "Developer Testing and Evaluation",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sast"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "test_|pytest|unittest|jest"
+            }
+          ],
+          "scoring": {
+            "pass": "Comprehensive testing pipeline",
+            "fail": "No developer testing"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SA-11"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "SC",
+      "name": "System and Communications Protection",
+      "controls": [
+        {
+          "id": "SC-7",
+          "title": "Boundary Protection",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "firewall|boundary|network_policy"
+            }
+          ],
+          "scoring": {
+            "pass": "Boundary protection present",
+            "fail": "No boundary protection"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SC-7"
+            }
+          ]
+        },
+        {
+          "id": "SC-8",
+          "title": "Transmission Confidentiality and Integrity",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "TLS|SSL|https|encrypt"
+            }
+          ],
+          "scoring": {
+            "pass": "TLS/encryption in transit",
+            "fail": "No transmission encryption"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SC-8"
+            }
+          ]
+        },
+        {
+          "id": "SC-13",
+          "title": "Cryptographic Protection",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "AES|RSA|FIPS|cryptography"
+            }
+          ],
+          "scoring": {
+            "pass": "FIPS-validated cryptography",
+            "fail": "No cryptographic protection"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SC-13"
+            }
+          ]
+        },
+        {
+          "id": "SC-28",
+          "title": "Protection of Information at Rest",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "encrypt_at_rest|disk_encryption|database_encryption"
+            }
+          ],
+          "scoring": {
+            "pass": "Data at rest encryption",
+            "fail": "No data at rest encryption"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SC-28"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "SI",
+      "name": "System and Information Integrity",
+      "controls": [
+        {
+          "id": "SI-2",
+          "title": "Flaw Remediation",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            },
+            {
+              "type": "tool",
+              "tool": "sast"
+            }
+          ],
+          "scoring": {
+            "pass": "No critical flaws",
+            "fail": "Unaddressed flaws"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SI-2"
+            }
+          ]
+        },
+        {
+          "id": "SI-3",
+          "title": "Malicious Code Protection",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sast"
+            },
+            {
+              "type": "tool",
+              "tool": "secrets"
+            }
+          ],
+          "scoring": {
+            "pass": "Active malicious code protection",
+            "fail": "No protection"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SI-3"
+            }
+          ]
+        },
+        {
+          "id": "SI-4",
+          "title": "System Monitoring",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "monitor|alert|metrics|observability"
+            }
+          ],
+          "scoring": {
+            "pass": "System monitoring active",
+            "fail": "No monitoring"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SI-4"
+            }
+          ]
+        },
+        {
+          "id": "SI-10",
+          "title": "Information Input Validation",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sast"
+            }
+          ],
+          "scoring": {
+            "pass": "Input validation with no SAST findings",
+            "fail": "SAST findings or no validation"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SI-10"
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}