icdev 0.0.3__py3-none-any.whl

args/audit_regimes/nist_800_53.json

@@ -0,0 +1,907 @@
+{
+  "regime": {
+    "id": "nist_800_53",
+    "name": "NIST SP 800-53 Rev 5",
+    "version": "5.1.1",
+    "last_updated": "2025-12-15",
+    "description": "Federal information systems security and privacy baseline",
+    "authority": "NIST / OMB"
+  },
+  "categories": [
+    {
+      "id": "AC",
+      "name": "Access Control",
+      "controls": [
+        {
+          "id": "AC-1",
+          "title": "Policy and Procedures",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "config",
+              "file": "*.yaml",
+              "key": "auth"
+            }
+          ],
+          "scoring": {
+            "pass": "Access control policy documented",
+            "partial": "Policy exists but incomplete",
+            "fail": "No access control policy found"
+          }
+        },
+        {
+          "id": "AC-2",
+          "title": "Account Management",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "stig"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "auth|login|session|rbac|user_management"
+            }
+          ],
+          "scoring": {
+            "pass": "Account management with STIG pass",
+            "partial": "Account management detected, STIG incomplete",
+            "fail": "No account management detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "fedramp_moderate",
+              "control": "AC-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.1.1"
+            },
+            {
+              "framework": "cmmc_l2",
+              "control": "AC.L2-3.1.1"
+            }
+          ]
+        },
+        {
+          "id": "AC-3",
+          "title": "Access Enforcement",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "authorize|permission|role|access_control"
+            },
+            {
+              "type": "tool",
+              "tool": "sast"
+            }
+          ],
+          "scoring": {
+            "pass": "Authorization enforcement found",
+            "fail": "No access enforcement detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "fedramp_moderate",
+              "control": "AC-3"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.1.2"
+            }
+          ]
+        },
+        {
+          "id": "AC-4",
+          "title": "Information Flow Enforcement",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "firewall|network_policy|ingress|egress"
+            }
+          ],
+          "scoring": {
+            "pass": "Information flow controls detected",
+            "fail": "No flow enforcement found"
+          }
+        },
+        {
+          "id": "AC-6",
+          "title": "Least Privilege",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "least_privilege|minimal_permissions|non.?root|read.?only"
+            },
+            {
+              "type": "tool",
+              "tool": "file_permissions"
+            }
+          ],
+          "scoring": {
+            "pass": "Least privilege patterns found",
+            "fail": "No least privilege enforcement"
+          },
+          "crosswalk": [
+            {
+              "framework": "fedramp_moderate",
+              "control": "AC-6"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.1.5"
+            }
+          ]
+        },
+        {
+          "id": "AC-7",
+          "title": "Unsuccessful Logon Attempts",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "lockout|max_attempts|failed_login|brute_force"
+            }
+          ],
+          "scoring": {
+            "pass": "Login attempt limits detected",
+            "fail": "No login lockout mechanism"
+          }
+        },
+        {
+          "id": "AC-8",
+          "title": "System Use Notification",
+          "severity": "low",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "banner|warning|notice|terms_of_use"
+            }
+          ],
+          "scoring": {
+            "pass": "System use notification present",
+            "fail": "No system use notification"
+          }
+        },
+        {
+          "id": "AC-14",
+          "title": "Permitted Actions Without Identification",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "public_route|anonymous|unauthenticated"
+            }
+          ],
+          "scoring": {
+            "pass": "Public/anonymous access explicitly defined",
+            "fail": "No definition of permitted unauthenticated actions"
+          }
+        },
+        {
+          "id": "AC-16",
+          "title": "Security and Privacy Attributes",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "cui_markings"
+            }
+          ],
+          "scoring": {
+            "pass": "CUI markings >= 90%",
+            "partial": "CUI markings >= 50%",
+            "fail": "CUI markings < 50%"
+          }
+        },
+        {
+          "id": "AC-17",
+          "title": "Remote Access",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "vpn|tls|ssh|mTLS|mutual_tls"
+            }
+          ],
+          "scoring": {
+            "pass": "Secure remote access mechanism found",
+            "fail": "No secure remote access controls"
+          }
+        }
+      ]
+    },
+    {
+      "id": "AU",
+      "name": "Audit and Accountability",
+      "controls": [
+        {
+          "id": "AU-2",
+          "title": "Event Logging",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "code_patterns"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "logging|audit_trail|log_event"
+            }
+          ],
+          "scoring": {
+            "pass": "Event logging framework detected",
+            "fail": "No event logging detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "fedramp_moderate",
+              "control": "AU-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.3.1"
+            }
+          ]
+        },
+        {
+          "id": "AU-3",
+          "title": "Content of Audit Records",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "timestamp|user_id|event_type|source_ip"
+            }
+          ],
+          "scoring": {
+            "pass": "Audit record content fields present",
+            "fail": "Incomplete audit record content"
+          }
+        },
+        {
+          "id": "AU-6",
+          "title": "Audit Record Review, Analysis, and Reporting",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "audit_review|log_analysis|alert|monitor"
+            }
+          ],
+          "scoring": {
+            "pass": "Audit analysis capability present",
+            "fail": "No audit analysis capability"
+          }
+        },
+        {
+          "id": "AU-9",
+          "title": "Protection of Audit Information",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "append.?only|immutable|no.?delete|write.?once"
+            }
+          ],
+          "scoring": {
+            "pass": "Audit protection mechanism found",
+            "fail": "No audit protection mechanism"
+          },
+          "crosswalk": [
+            {
+              "framework": "fedramp_moderate",
+              "control": "AU-9"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.3.8"
+            }
+          ]
+        },
+        {
+          "id": "AU-12",
+          "title": "Audit Record Generation",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "audit_trail|log_audit|create_audit"
+            }
+          ],
+          "scoring": {
+            "pass": "Audit generation system present",
+            "fail": "No audit generation system"
+          }
+        }
+      ]
+    },
+    {
+      "id": "CM",
+      "name": "Configuration Management",
+      "controls": [
+        {
+          "id": "CM-2",
+          "title": "Baseline Configuration",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "file_permissions"
+            },
+            {
+              "type": "config",
+              "file": "*.yaml"
+            }
+          ],
+          "scoring": {
+            "pass": "Configuration baselines documented",
+            "fail": "No baseline configuration found"
+          }
+        },
+        {
+          "id": "CM-3",
+          "title": "Configuration Change Control",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "git|version_control|change_request"
+            }
+          ],
+          "scoring": {
+            "pass": "Version control and change management present",
+            "fail": "No change control detected"
+          }
+        },
+        {
+          "id": "CM-6",
+          "title": "Configuration Settings",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "stig"
+            }
+          ],
+          "scoring": {
+            "pass": "STIG configuration compliance",
+            "fail": "Configuration non-compliance"
+          }
+        },
+        {
+          "id": "CM-7",
+          "title": "Least Functionality",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            }
+          ],
+          "scoring": {
+            "pass": "Minimal dependencies with no known vulnerabilities",
+            "fail": "Excess or vulnerable dependencies"
+          }
+        },
+        {
+          "id": "CM-8",
+          "title": "System Component Inventory",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sbom"
+            }
+          ],
+          "scoring": {
+            "pass": "SBOM generated with full component inventory",
+            "fail": "No SBOM or incomplete inventory"
+          },
+          "crosswalk": [
+            {
+              "framework": "fedramp_moderate",
+              "control": "CM-8"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.4.1"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "IA",
+      "name": "Identification and Authentication",
+      "controls": [
+        {
+          "id": "IA-2",
+          "title": "Identification and Authentication (Organizational Users)",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "code_patterns"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "authenticate|login|credential|identity"
+            }
+          ],
+          "scoring": {
+            "pass": "User authentication system present",
+            "fail": "No user authentication system"
+          },
+          "crosswalk": [
+            {
+              "framework": "fedramp_moderate",
+              "control": "IA-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.5.1"
+            }
+          ]
+        },
+        {
+          "id": "IA-5",
+          "title": "Authenticator Management",
+          "severity": "critical",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "secrets"
+            }
+          ],
+          "scoring": {
+            "pass": "No hardcoded secrets; proper credential management",
+            "fail": "Hardcoded secrets detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "fedramp_moderate",
+              "control": "IA-5"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.5.2"
+            }
+          ]
+        },
+        {
+          "id": "IA-8",
+          "title": "Identification and Authentication (Non-Organizational Users)",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "api_key|token|oauth|external_auth"
+            }
+          ],
+          "scoring": {
+            "pass": "External user authentication present",
+            "fail": "No external authentication"
+          }
+        }
+      ]
+    },
+    {
+      "id": "RA",
+      "name": "Risk Assessment",
+      "controls": [
+        {
+          "id": "RA-3",
+          "title": "Risk Assessment",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sast"
+            },
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            }
+          ],
+          "scoring": {
+            "pass": "Automated risk assessment tools active",
+            "fail": "No automated risk assessment"
+          }
+        },
+        {
+          "id": "RA-5",
+          "title": "Vulnerability Monitoring and Scanning",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sast"
+            },
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            }
+          ],
+          "scoring": {
+            "pass": "Vulnerability scanning active with no critical findings",
+            "partial": "Scanning active but critical findings exist",
+            "fail": "No vulnerability scanning"
+          },
+          "crosswalk": [
+            {
+              "framework": "fedramp_moderate",
+              "control": "RA-5"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.11.2"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "SA",
+      "name": "System and Services Acquisition",
+      "controls": [
+        {
+          "id": "SA-4",
+          "title": "Acquisition Process",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sbom"
+            },
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            }
+          ],
+          "scoring": {
+            "pass": "Supply chain documented via SBOM",
+            "fail": "No supply chain documentation"
+          }
+        },
+        {
+          "id": "SA-8",
+          "title": "Security and Privacy Engineering Principles",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sbd"
+            }
+          ],
+          "scoring": {
+            "pass": "Secure by Design principles applied",
+            "fail": "No SbD assessment"
+          }
+        },
+        {
+          "id": "SA-11",
+          "title": "Developer Testing and Evaluation",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sast"
+            },
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "test_|_test|pytest|unittest|jest|mocha"
+            }
+          ],
+          "scoring": {
+            "pass": "Automated testing with SAST and dep audit",
+            "partial": "Some testing present",
+            "fail": "No developer testing detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "fedramp_moderate",
+              "control": "SA-11"
+            }
+          ]
+        },
+        {
+          "id": "SA-15",
+          "title": "Development Process, Standards, and Tools",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sbd"
+            }
+          ],
+          "scoring": {
+            "pass": "Secure development process documented",
+            "fail": "No development process documentation"
+          }
+        }
+      ]
+    },
+    {
+      "id": "SC",
+      "name": "System and Communications Protection",
+      "controls": [
+        {
+          "id": "SC-7",
+          "title": "Boundary Protection",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "firewall|network_policy|ingress|egress|boundary"
+            }
+          ],
+          "scoring": {
+            "pass": "Boundary protection controls present",
+            "fail": "No boundary protection detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "fedramp_moderate",
+              "control": "SC-7"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.13.1"
+            }
+          ]
+        },
+        {
+          "id": "SC-8",
+          "title": "Transmission Confidentiality and Integrity",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "code_patterns"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "TLS|SSL|https|encrypt|mTLS"
+            }
+          ],
+          "scoring": {
+            "pass": "Encryption in transit detected",
+            "fail": "No transmission encryption"
+          },
+          "crosswalk": [
+            {
+              "framework": "fedramp_moderate",
+              "control": "SC-8"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.13.8"
+            }
+          ]
+        },
+        {
+          "id": "SC-12",
+          "title": "Cryptographic Key Establishment and Management",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "key_management|kms|key_rotation|HSM"
+            }
+          ],
+          "scoring": {
+            "pass": "Cryptographic key management present",
+            "fail": "No key management detected"
+          }
+        },
+        {
+          "id": "SC-13",
+          "title": "Cryptographic Protection",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "code_patterns"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "AES|RSA|SHA|FIPS|cryptography|bcrypt"
+            }
+          ],
+          "scoring": {
+            "pass": "FIPS-validated or standard cryptography used",
+            "fail": "No cryptographic protection detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "fedramp_moderate",
+              "control": "SC-13"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.13.11"
+            }
+          ]
+        },
+        {
+          "id": "SC-28",
+          "title": "Protection of Information at Rest",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "encrypt_at_rest|disk_encryption|database_encryption"
+            }
+          ],
+          "scoring": {
+            "pass": "Data at rest encryption present",
+            "fail": "No data at rest encryption"
+          }
+        }
+      ]
+    },
+    {
+      "id": "SI",
+      "name": "System and Information Integrity",
+      "controls": [
+        {
+          "id": "SI-2",
+          "title": "Flaw Remediation",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            },
+            {
+              "type": "tool",
+              "tool": "sast"
+            }
+          ],
+          "scoring": {
+            "pass": "No critical/high vulnerabilities",
+            "partial": "Known vulnerabilities with remediation plan",
+            "fail": "Unaddressed critical vulnerabilities"
+          },
+          "crosswalk": [
+            {
+              "framework": "fedramp_moderate",
+              "control": "SI-2"
+            },
+            {
+              "framework": "nist_800_171",
+              "control": "3.14.1"
+            }
+          ]
+        },
+        {
+          "id": "SI-3",
+          "title": "Malicious Code Protection",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sast"
+            },
+            {
+              "type": "tool",
+              "tool": "secrets"
+            }
+          ],
+          "scoring": {
+            "pass": "SAST and secret detection active",
+            "fail": "No malicious code protection"
+          }
+        },
+        {
+          "id": "SI-4",
+          "title": "System Monitoring",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "monitor|alert|metrics|health_check|observability"
+            }
+          ],
+          "scoring": {
+            "pass": "System monitoring present",
+            "fail": "No monitoring detected"
+          }
+        },
+        {
+          "id": "SI-10",
+          "title": "Information Input Validation",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sast"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "validate|sanitize|escape|parameterized"
+            }
+          ],
+          "scoring": {
+            "pass": "Input validation present with no SAST findings",
+            "partial": "Some validation but SAST findings exist",
+            "fail": "No input validation and/or critical SAST findings"
+          },
+          "crosswalk": [
+            {
+              "framework": "fedramp_moderate",
+              "control": "SI-10"
+            }
+          ]
+        },
+        {
+          "id": "SI-11",
+          "title": "Error Handling",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "code_patterns"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "try|except|catch|error_handler"
+            }
+          ],
+          "scoring": {
+            "pass": "Error handling framework present",
+            "fail": "No error handling detected"
+          }
+        }
+      ]
+    },
+    {
+      "id": "SR",
+      "name": "Supply Chain Risk Management",
+      "controls": [
+        {
+          "id": "SR-3",
+          "title": "Supply Chain Controls and Processes",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sbom"
+            },
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            }
+          ],
+          "scoring": {
+            "pass": "SBOM generated and dependencies audited",
+            "fail": "No supply chain controls"
+          }
+        },
+        {
+          "id": "SR-4",
+          "title": "Provenance",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sbom"
+            }
+          ],
+          "scoring": {
+            "pass": "Component provenance tracked via SBOM",
+            "fail": "No provenance tracking"
+          }
+        }
+      ]
+    }
+  ]
+}