icdev 1.0.0__py3-none-any.whl

icdev/data/context/compliance/dod_cssp_8530.json

@@ -0,0 +1,463 @@
+{
+  "metadata": {
+    "title": "DoD Instruction 8530.01 - Cybersecurity Service Provider (CSSP) Requirements",
+    "revision": "2020-07-25 (Change 1)",
+    "source": "Department of Defense, Office of the DoD CIO",
+    "classification": "CUI // SP-CTI",
+    "last_updated": "2026-02-15",
+    "description": "CSSP requirements catalog aligned to DoDI 8530.01 Cybersecurity Activities Support to DoD Information Network Operations. Covers the five CSSP functional areas: Identify, Protect, Detect, Respond, and Sustain. Each requirement maps to NIST 800-53 controls and includes automation level for ICDEV integration."
+  },
+  "requirements": [
+    {
+      "id": "ID-1",
+      "functional_area": "Identify",
+      "functional_area_code": "ID",
+      "title": "Hardware Asset Inventory",
+      "description": "Maintain a current, accurate inventory of all hardware assets connected to the network and within the authorization boundary. The inventory must include device type, serial number, network address, owner, location, and operational status. Hardware assets must be reconciled against authorized baselines at least quarterly.",
+      "evidence_required": "Asset inventory database or spreadsheet with hardware details, reconciliation records, and automated discovery scan results.",
+      "automation_level": "auto",
+      "nist_controls": ["CM-8"],
+      "priority": "high"
+    },
+    {
+      "id": "ID-2",
+      "functional_area": "Identify",
+      "functional_area_code": "ID",
+      "title": "Software Asset Inventory",
+      "description": "Maintain a current inventory of all software installed or deployed within the system, including version numbers, patch levels, license status, and approval status. Software Bill of Materials (SBOM) must be generated for all custom-developed and deployed applications. Unauthorized software must be identified and removed or documented with a waiver.",
+      "evidence_required": "Software Bill of Materials (SBOM), package manifests (requirements.txt, package.json, etc.), software inventory reports, and license compliance records.",
+      "automation_level": "auto",
+      "nist_controls": ["CM-8"],
+      "priority": "high"
+    },
+    {
+      "id": "ID-3",
+      "functional_area": "Identify",
+      "functional_area_code": "ID",
+      "title": "Risk Assessment",
+      "description": "Conduct periodic risk assessments identifying threats, vulnerabilities, and potential impacts to the system and its data. Risk assessments must consider insider threats, advanced persistent threats, supply chain risks, and environmental threats. Results must inform the security posture and drive remediation priorities. Assessments must be updated when significant changes occur or at least annually.",
+      "evidence_required": "Risk assessment document, threat model file (STRIDE or PASTA methodology), risk register with likelihood and impact ratings, and risk acceptance documentation for residual risks.",
+      "automation_level": "semi",
+      "nist_controls": ["RA-3", "RA-5"],
+      "priority": "critical"
+    },
+    {
+      "id": "ID-4",
+      "functional_area": "Identify",
+      "functional_area_code": "ID",
+      "title": "Data Classification",
+      "description": "Classify all data handled, processed, stored, or transmitted by the system according to DoD data classification categories and CUI marking requirements. All artifacts generated by the system must bear appropriate CUI markings including banner markings (top and bottom), portion markings, and designation indicators per DoDI 5200.48 and 32 CFR Part 2002.",
+      "evidence_required": "Data classification matrix mapping data types to classification levels, CUI markings present on all generated artifacts, and CUI registry entries for applicable categories.",
+      "automation_level": "auto",
+      "nist_controls": ["SC-16", "MP-3"],
+      "priority": "critical"
+    },
+    {
+      "id": "ID-5",
+      "functional_area": "Identify",
+      "functional_area_code": "ID",
+      "title": "Supply Chain Risk Management",
+      "description": "Assess and manage supply chain risks for all third-party components, libraries, and services used within the system. Maintain awareness of known vulnerabilities in dependencies, verify the provenance of software components, and implement controls to mitigate risks from compromised or counterfeit components. Third-party vendor security assessments must be conducted and documented.",
+      "evidence_required": "SBOM with vulnerability status for all dependencies, dependency audit reports, vendor security assessment records, and supply chain risk management plan.",
+      "automation_level": "semi",
+      "nist_controls": ["SA-12", "SR-1", "SR-3"],
+      "priority": "high"
+    },
+    {
+      "id": "ID-6",
+      "functional_area": "Identify",
+      "functional_area_code": "ID",
+      "title": "System Boundary Definition",
+      "description": "Define and document the authorization boundary for the system, including all components, interconnections, data flows, and external interfaces. The boundary documentation must clearly delineate what is within scope for authorization and what is inherited from or connected to external systems. Boundary definitions must be reviewed and updated when system architecture changes.",
+      "evidence_required": "System architecture diagram, authorization boundary documentation, interconnection security agreements (ISAs), memoranda of understanding (MOUs), and data flow diagrams.",
+      "automation_level": "manual",
+      "nist_controls": ["CA-3", "PL-2"],
+      "priority": "critical"
+    },
+    {
+      "id": "ID-7",
+      "functional_area": "Identify",
+      "functional_area_code": "ID",
+      "title": "Threat Intelligence Integration",
+      "description": "Consume and act on relevant threat intelligence feeds including DISA STIGS, US-CERT advisories, CVE databases, and DoD-specific threat indicators. Threat intelligence must be integrated into monitoring, detection, and response processes. Indicators of compromise (IOCs) must be operationalized within detection systems in a timely manner.",
+      "evidence_required": "Threat intelligence feed configuration, indicator of compromise (IOC) processing logs, threat intel integration with SIEM/IDS, and documentation of actions taken based on threat intel.",
+      "automation_level": "semi",
+      "nist_controls": ["PM-16", "RA-3"],
+      "priority": "medium"
+    },
+    {
+      "id": "PR-1",
+      "functional_area": "Protect",
+      "functional_area_code": "PR",
+      "title": "PKI/CAC Authentication",
+      "description": "Implement DoD Public Key Infrastructure (PKI) and Common Access Card (CAC) based authentication for all user access to the system. Multi-factor authentication using CAC certificates must be enforced for privileged and non-privileged users. Authentication mechanisms must validate certificate chains against the DoD certificate authority hierarchy and check certificate revocation status via OCSP or CRL.",
+      "evidence_required": "CAC authentication module configuration, PKI certificate validation settings, OCSP/CRL configuration, authentication flow documentation, and test results demonstrating CAC-based login.",
+      "automation_level": "auto",
+      "nist_controls": ["IA-2", "IA-5", "IA-8"],
+      "priority": "critical"
+    },
+    {
+      "id": "PR-2",
+      "functional_area": "Protect",
+      "functional_area_code": "PR",
+      "title": "Encryption at Rest",
+      "description": "Encrypt all CUI data at rest using FIPS 140-2 or FIPS 140-3 validated cryptographic modules. Encryption must cover databases, file systems, backups, and any persistent storage containing CUI. Key management procedures must ensure keys are protected, rotated on schedule, and recoverable through authorized means.",
+      "evidence_required": "Encryption configuration for databases and file systems, FIPS 140-2/3 validation certificate numbers, key management documentation, and key rotation logs.",
+      "automation_level": "auto",
+      "nist_controls": ["SC-28", "SC-13"],
+      "priority": "critical"
+    },
+    {
+      "id": "PR-3",
+      "functional_area": "Protect",
+      "functional_area_code": "PR",
+      "title": "Encryption in Transit",
+      "description": "Encrypt all data in transit using TLS 1.2 or higher with FIPS-approved cipher suites. All internal service-to-service communication must use mutual TLS (mTLS) within the Kubernetes cluster. External-facing endpoints must present valid certificates from a DoD-approved certificate authority. Weak cipher suites and protocols (SSLv3, TLS 1.0, TLS 1.1) must be explicitly disabled.",
+      "evidence_required": "TLS configuration files, certificate management documentation, cipher suite configuration, mTLS settings for inter-service communication, and TLS scan results showing compliance.",
+      "automation_level": "auto",
+      "nist_controls": ["SC-8", "SC-13", "SC-23"],
+      "priority": "critical"
+    },
+    {
+      "id": "PR-4",
+      "functional_area": "Protect",
+      "functional_area_code": "PR",
+      "title": "Endpoint Protection",
+      "description": "Deploy and maintain Host-Based Security System (HBSS) or equivalent endpoint protection on all hosts and endpoints. Endpoint protection must include antivirus, host-based intrusion detection, application whitelisting, and device control. Agents must be configured to receive automatic signature updates and report to a centralized management console.",
+      "evidence_required": "HBSS or endpoint protection agent configuration, agent deployment status across all hosts, signature update schedule, and centralized management console access logs.",
+      "automation_level": "semi",
+      "nist_controls": ["SI-3", "SI-4"],
+      "priority": "high"
+    },
+    {
+      "id": "PR-5",
+      "functional_area": "Protect",
+      "functional_area_code": "PR",
+      "title": "Network Segmentation",
+      "description": "Implement network segmentation with firewall rules and network policies restricting traffic to the minimum necessary for operational requirements. Kubernetes NetworkPolicies must enforce default-deny ingress and egress, with explicit allow rules for authorized traffic flows only. DMZ architectures must separate publicly accessible components from internal networks.",
+      "evidence_required": "Network architecture diagram, firewall rule sets, Kubernetes NetworkPolicy manifests, traffic flow documentation, and network segmentation test results.",
+      "automation_level": "auto",
+      "nist_controls": ["SC-7", "AC-4"],
+      "priority": "critical"
+    },
+    {
+      "id": "PR-6",
+      "functional_area": "Protect",
+      "functional_area_code": "PR",
+      "title": "Configuration Baselines",
+      "description": "Establish and maintain secure configuration baselines for all system components based on applicable DISA STIGs, SRGs, and vendor hardening guides. Container images must be built from STIG-hardened base images with minimal packages, non-root execution, read-only root filesystems, and dropped capabilities. Configuration drift from baselines must be detected and remediated.",
+      "evidence_required": "STIG checklist results (CKL files), baseline configuration documentation, STIG-hardened Dockerfile contents, configuration drift detection reports, and remediation records.",
+      "automation_level": "auto",
+      "nist_controls": ["CM-2", "CM-6", "CM-7"],
+      "priority": "high"
+    },
+    {
+      "id": "PR-7",
+      "functional_area": "Protect",
+      "functional_area_code": "PR",
+      "title": "Patch Management",
+      "description": "Maintain a formal patch management program with defined SLAs for patch application based on severity. Critical patches must be applied within 72 hours, high within 30 days, and moderate within 90 days. Patch status must be tracked and reported. Emergency patches must have an expedited process. All patches must be tested before deployment to production.",
+      "evidence_required": "Patch management policy document, patch status reports showing SLA compliance, patch testing records, and automated dependency version checking results.",
+      "automation_level": "semi",
+      "nist_controls": ["SI-2", "CM-3"],
+      "priority": "high"
+    },
+    {
+      "id": "PR-8",
+      "functional_area": "Protect",
+      "functional_area_code": "PR",
+      "title": "Access Control / Least Privilege",
+      "description": "Implement role-based access control (RBAC) enforcing the principle of least privilege across all system components. Users and service accounts must be granted only the minimum permissions required to perform their assigned duties. Privileged access must be tightly controlled with additional authentication requirements. Access reviews must be conducted at least quarterly to remove unnecessary permissions.",
+      "evidence_required": "RBAC configuration files, access control matrix documenting roles and permissions, Kubernetes RBAC manifests, access review records, and privileged access audit logs.",
+      "automation_level": "auto",
+      "nist_controls": ["AC-2", "AC-3", "AC-6"],
+      "priority": "high"
+    },
+    {
+      "id": "PR-9",
+      "functional_area": "Protect",
+      "functional_area_code": "PR",
+      "title": "Security Awareness Training",
+      "description": "Ensure all personnel with access to the system complete initial and annual security awareness training covering CUI handling, phishing awareness, insider threat indicators, incident reporting procedures, and acceptable use policies. Role-based training must be provided for personnel with specialized security responsibilities including system administrators, developers, and security analysts.",
+      "evidence_required": "Training completion records for all personnel, training curriculum documentation, role-based training materials, and annual training compliance reports.",
+      "automation_level": "manual",
+      "nist_controls": ["AT-2", "AT-3"],
+      "priority": "medium"
+    },
+    {
+      "id": "PR-10",
+      "functional_area": "Protect",
+      "functional_area_code": "PR",
+      "title": "Physical Security",
+      "description": "Implement physical security controls for data centers, server rooms, and equipment housing system components. Physical access must be restricted to authorized personnel using multi-factor authentication (badge + PIN). Visitor access must be escorted and logged. Physical security monitoring including CCTV and intrusion detection must be operational and monitored.",
+      "evidence_required": "Physical security plan, physical access control system logs, visitor access logs, CCTV monitoring documentation, and physical security assessment reports.",
+      "automation_level": "manual",
+      "nist_controls": ["PE-2", "PE-3", "PE-6"],
+      "priority": "medium"
+    },
+    {
+      "id": "DE-1",
+      "functional_area": "Detect",
+      "functional_area_code": "DE",
+      "title": "Continuous Monitoring Strategy",
+      "description": "Implement and maintain a comprehensive continuous monitoring (ConMon) strategy that defines monitoring objectives, metrics, frequencies, and responsible parties. The strategy must cover security control effectiveness, vulnerability management, threat detection, and compliance status. Monitoring data must be aggregated into dashboards providing real-time security posture visibility to authorized stakeholders.",
+      "evidence_required": "Continuous monitoring plan document, monitoring metrics definitions, monitoring dashboard configuration, and periodic ConMon status reports.",
+      "automation_level": "semi",
+      "nist_controls": ["CA-7", "SI-4"],
+      "priority": "critical"
+    },
+    {
+      "id": "DE-2",
+      "functional_area": "Detect",
+      "functional_area_code": "DE",
+      "title": "SIEM Log Forwarding",
+      "description": "Forward all security-relevant logs to the CSSP Security Information and Event Management (SIEM) system (Splunk or ELK stack). Log sources must include operating system events, application logs, authentication events, network traffic logs, firewall logs, IDS/IPS alerts, and audit trail records. Log forwarding must be configured with guaranteed delivery and tamper-evident mechanisms.",
+      "evidence_required": "SIEM forwarding configuration (Splunk forwarder, Filebeat, or equivalent), log source inventory mapping all sources to SIEM inputs, log delivery verification records, and SIEM ingestion dashboards.",
+      "automation_level": "auto",
+      "nist_controls": ["AU-6", "SI-4"],
+      "priority": "critical"
+    },
+    {
+      "id": "DE-3",
+      "functional_area": "Detect",
+      "functional_area_code": "DE",
+      "title": "Audit Log Generation",
+      "description": "Generate comprehensive audit logs for all security-relevant events including authentication attempts (success and failure), authorization decisions, data access, configuration changes, administrative actions, and system errors. Audit logs must include timestamp, source, actor, action, target, and outcome fields. Audit logs must be append-only and immutable to satisfy NIST AU controls.",
+      "evidence_required": "Logging configuration showing event types captured, sample audit log entries demonstrating required fields, append-only audit trail implementation, and log integrity verification mechanisms.",
+      "automation_level": "auto",
+      "nist_controls": ["AU-2", "AU-3", "AU-12"],
+      "priority": "critical"
+    },
+    {
+      "id": "DE-4",
+      "functional_area": "Detect",
+      "functional_area_code": "DE",
+      "title": "Anomaly Detection",
+      "description": "Implement automated anomaly detection capabilities for identifying unusual or suspicious security events. Detection mechanisms must cover abnormal login patterns, unusual data access volumes, unexpected network traffic, privilege escalation attempts, and deviations from established behavioral baselines. Alert thresholds must be tuned to minimize false positives while maintaining detection effectiveness.",
+      "evidence_required": "Anomaly detection rule configuration, alert threshold settings, behavioral baseline documentation, false positive rate metrics, and sample alert notifications.",
+      "automation_level": "semi",
+      "nist_controls": ["SI-4", "IR-4"],
+      "priority": "high"
+    },
+    {
+      "id": "DE-5",
+      "functional_area": "Detect",
+      "functional_area_code": "DE",
+      "title": "Intrusion Detection/Prevention",
+      "description": "Deploy network-based and host-based intrusion detection and prevention systems (IDS/IPS) at key network boundaries and on critical hosts. Detection signatures and rules must be updated regularly. IDS/IPS must be configured to detect known attack patterns, protocol anomalies, and policy violations. Alerts must be forwarded to the SIEM for correlation and analysis.",
+      "evidence_required": "IDS/IPS deployment architecture, detection rule configuration, signature update schedule, alert forwarding configuration to SIEM, and detection effectiveness metrics.",
+      "automation_level": "semi",
+      "nist_controls": ["SI-4", "SC-7"],
+      "priority": "high"
+    },
+    {
+      "id": "DE-6",
+      "functional_area": "Detect",
+      "functional_area_code": "DE",
+      "title": "Security Event Correlation",
+      "description": "Correlate security events across multiple sources including network logs, host logs, application logs, authentication systems, and threat intelligence to identify complex attack patterns and multi-stage intrusions. Correlation rules must be defined for common attack scenarios and updated based on emerging threats and lessons learned from incidents.",
+      "evidence_required": "SIEM correlation rule definitions, cross-source event correlation examples, alert correlation dashboard configuration, and correlation rule update records.",
+      "automation_level": "semi",
+      "nist_controls": ["AU-6", "SI-4"],
+      "priority": "high"
+    },
+    {
+      "id": "DE-7",
+      "functional_area": "Detect",
+      "functional_area_code": "DE",
+      "title": "Vulnerability Scanning",
+      "description": "Conduct regular vulnerability scanning of all system components per a defined schedule. Scanning must include infrastructure vulnerability scans, web application scans (DAST), static application security testing (SAST), and dependency/container image scanning. Scan results must be triaged, prioritized, and tracked through remediation. Credentialed scans must be performed for comprehensive coverage.",
+      "evidence_required": "Vulnerability scan schedule documentation, scan reports (SAST, DAST, infrastructure), scan result triage and remediation tracking records, and scan coverage metrics.",
+      "automation_level": "auto",
+      "nist_controls": ["RA-5", "SI-2"],
+      "priority": "critical"
+    },
+    {
+      "id": "DE-8",
+      "functional_area": "Detect",
+      "functional_area_code": "DE",
+      "title": "Malware Detection",
+      "description": "Implement malware detection capabilities across all endpoints, servers, and network entry points. Detection mechanisms must include signature-based and heuristic/behavioral analysis. Container images must be scanned for malware before deployment. Email and web gateways must include malware scanning. Detection signatures must be updated at least daily.",
+      "evidence_required": "Antivirus/antimalware configuration across all endpoints, container image scanning configuration, gateway malware scanning settings, signature update verification records, and malware detection incident logs.",
+      "automation_level": "semi",
+      "nist_controls": ["SI-3"],
+      "priority": "high"
+    },
+    {
+      "id": "RS-1",
+      "functional_area": "Respond",
+      "functional_area_code": "RS",
+      "title": "Incident Response Plan",
+      "description": "Maintain a documented incident response plan that defines incident categories, severity levels, roles and responsibilities, escalation procedures, communication protocols, and coordination with external entities including the CSSP SOC and US-CERT. The plan must be reviewed and updated at least annually and after each significant incident. All IR team members must be trained on the plan.",
+      "evidence_required": "Incident response plan document with review dates, IR team roster with roles and contact information, plan distribution records, and annual review/update evidence.",
+      "automation_level": "auto",
+      "nist_controls": ["IR-1", "IR-8"],
+      "priority": "critical"
+    },
+    {
+      "id": "RS-2",
+      "functional_area": "Respond",
+      "functional_area_code": "RS",
+      "title": "SOC Coordination",
+      "description": "Establish and maintain procedures for coordination with the CSSP Security Operations Center (SOC) during security incidents. Coordination procedures must include primary and alternate communication channels, escalation criteria, information sharing protocols, and joint response procedures. Regular coordination exercises must be conducted to validate procedures.",
+      "evidence_required": "SOC contact matrix with primary and alternate contacts, escalation procedure documentation, communication channel configuration, and coordination exercise records.",
+      "automation_level": "manual",
+      "nist_controls": ["IR-6", "IR-7"],
+      "priority": "critical"
+    },
+    {
+      "id": "RS-3",
+      "functional_area": "Respond",
+      "functional_area_code": "RS",
+      "title": "Incident Reporting Timelines",
+      "description": "Meet mandatory incident reporting timelines as defined by DoD policy: critical incidents must be reported within 1 hour, high-severity incidents within 24 hours, and moderate incidents within 72 hours. Reports must be submitted to the CSSP SOC and appropriate authorities using approved reporting formats. Automated alerting must be configured to ensure timeline compliance.",
+      "evidence_required": "Incident reports with timestamps demonstrating timeline compliance, automated alerting configuration for reporting deadlines, reporting timeline compliance metrics, and escalation records for missed timelines.",
+      "automation_level": "semi",
+      "nist_controls": ["IR-6"],
+      "priority": "critical"
+    },
+    {
+      "id": "RS-4",
+      "functional_area": "Respond",
+      "functional_area_code": "RS",
+      "title": "Containment Procedures",
+      "description": "Document and test containment procedures for each category of security incident including malware outbreak, unauthorized access, data exfiltration, denial of service, and insider threat. Containment procedures must include both short-term (immediate isolation) and long-term (sustained containment) actions. Procedures must be tested through tabletop exercises or simulations at least annually.",
+      "evidence_required": "Containment playbooks for each incident category, containment procedure test results, tabletop exercise records, and lessons learned from containment actions.",
+      "automation_level": "manual",
+      "nist_controls": ["IR-4"],
+      "priority": "high"
+    },
+    {
+      "id": "RS-5",
+      "functional_area": "Respond",
+      "functional_area_code": "RS",
+      "title": "Evidence Preservation",
+      "description": "Implement forensic evidence preservation procedures ensuring that digital evidence is collected, handled, and stored in a manner that maintains its integrity and admissibility. Chain of custody must be maintained for all evidence. Evidence preservation procedures must comply with DoD forensic standards and be coordinated with law enforcement and counterintelligence as appropriate.",
+      "evidence_required": "Evidence handling standard operating procedures, chain of custody form templates, forensic tool inventory, evidence storage configuration, and evidence preservation training records.",
+      "automation_level": "manual",
+      "nist_controls": ["IR-4", "AU-9"],
+      "priority": "high"
+    },
+    {
+      "id": "RS-6",
+      "functional_area": "Respond",
+      "functional_area_code": "RS",
+      "title": "Eradication and Recovery",
+      "description": "Document eradication and recovery procedures for restoring systems to a known-good state after security incidents. Procedures must include malware removal, vulnerability remediation, system rebuild from trusted media, data restoration from verified backups, and validation testing before returning systems to production. Recovery time objectives (RTOs) must be defined for each system criticality level.",
+      "evidence_required": "Recovery playbooks for each incident category, backup verification records, system rebuild procedures, recovery test results, and RTO compliance documentation.",
+      "automation_level": "semi",
+      "nist_controls": ["IR-4", "CP-10"],
+      "priority": "high"
+    },
+    {
+      "id": "RS-7",
+      "functional_area": "Respond",
+      "functional_area_code": "RS",
+      "title": "Lessons Learned",
+      "description": "Conduct post-incident lessons learned reviews after each significant security incident. Reviews must identify what worked well, what needs improvement, and specific actions to prevent recurrence. Findings must be fed back into incident response plans, detection rules, security controls, and training programs. A lessons learned repository must be maintained for knowledge sharing.",
+      "evidence_required": "Lessons learned reports for each significant incident, action item tracking from reviews, evidence of control updates based on findings, and lessons learned repository.",
+      "automation_level": "manual",
+      "nist_controls": ["IR-4"],
+      "priority": "medium"
+    },
+    {
+      "id": "RS-8",
+      "functional_area": "Respond",
+      "functional_area_code": "RS",
+      "title": "Incident Communication",
+      "description": "Establish a communication plan for incident notification to all relevant stakeholders including system owners, data owners, affected users, CSSP SOC, chain of command, legal counsel, and public affairs as appropriate. Communication templates must be pre-approved for common incident types to expedite notifications. Communication channels must include both primary and backup methods.",
+      "evidence_required": "Incident communication plan, stakeholder notification matrix, pre-approved communication templates, communication channel documentation, and notification log records.",
+      "automation_level": "manual",
+      "nist_controls": ["IR-6", "IR-7"],
+      "priority": "high"
+    },
+    {
+      "id": "SU-1",
+      "functional_area": "Sustain",
+      "functional_area_code": "SU",
+      "title": "Vulnerability Management Program",
+      "description": "Maintain a formal vulnerability management program with defined processes for vulnerability identification, assessment, prioritization, remediation, and verification. Remediation SLAs must be enforced: critical vulnerabilities within 72 hours, high within 30 days, moderate within 90 days, and low within 180 days. Vulnerability metrics must be tracked and reported to leadership monthly.",
+      "evidence_required": "Vulnerability management policy document, remediation SLA definitions and compliance metrics, monthly vulnerability status reports, and vulnerability trending analysis.",
+      "automation_level": "semi",
+      "nist_controls": ["RA-5", "SI-2"],
+      "priority": "critical"
+    },
+    {
+      "id": "SU-2",
+      "functional_area": "Sustain",
+      "functional_area_code": "SU",
+      "title": "Patch Cadence Compliance",
+      "description": "Meet defined patching SLAs for all system components: critical patches applied within 72 hours, high-severity patches within 30 days, and moderate patches within 90 days. Patch compliance must be measured and reported. Exceptions must be documented with risk acceptance and compensating controls. Automated patch management tools must be used where feasible.",
+      "evidence_required": "Patch status reports showing SLA compliance percentages, automated dependency version checking results, patch exception documentation with risk acceptance, and patch deployment verification records.",
+      "automation_level": "semi",
+      "nist_controls": ["SI-2", "CM-3"],
+      "priority": "high"
+    },
+    {
+      "id": "SU-3",
+      "functional_area": "Sustain",
+      "functional_area_code": "SU",
+      "title": "Configuration Management",
+      "description": "Maintain a configuration management program with formal change control processes. All changes must be documented, reviewed, approved, tested, and tracked. Infrastructure as Code (IaC) must be used for reproducible deployments. Configuration baselines must be maintained and configuration drift detected and remediated. Change records must include rollback procedures.",
+      "evidence_required": "Configuration management plan, change control records, Infrastructure as Code repositories (Terraform, Ansible), configuration drift detection reports, and rollback procedure documentation.",
+      "automation_level": "auto",
+      "nist_controls": ["CM-1", "CM-2", "CM-3"],
+      "priority": "high"
+    },
+    {
+      "id": "SU-4",
+      "functional_area": "Sustain",
+      "functional_area_code": "SU",
+      "title": "Business Continuity/DR Plan",
+      "description": "Maintain and regularly test business continuity and disaster recovery plans ensuring the system can be recovered within defined recovery time objectives (RTO) and recovery point objectives (RPO). Plans must address multiple failure scenarios including single component failure, site failure, and regional disaster. DR tests must be conducted at least annually with results documented.",
+      "evidence_required": "Business continuity plan (BCP), disaster recovery plan (DRP), RTO/RPO definitions for each system component, DR test results and after-action reports, and plan update records.",
+      "automation_level": "manual",
+      "nist_controls": ["CP-1", "CP-2", "CP-4"],
+      "priority": "high"
+    },
+    {
+      "id": "SU-5",
+      "functional_area": "Sustain",
+      "functional_area_code": "SU",
+      "title": "Security Assessment Schedule",
+      "description": "Maintain a schedule for periodic security assessments including annual security control assessments, penetration testing, red team exercises, and compliance audits. Assessment findings must be tracked through resolution via Plan of Action and Milestones (POA&M). Assessment results must inform continuous monitoring and risk management decisions.",
+      "evidence_required": "Security assessment schedule with planned and completed dates, assessment reports, penetration test results, POA&M tracking for findings, and assessment closure verification records.",
+      "automation_level": "semi",
+      "nist_controls": ["CA-2", "CA-5"],
+      "priority": "high"
+    },
+    {
+      "id": "SU-6",
+      "functional_area": "Sustain",
+      "functional_area_code": "SU",
+      "title": "Authorization Maintenance",
+      "description": "Maintain system authorization (Authority to Operate - ATO) currency through continuous monitoring, ongoing authorization activities, and timely reauthorization. The ATO package must be kept current including System Security Plan (SSP), POA&M, security assessment report, and continuous monitoring reports. Significant changes must trigger reauthorization assessment.",
+      "evidence_required": "Current ATO letter with expiration date, up-to-date SSP, active POA&M with remediation progress, continuous monitoring reports, and significant change assessment records.",
+      "automation_level": "semi",
+      "nist_controls": ["CA-6", "CA-7"],
+      "priority": "critical"
+    },
+    {
+      "id": "SU-7",
+      "functional_area": "Sustain",
+      "functional_area_code": "SU",
+      "title": "Key Management",
+      "description": "Implement and maintain a cryptographic key management program covering the full key lifecycle: generation, distribution, storage, rotation, revocation, and destruction. Keys must be generated using FIPS-approved methods and stored in hardware security modules (HSMs) or equivalent secure storage. Key rotation must occur on defined schedules and immediately upon suspected compromise.",
+      "evidence_required": "Key management plan document, key inventory with rotation schedules, key rotation execution logs, HSM or secure key storage configuration, and key destruction records.",
+      "automation_level": "semi",
+      "nist_controls": ["SC-12", "SC-13"],
+      "priority": "high"
+    },
+    {
+      "id": "SU-8",
+      "functional_area": "Sustain",
+      "functional_area_code": "SU",
+      "title": "Backup and Recovery",
+      "description": "Implement regular backup procedures for all critical system data, configurations, and code with defined backup schedules based on data criticality. Backups must be encrypted, stored in geographically separate locations, and tested for recoverability at least quarterly. Recovery procedures must be documented and recovery tests must verify that data can be restored within defined RPO targets.",
+      "evidence_required": "Backup schedule documentation, backup encryption configuration, backup storage location documentation, recovery test results with RPO compliance verification, and backup monitoring/alerting configuration.",
+      "automation_level": "semi",
+      "nist_controls": ["CP-9", "CP-10"],
+      "priority": "high"
+    }
+  ]
+}

icdev/data/context/compliance/eu_ai_act_annex_iii.json

@@ -0,0 +1,108 @@
+{
+  "framework_id": "eu_ai_act",
+  "framework_name": "EU Artificial Intelligence Act (Regulation 2024/1689)",
+  "version": "2024",
+  "description": "EU AI Act risk classification and requirements for AI systems placed on the EU market.",
+  "requirements": [
+    {
+      "id": "EUAI-01",
+      "title": "Risk Classification",
+      "family": "classification",
+      "description": "AI system must be classified into risk categories: unacceptable, high-risk, limited, or minimal risk.",
+      "nist_800_53_crosswalk": ["RA-2", "RA-3"]
+    },
+    {
+      "id": "EUAI-02",
+      "title": "Data Governance",
+      "family": "data_governance",
+      "description": "High-risk AI systems must use training, validation, and testing data sets subject to appropriate data governance practices.",
+      "nist_800_53_crosswalk": ["SA-3", "SI-12"]
+    },
+    {
+      "id": "EUAI-03",
+      "title": "Technical Documentation",
+      "family": "documentation",
+      "description": "Technical documentation must be drawn up and kept up to date before the AI system is placed on the market.",
+      "nist_800_53_crosswalk": ["SA-5", "PL-2"]
+    },
+    {
+      "id": "EUAI-04",
+      "title": "Record-Keeping",
+      "family": "logging",
+      "description": "High-risk AI systems must allow for automatic recording of events (logging) throughout the AI system lifecycle.",
+      "nist_800_53_crosswalk": ["AU-2", "AU-3", "AU-6"]
+    },
+    {
+      "id": "EUAI-05",
+      "title": "Transparency",
+      "family": "transparency",
+      "description": "High-risk AI systems must be designed to ensure appropriate transparency to deployers.",
+      "nist_800_53_crosswalk": ["PL-4", "AT-2"]
+    },
+    {
+      "id": "EUAI-06",
+      "title": "Human Oversight",
+      "family": "oversight",
+      "description": "High-risk AI systems must be designed to allow effective human oversight during use.",
+      "nist_800_53_crosswalk": ["CA-7", "SI-4"]
+    },
+    {
+      "id": "EUAI-07",
+      "title": "Accuracy, Robustness, Cybersecurity",
+      "family": "technical",
+      "description": "High-risk AI systems must achieve appropriate levels of accuracy, robustness, and cybersecurity.",
+      "nist_800_53_crosswalk": ["SA-11", "SI-2", "SC-7"]
+    },
+    {
+      "id": "EUAI-08",
+      "title": "Risk Management System",
+      "family": "risk_management",
+      "description": "A risk management system must be established, implemented, documented and maintained for high-risk AI systems.",
+      "nist_800_53_crosswalk": ["RA-1", "RA-2", "PM-9"]
+    },
+    {
+      "id": "EUAI-09",
+      "title": "Conformity Assessment",
+      "family": "conformity",
+      "description": "High-risk AI systems must undergo conformity assessment before being placed on the market.",
+      "nist_800_53_crosswalk": ["CA-2", "CA-6"]
+    },
+    {
+      "id": "EUAI-10",
+      "title": "Post-Market Monitoring",
+      "family": "monitoring",
+      "description": "Providers must establish a post-market monitoring system proportionate to the risk level.",
+      "nist_800_53_crosswalk": ["CA-7", "SI-4", "PM-14"]
+    },
+    {
+      "id": "EUAI-11",
+      "title": "Incident Reporting",
+      "family": "incident",
+      "description": "Providers of high-risk AI systems must report serious incidents and malfunctions to market surveillance authorities.",
+      "nist_800_53_crosswalk": ["IR-6", "SI-5"]
+    },
+    {
+      "id": "EUAI-12",
+      "title": "Fundamental Rights Impact Assessment",
+      "family": "rights",
+      "description": "Deployers of high-risk AI systems must perform a fundamental rights impact assessment before deployment.",
+      "nist_800_53_crosswalk": ["RA-5", "PM-9"]
+    }
+  ],
+  "annex_iii_categories": [
+    {"id": "AX3-1", "title": "Biometric identification and categorisation of natural persons"},
+    {"id": "AX3-2", "title": "Management and operation of critical infrastructure"},
+    {"id": "AX3-3", "title": "Education and vocational training"},
+    {"id": "AX3-4", "title": "Employment, workers management and access to self-employment"},
+    {"id": "AX3-5", "title": "Access to essential private and public services"},
+    {"id": "AX3-6", "title": "Law enforcement"},
+    {"id": "AX3-7", "title": "Migration, asylum and border control management"},
+    {"id": "AX3-8", "title": "Administration of justice and democratic processes"}
+  ],
+  "risk_levels": [
+    {"level": "unacceptable", "description": "Banned AI practices (social scoring, real-time biometric identification)"},
+    {"level": "high_risk", "description": "AI systems in Annex III areas requiring full compliance"},
+    {"level": "limited_risk", "description": "AI systems with transparency obligations (chatbots, deepfakes)"},
+    {"level": "minimal_risk", "description": "AI systems with no specific requirements (spam filters, games)"}
+  ]
+}

icdev/data/context/compliance/export_templates/__init__.py

@@ -0,0 +1 @@
+# Package marker for PyPI distribution

icdev/data/context/compliance/export_templates/emass_controls.csv.j2

@@ -0,0 +1,4 @@
+Control Number,Control Name,Implementation Status,Implementation Description,Responsible Role,Assessment Date
+{% for ctrl in controls %}
+"{{ ctrl.control_id }}","{{ ctrl.control_name }}","{{ ctrl.status }}","{{ ctrl.description }}","{{ ctrl.responsible_role }}","{{ ctrl.assessment_date }}"
+{% endfor %}

icdev/data/context/compliance/export_templates/evidence_package.md.j2

@@ -0,0 +1,39 @@
+<!-- [TEMPLATE: CUI // SP-CTI] -->
+# {{ framework_name }} — Evidence Package
+
+**Project:** {{ project_id }}
+**Assessment Date:** {{ assessment_date }}
+**Classification:** CUI // SP-CTI
+
+---
+
+## Assessment Evidence
+
+{% for result in results %}
+### {{ result.requirement_id }} — {{ result.title | default("Untitled") }}
+
+- **Status:** {{ result.status }}
+- **Category:** {{ result.category | default("General") }}
+{% if result.implementation_detail %}
+- **Implementation:** {{ result.implementation_detail }}
+{% endif %}
+{% if result.evidence %}
+- **Evidence:** {{ result.evidence }}
+{% endif %}
+{% if result.last_assessed %}
+- **Last Assessed:** {{ result.last_assessed }}
+{% endif %}
+
+{% endfor %}
+
+---
+
+## Summary Statistics
+
+- **Total Assessed:** {{ total_requirements }}
+- **Coverage:** {{ coverage_pct }}%
+- **Gate Status:** {{ gate_status }}
+
+---
+
+*Generated by ICDEV Compliance Exporter — CUI // SP-CTI*