icdev 1.0.0__py3-none-any.whl

icdev/data/context/simulation/coa_templates.json

@@ -0,0 +1,38 @@
+{
+  "coa_types": {
+    "speed": {
+      "name": "Speed COA",
+      "priority_filter": ["P1"],
+      "timeline_pis_range": [1, 2],
+      "risk_level": "high",
+      "compliance_coverage_target": 0.70,
+      "contingency_factor": 0.10,
+      "team_size_factor": 0.7,
+      "advantages": ["Fastest delivery", "Lowest initial cost", "Quick customer feedback", "Minimal initial complexity"],
+      "disadvantages": ["Technical debt accumulation", "Limited feature scope", "Higher long-term risk", "May require significant rework"]
+    },
+    "balanced": {
+      "name": "Balanced COA",
+      "priority_filter": ["P1", "P2"],
+      "timeline_pis_range": [2, 3],
+      "risk_level": "moderate",
+      "compliance_coverage_target": 0.85,
+      "contingency_factor": 0.20,
+      "team_size_factor": 1.0,
+      "recommended": true,
+      "advantages": ["Good scope-risk balance", "Reasonable timeline", "Adequate compliance coverage", "Sustainable pace"],
+      "disadvantages": ["Some features deferred", "Moderate complexity", "Requires prioritization discipline"]
+    },
+    "comprehensive": {
+      "name": "Comprehensive COA",
+      "priority_filter": ["P1", "P2", "P3"],
+      "timeline_pis_range": [3, 5],
+      "risk_level": "low",
+      "compliance_coverage_target": 0.95,
+      "contingency_factor": 0.35,
+      "team_size_factor": 1.3,
+      "advantages": ["Complete scope coverage", "Lowest operational risk", "Full compliance", "Future-proof architecture"],
+      "disadvantages": ["Longest timeline", "Highest cost", "Feature creep risk", "Delayed initial value"]
+    }
+  }
+}

icdev/data/context/simulation/cost_models.json

@@ -0,0 +1,23 @@
+{
+  "t_shirt_sizes": {
+    "XS": {"hours": 8, "cost_per_hour": 150, "total": 1200},
+    "S": {"hours": 40, "cost_per_hour": 150, "total": 6000},
+    "M": {"hours": 80, "cost_per_hour": 150, "total": 12000},
+    "L": {"hours": 200, "cost_per_hour": 150, "total": 30000},
+    "XL": {"hours": 400, "cost_per_hour": 150, "total": 60000},
+    "XXL": {"hours": 800, "cost_per_hour": 150, "total": 120000}
+  },
+  "infrastructure_cost_per_component": 5000,
+  "contingency_factors": {
+    "low_risk": 0.10,
+    "moderate_risk": 0.20,
+    "high_risk": 0.35
+  },
+  "hourly_rates": {
+    "default": 150,
+    "senior_engineer": 200,
+    "architect": 250,
+    "compliance_specialist": 175,
+    "project_manager": 160
+  }
+}

icdev/data/context/simulation/risk_categories.json

@@ -0,0 +1,46 @@
+{
+  "categories": [
+    {
+      "id": "RISK-TECH",
+      "name": "Technical Risk",
+      "indicators": ["complex architecture", "new technology", "integration challenges", "performance requirements"],
+      "base_probability": 0.3,
+      "impact_levels": {"low": 0.1, "medium": 0.3, "high": 0.6, "critical": 0.9}
+    },
+    {
+      "id": "RISK-COMP",
+      "name": "Compliance Risk",
+      "indicators": ["ATO boundary change", "control gaps", "classification change", "framework requirements"],
+      "base_probability": 0.25,
+      "impact_levels": {"low": 0.1, "medium": 0.3, "high": 0.6, "critical": 0.9}
+    },
+    {
+      "id": "RISK-SC",
+      "name": "Supply Chain Risk",
+      "indicators": ["new vendor", "single source", "foreign dependency", "CVE history"],
+      "base_probability": 0.2,
+      "impact_levels": {"low": 0.05, "medium": 0.2, "high": 0.5, "critical": 0.8}
+    },
+    {
+      "id": "RISK-SCHED",
+      "name": "Schedule Risk",
+      "indicators": ["aggressive timeline", "resource constraints", "dependencies", "scope creep"],
+      "base_probability": 0.4,
+      "impact_levels": {"low": 0.1, "medium": 0.25, "high": 0.5, "critical": 0.8}
+    },
+    {
+      "id": "RISK-COST",
+      "name": "Cost Risk",
+      "indicators": ["estimation uncertainty", "hidden costs", "vendor pricing", "scope changes"],
+      "base_probability": 0.35,
+      "impact_levels": {"low": 0.1, "medium": 0.2, "high": 0.4, "critical": 0.7}
+    },
+    {
+      "id": "RISK-ORG",
+      "name": "Organizational Risk",
+      "indicators": ["stakeholder misalignment", "change resistance", "skill gaps", "turnover"],
+      "base_probability": 0.2,
+      "impact_levels": {"low": 0.05, "medium": 0.15, "high": 0.35, "critical": 0.6}
+    }
+  ]
+}

icdev/data/context/supply_chain/__init__.py

@@ -0,0 +1 @@
+# Package marker for PyPI distribution

icdev/data/context/supply_chain/isa_templates.json

@@ -0,0 +1,129 @@
+{
+  "classification": "CUI // SP-CTI",
+  "version": "1.0.0",
+  "description": "ISA/MOU lifecycle templates for interconnection security agreements",
+  "isa_types": {
+    "ISA": {
+      "full_name": "Interconnection Security Agreement",
+      "description": "Governs the security requirements for connecting two or more IT systems owned or operated by different organizations",
+      "required_sections": [
+        "system_identification",
+        "security_controls",
+        "data_types",
+        "ports_protocols",
+        "incident_response"
+      ],
+      "review_cadence_days": 365,
+      "template_fields": {
+        "system_identification": {
+          "description": "Identifies the systems being interconnected",
+          "fields": ["system_name", "system_owner", "authorizing_official", "classification_level", "impact_level"]
+        },
+        "security_controls": {
+          "description": "Security controls governing the interconnection",
+          "fields": ["encryption_standard", "authentication_method", "access_control_policy", "audit_logging", "monitoring_requirements"]
+        },
+        "data_types": {
+          "description": "Types of data transmitted across the interconnection",
+          "fields": ["data_classification", "data_categories", "pii_indicator", "cui_indicator", "volume_estimate"]
+        },
+        "ports_protocols": {
+          "description": "Network ports, protocols, and services allowed",
+          "fields": ["allowed_ports", "allowed_protocols", "allowed_services", "firewall_rules", "network_diagram_ref"]
+        },
+        "incident_response": {
+          "description": "Incident response procedures for the interconnection",
+          "fields": ["notification_timeline", "escalation_contacts", "isolation_procedures", "recovery_procedures", "joint_exercises"]
+        }
+      }
+    },
+    "MOU": {
+      "full_name": "Memorandum of Understanding",
+      "description": "High-level agreement establishing mutual understanding for information sharing and system interconnection",
+      "required_sections": [
+        "purpose",
+        "responsibilities",
+        "data_sharing",
+        "security_requirements"
+      ],
+      "review_cadence_days": 365,
+      "template_fields": {
+        "purpose": {
+          "description": "Purpose and scope of the agreement",
+          "fields": ["agreement_purpose", "scope", "effective_date", "duration", "renewal_terms"]
+        },
+        "responsibilities": {
+          "description": "Responsibilities of each party",
+          "fields": ["party_a_responsibilities", "party_b_responsibilities", "shared_responsibilities", "governance_structure"]
+        },
+        "data_sharing": {
+          "description": "Data sharing terms and conditions",
+          "fields": ["data_types", "data_classification", "sharing_frequency", "retention_period", "destruction_requirements"]
+        },
+        "security_requirements": {
+          "description": "Security requirements for all parties",
+          "fields": ["baseline_controls", "incident_notification", "audit_rights", "compliance_verification", "breach_liability"]
+        }
+      }
+    },
+    "SLA": {
+      "full_name": "Service Level Agreement",
+      "description": "Defines the service levels and performance metrics for interconnected services",
+      "required_sections": [
+        "service_description",
+        "performance_metrics",
+        "availability",
+        "support"
+      ],
+      "review_cadence_days": 180,
+      "template_fields": {
+        "service_description": {
+          "description": "Description of the service being provided",
+          "fields": ["service_name", "service_scope", "service_hours", "maintenance_windows"]
+        },
+        "performance_metrics": {
+          "description": "Performance metrics and thresholds",
+          "fields": ["latency_threshold", "throughput_threshold", "error_rate_threshold", "measurement_method"]
+        },
+        "availability": {
+          "description": "Availability targets and disaster recovery",
+          "fields": ["uptime_target", "rto", "rpo", "failover_procedure", "dr_testing_cadence"]
+        },
+        "support": {
+          "description": "Support structure and escalation",
+          "fields": ["support_tiers", "response_times", "escalation_path", "poc_contacts"]
+        }
+      }
+    }
+  },
+  "status_transitions": {
+    "draft": ["pending_review"],
+    "pending_review": ["active", "revoked"],
+    "active": ["pending_review", "expired", "revoked"],
+    "expired": ["pending_review", "revoked"],
+    "revoked": []
+  },
+  "status_descriptions": {
+    "draft": "Initial creation, not yet submitted for review",
+    "pending_review": "Submitted for review by both parties and security team",
+    "active": "Signed, authorized, and in effect",
+    "expired": "Past expiry date, requires re-authorization to continue",
+    "revoked": "Terminated, no longer valid, interconnection must be severed"
+  },
+  "compliance_checks": {
+    "pre_activation": [
+      "Both system ATOs are current",
+      "Security controls are implemented and verified",
+      "Incident response procedures tested",
+      "Network architecture reviewed by ISSM",
+      "Data classification markings confirmed"
+    ],
+    "annual_review": [
+      "All data flows still required and authorized",
+      "Security controls still adequate for current threat landscape",
+      "Incident response contacts current",
+      "No unauthorized changes to interconnection",
+      "Both system ATOs still valid"
+    ]
+  }
+}

icdev/data/context/supply_chain/nist_800_161_controls.json

@@ -0,0 +1,247 @@
+{
+  "classification": "CUI // SP-CTI",
+  "version": "1.0.0",
+  "framework": "NIST SP 800-161 Rev 1",
+  "title": "Cybersecurity Supply Chain Risk Management Practices",
+  "description": "Supply chain risk management controls for federal information systems and organizations",
+  "controls": [
+    {
+      "id": "SR-1",
+      "title": "Policy and Procedures",
+      "description": "Develop, document, and disseminate supply chain risk management policy and procedures that address purpose, scope, roles, responsibilities, management commitment, coordination, and compliance",
+      "family": "Supply Chain Risk Management",
+      "nist_800_53_mapping": ["SA-12", "SR-1"],
+      "assessment_criteria": [
+        "SCRM policy exists and is approved",
+        "Policy updated within 12 months",
+        "Includes roles and responsibilities",
+        "Addresses coordination among entities",
+        "Defines compliance requirements"
+      ]
+    },
+    {
+      "id": "SR-2",
+      "title": "Supply Chain Risk Management Plan",
+      "description": "Develop a plan for managing supply chain risks associated with the research, development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of systems, components, or services",
+      "family": "Supply Chain Risk Management",
+      "nist_800_53_mapping": ["SA-12(1)", "SR-2"],
+      "assessment_criteria": [
+        "SCRM plan exists for each system",
+        "Plan identifies critical components",
+        "Plan addresses threat landscape",
+        "Plan includes risk mitigation strategies",
+        "Plan is reviewed and updated annually"
+      ]
+    },
+    {
+      "id": "SR-3",
+      "title": "Supply Chain Controls and Processes",
+      "description": "Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes",
+      "family": "Supply Chain Risk Management",
+      "nist_800_53_mapping": ["SA-12(2)", "SR-3"],
+      "assessment_criteria": [
+        "Supply chain control processes are documented",
+        "Weakness identification mechanisms exist",
+        "Deficiency remediation timelines defined",
+        "Controls cover procurement through disposal",
+        "Evidence of periodic process review"
+      ]
+    },
+    {
+      "id": "SR-4",
+      "title": "Provenance",
+      "description": "Document, monitor, and maintain valid provenance of systems, components, and associated data",
+      "family": "Supply Chain Risk Management",
+      "nist_800_53_mapping": ["SA-12(13)", "SR-4"],
+      "assessment_criteria": [
+        "Component provenance is tracked",
+        "Chain of custody documented",
+        "Source code origin verified",
+        "Binary artifact provenance established",
+        "SBOM generated and maintained"
+      ]
+    },
+    {
+      "id": "SR-5",
+      "title": "Acquisition Strategies, Tools, and Methods",
+      "description": "Employ acquisition strategies, contract tools, and procurement methods to protect against, detect, and mitigate supply chain risks",
+      "family": "Supply Chain Risk Management",
+      "nist_800_53_mapping": ["SA-4", "SR-5"],
+      "assessment_criteria": [
+        "Acquisition strategy includes SCRM requirements",
+        "Contract clauses address security requirements",
+        "Procurement methods include vendor assessment",
+        "Section 889 compliance verified",
+        "Country-of-origin restrictions enforced"
+      ]
+    },
+    {
+      "id": "SR-6",
+      "title": "Supplier Assessments and Reviews",
+      "description": "Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide",
+      "family": "Supply Chain Risk Management",
+      "nist_800_53_mapping": ["SA-12(14)", "SR-6"],
+      "assessment_criteria": [
+        "Supplier risk assessments conducted",
+        "Assessment cadence defined and followed",
+        "Risk scoring methodology documented",
+        "High-risk suppliers have mitigation plans",
+        "Assessment results inform procurement decisions"
+      ]
+    },
+    {
+      "id": "SR-7",
+      "title": "Supply Chain Operations Security",
+      "description": "Employ operations security controls to protect supply chain activities",
+      "family": "Supply Chain Risk Management",
+      "nist_800_53_mapping": ["SA-12(4)", "SR-7"],
+      "assessment_criteria": [
+        "OPSEC plan covers supply chain activities",
+        "Critical information identified and protected",
+        "Threat analysis conducted for supply chain",
+        "Countermeasures implemented for identified threats",
+        "OPSEC indicators monitored"
+      ]
+    },
+    {
+      "id": "SR-8",
+      "title": "Notification Agreements",
+      "description": "Establish agreements and procedures with entities involved in the supply chain for notification of supply chain compromises and results of assessments or audits",
+      "family": "Supply Chain Risk Management",
+      "nist_800_53_mapping": ["SA-12(5)", "SR-8"],
+      "assessment_criteria": [
+        "Notification agreements with suppliers",
+        "Incident notification timelines defined",
+        "Assessment result sharing procedures exist",
+        "ISA/MOU agreements are current",
+        "Notification test exercises conducted"
+      ]
+    },
+    {
+      "id": "SR-9",
+      "title": "Tamper Resistance and Detection",
+      "description": "Implement tamper protection for systems, system components, and associated data during development, manufacturing, and transportation",
+      "family": "Supply Chain Risk Management",
+      "nist_800_53_mapping": ["SA-12(10)", "SR-9"],
+      "assessment_criteria": [
+        "Tamper-evident packaging required",
+        "Component integrity verification on receipt",
+        "Cryptographic signing for software/firmware",
+        "Transportation security controls defined",
+        "Tamper detection mechanisms in place"
+      ]
+    },
+    {
+      "id": "SR-10",
+      "title": "Inspection of Systems or Components",
+      "description": "Inspect systems or system components upon delivery, at random, or at a specific state in the system development life cycle to detect tampering",
+      "family": "Supply Chain Risk Management",
+      "nist_800_53_mapping": ["SA-12(11)", "SR-10"],
+      "assessment_criteria": [
+        "Inspection procedures documented",
+        "Inspection occurs at delivery",
+        "Random inspection schedule exists",
+        "SDLC phase inspection points defined",
+        "Inspection results recorded and tracked"
+      ]
+    },
+    {
+      "id": "SR-11",
+      "title": "Component Authenticity",
+      "description": "Develop and implement anti-counterfeit policy and procedures that include the detection and prevention of counterfeit components",
+      "family": "Supply Chain Risk Management",
+      "nist_800_53_mapping": ["SA-12(12)", "SR-11"],
+      "assessment_criteria": [
+        "Anti-counterfeit policy exists",
+        "Component verification procedures documented",
+        "Authorized distribution channels identified",
+        "Counterfeit detection training provided",
+        "Incident reporting for counterfeit components"
+      ]
+    },
+    {
+      "id": "SR-12",
+      "title": "Component Disposal",
+      "description": "Dispose of system components using organization-defined techniques and methods in accordance with applicable laws, executive orders, directives, policies, regulations, and standards",
+      "family": "Supply Chain Risk Management",
+      "nist_800_53_mapping": ["SA-12(3)", "SR-12"],
+      "assessment_criteria": [
+        "Disposal procedures documented",
+        "Data sanitization before disposal",
+        "Chain of custody maintained during disposal",
+        "Disposal certificates obtained",
+        "Compliance with environmental regulations"
+      ]
+    },
+    {
+      "id": "SA-12",
+      "title": "Supply Chain Protection",
+      "description": "Protect against supply chain threats to the system, system component, or system service by employing security safeguards as part of a comprehensive, defense-in-depth information security strategy",
+      "family": "System and Services Acquisition",
+      "nist_800_53_mapping": ["SA-12"],
+      "assessment_criteria": [
+        "Defense-in-depth strategy includes supply chain",
+        "Supply chain threat model exists",
+        "Multi-layered security safeguards implemented",
+        "Supply chain risk integrated into enterprise risk",
+        "Continuous monitoring of supply chain indicators"
+      ]
+    },
+    {
+      "id": "SA-22",
+      "title": "Unsupported System Components",
+      "description": "Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; and provide options for alternative sources for continued support for unsupported components",
+      "family": "System and Services Acquisition",
+      "nist_800_53_mapping": ["SA-22"],
+      "assessment_criteria": [
+        "EOL/EOS tracking for all components",
+        "Replacement plan for unsupported components",
+        "Alternative support sources identified",
+        "Risk assessment for unsupported components",
+        "Migration timeline defined for each EOL component"
+      ]
+    },
+    {
+      "id": "PM-30",
+      "title": "Supply Chain Risk Management Strategy",
+      "description": "Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services",
+      "family": "Program Management",
+      "nist_800_53_mapping": ["PM-30"],
+      "assessment_criteria": [
+        "Organization-wide SCRM strategy exists",
+        "Strategy approved by senior leadership",
+        "Strategy addresses all system lifecycle phases",
+        "Strategy defines acceptable risk levels",
+        "Strategy reviewed and updated annually"
+      ]
+    },
+    {
+      "id": "SA-4",
+      "title": "Acquisition Process",
+      "description": "Include security and supply chain risk management requirements, descriptions, and criteria in the acquisition contract for the system, system component, or system service",
+      "family": "System and Services Acquisition",
+      "nist_800_53_mapping": ["SA-4"],
+      "assessment_criteria": [
+        "Security requirements in acquisition contracts",
+        "SCRM clauses in all vendor agreements",
+        "Evaluation criteria include security posture",
+        "Vendor security certification requirements defined",
+        "Contract includes incident notification obligations"
+      ]
+    },
+    {
+      "id": "SA-9",
+      "title": "External System Services",
+      "description": "Require that providers of external system services comply with organizational security requirements and employ defined controls in accordance with applicable laws, executive orders, directives, policies, regulations, standards, and guidance",
+      "family": "System and Services Acquisition",
+      "nist_800_53_mapping": ["SA-9"],
+      "assessment_criteria": [
+        "External service provider agreements exist",
+        "Security requirements flowed to providers",
+        "Provider compliance monitoring in place",
+        "ISA/MOU for all external connections",
+        "Provider incident response integration"
+      ]
+    }
+  ]
+}

icdev/data/context/supply_chain/scrm_risk_matrix.json

@@ -0,0 +1,147 @@
+{
+  "classification": "CUI // SP-CTI",
+  "version": "1.0.0",
+  "description": "SCRM risk scoring matrix for supply chain vendor and component assessment",
+  "risk_dimensions": {
+    "provenance": {
+      "weight": 0.25,
+      "description": "Country of origin and supply chain transparency",
+      "scoring": {
+        "five_eyes": 10,
+        "nato_ally": 7,
+        "partner_nation": 5,
+        "neutral": 3,
+        "adversary_nation": 1
+      },
+      "factors": [
+        "Country of origin of vendor headquarters",
+        "Country of manufacture for hardware components",
+        "Transparency of sub-supplier chain",
+        "Open source vs proprietary provenance",
+        "Code signing and artifact verification"
+      ]
+    },
+    "integrity": {
+      "weight": 0.20,
+      "description": "Component integrity verification and tamper resistance",
+      "scoring": {
+        "cryptographic_verification": 10,
+        "signed_builds": 8,
+        "checksum_verification": 6,
+        "vendor_attestation_only": 4,
+        "no_verification": 1
+      },
+      "factors": [
+        "SBOM completeness and accuracy",
+        "Build provenance (SLSA level)",
+        "Code signing practices",
+        "Reproducible builds",
+        "Vulnerability disclosure program"
+      ]
+    },
+    "dependency": {
+      "weight": 0.15,
+      "description": "Dependency depth, breadth, and single-point-of-failure risk",
+      "scoring": {
+        "no_transitive_deps": 10,
+        "shallow_deps_verified": 8,
+        "moderate_deps_partially_verified": 6,
+        "deep_deps_unverified": 3,
+        "unknown_dependency_tree": 1
+      },
+      "factors": [
+        "Number of direct dependencies",
+        "Transitive dependency depth",
+        "Single vendor concentration",
+        "Single country concentration",
+        "Dependency update frequency"
+      ]
+    },
+    "substitutability": {
+      "weight": 0.15,
+      "description": "Ability to replace vendor or component if compromised or unavailable",
+      "scoring": {
+        "commodity_multiple_sources": 10,
+        "standard_interface_alternatives_exist": 8,
+        "alternatives_exist_migration_needed": 6,
+        "limited_alternatives_high_switching_cost": 3,
+        "sole_source_no_alternative": 1
+      },
+      "factors": [
+        "Number of alternative vendors",
+        "Standardized interfaces (APIs, protocols)",
+        "Migration complexity estimate",
+        "Data portability",
+        "Contractual lock-in duration"
+      ]
+    },
+    "access_control": {
+      "weight": 0.15,
+      "description": "Vendor access to systems, data, and networks",
+      "scoring": {
+        "no_access_air_gapped": 10,
+        "read_only_monitored": 8,
+        "limited_write_audited": 6,
+        "broad_access_partially_monitored": 3,
+        "privileged_access_unmonitored": 1
+      },
+      "factors": [
+        "Level of system access granted",
+        "Access monitoring and logging",
+        "Privileged access controls",
+        "Data access scope",
+        "Remote access mechanisms"
+      ]
+    },
+    "incident_history": {
+      "weight": 0.10,
+      "description": "Vendor security incident history and response capability",
+      "scoring": {
+        "no_incidents_strong_program": 10,
+        "minor_incidents_good_response": 8,
+        "moderate_incidents_adequate_response": 6,
+        "significant_incidents_slow_response": 3,
+        "major_breach_poor_response": 1
+      },
+      "factors": [
+        "Number of security incidents in past 3 years",
+        "Severity of past incidents",
+        "Mean time to disclosure",
+        "Mean time to remediation",
+        "Security program maturity (SOC 2, ISO 27001)"
+      ]
+    }
+  },
+  "risk_tiers": {
+    "low": {
+      "min_score": 8.0,
+      "color": "green",
+      "action": "Standard monitoring",
+      "review_cadence_days": 365,
+      "description": "Vendor presents minimal supply chain risk. Standard monitoring and annual review."
+    },
+    "medium": {
+      "min_score": 6.0,
+      "color": "yellow",
+      "action": "Enhanced due diligence",
+      "review_cadence_days": 180,
+      "description": "Vendor requires enhanced monitoring. Semi-annual risk review and additional controls."
+    },
+    "high": {
+      "min_score": 4.0,
+      "color": "orange",
+      "action": "Risk mitigation plan required",
+      "review_cadence_days": 90,
+      "description": "Vendor presents significant risk. Quarterly review, mitigation plan, and alternative sourcing analysis required."
+    },
+    "critical": {
+      "min_score": 0.0,
+      "color": "red",
+      "action": "Immediate remediation or vendor replacement",
+      "review_cadence_days": 30,
+      "description": "Vendor presents unacceptable risk. Immediate action required: remediation plan, vendor replacement, or AO risk acceptance."
+    }
+  },
+  "composite_score_formula": "sum(dimension_weight * dimension_score) for each dimension",
+  "section_889_override": "If section_889_status == 'non_compliant', force risk_tier to 'critical' regardless of composite score"
+}

icdev/data/context/templates/__init__.py

@@ -0,0 +1 @@
+# Package marker for PyPI distribution

icdev/data/context/templates/ansible/__init__.py

@@ -0,0 +1 @@
+# Package marker for PyPI distribution

icdev/data/context/templates/ansible/playbooks/__init__.py

@@ -0,0 +1 @@
+# Package marker for PyPI distribution

icdev/data/context/templates/ansible/roles/__init__.py

@@ -0,0 +1 @@
+# Package marker for PyPI distribution

icdev/data/context/templates/gitlab_ci/__init__.py

@@ -0,0 +1 @@
+# Package marker for PyPI distribution

icdev/data/context/templates/grafana/__init__.py

@@ -0,0 +1 @@
+# Package marker for PyPI distribution

icdev/data/context/templates/kubernetes/__init__.py

@@ -0,0 +1 @@
+# Package marker for PyPI distribution

icdev/data/context/templates/project/__init__.py

@@ -0,0 +1 @@
+# Package marker for PyPI distribution