rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add CMMI maturity level to compliance controls

Browse Source 
Adds an optional CMMI 0-5 maturity level field to Control to support
ISO 27001 clause 9.1 effectiveness measurement and HITRUST CSF maturity
requirements. The field is nullable, framework-agnostic, and exposed
across all four API surfaces (GraphQL, MCP, CLI, n8n) plus the
generated SoA document.

Signed-off-by: Alejandro Juan <alejandrojuan@alejandrojuan.com>
This commit is contained in:
Alejandro Juan
2026-04-20 13:26:19 +02:00
committed by Sacha Al Himdani
parent 98487953b9
commit da91afc2a7
31 changed files with 919 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
pkg/cmd/control/create/create.go
View File

@@ -35,12 +35,22 @@ mutation($input: CreateControlInput!) {
bestPractice
implemented
notImplementedJustification
maturityLevel
}
}
}
}
`
var maturityLevelValues = []string{
"NONE",
"INITIAL",
"MANAGED",
"DEFINED",
"QUANTITATIVELY_MANAGED",
"OPTIMIZING",
}
type createResponse struct {
CreateControl struct {
ControlEdge struct {
@@ -52,6 +62,7 @@ type createResponse struct {
BestPractice bool `json:"bestPractice"`
Implemented string `json:"implemented"`
NotImplementedJustification *string `json:"notImplementedJustification"`
MaturityLevel *string `json:"maturityLevel"`
} `json:"node"`
} `json:"controlEdge"`
} `json:"createControl"`
@@ -66,6 +77,7 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
flagBestPractice bool
flagNotImplemented bool
flagNotImplementedJustification string
flagMaturityLevel string
)
cmd := &cobra.Command{
@@ -114,6 +126,13 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
input["notImplementedJustification"] = flagNotImplementedJustification
}
if flagMaturityLevel != "" {
if err := cmdutil.ValidateEnum("maturity-level", flagMaturityLevel, maturityLevelValues); err != nil {
return err
}
input["maturityLevel"] = flagMaturityLevel
}
data, err := client.Do(
createMutation,
map[string]any{"input": input},
@@ -146,6 +165,7 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
cmd.Flags().BoolVar(&flagBestPractice, "best-practice", false, "Mark as best practice")
cmd.Flags().BoolVar(&flagNotImplemented, "not-implemented", false, "Mark as not implemented")
cmd.Flags().StringVar(&flagNotImplementedJustification, "not-implemented-justification", "", "Justification for non-implementation")
cmd.Flags().StringVar(&flagMaturityLevel, "maturity-level", "", "CMMI maturity level (NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING)")
_ = cmd.MarkFlagRequired("framework")
_ = cmd.MarkFlagRequired("section-title")

21
pkg/cmd/control/list/list.go
View File

@@ -37,6 +37,8 @@ query($id: ID!, $first: Int, $after: CursorKey, $orderBy: ControlOrder, $filter:
name
description
bestPractice
implemented
maturityLevel
}
}
pageInfo {
@@ -50,11 +52,13 @@ query($id: ID!, $first: Int, $after: CursorKey, $orderBy: ControlOrder, $filter:
`
type control struct {
ID string `json:"id"`
SectionTitle string `json:"sectionTitle"`
Name string `json:"name"`
Description *string `json:"description"`
BestPractice bool `json:"bestPractice"`
ID string `json:"id"`
SectionTitle string `json:"sectionTitle"`
Name string `json:"name"`
Description *string `json:"description"`
BestPractice bool `json:"bestPractice"`
Implemented string `json:"implemented"`
MaturityLevel *string `json:"maturityLevel"`
}
func NewCmdList(f *cmdutil.Factory) *cobra.Command {
@@ -163,15 +167,20 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
if c.BestPractice {
bp = "Yes"
}
maturity := "-"
if c.MaturityLevel != nil {
maturity = *c.MaturityLevel
}
rows = append(rows, []string{
c.ID,
c.SectionTitle,
c.Name,
bp,
maturity,
})
}
t := cmdutil.NewTable("ID", "SECTION", "NAME", "BEST PRACTICE").Rows(rows...)
t := cmdutil.NewTable("ID", "SECTION", "NAME", "BEST PRACTICE", "MATURITY").Rows(rows...)
_, _ = fmt.Fprintln(f.IOStreams.Out, t)

23
pkg/cmd/control/update/update.go
View File

@@ -34,6 +34,7 @@ mutation($input: UpdateControlInput!) {
bestPractice
implemented
notImplementedJustification
maturityLevel
}
}
}
@@ -49,10 +50,20 @@ type updateResponse struct {
BestPractice bool `json:"bestPractice"`
Implemented string `json:"implemented"`
NotImplementedJustification *string `json:"notImplementedJustification"`
MaturityLevel *string `json:"maturityLevel"`
} `json:"control"`
} `json:"updateControl"`
}
var maturityLevelValues = []string{
"NONE",
"INITIAL",
"MANAGED",
"DEFINED",
"QUANTITATIVELY_MANAGED",
"OPTIMIZING",
}
func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
var (
flagSectionTitle string
@@ -61,6 +72,7 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
flagBestPractice bool
flagNotImplemented bool
flagNotImplementedJustification string
flagMaturityLevel string
)
cmd := &cobra.Command{
@@ -120,6 +132,16 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
input["notImplementedJustification"] = flagNotImplementedJustification
}
}
if cmd.Flags().Changed("maturity-level") {
if flagMaturityLevel == "" {
input["maturityLevel"] = nil
} else {
if err := cmdutil.ValidateEnum("maturity-level", flagMaturityLevel, maturityLevelValues); err != nil {
return err
}
input["maturityLevel"] = flagMaturityLevel
}
}
if len(input) == 1 {
return fmt.Errorf("at least one field must be specified for update")
@@ -156,6 +178,7 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
cmd.Flags().BoolVar(&flagBestPractice, "best-practice", false, "Mark as best practice")
cmd.Flags().BoolVar(&flagNotImplemented, "not-implemented", false, "Mark as not implemented")
cmd.Flags().StringVar(&flagNotImplementedJustification, "not-implemented-justification", "", "Justification for non-implementation")
cmd.Flags().StringVar(&flagMaturityLevel, "maturity-level", "", "CMMI maturity level (NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING). Empty string clears the value.")
return cmd
}

30
pkg/cmd/control/view/view.go
View File

@@ -34,6 +34,9 @@ query($id: ID!) {
name
description
bestPractice
implemented
notImplementedJustification
maturityLevel
framework {
id
name
@@ -47,13 +50,16 @@ query($id: ID!) {
type viewResponse struct {
Node *struct {
Typename string `json:"__typename"`
ID string `json:"id"`
SectionTitle string `json:"sectionTitle"`
Name string `json:"name"`
Description *string `json:"description"`
BestPractice bool `json:"bestPractice"`
Framework struct {
Typename string `json:"__typename"`
ID string `json:"id"`
SectionTitle string `json:"sectionTitle"`
Name string `json:"name"`
Description *string `json:"description"`
BestPractice bool `json:"bestPractice"`
Implemented string `json:"implemented"`
NotImplementedJustification *string `json:"notImplementedJustification"`
MaturityLevel *string `json:"maturityLevel"`
Framework struct {
ID string `json:"id"`
Name string `json:"name"`
} `json:"framework"`
@@ -138,6 +144,16 @@ func NewCmdView(f *cmdutil.Factory) *cobra.Command {
bp = "Yes"
}
_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Best Practice:"), bp)
_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Implemented:"), c.Implemented)
if c.Implemented == "NOT_IMPLEMENTED" && c.NotImplementedJustification != nil && *c.NotImplementedJustification != "" {
_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Justification:"), *c.NotImplementedJustification)
}
maturity := "Not set"
if c.MaturityLevel != nil {
maturity = *c.MaturityLevel
}
_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Maturity:"), maturity)
_, _ = fmt.Fprintln(out)
_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Created:"), cmdutil.FormatTime(c.CreatedAt))

22
pkg/coredata/control.go
View File

@@ -39,6 +39,7 @@ type (
BestPractice bool `db:"best_practice"`
Implemented ControlImplementationState `db:"implemented"`
NotImplementedJustification *string `db:"not_implemented_justification"`
MaturityLevel *ControlMaturityLevel `db:"maturity_level"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
}
@@ -135,6 +136,7 @@ WITH ctrl AS (
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
c.updated_at,
c.search_vector
@@ -155,6 +157,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -248,6 +251,7 @@ WITH ctrl AS (
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
c.updated_at,
c.search_vector
@@ -268,6 +272,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -367,6 +372,7 @@ WITH ctrl AS (
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
c.updated_at,
c.search_vector
@@ -393,6 +399,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -474,6 +481,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -570,6 +578,7 @@ WITH ctrl AS (
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
c.updated_at,
c.search_vector
@@ -590,6 +599,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -638,6 +648,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -688,6 +699,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -737,6 +749,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -783,6 +796,7 @@ INSERT INTO
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
)
@@ -797,6 +811,7 @@ VALUES (
@best_practice,
@implemented,
@not_implemented_justification,
@maturity_level,
@created_at,
@updated_at
);
@@ -813,6 +828,7 @@ VALUES (
"best_practice": c.BestPractice,
"implemented": c.Implemented,
"not_implemented_justification": c.NotImplementedJustification,
"maturity_level": c.MaturityLevel,
"created_at": c.CreatedAt,
"updated_at": c.UpdatedAt,
}
@@ -866,6 +882,7 @@ UPDATE controls SET
best_practice = @best_practice,
implemented = @implemented,
not_implemented_justification = @not_implemented_justification,
maturity_level = @maturity_level,
updated_at = @updated_at
WHERE %s
AND id = @control_id
@@ -880,6 +897,7 @@ WHERE %s
"best_practice": c.BestPractice,
"implemented": c.Implemented,
"not_implemented_justification": c.NotImplementedJustification,
"maturity_level": c.MaturityLevel,
"updated_at": c.UpdatedAt,
}
@@ -920,6 +938,7 @@ WITH ctrl AS (
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
c.updated_at,
c.search_vector
@@ -940,6 +959,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM
@@ -991,6 +1011,7 @@ WITH ctrl AS (
c.best_practice,
c.implemented,
c.not_implemented_justification,
c.maturity_level,
c.created_at,
c.updated_at,
c.search_vector
@@ -1011,6 +1032,7 @@ SELECT
best_practice,
implemented,
not_implemented_justification,
maturity_level,
created_at,
updated_at
FROM

75
pkg/coredata/control_maturity_level.go Normal file
View File

@@ -0,0 +1,75 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"database/sql/driver"
"fmt"
)
type (
ControlMaturityLevel string
)
const (
ControlMaturityLevelNone ControlMaturityLevel = "NONE"
ControlMaturityLevelInitial ControlMaturityLevel = "INITIAL"
ControlMaturityLevelManaged ControlMaturityLevel = "MANAGED"
ControlMaturityLevelDefined ControlMaturityLevel = "DEFINED"
ControlMaturityLevelQuantitativelyManaged ControlMaturityLevel = "QUANTITATIVELY_MANAGED"
ControlMaturityLevelOptimizing ControlMaturityLevel = "OPTIMIZING"
)
func (l ControlMaturityLevel) IsValid() bool {
switch l {
case ControlMaturityLevelNone,
ControlMaturityLevelInitial,
ControlMaturityLevelManaged,
ControlMaturityLevelDefined,
ControlMaturityLevelQuantitativelyManaged,
ControlMaturityLevelOptimizing:
return true
}
return false
}
func (l ControlMaturityLevel) String() string {
return string(l)
}
func (l ControlMaturityLevel) MarshalText() ([]byte, error) {
return []byte(l.String()), nil
}
func (l *ControlMaturityLevel) UnmarshalText(data []byte) error {
val := ControlMaturityLevel(data)
if !val.IsValid() {
return fmt.Errorf("invalid ControlMaturityLevel value: %q", string(data))
}
*l = val
return nil
}
func (l *ControlMaturityLevel) Scan(value any) error {
val, ok := value.(string)
if !ok {
return fmt.Errorf("invalid scan source for ControlMaturityLevel, expected string got %T", value)
}
return l.UnmarshalText([]byte(val))
}
func (l ControlMaturityLevel) Value() (driver.Value, error) {
return l.String(), nil
}

158
pkg/coredata/control_maturity_level_test.go Normal file
View File

@@ -0,0 +1,158 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import "testing"
func TestControlMaturityLevelIsValid(t *testing.T) {
t.Parallel()
tests := []struct {
name string
level ControlMaturityLevel
want bool
}{
{name: "none", level: ControlMaturityLevelNone, want: true},
{name: "initial", level: ControlMaturityLevelInitial, want: true},
{name: "managed", level: ControlMaturityLevelManaged, want: true},
{name: "defined", level: ControlMaturityLevelDefined, want: true},
{name: "quantitatively managed", level: ControlMaturityLevelQuantitativelyManaged, want: true},
{name: "optimizing", level: ControlMaturityLevelOptimizing, want: true},
{name: "empty string", level: "", want: false},
{name: "unknown value", level: "BOGUS", want: false},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
t.Parallel()
if got := tt.level.IsValid(); got != tt.want {
t.Fatalf("IsValid() = %v, want %v", got, tt.want)
}
})
}
}
func TestControlMaturityLevelScan(t *testing.T) {
t.Parallel()
tests := []struct {
name string
input any
want ControlMaturityLevel
wantErr bool
}{
{name: "none string", input: "NONE", want: ControlMaturityLevelNone},
{name: "initial string", input: "INITIAL", want: ControlMaturityLevelInitial},
{name: "managed string", input: "MANAGED", want: ControlMaturityLevelManaged},
{name: "defined string", input: "DEFINED", want: ControlMaturityLevelDefined},
{name: "quantitatively managed string", input: "QUANTITATIVELY_MANAGED", want: ControlMaturityLevelQuantitativelyManaged},
{name: "optimizing string", input: "OPTIMIZING", want: ControlMaturityLevelOptimizing},
{name: "invalid value", input: "BOGUS", wantErr: true},
{name: "unsupported type", input: 42, wantErr: true},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
t.Parallel()
var got ControlMaturityLevel
err := got.Scan(tt.input)
if tt.wantErr {
if err == nil {
t.Fatalf("Scan(%v) expected error", tt.input)
}
return
}
if err != nil {
t.Fatalf("Scan(%v) returned error: %v", tt.input, err)
}
if got != tt.want {
t.Fatalf("Scan(%v) = %q, want %q", tt.input, got, tt.want)
}
})
}
}
func TestControlMaturityLevelValue(t *testing.T) {
t.Parallel()
tests := []struct {
name string
level ControlMaturityLevel
want string
}{
{name: "none", level: ControlMaturityLevelNone, want: "NONE"},
{name: "initial", level: ControlMaturityLevelInitial, want: "INITIAL"},
{name: "managed", level: ControlMaturityLevelManaged, want: "MANAGED"},
{name: "defined", level: ControlMaturityLevelDefined, want: "DEFINED"},
{name: "quantitatively managed", level: ControlMaturityLevelQuantitativelyManaged, want: "QUANTITATIVELY_MANAGED"},
{name: "optimizing", level: ControlMaturityLevelOptimizing, want: "OPTIMIZING"},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
t.Parallel()
got, err := tt.level.Value()
if err != nil {
t.Fatalf("Value() returned error: %v", err)
}
if got != tt.want {
t.Fatalf("Value() = %q, want %q", got, tt.want)
}
})
}
}
func TestControlMaturityLevelMarshalUnmarshalText(t *testing.T) {
t.Parallel()
for _, level := range []ControlMaturityLevel{
ControlMaturityLevelNone,
ControlMaturityLevelInitial,
ControlMaturityLevelManaged,
ControlMaturityLevelDefined,
ControlMaturityLevelQuantitativelyManaged,
ControlMaturityLevelOptimizing,
} {
t.Run(string(level), func(t *testing.T) {
t.Parallel()
data, err := level.MarshalText()
if err != nil {
t.Fatalf("MarshalText() returned error: %v", err)
}
var roundtrip ControlMaturityLevel
if err := roundtrip.UnmarshalText(data); err != nil {
t.Fatalf("UnmarshalText(%q) returned error: %v", string(data), err)
}
if roundtrip != level {
t.Fatalf("roundtrip = %q, want %q", roundtrip, level)
}
})
}
t.Run("invalid", func(t *testing.T) {
t.Parallel()
var l ControlMaturityLevel
if err := l.UnmarshalText([]byte("BOGUS")); err == nil {
t.Fatal("UnmarshalText(BOGUS) expected error")
}
})
}

15
pkg/coredata/migrations/20260419T172808Z.sql Normal file
View File

@@ -0,0 +1,15 @@
-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
--
-- Permission to use, copy, modify, and/or distribute this software for any
-- purpose with or without fee is hereby granted, provided that the above
-- copyright notice and this permission notice appear in all copies.
--
-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-- PERFORMANCE OF THIS SOFTWARE.
ALTER TABLE controls ADD COLUMN maturity_level TEXT;

22
pkg/docgen/generator.go
View File

@@ -291,6 +291,7 @@ type (
Justification string
Implemented string
NotImplJustification string
MaturityLevel string
Regulatory string
Contractual string
BestPractice string
@@ -320,6 +321,27 @@ func BoolLabel(v bool) string {
return "No"
}
func MaturityLabel(l *coredata.ControlMaturityLevel) string {
if l == nil {
return "Not set"
}
switch *l {
case coredata.ControlMaturityLevelNone:
return "0 - None"
case coredata.ControlMaturityLevelInitial:
return "1 - Initial"
case coredata.ControlMaturityLevelManaged:
return "2 - Managed"
case coredata.ControlMaturityLevelDefined:
return "3 - Defined"
case coredata.ControlMaturityLevelQuantitativelyManaged:
return "4 - Quantitatively Managed"
case coredata.ControlMaturityLevelOptimizing:
return "5 - Optimizing"
}
return "Not set"
}
const (
ClassificationPublic Classification = "PUBLIC"
ClassificationInternal Classification = "INTERNAL"

37
pkg/probo/control_service.go
View File

@@ -40,6 +40,7 @@ type (
BestPractice bool
Implemented coredata.ControlImplementationState
NotImplementedJustification *string
MaturityLevel *coredata.ControlMaturityLevel
}
UpdateControlRequest struct {
@@ -50,6 +51,7 @@ type (
BestPractice *bool
Implemented *coredata.ControlImplementationState
NotImplementedJustification **string
MaturityLevel **coredata.ControlMaturityLevel
}
)
@@ -72,6 +74,21 @@ func (ccr *CreateControlRequest) Validate() error {
}),
)
if ccr.MaturityLevel != nil {
v.Check(
*ccr.MaturityLevel,
"maturity_level",
validator.OneOfSlice([]string{
string(coredata.ControlMaturityLevelNone),
string(coredata.ControlMaturityLevelInitial),
string(coredata.ControlMaturityLevelManaged),
string(coredata.ControlMaturityLevelDefined),
string(coredata.ControlMaturityLevelQuantitativelyManaged),
string(coredata.ControlMaturityLevelOptimizing),
}),
)
}
return v.Error()
}
@@ -92,6 +109,21 @@ func (ucr *UpdateControlRequest) Validate() error {
}),
)
if ucr.MaturityLevel != nil && *ucr.MaturityLevel != nil {
v.Check(
**ucr.MaturityLevel,
"maturity_level",
validator.OneOfSlice([]string{
string(coredata.ControlMaturityLevelNone),
string(coredata.ControlMaturityLevelInitial),
string(coredata.ControlMaturityLevelManaged),
string(coredata.ControlMaturityLevelDefined),
string(coredata.ControlMaturityLevelQuantitativelyManaged),
string(coredata.ControlMaturityLevelOptimizing),
}),
)
}
return v.Error()
}
@@ -868,6 +900,7 @@ func (s ControlService) Create(
BestPractice: req.BestPractice,
Implemented: req.Implemented,
NotImplementedJustification: notImplementedJustification,
MaturityLevel: req.MaturityLevel,
CreatedAt: now,
UpdatedAt: now,
}
@@ -985,6 +1018,10 @@ func (s ControlService) Update(
control.NotImplementedJustification = *req.NotImplementedJustification
}
if req.MaturityLevel != nil {
control.MaturityLevel = *req.MaturityLevel
}
control.UpdatedAt = time.Now()
return control.Update(ctx, conn, s.svc.scope)

9
pkg/probo/framework_service.go
View File

@@ -74,6 +74,7 @@ type (
BestPractice *bool `json:"best_practice,omitempty"`
Implemented string `json:"implemented,omitempty"`
NotImplementedJustification *string `json:"not_implemented_justification,omitempty"`
MaturityLevel *string `json:"maturity_level,omitempty"`
} `json:"controls"`
}
}
@@ -612,6 +613,13 @@ func (s FrameworkService) Import(
if implemented == coredata.ControlImplementationStateNotImplemented {
notImplementedJustification = control.NotImplementedJustification
}
var maturityLevel *coredata.ControlMaturityLevel
if control.MaturityLevel != nil {
ml := coredata.ControlMaturityLevel(*control.MaturityLevel)
if ml.IsValid() {
maturityLevel = &ml
}
}
control := &coredata.Control{
ID: controlID,
FrameworkID: frameworkID,
@@ -622,6 +630,7 @@ func (s FrameworkService) Import(
BestPractice: bestPractice,
Implemented: implemented,
NotImplementedJustification: notImplementedJustification,
MaturityLevel: maturityLevel,
CreatedAt: now,
UpdatedAt: now,
}

6
pkg/probo/generated_document_service.go
View File

@@ -317,6 +317,11 @@ func (s *GeneratedDocumentService) buildStatementOfApplicabilityDocumentData(
riskAssessment = docgen.BoolLabel(hasRisk)
}
maturityLevel := "-"
if applicable {
maturityLevel = docgen.MaturityLabel(control.MaturityLevel)
}
rows = append(rows, docgen.SOARow{
FrameworkName: framework.Name,
ControlSection: control.SectionTitle,
@@ -325,6 +330,7 @@ func (s *GeneratedDocumentService) buildStatementOfApplicabilityDocumentData(
Justification: justification,
Implemented: implemented,
NotImplJustification: notImplJustification,
MaturityLevel: maturityLevel,
Regulatory: regulatory,
Contractual: contractual,
BestPractice: bestPractice,

24
pkg/probo/templates/statement_of_applicability.json.tmpl
View File

@@ -28,6 +28,7 @@
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [130] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Justification for non-applicability", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [70] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Implemented", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [110] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Justification for non-implementation", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 2, "colwidth": [90] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Maturity", "marks": [{ "type": "bold" }] }] }] },
{ "type": "tableHeader", "attrs": { "colspan": 4, "rowspan": 1 }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Justification for inclusion", "marks": [{ "type": "bold" }] }] }] }
]
},
@@ -49,6 +50,7 @@
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [130] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Justification}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [70] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Implemented}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [110] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .NotImplJustification}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [90] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .MaturityLevel}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [60] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Regulatory}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [60] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Contractual}} }] }] },
{ "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [60] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .BestPractice}} }] }] },
@@ -124,6 +126,28 @@
"type": "paragraph",
"content": [{ "type": "text", "text": "Provides the rationale when a control is not implemented. This field is empty for implemented controls or when the control is not applicable." }]
},
{
"type": "heading",
"attrs": { "level": 3 },
"content": [{ "type": "text", "text": "Maturity" }]
},
{
"type": "paragraph",
"content": [{ "type": "text", "text": "Maturity level of the control, expressed on a CMMI 0-5 scale (Capability Maturity Model Integration). This is a best practice for ISO 27001 clause 9.1 (effectiveness measurement) and is required by frameworks such as HITRUST CSF." }]
},
{
"type": "bulletList",
"content": [
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "0 - None: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "the control is not implemented or does not exist." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "1 - Initial: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "ad-hoc and unpredictable, depending on individual effort." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "2 - Managed: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "the process is planned and tracked." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "3 - Defined: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "documented, standardized and integrated into the organization." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "4 - Quantitatively Managed: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "measured, controlled with metrics and statistical objectives." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "5 - Optimizing: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "continuous improvement based on quantitative analysis." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Not set: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "the maturity level has not yet been assessed." }] }] },
{ "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "-: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Not applicable (control is not applicable)." }] }] }
]
},
{
"type": "heading",
"attrs": { "level": 3 },

2
pkg/server/api/console/v1/control_resolvers.go
View File

@@ -417,6 +417,7 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create
BestPractice: input.BestPractice,
Implemented: input.Implemented,
NotImplementedJustification: input.NotImplementedJustification,
MaturityLevel: input.MaturityLevel,
},
)
if err != nil {
@@ -454,6 +455,7 @@ func (r *mutationResolver) UpdateControl(ctx context.Context, input types.Update
BestPractice: input.BestPractice,
Implemented: input.Implemented,
NotImplementedJustification: gqlutils.UnwrapOmittable(input.NotImplementedJustification),
MaturityLevel: gqlutils.UnwrapOmittable(input.MaturityLevel),
},
)

31
pkg/server/api/console/v1/graphql/control.graphql
View File

@@ -12,6 +12,34 @@ enum ControlImplementationState
)
}
enum ControlMaturityLevel
@goModel(model: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevel") {
NONE
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelNone"
)
INITIAL
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelInitial"
)
MANAGED
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelManaged"
)
DEFINED
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelDefined"
)
QUANTITATIVELY_MANAGED
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelQuantitativelyManaged"
)
OPTIMIZING
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelOptimizing"
)
}
enum ControlOrderField
@goModel(model: "go.probo.inc/probo/pkg/coredata.ControlOrderField") {
CREATED_AT
@@ -87,6 +115,7 @@ type Control implements Node {
bestPractice: Boolean!
implemented: ControlImplementationState!
notImplementedJustification: String
maturityLevel: ControlMaturityLevel
regulatory: Boolean! @goField(forceResolver: true)
contractual: Boolean! @goField(forceResolver: true)
riskAssessment: Boolean! @goField(forceResolver: true)
@@ -280,6 +309,7 @@ input CreateControlInput {
bestPractice: Boolean!
implemented: ControlImplementationState!
notImplementedJustification: String
maturityLevel: ControlMaturityLevel
}
input UpdateControlInput {
@@ -290,6 +320,7 @@ input UpdateControlInput {
bestPractice: Boolean
implemented: ControlImplementationState
notImplementedJustification: String @goField(omittable: true)
maturityLevel: ControlMaturityLevel @goField(omittable: true)
}
input DeleteControlInput {

1
pkg/server/api/console/v1/types/control.go
View File

@@ -77,6 +77,7 @@ func NewControl(control *coredata.Control) *Control {
BestPractice: control.BestPractice,
Implemented: control.Implemented,
NotImplementedJustification: control.NotImplementedJustification,
MaturityLevel: control.MaturityLevel,
CreatedAt: control.CreatedAt,
UpdatedAt: control.UpdatedAt,
}

18
pkg/server/api/mcp/v1/schema.resolvers.go
View File

@@ -1473,6 +1473,12 @@ func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest,
svc := r.ProboService(ctx, input.FrameworkID)
var maturityLevel *coredata.ControlMaturityLevel
if input.MaturityLevel != nil {
v := coredata.ControlMaturityLevel(*input.MaturityLevel)
maturityLevel = &v
}
control, err := svc.Controls.Create(
ctx,
probo.CreateControlRequest{
@@ -1483,6 +1489,7 @@ func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest,
BestPractice: input.BestPractice,
Implemented: coredata.ControlImplementationState(input.Implemented),
NotImplementedJustification: input.NotImplementedJustification,
MaturityLevel: maturityLevel,
},
)
if err != nil {
@@ -1505,6 +1512,16 @@ func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolReque
implemented = &v
}
var maturityLevel **coredata.ControlMaturityLevel
if rawMaturity := UnwrapOmittable(input.MaturityLevel); rawMaturity != nil {
var inner *coredata.ControlMaturityLevel
if *rawMaturity != nil {
v := coredata.ControlMaturityLevel(**rawMaturity)
inner = &v
}
maturityLevel = &inner
}
control, err := svc.Controls.Update(
ctx,
probo.UpdateControlRequest{
@@ -1515,6 +1532,7 @@ func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolReque
BestPractice: input.BestPractice,
Implemented: implemented,
NotImplementedJustification: UnwrapOmittable(input.NotImplementedJustification),
MaturityLevel: maturityLevel,
},
)
if err != nil {

20
pkg/server/api/mcp/v1/specification.yaml
View File

@@ -4249,6 +4249,13 @@ components:
- string
- "null"
description: Justification for non-implementation
maturity_level:
type:
- string
- "null"
enum: [NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING, null]
description: CMMI 0-5 maturity level of the control
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlMaturityLevel
created_at:
type: string
format: date-time
@@ -4353,6 +4360,13 @@ components:
- string
- "null"
description: Justification for non-implementation
maturity_level:
type:
- string
- "null"
enum: [NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING, null]
description: CMMI 0-5 maturity level of the control
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlMaturityLevel
AddControlOutput:
type: object
@@ -4392,6 +4406,12 @@ components:
type: ["string", "null"]
description: Justification for non-implementation
go.probo.inc/mcpgen/omittable: true
maturity_level:
type: ["string", "null"]
enum: [NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING, null]
description: CMMI 0-5 maturity level of the control
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlMaturityLevel
go.probo.inc/mcpgen/omittable: true
UpdateControlOutput:
type: object

7
pkg/server/api/mcp/v1/types/control.go
View File

@@ -19,6 +19,12 @@ import (
)
func NewControl(c *coredata.Control) *Control {
var maturityLevel *string
if c.MaturityLevel != nil {
s := string(*c.MaturityLevel)
maturityLevel = &s
}
return &Control{
ID: c.ID,
OrganizationID: c.OrganizationID,
@@ -29,6 +35,7 @@ func NewControl(c *coredata.Control) *Control {
BestPractice: c.BestPractice,
Implemented: ControlImplemented(c.Implemented),
NotImplementedJustification: c.NotImplementedJustification,
MaturityLevel: maturityLevel,
CreatedAt: c.CreatedAt,
UpdatedAt: c.UpdatedAt,
}