adding GPDR, CCPA, NIS2 & DORA
This commit is contained in:
Antoine Bouchardy
committed by
Bryan Frimin
Bryan Frimin
parent
232d05d99a
commit
dcac038055
97
apps/console/public/data/frameworks/CCPA.json
Normal file
97
apps/console/public/data/frameworks/CCPA.json
Normal file
@@ -0,0 +1,97 @@
|
||||
{
|
||||
"id": "CCPA",
|
||||
"name": "CCPA",
|
||||
"controls": [
|
||||
{
|
||||
"id": "1798.100(a)",
|
||||
"name": "Notice at collection"
|
||||
},
|
||||
{
|
||||
"id": "1798.100(a)(3)",
|
||||
"name": "Data retention limits"
|
||||
},
|
||||
{
|
||||
"id": "1798.100(c)",
|
||||
"name": "Data minimization"
|
||||
},
|
||||
{
|
||||
"id": "1798.100(d)",
|
||||
"name": "Contracts with third parties and service providers"
|
||||
},
|
||||
{
|
||||
"id": "1798.100(e)",
|
||||
"name": "Security procedures and practices"
|
||||
},
|
||||
{
|
||||
"id": "1798.105",
|
||||
"name": "Right to delete personal information"
|
||||
},
|
||||
{
|
||||
"id": "1798.106",
|
||||
"name": "Right to correct inaccurate personal information"
|
||||
},
|
||||
{
|
||||
"id": "1798.110",
|
||||
"name": "Right to know collected information"
|
||||
},
|
||||
{
|
||||
"id": "1798.115",
|
||||
"name": "Right to know sold or shared information"
|
||||
},
|
||||
{
|
||||
"id": "1798.120(a)",
|
||||
"name": "Right to opt-out of sale or sharing"
|
||||
},
|
||||
{
|
||||
"id": "1798.120(c)",
|
||||
"name": "Consent for minors (opt-in)"
|
||||
},
|
||||
{
|
||||
"id": "1798.121",
|
||||
"name": "Right to limit use of sensitive personal information"
|
||||
},
|
||||
{
|
||||
"id": "1798.125(a)",
|
||||
"name": "Non-discrimination"
|
||||
},
|
||||
{
|
||||
"id": "1798.125(b)",
|
||||
"name": "Financial incentive notices and consent"
|
||||
},
|
||||
{
|
||||
"id": "1798.130(a)(1)",
|
||||
"name": "Methods for submitting consumer requests"
|
||||
},
|
||||
{
|
||||
"id": "1798.130(a)(2)",
|
||||
"name": "Timelines for responding to requests"
|
||||
},
|
||||
{
|
||||
"id": "1798.130(a)(3)",
|
||||
"name": "Specific pieces of information disclosure"
|
||||
},
|
||||
{
|
||||
"id": "1798.130(a)(5)",
|
||||
"name": "Privacy policy content and updates"
|
||||
},
|
||||
{
|
||||
"id": "1798.130(a)(6)",
|
||||
"name": "Privacy training for personnel"
|
||||
},
|
||||
{
|
||||
"id": "1798.130(a)(7)",
|
||||
"name": "Verification of consumer requests"
|
||||
},
|
||||
{
|
||||
"id": "1798.135(a)",
|
||||
"name": "Website opt-out links"
|
||||
},
|
||||
{
|
||||
"id": "1798.135(b)",
|
||||
"name": "Recognition of opt-out preference signals"
|
||||
},
|
||||
{
|
||||
"id": "1798.135(c)(4)",
|
||||
"name": "Waiting period after opt-out"
|
||||
}
|
||||
]}
|
||||
265
apps/console/public/data/frameworks/DORA.json
Normal file
265
apps/console/public/data/frameworks/DORA.json
Normal file
@@ -0,0 +1,265 @@
|
||||
{
|
||||
"id": "DORA",
|
||||
"name": "DORA",
|
||||
"controls":[
|
||||
{
|
||||
"id": "Art. 5(1)",
|
||||
"name": "Internal governance and control framework"
|
||||
},
|
||||
{
|
||||
"id": "Art. 5(2)",
|
||||
"name": "Management body responsibility for ICT risk management"
|
||||
},
|
||||
{
|
||||
"id": "Art. 5(3)",
|
||||
"name": "Senior management role for ICT third-party risk"
|
||||
},
|
||||
{
|
||||
"id": "Art. 5(4)",
|
||||
"name": "ICT training for management body"
|
||||
},
|
||||
{
|
||||
"id": "Art. 6(1)",
|
||||
"name": "ICT risk management framework"
|
||||
},
|
||||
{
|
||||
"id": "Art. 6(4)",
|
||||
"name": "Independence of control functions"
|
||||
},
|
||||
{
|
||||
"id": "Art. 6(5)",
|
||||
"name": "Review of ICT risk management framework"
|
||||
},
|
||||
{
|
||||
"id": "Art. 6(6)",
|
||||
"name": "ICT internal audits"
|
||||
},
|
||||
{
|
||||
"id": "Art. 6(8)",
|
||||
"name": "Digital operational resilience strategy"
|
||||
},
|
||||
{
|
||||
"id": "Art. 7",
|
||||
"name": "ICT systems protocols and tools"
|
||||
},
|
||||
{
|
||||
"id": "Art. 8(1)",
|
||||
"name": "Identification and classification of ICT assets"
|
||||
},
|
||||
{
|
||||
"id": "Art. 8(2)",
|
||||
"name": "Identification of ICT risks and cyber threats"
|
||||
},
|
||||
{
|
||||
"id": "Art. 8(4)",
|
||||
"name": "Mapping of critical assets and dependencies"
|
||||
},
|
||||
{
|
||||
"id": "Art. 8(5)",
|
||||
"name": "Identification of third-party dependencies"
|
||||
},
|
||||
{
|
||||
"id": "Art. 8(7)",
|
||||
"name": "Risk assessment on legacy ICT systems"
|
||||
},
|
||||
{
|
||||
"id": "Art. 9(1)",
|
||||
"name": "Monitoring and control of ICT security"
|
||||
},
|
||||
{
|
||||
"id": "Art. 9(2)",
|
||||
"name": "ICT security policies and procedures"
|
||||
},
|
||||
{
|
||||
"id": "Art. 9(4)(a)",
|
||||
"name": "Information security policy"
|
||||
},
|
||||
{
|
||||
"id": "Art. 9(4)(b)",
|
||||
"name": "Network and infrastructure management"
|
||||
},
|
||||
{
|
||||
"id": "Art. 9(4)(c)",
|
||||
"name": "Access control policies"
|
||||
},
|
||||
{
|
||||
"id": "Art. 9(4)(d)",
|
||||
"name": "Authentication and encryption protocols"
|
||||
},
|
||||
{
|
||||
"id": "Art. 9(4)(e)",
|
||||
"name": "ICT change management policies"
|
||||
},
|
||||
{
|
||||
"id": "Art. 9(4)(f)",
|
||||
"name": "Patch management and updates"
|
||||
},
|
||||
{
|
||||
"id": "Art. 10(1)",
|
||||
"name": "Detection of anomalous activities"
|
||||
},
|
||||
{
|
||||
"id": "Art. 10(2)",
|
||||
"name": "Alert thresholds and control layers"
|
||||
},
|
||||
{
|
||||
"id": "Art. 11(1)",
|
||||
"name": "ICT business continuity policy"
|
||||
},
|
||||
{
|
||||
"id": "Art. 11(3)",
|
||||
"name": "ICT response and recovery plans"
|
||||
},
|
||||
{
|
||||
"id": "Art. 11(5)",
|
||||
"name": "Business impact analysis (BIA)"
|
||||
},
|
||||
{
|
||||
"id": "Art. 11(6)",
|
||||
"name": "Testing of business continuity plans"
|
||||
},
|
||||
{
|
||||
"id": "Art. 11(7)",
|
||||
"name": "Crisis management function"
|
||||
},
|
||||
{
|
||||
"id": "Art. 12(1)",
|
||||
"name": "Backup policies and procedures"
|
||||
},
|
||||
{
|
||||
"id": "Art. 12(4)",
|
||||
"name": "Redundant ICT capacities"
|
||||
},
|
||||
{
|
||||
"id": "Art. 13(1)",
|
||||
"name": "Capabilities to gather threat information"
|
||||
},
|
||||
{
|
||||
"id": "Art. 13(2)",
|
||||
"name": "Post-incident reviews"
|
||||
},
|
||||
{
|
||||
"id": "Art. 13(6)",
|
||||
"name": "ICT security awareness and training"
|
||||
},
|
||||
{
|
||||
"id": "Art. 14(1)",
|
||||
"name": "Crisis communication plans"
|
||||
},
|
||||
{
|
||||
"id": "Art. 14(2)",
|
||||
"name": "Internal and external communication policies"
|
||||
},
|
||||
{
|
||||
"id": "Art. 16(1)",
|
||||
"name": "Simplified ICT risk management framework"
|
||||
},
|
||||
{
|
||||
"id": "Art. 17(1)",
|
||||
"name": "ICT-related incident management process"
|
||||
},
|
||||
{
|
||||
"id": "Art. 17(2)",
|
||||
"name": "Recording of incidents and cyber threats"
|
||||
},
|
||||
{
|
||||
"id": "Art. 17(3)",
|
||||
"name": "Classification and reporting procedures"
|
||||
},
|
||||
{
|
||||
"id": "Art. 18(1)",
|
||||
"name": "Classification of ICT-related incidents"
|
||||
},
|
||||
{
|
||||
"id": "Art. 19(1)",
|
||||
"name": "Reporting of major ICT-related incidents"
|
||||
},
|
||||
{
|
||||
"id": "Art. 19(3)",
|
||||
"name": "Client notification of major incidents"
|
||||
},
|
||||
{
|
||||
"id": "Art. 23",
|
||||
"name": "Operational or security payment-related incidents"
|
||||
},
|
||||
{
|
||||
"id": "Art. 24(1)",
|
||||
"name": "Digital operational resilience testing programme"
|
||||
},
|
||||
{
|
||||
"id": "Art. 25(1)",
|
||||
"name": "Execution of appropriate tests (vulnerability scans)"
|
||||
},
|
||||
{
|
||||
"id": "Art. 26(1)",
|
||||
"name": "Advanced threat-led penetration testing (TLPT)"
|
||||
},
|
||||
{
|
||||
"id": "Art. 28(1)",
|
||||
"name": "Management of ICT third-party risk"
|
||||
},
|
||||
{
|
||||
"id": "Art. 28(2)",
|
||||
"name": "Strategy on ICT third-party risk"
|
||||
},
|
||||
{
|
||||
"id": "Art. 28(3)",
|
||||
"name": "Register of information on contractual arrangements"
|
||||
},
|
||||
{
|
||||
"id": "Art. 28(4)",
|
||||
"name": "Assessment before entering contractual arrangements"
|
||||
},
|
||||
{
|
||||
"id": "Art. 28(8)",
|
||||
"name": "Exit strategies for critical services"
|
||||
},
|
||||
{
|
||||
"id": "Art. 29",
|
||||
"name": "Assessment of ICT concentration risk"
|
||||
},
|
||||
{
|
||||
"id": "Art. 30(1)",
|
||||
"name": "Documentation of contractual arrangements"
|
||||
},
|
||||
{
|
||||
"id": "Art. 30(2)",
|
||||
"name": "Key contractual provisions (general)"
|
||||
},
|
||||
{
|
||||
"id": "Art. 30(3)",
|
||||
"name": "Key contractual provisions (critical functions)"
|
||||
},
|
||||
{
|
||||
"id": "Art. 31(12)",
|
||||
"name": "Establishment of subsidiary in the Union"
|
||||
},
|
||||
{
|
||||
"id": "Art. 35(5)",
|
||||
"name": "Cooperation with Lead Overseer"
|
||||
},
|
||||
{
|
||||
"id": "Art. 37",
|
||||
"name": "Response to requests for information"
|
||||
},
|
||||
{
|
||||
"id": "Art. 38",
|
||||
"name": "Submission to general investigations"
|
||||
},
|
||||
{
|
||||
"id": "Art. 39",
|
||||
"name": "Submission to on-site inspections"
|
||||
},
|
||||
{
|
||||
"id": "Art. 42(1)",
|
||||
"name": "Notification of intent to follow recommendations"
|
||||
},
|
||||
{
|
||||
"id": "Art. 43",
|
||||
"name": "Payment of oversight fees"
|
||||
},
|
||||
{
|
||||
"id": "Art. 45",
|
||||
"name": "Information-sharing arrangements"
|
||||
}
|
||||
]}
|
||||
253
apps/console/public/data/frameworks/GDPR.json
Normal file
253
apps/console/public/data/frameworks/GDPR.json
Normal file
@@ -0,0 +1,253 @@
|
||||
{
|
||||
"id": "GDPR",
|
||||
"name": "GDPR",
|
||||
"controls": [
|
||||
{
|
||||
"id": "Art. 5(1)(a)",
|
||||
"name": "Lawfulness, fairness and transparency"
|
||||
},
|
||||
{
|
||||
"id": "Art. 5(1)(c)",
|
||||
"name": "Data minimisation"
|
||||
},
|
||||
{
|
||||
"id": "Art. 5(1)(e)",
|
||||
"name": "Storage limitation"
|
||||
},
|
||||
{
|
||||
"id": "Art. 5(1)(f)",
|
||||
"name": "Integrity and confidentiality"
|
||||
},
|
||||
{
|
||||
"id": "Art. 6",
|
||||
"name": "Lawfulness of processing"
|
||||
},
|
||||
{
|
||||
"id": "Art. 7",
|
||||
"name": "Conditions for consent"
|
||||
},
|
||||
{
|
||||
"id": "Art. 8",
|
||||
"name": "Child's consent for information society services"
|
||||
},
|
||||
{
|
||||
"id": "Art. 9(2)",
|
||||
"name": "Exceptions for processing special categories of data"
|
||||
},
|
||||
{
|
||||
"id": "Art. 9(2)(a)",
|
||||
"name": "Explicit consent for special categories"
|
||||
},
|
||||
{
|
||||
"id": "Art. 10",
|
||||
"name": "Processing of criminal conviction data"
|
||||
},
|
||||
{
|
||||
"id": "Art. 11",
|
||||
"name": "Processing not requiring identification"
|
||||
},
|
||||
{
|
||||
"id": "Art. 12(3)",
|
||||
"name": "Response timelines for data subject requests"
|
||||
},
|
||||
{
|
||||
"id": "Art. 13",
|
||||
"name": "Information for data collected from subject"
|
||||
},
|
||||
{
|
||||
"id": "Art. 14",
|
||||
"name": "Information for data not obtained from subject"
|
||||
},
|
||||
{
|
||||
"id": "Art. 15",
|
||||
"name": "Right of access"
|
||||
},
|
||||
{
|
||||
"id": "Art. 16",
|
||||
"name": "Right to rectification"
|
||||
},
|
||||
{
|
||||
"id": "Art. 17",
|
||||
"name": "Right to erasure"
|
||||
},
|
||||
{
|
||||
"id": "Art. 18",
|
||||
"name": "Right to restriction of processing"
|
||||
},
|
||||
{
|
||||
"id": "Art. 19",
|
||||
"name": "Notification of rectification, erasure or restriction"
|
||||
},
|
||||
{
|
||||
"id": "Art. 20",
|
||||
"name": "Right to data portability"
|
||||
},
|
||||
{
|
||||
"id": "Art. 21",
|
||||
"name": "Right to object"
|
||||
},
|
||||
{
|
||||
"id": "Art. 22",
|
||||
"name": "Automated individual decision-making"
|
||||
},
|
||||
{
|
||||
"id": "Art. 24",
|
||||
"name": "Responsibility of the controller"
|
||||
},
|
||||
{
|
||||
"id": "Art. 25(1)",
|
||||
"name": "Data protection by design"
|
||||
},
|
||||
{
|
||||
"id": "Art. 25(2)",
|
||||
"name": "Data protection by default"
|
||||
},
|
||||
{
|
||||
"id": "Art. 26",
|
||||
"name": "Joint controllers arrangement"
|
||||
},
|
||||
{
|
||||
"id": "Art. 27",
|
||||
"name": "Designation of representative (non-EU entities)"
|
||||
},
|
||||
{
|
||||
"id": "Art. 28",
|
||||
"name": "General processor obligations"
|
||||
},
|
||||
{
|
||||
"id": "Art. 28(1)",
|
||||
"name": "Selection of processors with sufficient guarantees"
|
||||
},
|
||||
{
|
||||
"id": "Art. 28(3)",
|
||||
"name": "Data processing contract requirements"
|
||||
},
|
||||
{
|
||||
"id": "Art. 29",
|
||||
"name": "Processing under authority"
|
||||
},
|
||||
{
|
||||
"id": "Art. 30",
|
||||
"name": "Records of processing activities (general)"
|
||||
},
|
||||
{
|
||||
"id": "Art. 30(1)",
|
||||
"name": "Controller record of processing activities"
|
||||
},
|
||||
{
|
||||
"id": "Art. 30(1)(g)",
|
||||
"name": "Description of security measures in records"
|
||||
},
|
||||
{
|
||||
"id": "Art. 31",
|
||||
"name": "Cooperation with supervisory authority"
|
||||
},
|
||||
{
|
||||
"id": "Art. 32",
|
||||
"name": "Security of processing (general)"
|
||||
},
|
||||
{
|
||||
"id": "Art. 32(1)",
|
||||
"name": "Technical and organisational security measures"
|
||||
},
|
||||
{
|
||||
"id": "Art. 32(1)(a)",
|
||||
"name": "Pseudonymisation and encryption"
|
||||
},
|
||||
{
|
||||
"id": "Art. 32(1)(b)",
|
||||
"name": "Confidentiality, integrity, availability and resilience"
|
||||
},
|
||||
{
|
||||
"id": "Art. 32(1)(c)",
|
||||
"name": "Restoration of availability and access"
|
||||
},
|
||||
{
|
||||
"id": "Art. 32(1)(d)",
|
||||
"name": "Regular testing and evaluation of security"
|
||||
},
|
||||
{
|
||||
"id": "Art. 32(2)",
|
||||
"name": "Assessment of security risks"
|
||||
},
|
||||
{
|
||||
"id": "Art. 32(4)",
|
||||
"name": "Processing under instructions"
|
||||
},
|
||||
{
|
||||
"id": "Art. 33",
|
||||
"name": "Notification of breach to supervisory authority"
|
||||
},
|
||||
{
|
||||
"id": "Art. 33(1)",
|
||||
"name": "Breach notification timeline"
|
||||
},
|
||||
{
|
||||
"id": "Art. 33(3)",
|
||||
"name": "Content of breach notification"
|
||||
},
|
||||
{
|
||||
"id": "Art. 33(5)",
|
||||
"name": "Documentation of breaches"
|
||||
},
|
||||
{
|
||||
"id": "Art. 34",
|
||||
"name": "Communication of breach to data subject"
|
||||
},
|
||||
{
|
||||
"id": "Art. 34(1)",
|
||||
"name": "High-risk breach communication"
|
||||
},
|
||||
{
|
||||
"id": "Art. 35(1)",
|
||||
"name": "Requirement for data protection impact assessment"
|
||||
},
|
||||
{
|
||||
"id": "Art. 35(7)",
|
||||
"name": "Minimum content of impact assessment"
|
||||
},
|
||||
{
|
||||
"id": "Art. 36",
|
||||
"name": "Prior consultation"
|
||||
},
|
||||
{
|
||||
"id": "Art. 37",
|
||||
"name": "Designation of data protection officer"
|
||||
},
|
||||
{
|
||||
"id": "Art. 38",
|
||||
"name": "Position and support of the DPO"
|
||||
},
|
||||
{
|
||||
"id": "Art. 39",
|
||||
"name": "Tasks of the data protection officer"
|
||||
},
|
||||
{
|
||||
"id": "Art. 44",
|
||||
"name": "General principle for transfers"
|
||||
},
|
||||
{
|
||||
"id": "Art. 45",
|
||||
"name": "Transfers based on adequacy decision"
|
||||
},
|
||||
{
|
||||
"id": "Art. 46",
|
||||
"name": "Transfers subject to appropriate safeguards"
|
||||
},
|
||||
{
|
||||
"id": "Art. 47",
|
||||
"name": "Binding corporate rules"
|
||||
},
|
||||
{
|
||||
"id": "Art. 48",
|
||||
"name": "Transfers not authorised by Union law"
|
||||
},
|
||||
{
|
||||
"id": "Art. 49",
|
||||
"name": "Derogations for specific situations"
|
||||
},
|
||||
{
|
||||
"id": "Art. 50",
|
||||
"name": "International cooperation"
|
||||
}
|
||||
]}
|
||||
73
apps/console/public/data/frameworks/NIS2.json
Normal file
73
apps/console/public/data/frameworks/NIS2.json
Normal file
@@ -0,0 +1,73 @@
|
||||
{
|
||||
"id": "NIS2",
|
||||
"name": "NIS 2",
|
||||
"controls":[
|
||||
{
|
||||
"id": "Art. 3(4)",
|
||||
"name": "Submission of entity registration data"
|
||||
},
|
||||
{
|
||||
"id": "Art. 20(1)",
|
||||
"name": "Management body oversight and approval"
|
||||
},
|
||||
{
|
||||
"id": "Art. 20(2)",
|
||||
"name": "Cybersecurity training for management bodies"
|
||||
},
|
||||
{
|
||||
"id": "Art. 21(2)(a)",
|
||||
"name": "Policies on risk analysis and information system security"
|
||||
},
|
||||
{
|
||||
"id": "Art. 21(2)(b)",
|
||||
"name": "Incident handling"
|
||||
},
|
||||
{
|
||||
"id": "Art. 21(2)(c)",
|
||||
"name": "Business continuity and crisis management"
|
||||
},
|
||||
{
|
||||
"id": "Art. 21(2)(d)",
|
||||
"name": "Supply chain security"
|
||||
},
|
||||
{
|
||||
"id": "Art. 21(2)(e)",
|
||||
"name": "Security in system acquisition, development and maintenance"
|
||||
},
|
||||
{
|
||||
"id": "Art. 21(2)(f)",
|
||||
"name": "Assessment of security measure effectiveness"
|
||||
},
|
||||
{
|
||||
"id": "Art. 21(2)(g)",
|
||||
"name": "Cyber hygiene practices and training"
|
||||
},
|
||||
{
|
||||
"id": "Art. 21(2)(h)",
|
||||
"name": "Cryptography and encryption policies"
|
||||
},
|
||||
{
|
||||
"id": "Art. 21(2)(i)",
|
||||
"name": "Human resources security and asset management"
|
||||
},
|
||||
{
|
||||
"id": "Art. 21(2)(j)",
|
||||
"name": "Multi-factor authentication and secure communications"
|
||||
},
|
||||
{
|
||||
"id": "Art. 23(1)",
|
||||
"name": "Reporting significant incidents to authorities"
|
||||
},
|
||||
{
|
||||
"id": "Art. 23(2)",
|
||||
"name": "Notifying service recipients of significant cyber threats"
|
||||
},
|
||||
{
|
||||
"id": "Art. 26(3)",
|
||||
"name": "Designation of Union representative (non-EU entities)"
|
||||
},
|
||||
{
|
||||
"id": "Art. 28(1)",
|
||||
"name": "Maintenance of domain name registration data (TLDs/registrars)"
|
||||
}
|
||||
]}
|
||||
Reference in New Issue
Block a user