From dcac038055c654b7f19cd218c711218e1fd01d90 Mon Sep 17 00:00:00 2001 From: Antoine Bouchardy Date: Tue, 16 Dec 2025 17:09:21 +0100 Subject: [PATCH] adding GPDR, CCPA, NIS2 & DORA --- apps/console/public/data/frameworks/CCPA.json | 97 +++++++ apps/console/public/data/frameworks/DORA.json | 265 ++++++++++++++++++ apps/console/public/data/frameworks/GDPR.json | 253 +++++++++++++++++ apps/console/public/data/frameworks/NIS2.json | 73 +++++ 4 files changed, 688 insertions(+) create mode 100644 apps/console/public/data/frameworks/CCPA.json create mode 100644 apps/console/public/data/frameworks/DORA.json create mode 100644 apps/console/public/data/frameworks/GDPR.json create mode 100644 apps/console/public/data/frameworks/NIS2.json diff --git a/apps/console/public/data/frameworks/CCPA.json b/apps/console/public/data/frameworks/CCPA.json new file mode 100644 index 000000000..acd05696d --- /dev/null +++ b/apps/console/public/data/frameworks/CCPA.json @@ -0,0 +1,97 @@ +{ + "id": "CCPA", + "name": "CCPA", + "controls": [ + { + "id": "1798.100(a)", + "name": "Notice at collection" + }, + { + "id": "1798.100(a)(3)", + "name": "Data retention limits" + }, + { + "id": "1798.100(c)", + "name": "Data minimization" + }, + { + "id": "1798.100(d)", + "name": "Contracts with third parties and service providers" + }, + { + "id": "1798.100(e)", + "name": "Security procedures and practices" + }, + { + "id": "1798.105", + "name": "Right to delete personal information" + }, + { + "id": "1798.106", + "name": "Right to correct inaccurate personal information" + }, + { + "id": "1798.110", + "name": "Right to know collected information" + }, + { + "id": "1798.115", + "name": "Right to know sold or shared information" + }, + { + "id": "1798.120(a)", + "name": "Right to opt-out of sale or sharing" + }, + { + "id": "1798.120(c)", + "name": "Consent for minors (opt-in)" + }, + { + "id": "1798.121", + "name": "Right to limit use of sensitive personal information" + }, + { + "id": "1798.125(a)", + "name": "Non-discrimination" + }, + { + "id": "1798.125(b)", + "name": "Financial incentive notices and consent" + }, + { + "id": "1798.130(a)(1)", + "name": "Methods for submitting consumer requests" + }, + { + "id": "1798.130(a)(2)", + "name": "Timelines for responding to requests" + }, + { + "id": "1798.130(a)(3)", + "name": "Specific pieces of information disclosure" + }, + { + "id": "1798.130(a)(5)", + "name": "Privacy policy content and updates" + }, + { + "id": "1798.130(a)(6)", + "name": "Privacy training for personnel" + }, + { + "id": "1798.130(a)(7)", + "name": "Verification of consumer requests" + }, + { + "id": "1798.135(a)", + "name": "Website opt-out links" + }, + { + "id": "1798.135(b)", + "name": "Recognition of opt-out preference signals" + }, + { + "id": "1798.135(c)(4)", + "name": "Waiting period after opt-out" + } + ]} \ No newline at end of file diff --git a/apps/console/public/data/frameworks/DORA.json b/apps/console/public/data/frameworks/DORA.json new file mode 100644 index 000000000..c06a76ad7 --- /dev/null +++ b/apps/console/public/data/frameworks/DORA.json @@ -0,0 +1,265 @@ +{ + "id": "DORA", + "name": "DORA", + "controls":[ + { + "id": "Art. 5(1)", + "name": "Internal governance and control framework" + }, + { + "id": "Art. 5(2)", + "name": "Management body responsibility for ICT risk management" + }, + { + "id": "Art. 5(3)", + "name": "Senior management role for ICT third-party risk" + }, + { + "id": "Art. 5(4)", + "name": "ICT training for management body" + }, + { + "id": "Art. 6(1)", + "name": "ICT risk management framework" + }, + { + "id": "Art. 6(4)", + "name": "Independence of control functions" + }, + { + "id": "Art. 6(5)", + "name": "Review of ICT risk management framework" + }, + { + "id": "Art. 6(6)", + "name": "ICT internal audits" + }, + { + "id": "Art. 6(8)", + "name": "Digital operational resilience strategy" + }, + { + "id": "Art. 7", + "name": "ICT systems protocols and tools" + }, + { + "id": "Art. 8(1)", + "name": "Identification and classification of ICT assets" + }, + { + "id": "Art. 8(2)", + "name": "Identification of ICT risks and cyber threats" + }, + { + "id": "Art. 8(4)", + "name": "Mapping of critical assets and dependencies" + }, + { + "id": "Art. 8(5)", + "name": "Identification of third-party dependencies" + }, + { + "id": "Art. 8(7)", + "name": "Risk assessment on legacy ICT systems" + }, + { + "id": "Art. 9(1)", + "name": "Monitoring and control of ICT security" + }, + { + "id": "Art. 9(2)", + "name": "ICT security policies and procedures" + }, + { + "id": "Art. 9(4)(a)", + "name": "Information security policy" + }, + { + "id": "Art. 9(4)(b)", + "name": "Network and infrastructure management" + }, + { + "id": "Art. 9(4)(c)", + "name": "Access control policies" + }, + { + "id": "Art. 9(4)(d)", + "name": "Authentication and encryption protocols" + }, + { + "id": "Art. 9(4)(e)", + "name": "ICT change management policies" + }, + { + "id": "Art. 9(4)(f)", + "name": "Patch management and updates" + }, + { + "id": "Art. 10(1)", + "name": "Detection of anomalous activities" + }, + { + "id": "Art. 10(2)", + "name": "Alert thresholds and control layers" + }, + { + "id": "Art. 11(1)", + "name": "ICT business continuity policy" + }, + { + "id": "Art. 11(3)", + "name": "ICT response and recovery plans" + }, + { + "id": "Art. 11(5)", + "name": "Business impact analysis (BIA)" + }, + { + "id": "Art. 11(6)", + "name": "Testing of business continuity plans" + }, + { + "id": "Art. 11(7)", + "name": "Crisis management function" + }, + { + "id": "Art. 12(1)", + "name": "Backup policies and procedures" + }, + { + "id": "Art. 12(4)", + "name": "Redundant ICT capacities" + }, + { + "id": "Art. 13(1)", + "name": "Capabilities to gather threat information" + }, + { + "id": "Art. 13(2)", + "name": "Post-incident reviews" + }, + { + "id": "Art. 13(6)", + "name": "ICT security awareness and training" + }, + { + "id": "Art. 14(1)", + "name": "Crisis communication plans" + }, + { + "id": "Art. 14(2)", + "name": "Internal and external communication policies" + }, + { + "id": "Art. 16(1)", + "name": "Simplified ICT risk management framework" + }, + { + "id": "Art. 17(1)", + "name": "ICT-related incident management process" + }, + { + "id": "Art. 17(2)", + "name": "Recording of incidents and cyber threats" + }, + { + "id": "Art. 17(3)", + "name": "Classification and reporting procedures" + }, + { + "id": "Art. 18(1)", + "name": "Classification of ICT-related incidents" + }, + { + "id": "Art. 19(1)", + "name": "Reporting of major ICT-related incidents" + }, + { + "id": "Art. 19(3)", + "name": "Client notification of major incidents" + }, + { + "id": "Art. 23", + "name": "Operational or security payment-related incidents" + }, + { + "id": "Art. 24(1)", + "name": "Digital operational resilience testing programme" + }, + { + "id": "Art. 25(1)", + "name": "Execution of appropriate tests (vulnerability scans)" + }, + { + "id": "Art. 26(1)", + "name": "Advanced threat-led penetration testing (TLPT)" + }, + { + "id": "Art. 28(1)", + "name": "Management of ICT third-party risk" + }, + { + "id": "Art. 28(2)", + "name": "Strategy on ICT third-party risk" + }, + { + "id": "Art. 28(3)", + "name": "Register of information on contractual arrangements" + }, + { + "id": "Art. 28(4)", + "name": "Assessment before entering contractual arrangements" + }, + { + "id": "Art. 28(8)", + "name": "Exit strategies for critical services" + }, + { + "id": "Art. 29", + "name": "Assessment of ICT concentration risk" + }, + { + "id": "Art. 30(1)", + "name": "Documentation of contractual arrangements" + }, + { + "id": "Art. 30(2)", + "name": "Key contractual provisions (general)" + }, + { + "id": "Art. 30(3)", + "name": "Key contractual provisions (critical functions)" + }, + { + "id": "Art. 31(12)", + "name": "Establishment of subsidiary in the Union" + }, + { + "id": "Art. 35(5)", + "name": "Cooperation with Lead Overseer" + }, + { + "id": "Art. 37", + "name": "Response to requests for information" + }, + { + "id": "Art. 38", + "name": "Submission to general investigations" + }, + { + "id": "Art. 39", + "name": "Submission to on-site inspections" + }, + { + "id": "Art. 42(1)", + "name": "Notification of intent to follow recommendations" + }, + { + "id": "Art. 43", + "name": "Payment of oversight fees" + }, + { + "id": "Art. 45", + "name": "Information-sharing arrangements" + } + ]} \ No newline at end of file diff --git a/apps/console/public/data/frameworks/GDPR.json b/apps/console/public/data/frameworks/GDPR.json new file mode 100644 index 000000000..93072fcac --- /dev/null +++ b/apps/console/public/data/frameworks/GDPR.json @@ -0,0 +1,253 @@ +{ + "id": "GDPR", + "name": "GDPR", + "controls": [ + { + "id": "Art. 5(1)(a)", + "name": "Lawfulness, fairness and transparency" + }, + { + "id": "Art. 5(1)(c)", + "name": "Data minimisation" + }, + { + "id": "Art. 5(1)(e)", + "name": "Storage limitation" + }, + { + "id": "Art. 5(1)(f)", + "name": "Integrity and confidentiality" + }, + { + "id": "Art. 6", + "name": "Lawfulness of processing" + }, + { + "id": "Art. 7", + "name": "Conditions for consent" + }, + { + "id": "Art. 8", + "name": "Child's consent for information society services" + }, + { + "id": "Art. 9(2)", + "name": "Exceptions for processing special categories of data" + }, + { + "id": "Art. 9(2)(a)", + "name": "Explicit consent for special categories" + }, + { + "id": "Art. 10", + "name": "Processing of criminal conviction data" + }, + { + "id": "Art. 11", + "name": "Processing not requiring identification" + }, + { + "id": "Art. 12(3)", + "name": "Response timelines for data subject requests" + }, + { + "id": "Art. 13", + "name": "Information for data collected from subject" + }, + { + "id": "Art. 14", + "name": "Information for data not obtained from subject" + }, + { + "id": "Art. 15", + "name": "Right of access" + }, + { + "id": "Art. 16", + "name": "Right to rectification" + }, + { + "id": "Art. 17", + "name": "Right to erasure" + }, + { + "id": "Art. 18", + "name": "Right to restriction of processing" + }, + { + "id": "Art. 19", + "name": "Notification of rectification, erasure or restriction" + }, + { + "id": "Art. 20", + "name": "Right to data portability" + }, + { + "id": "Art. 21", + "name": "Right to object" + }, + { + "id": "Art. 22", + "name": "Automated individual decision-making" + }, + { + "id": "Art. 24", + "name": "Responsibility of the controller" + }, + { + "id": "Art. 25(1)", + "name": "Data protection by design" + }, + { + "id": "Art. 25(2)", + "name": "Data protection by default" + }, + { + "id": "Art. 26", + "name": "Joint controllers arrangement" + }, + { + "id": "Art. 27", + "name": "Designation of representative (non-EU entities)" + }, + { + "id": "Art. 28", + "name": "General processor obligations" + }, + { + "id": "Art. 28(1)", + "name": "Selection of processors with sufficient guarantees" + }, + { + "id": "Art. 28(3)", + "name": "Data processing contract requirements" + }, + { + "id": "Art. 29", + "name": "Processing under authority" + }, + { + "id": "Art. 30", + "name": "Records of processing activities (general)" + }, + { + "id": "Art. 30(1)", + "name": "Controller record of processing activities" + }, + { + "id": "Art. 30(1)(g)", + "name": "Description of security measures in records" + }, + { + "id": "Art. 31", + "name": "Cooperation with supervisory authority" + }, + { + "id": "Art. 32", + "name": "Security of processing (general)" + }, + { + "id": "Art. 32(1)", + "name": "Technical and organisational security measures" + }, + { + "id": "Art. 32(1)(a)", + "name": "Pseudonymisation and encryption" + }, + { + "id": "Art. 32(1)(b)", + "name": "Confidentiality, integrity, availability and resilience" + }, + { + "id": "Art. 32(1)(c)", + "name": "Restoration of availability and access" + }, + { + "id": "Art. 32(1)(d)", + "name": "Regular testing and evaluation of security" + }, + { + "id": "Art. 32(2)", + "name": "Assessment of security risks" + }, + { + "id": "Art. 32(4)", + "name": "Processing under instructions" + }, + { + "id": "Art. 33", + "name": "Notification of breach to supervisory authority" + }, + { + "id": "Art. 33(1)", + "name": "Breach notification timeline" + }, + { + "id": "Art. 33(3)", + "name": "Content of breach notification" + }, + { + "id": "Art. 33(5)", + "name": "Documentation of breaches" + }, + { + "id": "Art. 34", + "name": "Communication of breach to data subject" + }, + { + "id": "Art. 34(1)", + "name": "High-risk breach communication" + }, + { + "id": "Art. 35(1)", + "name": "Requirement for data protection impact assessment" + }, + { + "id": "Art. 35(7)", + "name": "Minimum content of impact assessment" + }, + { + "id": "Art. 36", + "name": "Prior consultation" + }, + { + "id": "Art. 37", + "name": "Designation of data protection officer" + }, + { + "id": "Art. 38", + "name": "Position and support of the DPO" + }, + { + "id": "Art. 39", + "name": "Tasks of the data protection officer" + }, + { + "id": "Art. 44", + "name": "General principle for transfers" + }, + { + "id": "Art. 45", + "name": "Transfers based on adequacy decision" + }, + { + "id": "Art. 46", + "name": "Transfers subject to appropriate safeguards" + }, + { + "id": "Art. 47", + "name": "Binding corporate rules" + }, + { + "id": "Art. 48", + "name": "Transfers not authorised by Union law" + }, + { + "id": "Art. 49", + "name": "Derogations for specific situations" + }, + { + "id": "Art. 50", + "name": "International cooperation" + } + ]} \ No newline at end of file diff --git a/apps/console/public/data/frameworks/NIS2.json b/apps/console/public/data/frameworks/NIS2.json new file mode 100644 index 000000000..bba0cc42c --- /dev/null +++ b/apps/console/public/data/frameworks/NIS2.json @@ -0,0 +1,73 @@ +{ + "id": "NIS2", + "name": "NIS 2", + "controls":[ + { + "id": "Art. 3(4)", + "name": "Submission of entity registration data" + }, + { + "id": "Art. 20(1)", + "name": "Management body oversight and approval" + }, + { + "id": "Art. 20(2)", + "name": "Cybersecurity training for management bodies" + }, + { + "id": "Art. 21(2)(a)", + "name": "Policies on risk analysis and information system security" + }, + { + "id": "Art. 21(2)(b)", + "name": "Incident handling" + }, + { + "id": "Art. 21(2)(c)", + "name": "Business continuity and crisis management" + }, + { + "id": "Art. 21(2)(d)", + "name": "Supply chain security" + }, + { + "id": "Art. 21(2)(e)", + "name": "Security in system acquisition, development and maintenance" + }, + { + "id": "Art. 21(2)(f)", + "name": "Assessment of security measure effectiveness" + }, + { + "id": "Art. 21(2)(g)", + "name": "Cyber hygiene practices and training" + }, + { + "id": "Art. 21(2)(h)", + "name": "Cryptography and encryption policies" + }, + { + "id": "Art. 21(2)(i)", + "name": "Human resources security and asset management" + }, + { + "id": "Art. 21(2)(j)", + "name": "Multi-factor authentication and secure communications" + }, + { + "id": "Art. 23(1)", + "name": "Reporting significant incidents to authorities" + }, + { + "id": "Art. 23(2)", + "name": "Notifying service recipients of significant cyber threats" + }, + { + "id": "Art. 26(3)", + "name": "Designation of Union representative (non-EU entities)" + }, + { + "id": "Art. 28(1)", + "name": "Maintenance of domain name registration data (TLDs/registrars)" + } + ]} \ No newline at end of file