diff --git a/.eslintrc.js b/.eslintrc.js new file mode 100644 index 000000000..1321a4834 --- /dev/null +++ b/.eslintrc.js @@ -0,0 +1,16 @@ +{ + "rules": { + "@typescript-eslint/no-unused-vars": [ + "error", + { + "args": "all", + "argsIgnorePattern": "^_", + "caughtErrors": "all", + "caughtErrorsIgnorePattern": "^_", + "destructuredArrayIgnorePattern": "^_", + "varsIgnorePattern": "^_", + "ignoreRestSiblings": true + } + ] + } + } \ No newline at end of file diff --git a/backend/app_tests/api/test_api_libraries.py b/backend/app_tests/api/test_api_libraries.py index cddd132a8..503784ede 100644 --- a/backend/app_tests/api/test_api_libraries.py +++ b/backend/app_tests/api/test_api_libraries.py @@ -98,7 +98,10 @@ def test_import_frameworks(self, test): "name": lib_detail_response["name"], "description": lib_detail_response["description"], "urn": lib_detail_response["urn"], - "folder": {"str": Folder.get_root_folder().name}, + "folder": { + "id": str(Folder.get_root_folder().id), + "str": Folder.get_root_folder().name, + }, }, base_count=1, user_group=test.user_group, @@ -164,7 +167,10 @@ def test_import_risk_matrix(self, test): "name": lib_detail_response["name"], "description": lib_detail_response["description"], "urn": lib_detail_response["urn"], - "folder": {"str": Folder.get_root_folder().name}, + "folder": { + "id": str(Folder.get_root_folder().id), + "str": Folder.get_root_folder().name, + }, # 'json_definition': lib_detail_response # TODO: restore this test }, base_count=1, diff --git a/backend/app_tests/api/test_api_reference_controls.py b/backend/app_tests/api/test_api_reference_controls.py index 8b5b498de..20147751f 100644 --- a/backend/app_tests/api/test_api_reference_controls.py +++ b/backend/app_tests/api/test_api_reference_controls.py @@ -107,7 +107,10 @@ def test_get_reference_controls(self, test): "is_published": True, }, { - "folder": {"str": Folder.get_root_folder().name}, + "folder": { + "id": str(Folder.get_root_folder().id), + "str": Folder.get_root_folder().name, + }, }, user_group=test.user_group, scope="Global", @@ -157,7 +160,10 @@ def test_update_reference_control_with_urn(self, test): "provider": "new " + REFERENCE_CONTROL_PROVIDER, }, { - "folder": {"str": Folder.get_root_folder().name}, + "folder": { + "id": str(Folder.get_root_folder().id), + "str": Folder.get_root_folder().name, + }, }, user_group=test.user_group, scope="Global", diff --git a/backend/app_tests/api/test_api_threats.py b/backend/app_tests/api/test_api_threats.py index 784fc40f9..86d9e1b89 100644 --- a/backend/app_tests/api/test_api_threats.py +++ b/backend/app_tests/api/test_api_threats.py @@ -109,7 +109,10 @@ def test_get_threats(self, test): "is_published": True, }, { - "folder": {"str": Folder.get_root_folder().name}, + "folder": { + "id": str(Folder.get_root_folder().id), + "str": Folder.get_root_folder().name, + }, }, user_group=test.user_group, scope="Global", diff --git a/backend/ciso_assistant/settings.py b/backend/ciso_assistant/settings.py index aa6987b4e..81cf5ed5e 100644 --- a/backend/ciso_assistant/settings.py +++ b/backend/ciso_assistant/settings.py @@ -127,6 +127,7 @@ def set_ciso_assistant_url(_, __, event_dict): "tailwind", "iam", "global_settings", + "tprm", "core", "cal", "django_filters", diff --git a/backend/core/helpers.py b/backend/core/helpers.py index 9302362ec..d139eeefe 100644 --- a/backend/core/helpers.py +++ b/backend/core/helpers.py @@ -12,6 +12,8 @@ from typing import List, Dict, Optional +import json + from django.core.exceptions import NON_FIELD_ERRORS as DJ_NON_FIELD_ERRORS from django.core.exceptions import ValidationError as DjValidationError from rest_framework.exceptions import ValidationError as DRFValidationError diff --git a/backend/core/locale/fr/LC_MESSAGES/django.mo b/backend/core/locale/fr/LC_MESSAGES/django.mo index 7de2ea138..c071bbe28 100644 Binary files a/backend/core/locale/fr/LC_MESSAGES/django.mo and b/backend/core/locale/fr/LC_MESSAGES/django.mo differ diff --git a/backend/core/locale/fr/LC_MESSAGES/django.po b/backend/core/locale/fr/LC_MESSAGES/django.po index 773fcfd3a..4c182e090 100644 --- a/backend/core/locale/fr/LC_MESSAGES/django.po +++ b/backend/core/locale/fr/LC_MESSAGES/django.po @@ -8,7 +8,7 @@ msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2024-08-26 08:54+0000\n" +"POT-Creation-Date: 2024-09-13 19:22+0000\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" @@ -38,21 +38,21 @@ msgstr "Mis à jour le" msgid "published" msgstr "publié" -#: core/base_models.py:110 core/models.py:76 +#: core/base_models.py:110 core/models.py:113 #: core/templates/core/action_plan_pdf.html:42 #: core/templates/snippets/mp_data.html:58 #: core/templates/snippets/ri_list_nested.html:16 msgid "Name" msgstr "Nom" -#: core/base_models.py:111 core/models.py:78 +#: core/base_models.py:111 core/models.py:115 #: core/templates/core/action_plan_pdf.html:43 #: core/templates/snippets/mp_data.html:59 #: core/templates/snippets/ra_data.html:43 msgid "Description" msgstr "Description" -#: core/base_models.py:126 core/models.py:1242 +#: core/base_models.py:126 core/models.py:1309 #: core/templates/core/action_plan_pdf.html:46 #: core/templates/snippets/mp_data.html:62 msgid "ETA" @@ -200,130 +200,130 @@ msgstr "Rechercher une preuve..." msgid "Search framework..." msgstr "Rechercher un référentiel..." -#: core/models.py:67 core/models.py:148 +#: core/models.py:104 core/models.py:185 msgid "URN" msgstr "URN" -#: core/models.py:70 +#: core/models.py:107 msgid "Reference ID" msgstr "ID de référence" -#: core/models.py:73 core/models.py:772 +#: core/models.py:110 core/models.py:826 msgid "Provider" msgstr "Fournisseur" -#: core/models.py:79 core/models.py:1029 +#: core/models.py:116 core/models.py:1087 msgid "Annotation" msgstr "Annotation" -#: core/models.py:81 +#: core/models.py:118 msgid "Translations" msgstr "" -#: core/models.py:135 +#: core/models.py:172 msgid "Locale" msgstr "Locale" -#: core/models.py:137 +#: core/models.py:174 msgid "Default locale" msgstr "Locale par défaut" -#: core/models.py:150 +#: core/models.py:187 msgid "Copyright" msgstr "Copyright" -#: core/models.py:152 core/models.py:1371 +#: core/models.py:189 core/models.py:1443 msgid "Version" msgstr "Version" -#: core/models.py:157 +#: core/models.py:194 msgid "Packager of the library" msgstr "Responsable de l'empaquetage de la bibliothèque" -#: core/models.py:158 +#: core/models.py:195 msgid "Packager" msgstr "Empaqueteur" -#: core/models.py:555 +#: core/models.py:609 msgid "Dependencies" msgstr "Dépendances" -#: core/models.py:654 core/templates/snippets/ri_list_nested.html:19 +#: core/models.py:708 core/templates/snippets/ri_list_nested.html:19 msgid "Threat" msgstr "Menace" -#: core/models.py:655 core/models.py:903 core/models.py:1747 +#: core/models.py:709 core/models.py:960 core/models.py:1849 msgid "Threats" msgstr "Menaces" -#: core/models.py:675 core/models.py:1342 +#: core/models.py:729 core/models.py:1414 msgid "Policy" msgstr "Politique" -#: core/models.py:676 +#: core/models.py:730 msgid "Process" msgstr "Processus" -#: core/models.py:677 +#: core/models.py:731 msgid "Technical" msgstr "Technique" -#: core/models.py:678 +#: core/models.py:732 msgid "Physical" msgstr "Physique" -#: core/models.py:682 +#: core/models.py:736 msgid "Govern" msgstr "" -#: core/models.py:683 +#: core/models.py:737 msgid "Identify" msgstr "" -#: core/models.py:684 +#: core/models.py:738 msgid "Protect" msgstr "" -#: core/models.py:685 +#: core/models.py:739 msgid "Detect" msgstr "" -#: core/models.py:686 +#: core/models.py:740 msgid "Respond" msgstr "" -#: core/models.py:687 +#: core/models.py:741 msgid "Recover" msgstr "" -#: core/models.py:703 core/models.py:1222 +#: core/models.py:757 core/models.py:1283 #: core/templates/core/action_plan_pdf.html:44 msgid "Category" msgstr "Catégorie" -#: core/models.py:711 core/models.py:1229 +#: core/models.py:765 core/models.py:1290 #, fuzzy #| msgid "Search function..." msgid "CSF Function" msgstr "Rechercher une fonction..." -#: core/models.py:715 core/models.py:929 +#: core/models.py:769 core/models.py:986 msgid "Typical evidence" msgstr "Preuve type" -#: core/models.py:721 core/templates/snippets/mp_data.html:61 +#: core/models.py:775 core/templates/snippets/mp_data.html:61 msgid "Reference control" msgstr "Mesure de référence" -#: core/models.py:722 core/models.py:909 +#: core/models.py:776 core/models.py:966 msgid "Reference controls" msgstr "Mesures de référence" -#: core/models.py:757 +#: core/models.py:811 msgid "JSON definition" msgstr "Définition JSON" -#: core/models.py:759 +#: core/models.py:813 msgid "" "JSON definition of the risk matrix. See the documentation for more " "information." @@ -331,11 +331,11 @@ msgstr "" "Définition JSON de la matrice de risque. Consultez la documentation pour " "plus d'informations." -#: core/models.py:765 +#: core/models.py:819 msgid "enabled" msgstr "activé" -#: core/models.py:768 +#: core/models.py:822 msgid "" "If the risk matrix is set as disabled, it will not be available for " "selection for new risk assessments." @@ -343,378 +343,405 @@ msgstr "" "Si la matrice de risque est désactivée, elle ne sera pas disponible pour la " "sélection lors de nouvelles évaluations de risque." -#: core/models.py:837 core/models.py:1961 +#: core/models.py:891 core/models.py:2065 msgid "Minimum score" msgstr "Score minimum" -#: core/models.py:838 core/models.py:1962 +#: core/models.py:892 core/models.py:2066 msgid "Maximum score" msgstr "Score maximum" -#: core/models.py:840 core/models.py:1964 +#: core/models.py:894 core/models.py:2068 msgid "Score definition" msgstr "Définition du score" -#: core/models.py:843 +#: core/models.py:897 msgid "Implementation groups definition" msgstr "Définition des groupes d'implémentation" -#: core/models.py:854 core/models.py:917 core/models.py:1955 +#: core/models.py:908 core/models.py:974 core/models.py:2059 #: core/templates/core/action_plan_pdf.html:20 msgid "Framework" msgstr "Référentiel" -#: core/models.py:855 +#: core/models.py:909 msgid "Frameworks" msgstr "Référentiels" -#: core/models.py:921 +#: core/models.py:978 msgid "Parent URN" msgstr "URN parent" -#: core/models.py:923 +#: core/models.py:980 msgid "Order ID" msgstr "ID de commande" -#: core/models.py:925 +#: core/models.py:982 msgid "Implementation groups" msgstr "Groupes d'implémentation" -#: core/models.py:927 +#: core/models.py:984 msgid "Assessable" msgstr "Évaluable" -#: core/models.py:933 +#: core/models.py:988 +#, fuzzy +#| msgid "Description" +msgid "Question" +msgstr "Description" + +#: core/models.py:991 #, fuzzy #| msgid "Requirement" msgid "RequirementNode" msgstr "Exigence" -#: core/models.py:934 +#: core/models.py:992 #, fuzzy #| msgid "Requirement" msgid "RequirementNodes" msgstr "Exigence" -#: core/models.py:949 +#: core/models.py:1007 #, fuzzy #| msgid "Search framework..." msgid "Source framework" msgstr "Rechercher un référentiel..." -#: core/models.py:955 +#: core/models.py:1013 #, fuzzy #| msgid "Search framework..." msgid "Target framework" msgstr "Rechercher un référentiel..." -#: core/models.py:961 +#: core/models.py:1019 msgid "Source and related frameworks must be different" msgstr "" -#: core/models.py:967 +#: core/models.py:1025 msgid "Full" msgstr "" -#: core/models.py:968 +#: core/models.py:1026 msgid "Partial" msgstr "" -#: core/models.py:969 core/models.py:976 +#: core/models.py:1027 core/models.py:1034 #, fuzzy #| msgid "Created" msgid "Not related" msgstr "Créé" -#: core/models.py:972 +#: core/models.py:1030 msgid "Subset" msgstr "" -#: core/models.py:973 +#: core/models.py:1031 msgid "Intersect" msgstr "" -#: core/models.py:974 +#: core/models.py:1032 msgid "Equal" msgstr "" -#: core/models.py:975 +#: core/models.py:1033 msgid "Superset" msgstr "" -#: core/models.py:979 +#: core/models.py:1037 msgid "Syntactic" msgstr "" -#: core/models.py:980 +#: core/models.py:1038 msgid "Semantic" msgstr "" -#: core/models.py:981 +#: core/models.py:1039 #, fuzzy #| msgid "Production" msgid "Functional" msgstr "Production" -#: core/models.py:996 +#: core/models.py:1054 msgid "Mapping set" msgstr "" -#: core/models.py:1002 +#: core/models.py:1060 msgid "Target requirement" msgstr "Exigence cible" -#: core/models.py:1009 +#: core/models.py:1067 msgid "Relationship" msgstr "" -#: core/models.py:1016 +#: core/models.py:1074 msgid "Rationale" msgstr "Raison" -#: core/models.py:1021 +#: core/models.py:1079 msgid "Source requirement" msgstr "Exigence source" -#: core/models.py:1026 +#: core/models.py:1084 msgid "Strength of relationship" msgstr "" -#: core/models.py:1045 +#: core/models.py:1103 core/models.py:1251 msgid "Undefined" msgstr "Non défini" -#: core/models.py:1046 +#: core/models.py:1104 msgid "Design" msgstr "Conception" -#: core/models.py:1047 +#: core/models.py:1105 msgid "Development" msgstr "Développement" -#: core/models.py:1048 +#: core/models.py:1106 msgid "Production" msgstr "Production" -#: core/models.py:1049 +#: core/models.py:1107 msgid "EndOfLife" msgstr "Fin de vie" -#: core/models.py:1050 +#: core/models.py:1108 msgid "Dropped" msgstr "Abandonné" -#: core/models.py:1053 +#: core/models.py:1111 msgid "Internal reference" msgstr "Référence interne" -#: core/models.py:1059 core/models.py:1236 core/models.py:1378 -#: core/models.py:2361 core/templates/snippets/mp_data.html:65 +#: core/models.py:1117 core/models.py:1297 core/models.py:1450 +#: core/models.py:2497 core/templates/snippets/mp_data.html:66 #: core/templates/snippets/ri_list_nested.html:31 msgid "Status" msgstr "Statut" -#: core/models.py:1064 core/models.py:1364 core/models.py:1825 +#: core/models.py:1122 core/models.py:1436 core/models.py:1929 #: core/templates/core/action_plan_pdf.html:16 #: core/templates/snippets/mp_data.html:7 msgid "Project" msgstr "Projet" -#: core/models.py:1065 +#: core/models.py:1123 msgid "Projects" msgstr "Projets" -#: core/models.py:1098 +#: core/models.py:1156 msgid "Primary" msgstr "Primaire" -#: core/models.py:1099 +#: core/models.py:1157 msgid "Support" msgstr "Support" -#: core/models.py:1102 +#: core/models.py:1160 msgid "business value" msgstr "valeur métier" -#: core/models.py:1105 +#: core/models.py:1163 msgid "type" msgstr "type" -#: core/models.py:1108 +#: core/models.py:1166 msgid "parent assets" msgstr "actifs parents" -#: core/models.py:1114 core/models.py:1734 +#: core/models.py:1172 core/models.py:1836 msgid "Assets" msgstr "Actifs" -#: core/models.py:1115 +#: core/models.py:1173 msgid "Asset" msgstr "Actif" -#: core/models.py:1145 +#: core/models.py:1203 msgid "Attachment for evidence (eg. screenshot, log file, etc.)" msgstr "" "Pièce jointe pour la preuve (par ex. capture d'écran, fichier journal, etc.)" -#: core/models.py:1146 +#: core/models.py:1204 msgid "Attachment" msgstr "Pièce jointe" -#: core/models.py:1152 +#: core/models.py:1210 msgid "Link to the evidence (eg. Jira ticket, etc.)" msgstr "Lien vers la preuve (par ex. billet Jira, etc.)" -#: core/models.py:1153 core/models.py:1255 -#: core/templates/snippets/mp_data.html:64 +#: core/models.py:1211 core/models.py:1322 +#: core/templates/snippets/mp_data.html:65 msgid "Link" msgstr "Lien" -#: core/models.py:1159 +#: core/models.py:1217 msgid "Evidence" msgstr "Preuve" -#: core/models.py:1160 core/models.py:1214 core/models.py:2381 +#: core/models.py:1218 core/models.py:1275 core/models.py:2517 msgid "Evidences" msgstr "Preuves" -#: core/models.py:1188 core/models.py:1357 -msgid "Planned" -msgstr "Planifié" +#: core/models.py:1246 core/models.py:2481 +msgid "To do" +msgstr "À faire" + +#: core/models.py:1247 core/models.py:1430 core/models.py:2482 +msgid "In progress" +msgstr "En cours" -#: core/models.py:1189 +#: core/models.py:1248 +msgid "On hold" +msgstr "" + +#: core/models.py:1249 msgid "Active" msgstr "Actif" -#: core/models.py:1190 -msgid "Inactive" -msgstr "Inactif" +#: core/models.py:1250 core/models.py:1433 +msgid "Deprecated" +msgstr "Déprécié" -#: core/models.py:1196 +#: core/models.py:1257 msgid "Small" msgstr "Petit" -#: core/models.py:1197 core/models.py:1711 core/tests/test_helpers.py:77 +#: core/models.py:1258 core/models.py:1813 core/tests/test_helpers.py:77 #: core/tests/test_helpers.py:142 msgid "Medium" msgstr "Moyen" -#: core/models.py:1198 +#: core/models.py:1259 msgid "Large" msgstr "Grand" -#: core/models.py:1199 +#: core/models.py:1260 msgid "Extra Large" msgstr "Extra large" -#: core/models.py:1209 +#: core/models.py:1270 msgid "Reference Control" msgstr "Mesure de référence" -#: core/models.py:1241 +#: core/models.py:1302 core/models.py:1865 +msgid "Owner" +msgstr "Propriétaire" + +#: core/models.py:1308 msgid "Estimated Time of Arrival" msgstr "Heure d'arrivée estimée" -#: core/models.py:1247 +#: core/models.py:1314 msgid "Date after which the applied control is no longer valid" msgstr "Date à partir de laquelle la mesure appliquée n'est plus valide" -#: core/models.py:1248 core/models.py:2484 +#: core/models.py:1315 core/models.py:2625 #: core/templates/core/action_plan_pdf.html:47 msgid "Expiry date" msgstr "Date d'expiration" -#: core/models.py:1254 +#: core/models.py:1321 msgid "External url for action follow-up (eg. Jira ticket)" msgstr "URL externe pour le suivi de l'action (par ex. billet Jira)" -#: core/models.py:1262 +#: core/models.py:1329 msgid "Relative effort of the measure (using T-Shirt sizing)" msgstr "Effort relatif de la mesure (en utilisant la taille des T-shirts)" -#: core/models.py:1263 core/templates/core/action_plan_pdf.html:48 +#: core/models.py:1330 core/templates/core/action_plan_pdf.html:48 #: core/templates/snippets/mp_data.html:63 msgid "Effort" msgstr "Effort" -#: core/models.py:1269 +#: core/models.py:1334 +msgid "Cost of the measure (using globally-chosen currency)" +msgstr "" + +#: core/models.py:1335 core/templates/core/action_plan_pdf.html:49 +#: core/templates/snippets/mp_data.html:64 +msgid "Cost" +msgstr "" + +#: core/models.py:1341 msgid "Applied control" msgstr "Mesure appliqué" -#: core/models.py:1270 core/models.py:1741 core/models.py:2397 +#: core/models.py:1342 core/models.py:1843 core/models.py:2533 msgid "Applied controls" msgstr "Mesures appliquées" -#: core/models.py:1343 +#: core/models.py:1415 msgid "Policies" msgstr "Politiques" -#: core/models.py:1358 core/models.py:2346 -msgid "In progress" -msgstr "En cours" +#: core/models.py:1429 +msgid "Planned" +msgstr "Planifié" -#: core/models.py:1359 core/models.py:2347 +#: core/models.py:1431 core/models.py:2483 msgid "In review" msgstr "En examen" -#: core/models.py:1360 core/models.py:2348 +#: core/models.py:1432 core/models.py:2484 msgid "Done" msgstr "Terminé" -#: core/models.py:1361 -msgid "Deprecated" -msgstr "Déprécié" - -#: core/models.py:1370 +#: core/models.py:1442 msgid "Version of the compliance assessment (eg. 1.0, 2.0, etc.)" msgstr "Version de l'évaluation de conformité (par ex. 1.0, 2.0, etc.)" -#: core/models.py:1385 +#: core/models.py:1457 msgid "Authors" msgstr "Auteurs" -#: core/models.py:1391 core/templates/core/audit_report.html:35 +#: core/models.py:1463 core/templates/core/audit_report.html:35 msgid "Reviewers" msgstr "Relecteurs" -#: core/models.py:1405 +#: core/models.py:1466 core/models.py:2520 +msgid "Observation" +msgstr "Observation" + +#: core/models.py:1483 msgid "WARNING! After choosing it, you will not be able to change it" msgstr "" "ATTENTION ! Une fois que vous l'aurez choisi, vous ne pourrez plus le " "modifier." -#: core/models.py:1406 +#: core/models.py:1484 msgid "Risk matrix" msgstr "Matrice de risque" -#: core/models.py:1410 core/templates/snippets/mp_data.html:9 +#: core/models.py:1488 core/templates/snippets/mp_data.html:9 #: core/templates/snippets/ra_data.html:8 msgid "Risk assessment" msgstr "Évaluation de risque" -#: core/models.py:1411 +#: core/models.py:1489 msgid "Risk assessments" msgstr "Évaluations de risque" -#: core/models.py:1435 +#: core/models.py:1513 msgid "{}: Risk assessment is still in progress" msgstr "{} : L'évaluation des risques est toujours en cours" -#: core/models.py:1446 +#: core/models.py:1524 msgid "{}: No author assigned to this risk assessment" msgstr "{} : Aucun auteur n'a été affecté à cette évaluation des risques" -#: core/models.py:1458 +#: core/models.py:1536 msgid "{}: RiskAssessment is empty. No risk scenario declared yet" msgstr "" "{} : L'évaluation des risques est vide. Aucun scénario de risque n'a encore " "été déclaré." -#: core/models.py:1479 +#: core/models.py:1557 msgid "{} current risk level has not been assessed" msgstr "{} : Le niveau de risque actuel n'a pas été évalué" -#: core/models.py:1492 +#: core/models.py:1570 msgid "" "{} residual risk level has not been assessed. If no additional measures are " "applied, it should be at the same level as the current risk" @@ -723,43 +750,52 @@ msgstr "" "mesures supplémentaires appliquées, il devrait être au même niveau que le " "risque actuel." -#: core/models.py:1503 +#: core/models.py:1581 msgid "{} residual risk level is higher than the current one" msgstr "{} : Le niveau de risque résiduel est supérieur à l'actuel" -#: core/models.py:1515 +#: core/models.py:1593 msgid "{} residual risk probability is higher than the current one" msgstr "{} : La probabilité de risque résiduel est supérieure à l'actuelle" -#: core/models.py:1527 +#: core/models.py:1605 msgid "{} residual risk impact is higher than the current one" msgstr "{} : L'impact du risque résiduel est supérieur à l'actuel" -#: core/models.py:1548 +#: core/models.py:1626 msgid "{}: residual risk level has been lowered without any specific measure" msgstr "" "{} : Le niveau de risque résiduel a été réduit sans aucune mesure spécifique" -#: core/models.py:1562 +#: core/models.py:1640 msgid "{} risk accepted but no risk acceptance attached" msgstr "{} : Risque accepté mais aucune acceptation de risque jointe" -#: core/models.py:1585 +#: core/models.py:1663 msgid "{} does not have an ETA" msgstr "{} : Pas d'ETA" -#: core/models.py:1597 +#: core/models.py:1675 msgid "{} ETA is in the past now. Consider updating its status or the date" msgstr "" "{} : L'ETA est dans le passé maintenant. Envisagez de mettre à jour son " "statut ou la date." -#: core/models.py:1610 +#: core/models.py:1688 msgid "" "{} does not have an estimated effort. This will help you for prioritization" msgstr "{} : Pas d'effort estimé. Cela vous aidera pour la prioritisation" -#: core/models.py:1623 +#: core/models.py:1701 +#, fuzzy +#| msgid "" +#| "{} does not have an estimated effort. This will help you for " +#| "prioritization" +msgid "" +"{} does not have an estimated cost. This will help you for prioritization" +msgstr "{} : Pas d'effort estimé. Cela vous aidera pour la prioritisation" + +#: core/models.py:1714 msgid "" "{}: Applied control does not have an external link attached. This will help " "you for follow-up" @@ -767,74 +803,112 @@ msgstr "" "{} : La mesure appliquée ne comporte pas de lien externe joint. Cela vous " "aidera pour le suivi" -#: core/models.py:1646 +#: core/models.py:1737 msgid "{}: Acceptance has no expiry date" msgstr "{} : L'acceptation n'a pas de date d'expiration" -#: core/models.py:1660 +#: core/models.py:1751 msgid "{}: Acceptance has expired. Consider updating the status or the date" msgstr "" "{} : L'acceptation a expiré. Envisagez de mettre à jour le statut ou la date." -#: core/models.py:1689 +#: core/models.py:1780 msgid "Open" msgstr "Ouvert" -#: core/models.py:1690 +#: core/models.py:1781 msgid "Mitigate" msgstr "Atténuer" -#: core/models.py:1691 +#: core/models.py:1782 msgid "Accept" msgstr "Accepter" -#: core/models.py:1692 +#: core/models.py:1783 msgid "Avoid" msgstr "Éviter" -#: core/models.py:1693 +#: core/models.py:1784 msgid "Transfer" msgstr "Transférer" -#: core/models.py:1698 +#: core/models.py:1788 +msgid "Financial" +msgstr "" + +#: core/models.py:1789 +msgid "Legal" +msgstr "" + +#: core/models.py:1790 +#, fuzzy +#| msgid "Rationale" +msgid "Reputation" +msgstr "Raison" + +#: core/models.py:1791 +#, fuzzy +#| msgid "Observation" +msgid "Operational" +msgstr "Observation" + +#: core/models.py:1792 +msgid "Confidentiality" +msgstr "" + +#: core/models.py:1793 +msgid "Integrity" +msgstr "" + +#: core/models.py:1794 +#, fuzzy +#| msgid "Probability" +msgid "Availability" +msgstr "Probabilité" + +#: core/models.py:1795 +msgid "Authenticity" +msgstr "" + +#: core/models.py:1800 msgid "--" msgstr "--" -#: core/models.py:1700 +#: core/models.py:1802 msgid "The strength of the knowledge supporting the assessment is undefined" msgstr "La force de la connaissance soutenant l'évaluation est indéfinie" -#: core/models.py:1704 core/tests/test_helpers.py:76 +#: core/models.py:1806 core/tests/test_helpers.py:76 #: core/tests/test_helpers.py:141 msgid "Low" msgstr "Faible" -#: core/models.py:1706 +#: core/models.py:1808 msgid "The strength of the knowledge supporting the assessment is low" msgstr "La force de la connaissance soutenant l'évaluation est faible" -#: core/models.py:1713 +#: core/models.py:1815 msgid "The strength of the knowledge supporting the assessment is medium" msgstr "La force de la connaissance soutenant l'évaluation est moyenne" -#: core/models.py:1718 core/tests/test_helpers.py:78 +#: core/models.py:1820 core/tests/test_helpers.py:78 #: core/tests/test_helpers.py:143 msgid "High" msgstr "Élevé" -#: core/models.py:1720 +#: core/models.py:1822 msgid "The strength of the knowledge supporting the assessment is high" msgstr "La force de la connaissance soutenant l'évaluation est élevée" -#: core/models.py:1729 +#: core/models.py:1831 msgid "RiskAssessment" msgstr "ÉvaluationDesRisques" -#: core/models.py:1736 +#: core/models.py:1838 msgid "Assets impacted by the risk scenario" msgstr "Actifs impactés par le scénario de risque" -#: core/models.py:1754 +#: core/models.py:1856 msgid "" "The existing controls to manage this risk. Edit the risk scenario to add " "extra applied controls." @@ -842,28 +916,24 @@ msgstr "" "Les mesures existantes pour gérer ce risque. Modifiez le scénario de risque " "pour ajouter des mesures appliquées supplémentaires." -#: core/models.py:1756 core/templates/snippets/mp_data.html:48 +#: core/models.py:1858 core/templates/snippets/mp_data.html:48 #: core/templates/snippets/ri_list_nested.html:22 msgid "Existing controls" msgstr "Mesures existantes" -#: core/models.py:1763 -msgid "Owner" -msgstr "Propriétaire" - -#: core/models.py:1768 +#: core/models.py:1870 msgid "Current probability" msgstr "Probabilité actuelle" -#: core/models.py:1771 +#: core/models.py:1873 msgid "Current impact" msgstr "Impact actuel" -#: core/models.py:1775 +#: core/models.py:1877 msgid "Current level" msgstr "Niveau actuel" -#: core/models.py:1777 +#: core/models.py:1879 msgid "" "The risk level given the current measures. Automatically updated on Save, " "based on the chosen risk matrix" @@ -872,19 +942,19 @@ msgstr "" "automatiquement lors de l'enregistrement, sur la base de la matrice de " "risque choisie." -#: core/models.py:1783 +#: core/models.py:1885 msgid "Residual probability" msgstr "Probabilité résiduelle" -#: core/models.py:1786 +#: core/models.py:1888 msgid "Residual impact" msgstr "Impact résiduel" -#: core/models.py:1790 +#: core/models.py:1892 msgid "Residual level" msgstr "Niveau résiduel" -#: core/models.py:1792 +#: core/models.py:1894 msgid "" "The risk level when all the extra measures are done. Automatically updated " "on Save, based on the chosen risk matrix" @@ -893,154 +963,160 @@ msgstr "" "œuvre. Mis à jour automatiquement lors de l'enregistrement, sur la base de " "la matrice de risque choisie." -#: core/models.py:1800 +#: core/models.py:1902 msgid "Treatment status" msgstr "Statut de traitement" -#: core/models.py:1805 +#: core/models.py:1905 +#, fuzzy +#| msgid "Justification" +msgid "Qualifications" +msgstr "Justification" + +#: core/models.py:1909 msgid "Strength of Knowledge" msgstr "Force de la connaissance" -#: core/models.py:1806 +#: core/models.py:1910 msgid "The strength of the knowledge supporting the assessment" msgstr "La force de la connaissance soutenant l'évaluation" -#: core/models.py:1809 core/models.py:2496 +#: core/models.py:1913 core/models.py:2637 msgid "Justification" msgstr "Justification" -#: core/models.py:1815 +#: core/models.py:1919 msgid "Risk scenario" msgstr "Scénario de risque" -#: core/models.py:1816 core/models.py:2461 +#: core/models.py:1920 core/models.py:2602 msgid "Risk scenarios" msgstr "Scénarios de risque" -#: core/models.py:1926 +#: core/models.py:2030 msgid ": " msgstr ": " -#: core/models.py:1958 core/templates/core/audit_report.html:43 +#: core/models.py:2062 core/templates/core/audit_report.html:43 msgid "Selected implementation groups" msgstr "Groupes d'implémentation sélectionnés" -#: core/models.py:1968 core/models.py:2388 +#: core/models.py:2072 core/models.py:2524 msgid "Compliance assessment" msgstr "Évaluation de conformité" -#: core/models.py:1969 +#: core/models.py:2073 msgid "Compliance assessments" msgstr "Évaluations de conformité" -#: core/models.py:2174 +#: core/models.py:2310 msgid "{}: Compliance assessment is still in progress" msgstr "{} : L'évaluation de la conformité est toujours en cours" -#: core/models.py:2187 +#: core/models.py:2323 msgid "{}: No author assigned to this compliance assessment" msgstr "{} : Aucun auteur n'a été affecté à cette évaluation de conformité" -#: core/models.py:2214 +#: core/models.py:2350 +#, fuzzy +#| msgid "" +#| "{}: Requirement assessment status is compliant or partially compliant " +#| "with no applied control applied" msgid "" -"{}: Requirement assessment status is compliant or partially compliant with " +"{}: Requirement assessment result is compliant or partially compliant with " "no applied control applied" msgstr "" "{} : Le statut de l'évaluation de l'exigence est conforme ou partiellement " "conforme, sans aucun mesure appliquée" -#: core/models.py:2239 +#: core/models.py:2375 msgid "{}: Applied control has no reference control selected" msgstr "" "{} : La mesure appliquée ne comporte pas de mesure de référence sélectionné" -#: core/models.py:2265 +#: core/models.py:2401 msgid "{}: Evidence has no file uploaded" msgstr "{} : La preuve ne comporte pas de fichier téléchargé" -#: core/models.py:2345 -msgid "To do" -msgstr "À faire" - -#: core/models.py:2351 +#: core/models.py:2487 msgid "Not assessed" msgstr "Non évalué" -#: core/models.py:2352 +#: core/models.py:2488 msgid "Partially compliant" msgstr "Partiellement conforme" -#: core/models.py:2353 +#: core/models.py:2489 #, fuzzy #| msgid "Non compliant" msgid "Non-compliant" msgstr "Non conforme" -#: core/models.py:2354 +#: core/models.py:2490 msgid "Compliant" msgstr "Conforme" -#: core/models.py:2355 +#: core/models.py:2491 msgid "Not applicable" msgstr "Non applicable" -#: core/models.py:2366 +#: core/models.py:2502 msgid "Result" msgstr "Résultat" -#: core/models.py:2372 +#: core/models.py:2508 msgid "Score" msgstr "Score" -#: core/models.py:2376 +#: core/models.py:2512 msgid "Is scored" msgstr "Est noté" -#: core/models.py:2384 -msgid "Observation" -msgstr "Observation" - -#: core/models.py:2392 +#: core/models.py:2528 msgid "Requirement" msgstr "Exigence" -#: core/models.py:2402 +#: core/models.py:2538 msgid "Selected" msgstr "Sélectionné" -#: core/models.py:2406 +#: core/models.py:2542 msgid "Mapping inference" msgstr "Inference de mapping" -#: core/models.py:2443 +#: core/models.py:2547 +msgid "Answer" +msgstr "" + +#: core/models.py:2584 msgid "Requirement assessment" msgstr "Évaluation de l'exigence" -#: core/models.py:2444 +#: core/models.py:2585 msgid "Requirement assessments" msgstr "Évaluations de l'exigence" -#: core/models.py:2452 +#: core/models.py:2593 msgid "Created" msgstr "Créé" -#: core/models.py:2453 +#: core/models.py:2594 msgid "Submitted" msgstr "Soumis" -#: core/models.py:2454 +#: core/models.py:2595 msgid "Accepted" msgstr "Accepté" -#: core/models.py:2455 +#: core/models.py:2596 msgid "Rejected" msgstr "Rejeté" -#: core/models.py:2456 +#: core/models.py:2597 msgid "Revoked" msgstr "Révoqué" -#: core/models.py:2463 +#: core/models.py:2604 msgid "" "Select the risk scenarios to be accepted, attention they must be part of the " "chosen domain" @@ -1048,39 +1124,39 @@ msgstr "" "Sélectionnez les scénarios de risque à accepter, faites attention, ils " "doivent faire partie du domaine choisi" -#: core/models.py:2469 +#: core/models.py:2610 msgid "Risk owner and approver identity" msgstr "Identité du propriétaire du risque et de l'approbateur" -#: core/models.py:2470 core/utils.py:50 core/utils.py:57 core/utils.py:60 +#: core/models.py:2611 core/utils.py:50 core/utils.py:57 core/utils.py:60 msgid "Approver" msgstr "Approbateur" -#: core/models.py:2479 +#: core/models.py:2620 msgid "State" msgstr "État" -#: core/models.py:2482 +#: core/models.py:2623 msgid "Specify when the risk acceptance will no longer apply" msgstr "Précisez quand l'acceptation du risque ne sera plus valable" -#: core/models.py:2487 +#: core/models.py:2628 msgid "Acceptance date" msgstr "Date d'acceptation" -#: core/models.py:2490 +#: core/models.py:2631 msgid "Rejection date" msgstr "Date de rejet" -#: core/models.py:2493 +#: core/models.py:2634 msgid "Revocation date" msgstr "Date de révocation" -#: core/models.py:2505 +#: core/models.py:2646 msgid "Risk acceptance" msgstr "Acceptation du risque" -#: core/models.py:2506 +#: core/models.py:2647 msgid "Risk acceptances" msgstr "Acceptations du risque" @@ -1108,11 +1184,11 @@ msgstr "Pas de statut" msgid "CSF function" msgstr "fonction CSF" -#: core/templates/core/action_plan_pdf.html:49 +#: core/templates/core/action_plan_pdf.html:50 msgid "Matching requirements" msgstr "Exigences correspondantes" -#: core/templates/core/action_plan_pdf.html:67 +#: core/templates/core/action_plan_pdf.html:69 msgid "No entries found" msgstr "Aucun résultat trouvé" @@ -1134,6 +1210,7 @@ msgstr "Bienvenue sur CISO Assistant !" #: core/templates/registration/first_connexion_email.html:15 #: core/templates/registration/password_reset_email.html:23 +#: core/templates/tprm/third_party_email.html:23 msgid "Your all-in-one GRC Management Platform" msgstr "Votre plateforme de gestion GRC tout-en-un" @@ -1151,6 +1228,7 @@ msgstr "Définir mon mot de passe" #: core/templates/registration/first_connexion_email.html:41 #: core/templates/registration/password_reset_email.html:43 +#: core/templates/tprm/third_party_email.html:43 msgid "An issue with the link? copy and paste the following in your browser" msgstr "" "Un problème avec le lien ? Copiez et collez le suivant dans votre navigateur" @@ -1188,17 +1266,20 @@ msgstr "En savoir plus sur CISO Assistant" #: core/templates/registration/first_connexion_email.html:63 #: core/templates/registration/password_reset_email.html:58 +#: core/templates/tprm/third_party_email.html:49 msgid "Sincerely" -msgstr "Cordialement," +msgstr "Cordialement" #: core/templates/registration/first_connexion_email.html:64 #: core/templates/registration/password_reset_email.html:59 +#: core/templates/tprm/third_party_email.html:50 msgid "CISO Assistant Team" msgstr "Équipe CISO Assistant" #: core/templates/registration/password_reset_email.html:32 +#: core/templates/tprm/third_party_email.html:32 msgid "Hello" -msgstr "Bonjour," +msgstr "Bonjour" #: core/templates/registration/password_reset_email.html:36 msgid "" @@ -1345,6 +1426,15 @@ msgstr "Impact" msgid "Probability" msgstr "Probabilité" +#: core/templates/tprm/third_party_email.html:36 +msgid "You have been assigned to a questionnaire. Click below to proceed:" +msgstr "" +"Vous avez été assigné à un questionnaire. Cliquez ci-dessous pour continuer :" + +#: core/templates/tprm/third_party_email.html:40 +msgid "Go to the Questionnaire" +msgstr "Aller vers le questionnaire" + #: core/tests/test_helpers.py:75 core/tests/test_helpers.py:140 msgid "Very Low" msgstr "Très faible" @@ -1377,6 +1467,14 @@ msgstr "Français" msgid "English" msgstr "Anglais" +#~ msgid "Inactive" +#~ msgstr "Inactif" + +#, fuzzy +#~| msgid "Observation" +#~ msgid "Review Observation" +#~ msgstr "Observation" + #, fuzzy #~| msgid "estimated time of arrival" #~ msgid "Estimated time of arrival" diff --git a/backend/core/migrations/0027_requirementassessment_answer_and_more.py b/backend/core/migrations/0027_requirementassessment_answer_and_more.py new file mode 100644 index 000000000..e3e6f10b8 --- /dev/null +++ b/backend/core/migrations/0027_requirementassessment_answer_and_more.py @@ -0,0 +1,22 @@ +# Generated by Django 5.1 on 2024-09-13 16:25 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + dependencies = [ + ("core", "0026_appliedcontrol_cost"), + ] + + operations = [ + migrations.AddField( + model_name="requirementassessment", + name="answer", + field=models.JSONField(blank=True, null=True, verbose_name="Answer"), + ), + migrations.AddField( + model_name="requirementnode", + name="question", + field=models.JSONField(blank=True, null=True, verbose_name="Question"), + ), + ] diff --git a/backend/core/migrations/0028_complianceassessment_observation_and_more.py b/backend/core/migrations/0028_complianceassessment_observation_and_more.py new file mode 100644 index 000000000..a728f8542 --- /dev/null +++ b/backend/core/migrations/0028_complianceassessment_observation_and_more.py @@ -0,0 +1,22 @@ +# Generated by Django 5.1 on 2024-09-13 18:54 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + dependencies = [ + ("core", "0027_requirementassessment_answer_and_more"), + ] + + operations = [ + migrations.AddField( + model_name="complianceassessment", + name="observation", + field=models.TextField(blank=True, null=True, verbose_name="Observation"), + ), + migrations.AddField( + model_name="riskassessment", + name="observation", + field=models.TextField(blank=True, null=True, verbose_name="Observation"), + ), + ] diff --git a/backend/core/models.py b/backend/core/models.py index 9907d1673..31ecfbc6d 100644 --- a/backend/core/models.py +++ b/backend/core/models.py @@ -29,7 +29,6 @@ from django.forms.models import model_to_dict from django.urls import reverse from django.utils.html import format_html -from django.utils.translation import get_language from django.utils.translation import gettext_lazy as _ from iam.models import Folder, FolderMixin, PublishInRootFolderMixin from library.helpers import update_translations, update_translations_in_object @@ -55,6 +54,44 @@ def match_urn(urn_string): return None +def transform_question_to_answer(json_data): + """ + Used during Requirement Assessment creation to create a questionnaire base on + the Requirement Node question JSON field + + Args: + json_data (json): JSON describing a questionnaire from a Requirement Node + + Returns: + json: JSON formatted for the frontend to display a form + """ + question_type = json_data.get("question_type", "") + question_choices = json_data.get("question_choices", []) + questions = json_data.get("questions", []) + + form_fields = [] + + for question in questions: + field = {} + field["urn"] = question.get("urn", "") + field["text"] = question.get("text", "") + + if question_type == "unique_choice": + field["type"] = "unique_choice" + field["options"] = question_choices + elif question_type == "date": + field["type"] = "date" + else: + field["type"] = "text" + + field["answer"] = "" + + form_fields.append(field) + + form_json = {"questions": form_fields} + return form_json + + ########################### Referential objects ######################### @@ -490,7 +527,24 @@ def update_library(self) -> Union[str, None]: compliance_assessment=compliance_assessment, requirement=new_requirement_node, folder=compliance_assessment.project.folder, + answer=transform_question_to_answer( + new_requirement_node.question + ) + if new_requirement_node.question + else {}, + ) + else: + for ra in RequirementAssessment.objects.filter( + requirement=new_requirement_node + ): + ra.name = new_requirement_node.name + ra.description = new_requirement_node.description + ra.answer = ( + transform_question_to_answer(new_requirement_node.question) + if new_requirement_node.question + else {} ) + ra.save() for threat_urn in requirement_node_dict.get("threats", []): thread_to_add = objects_tracked.get(threat_urn) @@ -931,6 +985,7 @@ class RequirementNode(ReferentialObjectMixin, I18nObjectMixin): typical_evidence = models.TextField( null=True, blank=True, verbose_name=_("Typical evidence") ) + question = models.JSONField(blank=True, null=True, verbose_name=_("Question")) class Meta: verbose_name = _("RequirementNode") @@ -1378,7 +1433,7 @@ class Status(models.TextChoices): DEPRECATED = "deprecated", _("Deprecated") project = models.ForeignKey( - "Project", on_delete=models.CASCADE, verbose_name=_("Project") + Project, on_delete=models.CASCADE, verbose_name=_("Project") ) version = models.CharField( max_length=100, @@ -1408,6 +1463,7 @@ class Status(models.TextChoices): verbose_name=_("Reviewers"), related_name="%(class)s_reviewers", ) + observation = models.TextField(null=True, blank=True, verbose_name=_("Observation")) fields_to_check = ["name", "version"] @@ -2023,6 +2079,38 @@ def save(self, *args, **kwargs) -> None: self.scores_definition = self.framework.scores_definition super().save(*args, **kwargs) + def create_requirement_assessments(self, baseline: Self | None = None): + requirements = RequirementNode.objects.filter(framework=self.framework) + requirement_assessments = [] + for requirement in requirements: + requirement_assessment = RequirementAssessment.objects.create( + compliance_assessment=self, + requirement=requirement, + folder=Folder.objects.get(id=self.folder.id), + answer=transform_question_to_answer(requirement.question) + if requirement.question + else {}, + ) + if baseline and baseline.framework == self.framework: + baseline_requirement_assessment = RequirementAssessment.objects.get( + compliance_assessment=baseline, requirement=requirement + ) + requirement_assessment.result = baseline_requirement_assessment.result + requirement_assessment.status = baseline_requirement_assessment.status + requirement_assessment.score = baseline_requirement_assessment.score + requirement_assessment.is_scored = ( + baseline_requirement_assessment.is_scored + ) + requirement_assessment.evidences.set( + baseline_requirement_assessment.evidences.all() + ) + requirement_assessment.applied_controls.set( + baseline_requirement_assessment.applied_controls.all() + ) + requirement_assessment.save() + requirement_assessments.append(requirement_assessment) + return requirement_assessments + def get_global_score(self): requirement_assessments_scored = ( RequirementAssessment.objects.filter(compliance_assessment=self) @@ -2453,6 +2541,11 @@ class Result(models.TextChoices): default=dict, verbose_name=_("Mapping inference"), ) + answer = models.JSONField( + blank=True, + null=True, + verbose_name=_("Answer"), + ) def __str__(self) -> str: return self.requirement.display_short diff --git a/backend/core/serializer_fields.py b/backend/core/serializer_fields.py index 0d61a4a30..6884e87e4 100644 --- a/backend/core/serializer_fields.py +++ b/backend/core/serializer_fields.py @@ -27,6 +27,7 @@ def to_representation( res = {"str": str(value)} if value == Folder.get_root_folder(): + res.update({"id": value.id}) return res fields = fields or self.fields diff --git a/backend/core/serializers.py b/backend/core/serializers.py index 969c9e314..d23ded61c 100644 --- a/backend/core/serializers.py +++ b/backend/core/serializers.py @@ -343,6 +343,7 @@ class Meta: "date_joined", "user_groups", "is_sso", + "is_third_party", ] @@ -357,6 +358,7 @@ class Meta: "is_active", "date_joined", "user_groups", + "is_third_party", ] def validate_email(self, email): @@ -569,6 +571,7 @@ class Meta: class RequirementAssessmentReadSerializer(BaseModelSerializer): name = serializers.CharField(source="__str__") description = serializers.CharField(source="get_requirement_description") + evidences = FieldsRelatedField(many=True) compliance_assessment = FieldsRelatedField() folder = FieldsRelatedField() diff --git a/backend/core/startup.py b/backend/core/startup.py index 6d761413e..8c2deb181 100644 --- a/backend/core/startup.py +++ b/backend/core/startup.py @@ -6,6 +6,7 @@ from structlog import get_logger from ciso_assistant.settings import CISO_ASSISTANT_SUPERUSER_EMAIL +from core.utils import RoleCodename logger = get_logger(__name__) @@ -261,6 +262,32 @@ "change_globalsettings", "view_requirementmappingset", "view_requirementmapping", + "add_entity", + "change_entity", + "view_entity", + "delete_entity", + "add_representative", + "change_representative", + "view_representative", + "delete_representative", + "add_solution", + "change_solution", + "view_solution", + "delete_solution", + "add_entityassessment", + "change_entityassessment", + "view_entityassessment", + "delete_entityassessment", +] + +THIRD_PARTY_RESPONDENT_PERMISSIONS_LIST = [ + "view_complianceassessment", + "view_requirementassessment", + "change_requirementassessment", + "view_evidence", + "add_evidence", + "change_evidence", + "delete_evidence", ] @@ -273,6 +300,7 @@ def startup(sender: AppConfig, **kwargs): from django.contrib.auth.models import Permission from iam.models import Folder, Role, RoleAssignment, User, UserGroup + from tprm.models import Entity print("startup handler: initialize database") @@ -299,6 +327,12 @@ def startup(sender: AppConfig, **kwargs): Folder.objects.create( name="Global", content_type=Folder.ContentType.ROOT, builtin=True ) + # if main entity does not exist, then create it + if not Entity.objects.filter(name="Main").exists(): + main = Entity.objects.create( + name="Main", folder=Folder.get_root_folder(), builtin=True + ) + main.owned_folders.add(Folder.get_root_folder()) # update builtin roles to facilitate migrations reader, created = Role.objects.get_or_create(name="BI-RL-AUD", builtin=True) reader.permissions.set(reader_permissions) @@ -360,6 +394,14 @@ def startup(sender: AppConfig, **kwargs): ) ra2.perimeter_folders.add(global_approvers.folder) + third_party_respondent_permissions = Permission.objects.filter( + codename__in=THIRD_PARTY_RESPONDENT_PERMISSIONS_LIST + ) + third_party_respondent, created = Role.objects.get_or_create( + name=RoleCodename.THIRD_PARTY_RESPONDENT.value, builtin=True + ) + third_party_respondent.permissions.set(third_party_respondent_permissions) + # if superuser defined and does not exist, then create it if ( CISO_ASSISTANT_SUPERUSER_EMAIL diff --git a/backend/core/templates/tprm/third_party_email.html b/backend/core/templates/tprm/third_party_email.html new file mode 100644 index 000000000..218b8d4db --- /dev/null +++ b/backend/core/templates/tprm/third_party_email.html @@ -0,0 +1,58 @@ +{% load i18n static%} + + + + + + + + + + + + + + + + +
+
+ +
+

CISO Assistant

+

{% trans "Your all-in-one GRC Management Platform" %}

+
+ + CISO Assistant logo + +

+ + {% autoescape off %} +

+ {% trans "Hello" %}, +

+ +

+ {% trans "You have been assigned to a questionnaire. Click below to proceed:" %} +

+ +

+ {% trans "Go to the Questionnaire" %} +

+ +

{% trans "An issue with the link? copy and paste the following in your browser" %}:

+ +

+ {{ root_url }}/{{ object }}/{{ object_id }}/table-mode +

+ + {% trans "Sincerely" %},
+ {% trans "CISO Assistant Team" %} + + {% endautoescape %} +
+ + + + + diff --git a/backend/core/urls.py b/backend/core/urls.py index b4290a221..0397a7de3 100644 --- a/backend/core/urls.py +++ b/backend/core/urls.py @@ -1,7 +1,11 @@ -from iam.sso.views import SSOSettingsViewSet from .views import * +from tprm.views import ( + EntityViewSet, + RepresentativeViewSet, + SolutionViewSet, + EntityAssessmentViewSet, +) from library.views import StoredLibraryViewSet, LoadedLibraryViewSet -from iam.sso.saml.views import FinishACSView import importlib @@ -13,6 +17,12 @@ router = routers.DefaultRouter() router.register(r"folders", FolderViewSet, basename="folders") +router.register(r"entities", EntityViewSet, basename="entities") +router.register( + r"entity-assessments", EntityAssessmentViewSet, basename="entity-assessments" +) +router.register(r"solutions", SolutionViewSet, basename="solutions") +router.register(r"representatives", RepresentativeViewSet, basename="representatives") router.register(r"projects", ProjectViewSet, basename="projects") router.register(r"risk-matrices", RiskMatrixViewSet, basename="risk-matrices") router.register(r"risk-assessments", RiskAssessmentViewSet, basename="risk-assessments") diff --git a/backend/core/utils.py b/backend/core/utils.py index 27aa80237..8caa3cd3a 100644 --- a/backend/core/utils.py +++ b/backend/core/utils.py @@ -25,6 +25,7 @@ class RoleCodename(Enum): ANALYST = "BI-RL-ANA" APPROVER = "BI-RL-APP" READER = "BI-RL-AUD" + THIRD_PARTY_RESPONDENT = "BI-RL-TPR" def __str__(self) -> str: return self.value @@ -38,6 +39,7 @@ class UserGroupCodename(Enum): ANALYST = "BI-UG-ANA" APPROVER = "BI-UG-APP" READER = "BI-UG-AUD" + THIRD_PARTY_RESPONDENT = "BI-UG-TPR" def __str__(self) -> str: return self.value @@ -49,6 +51,7 @@ def __str__(self) -> str: str(RoleCodename.ANALYST): _("Analyst"), str(RoleCodename.APPROVER): _("Approver"), str(RoleCodename.READER): _("Reader"), + str(RoleCodename.THIRD_PARTY_RESPONDENT): _("Third-party respondent"), } BUILTIN_USERGROUP_CODENAMES = { @@ -59,6 +62,7 @@ def __str__(self) -> str: str(UserGroupCodename.ANALYST): _("Analyst"), str(UserGroupCodename.APPROVER): _("Approver"), str(UserGroupCodename.READER): _("Reader"), + str(UserGroupCodename.THIRD_PARTY_RESPONDENT): _("Third-party respondent"), } COUNTRY_FLAGS = { diff --git a/backend/core/views.py b/backend/core/views.py index 911acb72b..ba1358b78 100644 --- a/backend/core/views.py +++ b/backend/core/views.py @@ -940,7 +940,14 @@ def filter_approver(self, queryset, name, value): class Meta: model = User - fields = ["email", "first_name", "last_name", "is_active", "is_approver"] + fields = [ + "email", + "first_name", + "last_name", + "is_active", + "is_approver", + "is_third_party", + ] class UserViewSet(BaseModelViewSet): @@ -1018,13 +1025,33 @@ class RoleAssignmentViewSet(BaseModelViewSet): filterset_fields = ["folder"] +class FolderFilter(df.FilterSet): + owned = df.BooleanFilter(method="get_owned_folders", label="owned") + content_type = df.MultipleChoiceFilter( + choices=Folder.ContentType, lookup_expr="icontains" + ) + + def get_owned_folders(self, queryset, name, value): + owned_folders_id = [] + for folder in Folder.objects.all(): + if folder.owner.all().first(): + owned_folders_id.append(folder.id) + if value: + return queryset.filter(id__in=owned_folders_id) + return queryset.exclude(id__in=owned_folders_id) + + class Meta: + model = Folder + fields = ["parent_folder", "content_type", "owner", "owned"] + + class FolderViewSet(BaseModelViewSet): """ API endpoint that allows folders to be viewed or edited. """ model = Folder - filterset_fields = ["parent_folder", "content_type"] + filterset_class = FolderFilter def perform_create(self, serializer): """ @@ -1569,31 +1596,8 @@ def perform_create(self, serializer): Create RequirementAssessment objects for the newly created ComplianceAssessment """ baseline = serializer.validated_data.pop("baseline", None) - instance = serializer.save() - requirements = RequirementNode.objects.filter(framework=instance.framework) - for requirement in requirements: - requirement_assessment = RequirementAssessment.objects.create( - compliance_assessment=instance, - requirement=requirement, - folder=Folder.objects.get(id=instance.project.folder.id), - ) - if baseline and baseline.framework == instance.framework: - baseline_requirement_assessment = RequirementAssessment.objects.get( - compliance_assessment=baseline, requirement=requirement - ) - requirement_assessment.result = baseline_requirement_assessment.result - requirement_assessment.status = baseline_requirement_assessment.status - requirement_assessment.score = baseline_requirement_assessment.score - requirement_assessment.is_scored = ( - baseline_requirement_assessment.is_scored - ) - requirement_assessment.evidences.set( - baseline_requirement_assessment.evidences.all() - ) - requirement_assessment.applied_controls.set( - baseline_requirement_assessment.applied_controls.all() - ) - requirement_assessment.save() + instance: ComplianceAssessment = serializer.save() + instance.create_requirement_assessments(baseline) if baseline and baseline.framework != instance.framework: mapping_set = RequirementMappingSet.objects.get( target_framework=serializer.validated_data["framework"], @@ -1687,8 +1691,8 @@ def tree(self, request, pk): ) @action(detail=True, methods=["get"]) - def flash_mode(self, request, pk): - """Returns the list of requirement assessments for flash mode""" + def requirements_list(self, request, pk): + """Returns the list of requirement assessments for the different audit modes""" requirement_assessments_objects = ( self.get_object().get_requirement_assessments() ) @@ -1701,11 +1705,11 @@ def flash_mode(self, request, pk): requirements = RequirementNodeReadSerializer( requirements_objects, many=True ).data - flash_mode = { + requirements_list = { "requirements": requirements, "requirement_assessments": requirement_assessments, } - return Response(flash_mode, status=status.HTTP_200_OK) + return Response(requirements_list, status=status.HTTP_200_OK) @action(detail=True) def export(self, request, pk): diff --git a/backend/iam/migrations/0007_alter_folder_content_type.py b/backend/iam/migrations/0007_alter_folder_content_type.py new file mode 100644 index 000000000..943cbfe90 --- /dev/null +++ b/backend/iam/migrations/0007_alter_folder_content_type.py @@ -0,0 +1,21 @@ +# Generated by Django 5.1.1 on 2024-09-13 15:42 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + dependencies = [ + ("iam", "0006_alter_role_folder_alter_roleassignment_folder_and_more"), + ] + + operations = [ + migrations.AlterField( + model_name="folder", + name="content_type", + field=models.CharField( + choices=[("GL", "GLOBAL"), ("DO", "DOMAIN"), ("EN", "ENCLAVE")], + default="DO", + max_length=2, + ), + ), + ] diff --git a/backend/iam/migrations/0008_user_is_third_party.py b/backend/iam/migrations/0008_user_is_third_party.py new file mode 100644 index 000000000..e0404d1ce --- /dev/null +++ b/backend/iam/migrations/0008_user_is_third_party.py @@ -0,0 +1,17 @@ +# Generated by Django 5.1 on 2024-09-13 17:33 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + dependencies = [ + ("iam", "0007_alter_folder_content_type"), + ] + + operations = [ + migrations.AddField( + model_name="user", + name="is_third_party", + field=models.BooleanField(default=False), + ), + ] diff --git a/backend/iam/models.py b/backend/iam/models.py index bb3d04abc..eb67b766c 100644 --- a/backend/iam/models.py +++ b/backend/iam/models.py @@ -74,6 +74,7 @@ class ContentType(models.TextChoices): ROOT = "GL", _("GLOBAL") DOMAIN = "DO", _("DOMAIN") + ENCLAVE = "EN", _("ENCLAVE") content_type = models.CharField( max_length=2, choices=ContentType.choices, default=ContentType.DOMAIN @@ -157,6 +158,9 @@ def get_folder(obj: Any): ["folder"], ["parent_folder"], ["project", "folder"], + ["entity", "folder"], + ["provider_entity", "folder"], + ["solution", "provider_entity", "folder"], ["risk_assessment", "project", "folder"], ["risk_scenario", "risk_assessment", "project", "folder"], ["compliance_assessment", "project", "folder"], @@ -324,6 +328,7 @@ class User(AbstractBaseUser, AbstractBaseModel, FolderMixin): email = models.CharField(max_length=100, unique=True) first_login = models.BooleanField(default=True) is_sso = models.BooleanField(default=False) + is_third_party = models.BooleanField(default=False) is_active = models.BooleanField( _("active"), default=True, @@ -392,7 +397,7 @@ def get_short_name(self) -> str: """get user's short name (i.e. first_name or email before @))""" return self.first_name if self.first_name else self.email.split("@")[0] - def mailing(self, email_template_name, subject, pk=False): + def mailing(self, email_template_name, subject, object="", object_id="", pk=False): """ Sending a mail to a user for password resetting or creation """ @@ -404,6 +409,8 @@ def mailing(self, email_template_name, subject, pk=False): "token": default_token_generator.make_token(self), "protocol": "https", "pk": str(pk) if pk else None, + "object": object, + "object_id": object_id, } email = render_to_string(email_template_name, header) try: @@ -648,7 +655,7 @@ def get_accessible_object_ids( for ra in [ x for x in RoleAssignment.get_role_assignments(user) - if ref_permission in x.role.permissions.all() + if ref_permission in x.role.permissions.all() or user.is_third_party ]: ra_permissions = ra.role.permissions.all() for my_folder in perimeter & set(ra.perimeter_folders.all()): diff --git a/backend/iam/views.py b/backend/iam/views.py index 464a21b8a..72e4b2f9e 100644 --- a/backend/iam/views.py +++ b/backend/iam/views.py @@ -76,6 +76,7 @@ def get(self, request) -> Response: "date_joined": request.user.date_joined, "user_groups": request.user.get_user_groups(), "permissions": request.user.permissions, + "is_third_party": request.user.is_third_party, } return Response(res_data, status=HTTP_200_OK) diff --git a/backend/library/libraries/cisa-vendor-scrm.yaml b/backend/library/libraries/cisa-vendor-scrm.yaml new file mode 100644 index 000000000..9c5123972 --- /dev/null +++ b/backend/library/libraries/cisa-vendor-scrm.yaml @@ -0,0 +1,3898 @@ +urn: urn:intuitem:risk:library:cisa-scrm +locale: en +ref_id: cisa-scrm +name: VENDOR SUPPLY CHAIN RISK MANAGEMENT (SCRM) TEMPLATE +description: 'The following document is the result of a collaborative effort produced + by the Cybersecurity and Infrastructure Security Agency (CISA) Information and Communications + Technology (ICT) Supply Chain Risk Management (SCRM) Task Force, Working Group 4 + (hereinafter WG4), aimed at creating a standardized template of questions as a means + to communicate ICT supply chain risk posture in a consistent way among public and + private organizations of all sizes. The purpose of this assessment template is to + normalize a set of questions regarding an ICT Supplier/Provider implementation and + application of industry standards and best practices. This will enable both vendors + and customers to communicate in a way that is more consistently understood, predictable, + and actionable. These questions provide enhanced visibility and transparency into + entity trust and assurance practices and assist in informed decision-making about + acceptable risk exposure. + + This assessment may be used to illuminate potential gaps in risk management practices + and provides a flexible template that can help guide supply chain risk planning + in a standard way. It is meant to be non-prescriptive and no specific use case is + being mandated. The suggested use is as a tool for consistently analyzing risk when + comparing potential new providers. This template builds upon existing industry standards + to provide step-by-step guidance and improved awareness Key categories of vendor + SCRM + + compliance are defined within the document, building on a framework of established + industry standards and other Task Force efforts, while incorporating inputs from + key industry standards and best practices, such as NIST SP 800-161, the Department + of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC), and the Outsourcing + Network Services Assessment Tool (ONSAT).' +copyright: CISA +version: 1 +provider: CISA +packager: intuitem +objects: + framework: + urn: urn:intuitem:risk:framework:cisa-scrm + ref_id: cisa-scrm + name: VENDOR SUPPLY CHAIN RISK MANAGEMENT (SCRM) TEMPLATE + description: 'The following document is the result of a collaborative effort produced + by the Cybersecurity and Infrastructure Security Agency (CISA) Information and + Communications Technology (ICT) Supply Chain Risk Management (SCRM) Task Force, + Working Group 4 (hereinafter WG4), aimed at creating a standardized template + of questions as a means to communicate ICT supply chain risk posture in a consistent + way among public and private organizations of all sizes. The purpose of this + assessment template is to normalize a set of questions regarding an ICT Supplier/Provider + implementation and application of industry standards and best practices. This + will enable both vendors and customers to communicate in a way that is more + consistently understood, predictable, and actionable. These questions provide + enhanced visibility and transparency into entity trust and assurance practices + and assist in informed decision-making about acceptable risk exposure. + + This assessment may be used to illuminate potential gaps in risk management + practices and provides a flexible template that can help guide supply chain + risk planning in a standard way. It is meant to be non-prescriptive and no specific + use case is being mandated. The suggested use is as a tool for consistently + analyzing risk when comparing potential new providers. This template builds + upon existing industry standards to provide step-by-step guidance and improved + awareness Key categories of vendor SCRM + + compliance are defined within the document, building on a framework of established + industry standards and other Task Force efforts, while incorporating inputs + from key industry standards and best practices, such as NIST SP 800-161, the + Department of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC), + and the Outsourcing Network Services Assessment Tool (ONSAT).' + implementation_groups_definition: + - ref_id: IG1 + name: Qualifying Questions + description: null + - ref_id: IG2 + name: Supply Chain Management and Supplier Governance + description: null + - ref_id: IG3 + name: Secure Design and Engineering + description: null + - ref_id: IG4 + name: 'Information Security ' + description: null + - ref_id: IG5 + name: Physical Security + description: null + - ref_id: IG6 + name: Personnel Security + description: null + - ref_id: IG7 + name: Supply Chain Integrity + description: null + - ref_id: IG8 + name: Supply Chain Resilience + description: null + requirement_nodes: + - urn: urn:intuitem:risk:req_node:cisa-scrm:1 + assessable: true + depth: 1 + ref_id: '1' + name: Qualifying Questions + description: If you can provide affirmative responses to the questions below + AND supporting, non-expired documentation, you may skip ALL remaining questions. + implementation_groups: + - IG1 + - urn: urn:intuitem:risk:req_node:cisa-scrm:1.1 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:1 + ref_id: '1.1' + implementation_groups: + - IG1 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:1.1:question:1 + text: Have you previously provided supply chain risk management information + to this organization? + - urn: urn:intuitem:risk:req_node:cisa-scrm:1.1:question:2 + text: "If \u2018Yes,\u2019 please provide an updated revision covering material\ + \ changes." + - urn: urn:intuitem:risk:req_node:cisa-scrm:node4 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:1 + name: OR + implementation_groups: + - IG1 + - urn: urn:intuitem:risk:req_node:cisa-scrm:1.2 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:1 + ref_id: '1.2' + implementation_groups: + - IG1 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:1.2:question:1 + text: Do you have controls fully aligned to NIST SP 800-161, Supply Chain + Risk Management Practices for Federal Information Systems and Organization? + - urn: urn:intuitem:risk:req_node:cisa-scrm:1.2.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:1.2 + ref_id: 1.2.1 + implementation_groups: + - IG1 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:1.2.1:question:1 + text: Please provide proof of the scope of controls implemented and how + controls were validated. + - urn: urn:intuitem:risk:req_node:cisa-scrm:1.2.2 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:1.2 + ref_id: 1.2.2 + implementation_groups: + - IG1 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:1.2.2:question:1 + text: Provide any additional supporting documentation of relevant and current + third-party assessments or certification for supply chain risk management, + such as ANSI/ASIS SCRM 1.2014, ISO 28000:2007, ISO 31000, ISO 20243, etc. + - urn: urn:intuitem:risk:req_node:cisa-scrm:node8 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:1 + description: If you responded affirmatively to ANY of the questions above, you + may attach supporting documentation, skip the remaining questions, and continue + to the signature page. + implementation_groups: + - IG1 + - urn: urn:intuitem:risk:req_node:cisa-scrm:2 + assessable: false + depth: 1 + ref_id: '2' + name: Supply Chain Management and Supplier Governance + implementation_groups: + - IG2 + - urn: urn:intuitem:risk:req_node:cisa-scrm:node10 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2 + name: General + implementation_groups: + - IG2 + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node10 + ref_id: '2.1' + implementation_groups: + - IG2 + question: + question_type: unique_choice + question_choices: &id001 + - 'Yes' + - 'No' + - Alternate + - N/A + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.1:question:1 + text: Do you have policies to ensure timely notification of updated risk + management information previously provided to us? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.1.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2.1 + ref_id: 2.1.1 + implementation_groups: + - IG2 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.1.1:question:1 + text: How do you notify us of changes? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.1.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2.1 + ref_id: 2.1.2 + implementation_groups: + - IG2 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.1.2:question:1 + text: What is your customer notification policy? + - urn: urn:intuitem:risk:req_node:cisa-scrm:node14 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2 + name: Information Communications Technology (ICT) Supply Chain Management + implementation_groups: + - IG2 + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.2 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node14 + ref_id: '2.2' + implementation_groups: + - IG2 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.2:question:1 + text: Do you have a documented Quality Management System (QMS) for your + ICT supply chain operation based on an industry standard or framework? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.2.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2.2 + ref_id: 2.2.1 + implementation_groups: + - IG2 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.2.1:question:1 + text: Please provide the document which describes your QMS, including any + standards or frameworks to which it is aligned. + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.3 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node14 + ref_id: '2.3' + implementation_groups: + - IG2 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.3:question:1 + text: Do you have an organization-wide strategy for managing end-to-end + supply chain risks (from development, acquisition, life cycle support, + and disposal of systems, system components, and to system services)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.3.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2.3 + ref_id: 2.3.1 + implementation_groups: + - IG2 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.3.1:question:1 + text: What is your strategy? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.3.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2.3 + ref_id: 2.3.2 + implementation_groups: + - IG2 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.3.2:question:1 + text: How have you implemented it? + - urn: urn:intuitem:risk:req_node:cisa-scrm:node20 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2 + name: Authentication and Provenance + implementation_groups: + - IG2 + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.4 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node20 + ref_id: '2.4' + implementation_groups: + - IG2 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.4:question:1 + text: Do you have a policy or process to ensure that none of your suppliers + or third-party components are on any banned list? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.5 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node20 + ref_id: '2.5' + implementation_groups: + - IG2 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.5:question:1 + text: Do you provide a bill of materials (BOM) for your products, services, + and components which includes all logic-bearing (e.g., readable/writable/programmable) + hardware, firmware, and software? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.5.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2.5 + ref_id: 2.5.1 + implementation_groups: + - IG2 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.5.1:question:1 + text: If you provide a BOM that does not include all logic-bearing hardware, + firmware, and software, what does your BOM include? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.5.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2.5 + ref_id: 2.5.2 + implementation_groups: + - IG2 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.5.2:question:1 + text: Upon request, are you able to provide your BOM including all logic-bearing + hardware, firmware, and software? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.5.3 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2.5 + ref_id: 2.5.3 + implementation_groups: + - IG2 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.5.3:question:1 + text: How do you track changes in your products, services, and components + and how do you reflect those changes in the applicable BOM(s)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.6 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node20 + ref_id: '2.6' + implementation_groups: + - IG2 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.6:question:1 + text: For hardware components included in the product offering, do you only + buy from original equipment manufacturers or licensed resellers? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.7 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node20 + ref_id: '2.7' + implementation_groups: + - IG2 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.7:question:1 + text: Do you have a process for tracking and tracing your product while + in development and manufacturing? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.7.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2.7 + ref_id: 2.7.1 + implementation_groups: + - IG2 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.7.1:question:1 + text: How do you keep track of your chain of custody? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.7.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2.7 + ref_id: 2.7.2 + implementation_groups: + - IG2 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.7.2:question:1 + text: How do you track and trace components within your product? + - urn: urn:intuitem:risk:req_node:cisa-scrm:node30 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2 + name: Supplier Governance + implementation_groups: + - IG2 + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.8 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node30 + ref_id: '2.8' + implementation_groups: + - IG2 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.8:question:1 + text: Do you have written Supply Chain Risk Management (SCRM) requirements + in your contracts with your suppliers? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.8.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2.8 + ref_id: 2.8.1 + implementation_groups: + - IG2 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.8.1:question:1 + text: What are your SCRM requirements? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.8.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2.8 + ref_id: 2.8.2 + implementation_groups: + - IG2 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.8.2:question:1 + text: How do you verify that your suppliers are meeting contractual terms + and conditions, which may include requirements to be passed down to sub-suppliers? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.8.3 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2.8 + ref_id: 2.8.3 + implementation_groups: + - IG2 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.8.3:question:1 + text: If violations of contractual SCRM requirements or SCRM-related incidents + occur, do you ensure and monitor any remediation activities? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.9 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node30 + ref_id: '2.9' + implementation_groups: + - IG2 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.9:question:1 + text: Do you revise your written SCRM requirements regularly to include + needed provisions? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.10 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node30 + ref_id: '2.10' + implementation_groups: + - IG2 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.10:question:1 + text: Do you have policies for your suppliers to notify you when there are + changes to their subcontractors or their offerings (components, products, + services, or support activities)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.10.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:2.10 + ref_id: 2.10.1 + implementation_groups: + - IG2 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:2.10.1:question:1 + text: Please describe your policy. + - urn: urn:intuitem:risk:req_node:cisa-scrm:3 + assessable: false + depth: 1 + ref_id: '3' + name: Secure Design and Engineering + implementation_groups: + - IG3 + - urn: urn:intuitem:risk:req_node:cisa-scrm:node39 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3 + description: "Note: If your answer to the question below is \u2018Yes,\u2019\ + \ please continue and complete the remaining questions in this section. If\ + \ your answer is \u2018No,\u2019 you may skip the remainder of this section\ + \ and move on to the next section of this questionnaire." + implementation_groups: + - IG3 + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.1 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3 + ref_id: '3.1' + implementation_groups: + - IG3 + question: + question_type: unique_choice + question_choices: + - 'Yes' + - 'No' + - Alternate + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.1:question:1 + text: Does your organization develop (or integrate) custom hardware or software + offerings? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.1.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.1 + ref_id: 3.1.1 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.1.1:question:1 + text: List the custom software, hardware, system, or solution offering(s) + provided by your organization. + - urn: urn:intuitem:risk:req_node:cisa-scrm:node42 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3 + name: Product Offering Lifecycle Management and Organization + implementation_groups: + - IG3 + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.2 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node42 + ref_id: '3.2' + implementation_groups: + - IG3 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.2:question:1 + text: Do you implement formal organizational roles and governance responsible + for the implementation and oversight of Secure Engineering across the + development or manufacturing process for product offerings? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.2.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.2 + ref_id: 3.2.1 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.2.1:question:1 + text: If so, how are roles, responsibilities, and practices validated? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.3 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node42 + ref_id: '3.3' + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.3:question:1 + text: What security control framework (industry or customized) is used to + define product offering security capabilities? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.3:question:2 + text: Please describe or 'N/A' + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.4 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node42 + ref_id: '3.4' + implementation_groups: + - IG3 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.4:question:1 + text: Does your organization document and communicate security control requirements + for your hardware, software, or solution offering? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.4.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.4 + ref_id: 3.4.1 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.4.1:question:1 + text: How are security requirements validated as part of the product offering + development or manufacturing process? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.5 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node42 + ref_id: '3.5' + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.5:question:1 + text: How does your organization implement development andmanufacturing + automation to enforce lifecycle processes and practices? + - urn: urn:intuitem:risk:req_node:cisa-scrm:node49 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3 + name: Protect IP and Product (Supplier) Offering Assets + implementation_groups: + - IG3 + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.6 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node49 + ref_id: '3.6' + implementation_groups: + - IG3 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.6:question:1 + text: Does your organization protect all forms of code from unauthorized + access and tampering, including patch updates? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.6.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.6 + ref_id: 3.6.1 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.6.1:question:1 + text: How does your organization prevent unauthorized changes to code, both + inadvertent and intentional, which could circumvent or negate the intended + security characteristics of the software? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.7 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node49 + ref_id: '3.7' + implementation_groups: + - IG3 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.7:question:1 + text: Does your organization provide a mechanism for verifying software + release integrity, including patch updates for your software product offering? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.8 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node49 + ref_id: '3.8' + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.8:question:1 + text: How does your organization prevent malicious and/or counterfeit IP + components within your product offering or solution? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.9 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node49 + ref_id: '3.9' + implementation_groups: + - IG3 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.9:question:1 + text: Does your organization manage the integrity of IP for its product + offering? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.9.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.9 + ref_id: 3.9.1 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.9.1:question:1 + text: How does your organization archive assets associated with the product + offering development or manufacturing process? + - urn: urn:intuitem:risk:req_node:cisa-scrm:node56 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3 + name: Secure Coding and Manufacturing Practices + implementation_groups: + - IG3 + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.10 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node56 + ref_id: '3.10' + implementation_groups: + - IG3 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.10:question:1 + text: Does your organization define, follow, and validate secure coding + and manufacturing practices to mitigate security risks? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.10.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.10 + ref_id: 3.10.1 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.10.1:question:1 + text: How does your organization conduct threat modeling to determine required + product offering security requirements? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.10.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.10 + ref_id: 3.10.2 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.10.2:question:1 + text: How does your organization determine how identified risks are mitigated + in product offering design? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.10.3 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.10 + ref_id: 3.10.3 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.10.3:question:1 + text: How does your organization justify risk-based decisions to relax or + waive security requirements or controls? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.10.4 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.10 + ref_id: 3.10.4 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.10.4:question:1 + text: How does your organization validate that the offering will meet the + security requirements and satisfactorily address the identified threat + assessment? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.11 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node56 + ref_id: '3.11' + implementation_groups: + - IG3 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.11:question:1 + text: Does your organization verify that third-party software provides required + security requirements/controls? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.11.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.11 + ref_id: 3.11.1 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.11.1:question:1 + text: How does your organization reduce the risk associated with using acquired + software modules and services, which are potential sources of additional + vulnerabilities? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.12 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node56 + ref_id: '3.12' + implementation_groups: + - IG3 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.12:question:1 + text: Does your organization reuse existing, well-secured software and hardware + components, when feasible, instead of duplicating functionality? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.13 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node56 + ref_id: '3.13' + implementation_groups: + - IG3 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.13:question:1 + text: Does your organization configure the compilation and build processes + to improve executable security? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.13.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.13 + ref_id: 3.13.1 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.13.1:question:1 + text: How does your organization decrease the number of security vulnerabilities + in the software and reduce costs by eliminating vulnerabilities before + testing occurs? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.14 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node56 + ref_id: '3.14' + implementation_groups: + - IG3 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.14:question:1 + text: Does your organization implement formal vulnerability and weakness + analysis practices? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.14.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.14 + ref_id: 3.14.1 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.14.1:question:1 + text: Does your organization automate the identification of security vulnerabilities + and weaknesses? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.14.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.14 + ref_id: 3.14.2 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.14.2:question:1 + text: Does your organization test executable code or components to identify + vulnerabilities and verify compliance with security requirements? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.15 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node56 + ref_id: '3.15' + implementation_groups: + - IG3 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.15:question:1 + text: Does your organization configure offerings to implement secure settings + by default? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.15.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.15 + ref_id: 3.15.1 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.15.1:question:1 + text: Does your organization test offerings using hardened runtime environments? + - urn: urn:intuitem:risk:req_node:cisa-scrm:node72 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3 + name: Respond to Vulnerabilities (RV) + implementation_groups: + - IG3 + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.16 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node72 + ref_id: '3.16' + implementation_groups: + - IG3 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.16:question:1 + text: Does your organization maintain and manage a Product Security Incident + Reporting and Response program (PSRT)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.16.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.16 + ref_id: 3.16.1 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.16.1:question:1 + text: How does your organization assess, prioritize, and remediate reported + vulnerabilities? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.16.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.16 + ref_id: 3.16.2 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.16.2:question:1 + text: How does your organization ensure that vulnerabilities are remediated + in a timely period, reducing the window of opportunity for attackers? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.17 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node72 + ref_id: '3.17' + implementation_groups: + - IG3 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.17:question:1 + text: Does your organization analyze vulnerabilities to identify root cause? + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.17.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:3.17 + ref_id: 3.17.1 + implementation_groups: + - IG3 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:3.17.1:question:1 + text: Are vulnerability root causes used as input to update secure development + process, tools, and training to lower future vulnerabilities? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4 + assessable: false + depth: 1 + ref_id: '4' + name: Information Security + implementation_groups: + - IG4 + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.1 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4 + ref_id: '4.1' + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.1:question:1 + text: Do you hold a valid information security/cybersecurity third-party + attestation or certification? (e.g., ISO 27001, SOC 2 Type 2, CMMC Level + 3-5, Cybersecurity Maturity Assessment, etc.) + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.1:question:2 + text: '[If yes, please state the program and date that you were certified, + and provide a copy of the certification. You may skip the remaining questions + of this section and proceed to the following section. If no, continue.]' + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.2 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4 + ref_id: '4.2' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.2:question:1 + text: Do you follow operational standards or frameworks for managing Information + Security/Cyber security? (e.g., NIST CSF 1.1, NIST 800-37, Rev. 2, NIST + SP 800-161, ISO IEC 27001, ISO 20243, ISO 27036, SAE AS649) + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.2.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.2 + ref_id: 4.2.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.2.1:question:1 + text: If so, please state which one(s)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.3 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4 + ref_id: '4.3' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.3:question:1 + text: Do you have company-wide, publicly available information security + policies in place covering privacy policies? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.3.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.3 + ref_id: 4.3.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.3.1:question:1 + text: "If \u2018Yes\u2019, please provide." + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.3.2 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.3 + ref_id: 4.3.2 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.3.2:question:1 + text: What mechanisms are in place to ensure your policies are enforced + within your supply chain? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.3.2.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.3.2 + ref_id: 4.3.2.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.3.2.1:question:1 + text: Do you receive notification of and have a response plan in place for + privacy violations of the suppliers in your supply chain? + - urn: urn:intuitem:risk:req_node:cisa-scrm:node86 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4 + name: Asset Management + implementation_groups: + - IG4 + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.4 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node86 + ref_id: '4.4' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.4:question:1 + text: Do you inventory and audit back-up and/or replacement hardware and + software assets to ensure their accountability and integrity? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.4.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.4 + ref_id: 4.4.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.4.1:question:1 + text: What recognized standards or frameworks do you follow to ensure integrity + of back-up assets? (e.g., NIST 800-53, NIST 800- 171 DFARS, ISA/IEC 62443 + or ISO 27001/2) + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.5 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node86 + ref_id: '4.5' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.5:question:1 + text: Do you have a defined governance scope for asset management, including + line of business technology, facilities, devices, and all other data- + generating hardware (like Internet of Things devices)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.6 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node86 + ref_id: '4.6' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.6:question:1 + text: Do you have processes or procedures in place to ensure that devices + and software installed by users external to your IT department (e.g., + line of business personnel) are being discovered, properly secured, and + managed? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.6.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.6 + ref_id: 4.6.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.6.1:question:1 + text: What, if any, types of assets are out of scope for your tracking procedures? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.7 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node86 + ref_id: '4.7' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.7:question:1 + text: Do you have an asset management program approved by management for + your IT assets that is regularly maintained? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.7.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.7 + ref_id: 4.7.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.7.1:question:1 + text: What are your methods to manage IT assets on the network? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.7.1.1 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.7.1 + ref_id: 4.7.1.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.7.1.1:question:1 + text: How do you manage other IT hardware and software assets which are + not network connected, regardless of network presence? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.7.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.7 + ref_id: 4.7.2 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.7.2:question:1 + text: ' What are your methods of verifying acceptable use of assets, including + verified asset return, for your network-connected assets?' + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.8 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node86 + ref_id: '4.8' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.8:question:1 + text: Do you have documented policies or procedures to manage enterprise + network-connectable assets throughout their lifecycle? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.8.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.8 + ref_id: 4.8.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.8.1:question:1 + text: What are your processes to manage obsolescence of network-connected + assets? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.8.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.8 + ref_id: 4.8.2 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.8.2:question:1 + text: What are your policies or procedures to ensure your enterprise software + platforms and applications, and hardware assets, are classified according + to their criticality? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.8.3 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.8 + ref_id: 4.8.3 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.8.3:question:1 + text: What are your policies or procedures to ensure appropriate controls + are in place for internal or third-party cloud services? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.9 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node86 + ref_id: '4.9' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.9:question:1 + text: Do you ensure that you are not sourcing assets on a banned listto + customers (e.g., ITAR, NDAA Section 889)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.9.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.9 + ref_id: 4.9.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.9.1:question:1 + text: How do you ensure that you are not providing assets on a banned list + to customers? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.10 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node86 + ref_id: '4.10' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.10:question:1 + text: Do you have documented hardware and software policies and practices + in place to ensure asset integrity? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.10.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.10 + ref_id: 4.10.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.10.1:question:1 + text: What recognized standards or frameworks are followed to ensure asset + integrity? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.10.1.1 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.10.1 + ref_id: 4.10.1.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.10.1.1:question:1 + text: How do you ensure that regular reviews and updates of the asset integrity + policies and practices are performed? + - urn: urn:intuitem:risk:req_node:cisa-scrm:node105 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4 + name: Identify + implementation_groups: + - IG4 + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.11 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node105 + ref_id: '4.11' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.11:question:1 + text: Do you have documented policies or procedures for identification and + detection of cyber threats? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.11.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.11 + ref_id: 4.11.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.11.1:question:1 + text: What processes do you have in place to promptly detect cyber threats? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.11.1.1 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.11.1 + ref_id: 4.11.1.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.11.1.1:question:1 + text: How do you manage the identification of threats within your supply + chain, including suppliers and sub-contractors? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.11.1.2 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.11.1 + ref_id: 4.11.1.2 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.11.1.2:question:1 + text: What processes are in place to act upon external credible cyber security + threat information received? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.12 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node105 + ref_id: '4.12' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.12:question:1 + text: "Do you address the interaction of cybersecurity operational elements\ + \ (e.g., SOC, CSIRT, etc.) with the physical security operational elements\ + \ protecting the organization\u2019s physical assets?" + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.12.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.12 + ref_id: 4.12.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.12.1:question:1 + text: How do you ensure that physical security incidents and suspicious + events are escalated to cybersecurity operations staff? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.12.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.12 + ref_id: 4.12.2 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.12.2:question:1 + text: Are cybersecurity vulnerabilities for industrial control systems, + including physical access controls and video monitoring systems, tracked? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.12.3 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.12 + ref_id: 4.12.3 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.12.3:question:1 + text: What standards or frameworks are followed for management of IT and + OT system interactions? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.13 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node105 + ref_id: '4.13' + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.13:question:1 + text: Do you have a policy or procedure for the handling of information + thatis consistent with its classification? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.13.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.13 + ref_id: 4.13.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.13.1:question:1 + text: What is your process to verify that information is classified according + to legal, regulatory, or internal sensitivity requirements? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.13.1.1 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.13.1 + ref_id: 4.13.1.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.13.1.1:question:1 + text: How do you convey requirements for data retention, destruction, and + encryption to your suppliers? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.14 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node105 + ref_id: '4.14' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.14:question:1 + text: Do you have documented policies or procedures for internal identification + and management of vulnerabilities within your networks and enterprise + systems? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.14.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.14 + ref_id: 4.14.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.14.1:question:1 + text: What industry standards or frameworks are followed for vulnerability + management? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.14.1.1 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.14.1 + ref_id: 4.14.1.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.14.1.1:question:1 + text: How do you identify vulnerabilities in your supply chain (suppliers/sub-contractors) + before they pose a risk to your organization? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.14.1.2 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.14.1 + ref_id: 4.14.1.2 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.14.1.2:question:1 + text: How do you assess and prioritize the mitigation of vulnerabilities + discovered on your internal networks and systems? (e.g., asset criticality, + exploitability, severity, etc.) + - urn: urn:intuitem:risk:req_node:cisa-scrm:node121 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4 + name: Protect + implementation_groups: + - IG4 + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.15 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node121 + ref_id: '4.15' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.15:question:1 + text: Do you have network access control policies and procedures in place + for your information systems that are aligned with industry standards + or control frameworks? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.15.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.15 + ref_id: 4.15.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.15.1:question:1 + text: If Yes, please list any standards or frameworks used. + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.15.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.15 + ref_id: 4.15.2 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.15.2:question:1 + text: What are your practices for items such as federation, privileged users, + and role-based access control for end-user devices? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.15.2.1 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.15.2 + ref_id: 4.15.2.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.15.2.1:question:1 + text: How do you ensure remote access is managed for end-user devices or + employees and suppliers, including deactivation of accounts? (e.g. Multi-factor + authorization, encryption, protection from malware, etc.) + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.15.2.2 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.15.2 + ref_id: 4.15.2.2 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.15.2.2:question:1 + text: How do you identify and correct end-user systems that fall out of + compliance? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.16 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node121 + ref_id: '4.16' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.16:question:1 + text: Is cybersecurity training required for personnel who have administrative + rights to your enterprise computing resources? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.16.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.16 + ref_id: 4.16.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.16.1:question:1 + text: What is the frequency for verifying personnel training compliance? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.16.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.16 + ref_id: 4.16.2 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.16.2:question:1 + text: What cybersecurity training is required for your third-party stakeholders + (e.g., suppliers, customers, partners, etc.) who have network access? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.16.2.1 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.16.2 + ref_id: 4.16.2.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.16.2.1:question:1 + text: How is training compliance tracked for third parties with network + access? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.17 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node121 + ref_id: '4.17' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.17:question:1 + text: Do you include contractual obligations to protect information and + information systems handled by your suppliers? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.17.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.17 + ref_id: 4.17.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.17.1:question:1 + text: What standard cybersecurity standards or frameworks are the contractual + supplier terms for information protection aligned to, if any? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.18 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node121 + ref_id: '4.18' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.18:question:1 + text: Do you have an organizational policy on the use of encryption that + conforms with industry standards or control frameworks? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.18.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.18 + ref_id: 4.18.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.18.1:question:1 + text: What industry standards or controls frameworks are followed for encryption + and key management? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.18.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.18 + ref_id: 4.18.2 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.18.2:question:1 + text: What processes or procedures exist to comprehensively manage the use + of encryption keys? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.18.2.1 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.18.2 + ref_id: 4.18.2.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.18.2.1:question:1 + text: What is your process for protecting data at rest and in transit? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.19 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node121 + ref_id: '4.19' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.19:question:1 + text: Does your organization have hardening standards in place for network + devices (e.g., wireless access points, firewalls, etc.)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.19.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.19 + ref_id: 4.19.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.19.1:question:1 + text: What protections exist to provide network segregation where appropriate + (e.g., intrusion detection systems)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.19.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.19 + ref_id: 4.19.2 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.19.2:question:1 + text: What controls exist to continuously monitor changes to your network + architecture (e.g., NIST 800-53 or related controls)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.19.3 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.19 + ref_id: 4.19.3 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.19.3:question:1 + text: How do you manage prioritization and mitigation of threats discovered + on your networks? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.19.4 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.19 + ref_id: 4.19.4 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.19.4:question:1 + text: How do you track changes to software versions on your servers? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.20 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node121 + ref_id: '4.20' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.20:question:1 + text: Do you follow an industry standard or framework for your internal + or third- party cloud deployments, if applicable? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.20.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.20 + ref_id: 4.20.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.20.1:question:1 + text: What protections are in place between your network and cloud service + providers? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.20.1.1 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.20.1 + ref_id: 4.20.1.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.20.1.1:question:1 + text: How to do you convey cloud security requirements to your suppliers/sub-contractors + - urn: urn:intuitem:risk:req_node:cisa-scrm:node145 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4 + name: Detect + implementation_groups: + - IG4 + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.21 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node145 + ref_id: '4.21' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.21:question:1 + text: Do you have defined and documented incident detection practices that + outline which actions should be taken in the case of an information security + or cybersecurity event? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.21.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.21 + ref_id: 4.21.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.21.1:question:1 + text: Are cybersecurity events centrally logged, tracked, and continuously + monitored? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.21.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.21 + ref_id: 4.21.2 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.21.2:question:1 + text: Are incident detection practices continuously improved? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.22 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node145 + ref_id: '4.22' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.22:question:1 + text: Do you require vulnerability scanning of software running within your + enterprise prior to acceptance? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.22.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.22 + ref_id: 4.22.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.22.1:question:1 + text: What procedures or policies exist, if any, for detecting vulnerabilities + in externally obtained software (such as penetration testing of enterprise + and non-enterprise software)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.22.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.22 + ref_id: 4.22.2 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.22.2:question:1 + text: What are your procedures to scan for vulnerabilities in supplier-provided + software running on your network? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.23 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node145 + ref_id: '4.23' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.23:question:1 + text: Do you manage updates, version tracking of new releases, and patches + (including patching history) for your software and software services offerings? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.23.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.23 + ref_id: 4.23.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.23.1:question:1 + text: What is the responsibility of the product end-user (customer) for + updating software versions? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.24 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node145 + ref_id: '4.24' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.24:question:1 + text: Do you deploy anti-malware software? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.24.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.24 + ref_id: 4.24.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.24.1:question:1 + text: ' What systems are out of scope for anti-malware software compliance, + if any?' + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.24.1.1 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.24.1 + ref_id: 4.24.1.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.24.1.1:question:1 + text: How do you ensure anti-malware is present on developer platforms? + As applicable to your offering? + - urn: urn:intuitem:risk:req_node:cisa-scrm:node157 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4 + name: Respond & Recover + implementation_groups: + - IG4 + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.25 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node157 + ref_id: '4.25' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.25:question:1 + text: Do you have a documented incident response process and a dedicated + incident response team (CSIRT - Computer Security Incident Response Team)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.25.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.25 + ref_id: 4.25.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.25.1:question:1 + text: What is your process for reviewing and exercising your resiliency + plan? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.25.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.25 + ref_id: 4.25.2 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.25.2:question:1 + text: What is your process to ensure customers and external entities (such + as government agencies) are notified of an incident when their product + or service is impacted? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.26 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node157 + ref_id: '4.26' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.26:question:1 + text: Do you have processes or procedures to recover full functionality, + including integrity verification, following a major cybersecurity incident? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.26.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.26 + ref_id: 4.26.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.26.1:question:1 + text: What is the frequency for testing of back-up media? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.27 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node157 + ref_id: '4.27' + implementation_groups: + - IG4 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.27:question:1 + text: Do you insure for financial harm from a major cybersecurity incident + (e.g., self-insure, third-party, parent company, etc.)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.27.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:4.27 + ref_id: 4.27.1 + implementation_groups: + - IG4 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:4.27.1:question:1 + text: Does coverage include financial harm to your customers resulting from + a cybersecurity breach which has impacted your company? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5 + assessable: false + depth: 1 + ref_id: '5' + name: Physical Security + implementation_groups: + - IG5 + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.1 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5 + ref_id: '5.1' + implementation_groups: + - IG5 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.1:question:1 + text: ' Is the entity (organization, operational unit, facility, etc.) currently + covered by an unrestricted/unlimited National Industrial Security Program + (NISP) Facility Clearance (FCL) or a related U.S. government program such + as C- TPAT that certifies the entity as meeting appropriate physical security + standards?' + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.1:question:2 + text: "[If \u2018Yes,\u2019 please state the program that certified you\ + \ and date of last certification. You may skip the remaining questions\ + \ of this section and proceed to the next section. If not, continue with\ + \ this section.]" + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.1.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.1 + ref_id: 5.1.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.1.1:question:1 + text: If the entity is not covered by a NISP FCL but currently has some + other US Government or industry attestation, such as TAPA FSR of meeting + a physical security code or standard, please identify the standard, the + issuing agency, and the most recent date of certification. + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.1.2 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.1 + ref_id: 5.1.2 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.1.2:question:1 + text: Is the entity covered by a limited FCL (in agreement with a foreign + government)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.1.2:question:2 + text: Describe. + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.2 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5 + ref_id: '5.2' + implementation_groups: + - IG5 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.2:question:1 + text: Do you have documented security policies and procedures that address + the control of physical access to cyber assets (network devices, data + facilities, patch panels, industrial control systems, programmable logic, + etc.)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.2.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.2 + ref_id: 5.2.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.2.1:question:1 + text: To what standards/controls do you adhere? (e.g., NIST publication, + ISO, UL, etc.) + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.2.1.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.2.1 + ref_id: 5.2.1.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.2.1.1:question:1 + text: How often do you review and update to those policies and procedures + and what is the most recent review? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.2.1.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.2.1 + ref_id: 5.2.1.2 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.2.1.2:question:1 + text: If needed, can you provide these documents for our review? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.3 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5 + ref_id: '5.3' + implementation_groups: + - IG5 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.3:question:1 + text: Do you have documented policies addressing staff training which includes + procedures to limit physical access to cyber assets to only those with + demonstrated need? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.3.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.3 + ref_id: 5.3.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.3.1:question:1 + text: What training do all staff receive to address potential physical security + threats and how to respond to emergencies (e.g., fire, weather, etc.)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.3.2 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.3 + ref_id: 5.3.2 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.3.2:question:1 + text: What training do cybersecurity staff, physical security staff, and + contractors with at least limited access to sensitive areas of a facility + receive? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.3.2.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.3.2 + ref_id: 5.3.2.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.3.2.1:question:1 + text: How does this training address potential threats to the facility and + how the physical access controls are integrated with system network interfaces? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.3.3 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.3 + ref_id: 5.3.3 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.3.3:question:1 + text: What standards do you follow, or did you implement (e.g., NIST publication, + ISO, UL, etc.)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.3.3.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.3.3 + ref_id: 5.3.3.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.3.3.1:question:1 + text: How is this training documented? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.4 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5 + ref_id: '5.4' + implementation_groups: + - IG5 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.4:question:1 + text: Do you have a documented Security Incident Response process covering + physical security incidents? (e.g., potential intruder access, missing + equipment, etc.) + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.4.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.4 + ref_id: 5.4.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.4.1:question:1 + text: What processes do you have in place to document the actions taken + during and after an actual or suspected physical security incidents (e.g., + security log, formal report to management, police report, etc.)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.4.1.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.4.1 + ref_id: 5.4.1.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.4.1.1:question:1 + text: How do you ensure that your staff understands and complies with procedures + (e.g., training, exercises, and actual cases of incident response)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.5 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5 + ref_id: '5.5' + implementation_groups: + - IG5 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.5:question:1 + text: For facilities that use an independent contractor for physical security, + are physical facilities security policy and procedures incorporated into + service level agreements, contracts, policies, regulatory practices? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.5.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.5 + ref_id: 5.5.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.5.1:question:1 + text: What physical / facilities security policies and practices are subject + to audit? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.5.2 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.5 + ref_id: 5.5.2 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.5.2:question:1 + text: For contractors who have access to a critical facility, sensitive + assets, or major physical plant systems, what standards are they required + to attest to? (e.g., NIST publication, ISO, UL, etc.) + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.5.2.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.5.2 + ref_id: 5.5.2.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.5.2.1:question:1 + text: How is compliance with these standards validated? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.6 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5 + ref_id: '5.6' + implementation_groups: + - IG5 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.6:question:1 + text: Are there enforcement mechanisms (e.g., sanctions, response procedures, + technology) for unauthorized physical access to mission/business critical + information, functions, services and assets? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.6.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.6 + ref_id: 5.6.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.6.1:question:1 + text: What type of action or response would be taken for unauthorized physical + access to sensitive cyber assets? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.7 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5 + ref_id: '5.7' + implementation_groups: + - IG5 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.7:question:1 + text: Do you have evidence that physical security mechanisms are effective + and adequate to protect assets? Evidence could include third-party assessment, + self-assessment, records of actions taken to enforce rules, etc. + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.7.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.7 + ref_id: 5.7.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.7.1:question:1 + text: What is the date of the last review and update to your enforcement + strategy? + - urn: urn:intuitem:risk:req_node:cisa-scrm:node190 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5 + name: Physical Security In-transit + implementation_groups: + - IG5 + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.8 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node190 + ref_id: '5.8' + implementation_groups: + - IG5 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.8:question:1 + text: Do you utilize a controlled bill of materials (BOM) or similar capability + to protect assets that are being received, in process, or in-transit? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.8.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.8 + ref_id: 5.8.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.8.1:question:1 + text: What industry standards or frameworks are followed? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.9 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node190 + ref_id: '5.9' + implementation_groups: + - IG5 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.9:question:1 + text: Do you have requirements that all items being shipped have tamper-evident + packaging? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.9.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.9 + ref_id: 5.9.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.9.1:question:1 + text: What industry standards or frameworks are being followed to ensure + packaging is tamper-evident? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.9.1.1 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.9.1 + ref_id: 5.9.1.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.9.1.1:question:1 + text: How are these requirements audited to ensure that they are effective? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.10 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node190 + ref_id: '5.10' + implementation_groups: + - IG5 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.10:question:1 + text: Do you have processes in place to prevent counterfeit parts from entering + your supply chain? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.10.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.10 + ref_id: 5.10.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.10.1:question:1 + text: What requirements, if any, are in place to ensure the use of Original + Equipment Manufacturer (OEM) or Authorized Distributors for all key components? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.10.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.10 + ref_id: 5.10.2 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.10.2:question:1 + text: What are your processes for the detection and disposition of counterfeit + electronic components? + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.10.2.1 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:5.10.2 + ref_id: 5.10.2.1 + implementation_groups: + - IG5 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:5.10.2.1:question:1 + text: How do you pass on counterfeit prevention requirements to your third-party + suppliers? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6 + assessable: false + depth: 1 + ref_id: '6' + name: Personnel Security + implementation_groups: + - IG6 + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.1 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6 + ref_id: '6.1' + implementation_groups: + - IG6 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.1:question:1 + text: Does a formal personnel security program exist? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.1.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.1 + ref_id: 6.1.1 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.1.1:question:1 + text: Is employee access managed by role? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.1.2 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.1 + ref_id: 6.1.2 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.1.2:question:1 + text: Is access to business-critical systems, manufacturing facilities, + and assets formally managed and maintained? Please describe. + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.1.3 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.1 + ref_id: 6.1.3 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.1.3:question:1 + text: Are physical security practices formally governed, documented, maintained, + and enforced? + - urn: urn:intuitem:risk:req_node:cisa-scrm:node205 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6 + name: Onboarding + implementation_groups: + - IG6 + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.2 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node205 + ref_id: '6.2' + implementation_groups: + - IG6 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.2:question:1 + text: Do you have a process for onboarding personnel? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.2.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.2 + ref_id: 6.2.1 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.2.1:question:1 + text: Does the process include security awareness training? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.2.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.2 + ref_id: 6.2.2 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.2.2:question:1 + text: What is the process to determine the level of access to company identifications + (IDs), tokens, documents, applications, etc.? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.2.3 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.2 + ref_id: 6.2.3 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.2.3:question:1 + text: What is the process to distribute company assets? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.2.4 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.2 + ref_id: 6.2.4 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.2.4:question:1 + text: Is the onboarding process documented? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.2.4.1 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.2.4 + ref_id: 6.2.4.1 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.2.4.1:question:1 + text: "If \u2018Yes\u2019, please provide a copy." + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.3 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node205 + ref_id: '6.3' + implementation_groups: + - IG6 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.3:question:1 + text: Do you have policies for conducting background checks of your employees + as permitted by the country in which you operate? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.3.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.3 + ref_id: 6.3.1 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.3.1:question:1 + text: If not permitted by the country, please note that and provide the + part of your supply chain for which it is applicable. + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.3.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.3 + ref_id: 6.3.2 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.3.2:question:1 + text: How do you conduct the background checks and document, validate, and + update their responses? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.4 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node205 + ref_id: '6.4' + implementation_groups: + - IG6 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.4:question:1 + text: Do you have policies for conducting background checks for your suppliers, + as permitted by the country in which you operate? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.4.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.4 + ref_id: 6.4.1 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.4.1:question:1 + text: If not permitted by the country, please note that and provide the + part of your supply chain for which it is applicable. + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.4.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.4 + ref_id: 6.4.2 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.4.2:question:1 + text: How do you conduct the background checks and document, validate, and + update their responses? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.5 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node205 + ref_id: '6.5' + implementation_groups: + - IG6 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.5:question:1 + text: Do you have policies for conducting background checks for any subcontractors, + as permitted by the country in which you operate? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.5.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.5 + ref_id: 6.5.1 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.5.1:question:1 + text: If not permitted by the country, please note that and provide the + part of your supply chain for which it is applicable. + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.5.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.5 + ref_id: 6.5.2 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.5.2:question:1 + text: How do you conduct the background checks and document, validate, and + update their responses? + - urn: urn:intuitem:risk:req_node:cisa-scrm:node221 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6 + name: Offboarding + implementation_groups: + - IG6 + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.6 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node221 + ref_id: '6.6' + implementation_groups: + - IG6 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.6:question:1 + text: Do you have a process for offboarding personnel? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.6.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.6 + ref_id: 6.6.1 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.6.1:question:1 + text: Does the process include a process to transfer knowledge to other + personnel? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.6.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.6 + ref_id: 6.6.2 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.6.2:question:1 + text: What is the process to remove access to all company documents, applications, + assets, etc.? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.6.3 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.6 + ref_id: 6.6.3 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.6.3:question:1 + text: What is the process to recover all company assets? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.6.4 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.6 + ref_id: 6.6.4 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.6.4:question:1 + text: Is that process documented? + - urn: urn:intuitem:risk:req_node:cisa-scrm:node227 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6 + name: Awareness and Training (Security-Specific) + implementation_groups: + - IG6 + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.7 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node227 + ref_id: '6.7' + implementation_groups: + - IG6 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.7:question:1 + text: Are personnel security practices formally documented and accessible + to all employees? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.8 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node227 + ref_id: '6.8' + implementation_groups: + - IG6 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.8:question:1 + text: Are Personnel Security practices routinely enforced, audited, and + updated? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.9 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node227 + ref_id: '6.9' + implementation_groups: + - IG6 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.9:question:1 + text: Are personnel required to complete formal SCRM training annually? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.10 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node227 + ref_id: '6.10' + implementation_groups: + - IG6 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.10:question:1 + text: Are all personnel trained in security best practices? This includes, + but is not limited to, insider threats, access control, and data protection. + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.11 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node227 + ref_id: '6.11' + implementation_groups: + - IG6 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.11:question:1 + text: Is there additional security training provided to users with elevated + privileges? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.12 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node227 + ref_id: '6.12' + implementation_groups: + - IG6 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.12:question:1 + text: Are you aware of security training practices performed by your sub-suppliers + to their personnel? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.12.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.12 + ref_id: 6.12.1 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.12.1:question:1 + text: "If \u2018Yes\u2019, does it align with your security practices?" + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.13 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node227 + ref_id: '6.13' + implementation_groups: + - IG6 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.13:question:1 + text: Do you have a Code of Conduct for your employees, suppliers and subcontractors? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.13.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.13 + ref_id: 6.13.1 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.13.1:question:1 + text: Is the Code of Conduct always available and visible to your employees, + suppliers, and subcontractors? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.13.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.13 + ref_id: 6.13.2 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.13.2:question:1 + text: How [regularly or often] is this Code of Conduct updated? Please describe + the frequency. + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.13.3 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.13 + ref_id: 6.13.3 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.13.3:question:1 + text: Do you have personnel designated to address questions or violations + to the Code of Conduct? + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.13.4 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:6.13 + ref_id: 6.13.4 + implementation_groups: + - IG6 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:6.13.4:question:1 + text: Are these employees, suppliers, and subcontractors trained on the + Code of Conduct, including privacy and confidentiality requirements, as + required by your industry? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7 + assessable: false + depth: 1 + ref_id: '7' + name: Supply Chain Integrity + implementation_groups: + - IG7 + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.1 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7 + ref_id: '7.1' + implementation_groups: + - IG7 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.1:question:1 + text: Do your processes for product integrity conform to any of the following + standards (e.g., ISO 27036, SAE AS6171, etc.)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.2 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7 + ref_id: '7.2' + implementation_groups: + - IG7 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.2:question:1 + text: Do you control the integrity of your hardware/software (HW/SW) development + practices by using Secure Development Lifecycle practices? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.2.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.2 + ref_id: 7.2.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.2.1:question:1 + text: How do you manage the conformance of your third parties to your procedures? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.3 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7 + ref_id: '7.3' + implementation_groups: + - IG7 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.3:question:1 + text: Do you have documented performance and validation procedures for your + HW/SW products or services? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.3.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.3 + ref_id: 7.3.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.3.1:question:1 + text: What is your process to ensure conformance to those procedures? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.3.1.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.3.1 + ref_id: 7.3.1.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.3.1.1:question:1 + text: How do you manage HW/SW products or service that are not in compliance + with those procedures? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.3.1.2 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.3.1 + ref_id: 7.3.1.2 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.3.1.2:question:1 + text: How are subcontractors held accountable to performance specifications? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.3.2 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.3 + ref_id: 7.3.2 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.3.2:question:1 + text: What, if any, automated controls are in place for your validation + processes? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.3.2.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.3.2 + ref_id: 7.3.2.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.3.2.1:question:1 + text: How do you audit your validation processes? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.4 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7 + ref_id: '7.4' + implementation_groups: + - IG7 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.4:question:1 + text: Do you have processes in place to independently detect anomalous behavior + and defects in HW/SW products or services? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.4.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.4 + ref_id: 7.4.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.4.1:question:1 + text: What means do you provide to allow customers to report anomalies? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.4.1.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.4.1 + ref_id: 7.4.1.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.4.1.1:question:1 + text: How do you monitor and track anomalous product or service behavior? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.5 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7 + ref_id: '7.5' + implementation_groups: + - IG7 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.5:question:1 + text: Do you monitor third-party HW/SW products or services for defects? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.5.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.5 + ref_id: 7.5.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.5.1:question:1 + text: What are your processes for managing third-party products and component + defects throughout their lifecycle? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.6 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7 + ref_id: '7.6' + implementation_groups: + - IG7 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.6:question:1 + text: Does the functional integrity of your product or services rely on + cloud services (commercial or hybrid)? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.6.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.6 + ref_id: 7.6.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.6.1:question:1 + text: What policies and procedures are in place to protect the integrity + of the data provided through cloud services? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.6.1.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.6.1 + ref_id: 7.6.1.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.6.1.1:question:1 + text: How do you manage the shared responsibility for cloud service integrity + requirements with your suppliers? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.7 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7 + ref_id: '7.7' + implementation_groups: + - IG7 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.7:question:1 + text: Do you have required training on quality and product integrity processes + for employees, suppliers, and subcontractors? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.7.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.7 + ref_id: 7.7.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.7.1:question:1 + text: What mechanisms are in place for direct employees and contracted workers + to ensure applicable training has been completed? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.7.1.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.7.1 + ref_id: 7.7.1.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.7.1.1:question:1 + text: Do you pass down training requirements to your sub-suppliers, as applicable? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.8 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7 + ref_id: '7.8' + implementation_groups: + - IG7 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.8:question:1 + text: "Do you have processes to evaluate prospective third-party suppliers\u2019\ + \ product integrity during initial selection?" + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.8.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.8 + ref_id: 7.8.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.8.1:question:1 + text: What processes or procedures, if any, are in place to ensure that + prospective suppliers have met your product integrity requirements? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.8.1.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.8.1 + ref_id: 7.8.1.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.8.1.1:question:1 + text: How do your policies or procedures ensure appropriate management/leadership + input on supplier selection decisions? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.9 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7 + ref_id: '7.9' + implementation_groups: + - IG7 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.9:question:1 + text: Do you have regularly scheduled audits to ensure compliance with HW/SW + products or services integrity requirements? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.9.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.9 + ref_id: 7.9.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.9.1:question:1 + text: What provisions for auditing are included within supplier contracts? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.9.2 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.9 + ref_id: 7.9.2 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.9.2:question:1 + text: How do you pass down HW/SW products or services integrity requirements + to third-party suppliers? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.10 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7 + ref_id: '7.10' + implementation_groups: + - IG7 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.10:question:1 + text: Do you have a process for improving integrity of HW/SW products or + services? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.10.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.10 + ref_id: 7.10.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.10.1:question:1 + text: What programs are in place to ensure continuous performance monitoring + and improvement of key suppliers? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.11 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7 + ref_id: '7.11' + implementation_groups: + - IG7 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.11:question:1 + text: Do you have processes in place for addressing reuse and/or recycle + of HW products? + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.11.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:7.11 + ref_id: 7.11.1 + implementation_groups: + - IG7 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:7.11.1:question:1 + text: What is your process? + - urn: urn:intuitem:risk:req_node:cisa-scrm:8 + assessable: false + depth: 1 + ref_id: '8' + name: Supply Chain Resilience + implementation_groups: + - IG8 + - urn: urn:intuitem:risk:req_node:cisa-scrm:node272 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:8 + name: General + implementation_groups: + - IG8 + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.1 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node272 + ref_id: '8.1' + implementation_groups: + - IG8 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.1:question:1 + text: Does your organization have a formal process for ensuring supply chain + resilience as part of your product offering SCRM practices? + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.1.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:8.1 + ref_id: 8.1.1 + implementation_groups: + - IG8 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.1.1:question:1 + text: What standards or industry frameworks do you use to help inform those + practices? + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.2 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node272 + ref_id: '8.2' + implementation_groups: + - IG8 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.2:question:1 + text: Do you consider non-technical supply chain resilience threats such + as weather, geo-political instability, epidemic outbreak, volcanic, earthquakes, + etc.? + - urn: urn:intuitem:risk:req_node:cisa-scrm:node276 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:8 + name: Supply Chain Disruption Risk Management (Business Continuity) + implementation_groups: + - IG8 + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.3 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node276 + ref_id: '8.3' + implementation_groups: + - IG8 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.3:question:1 + text: Do you maintain a formal business continuity plan necessary to maintain + operations through disruptions and significant loss of staff? + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.3.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:8.3 + ref_id: 8.3.1 + implementation_groups: + - IG8 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.3.1:question:1 + text: If illness causes high absenteeism, are personnel cross-trained and + able to perform multiple duties? + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.4 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node276 + ref_id: '8.4' + implementation_groups: + - IG8 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.4:question:1 + text: Do you maintain a formally trained and dedicated crisis management + team, including on-call staff, assigned to address catastrophic or systemic + risks to your supply chain or manufacturing processes? + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.4.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:8.4 + ref_id: 8.4.1 + implementation_groups: + - IG8 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.4.1:question:1 + text: Do you require and audit key suppliers for their ability to be prepared + for unexpected supply chain disruptions? + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.5 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node276 + ref_id: '8.5' + implementation_groups: + - IG8 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.5:question:1 + text: Can personnel work remotely? + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.5.1 + assessable: true + depth: 4 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:8.5 + ref_id: 8.5.1 + implementation_groups: + - IG8 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.5.1:question:1 + text: Do your service deliverables outline which services can be done remotely + and which cannot? + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.5.1.1 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:8.5.1 + ref_id: 8.5.1.1 + implementation_groups: + - IG8 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.5.1.1:question:1 + text: Is that documented in Service-level agreement (SLA) or Terms and Conditions? + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.5.1.2 + assessable: true + depth: 5 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:8.5.1 + ref_id: 8.5.1.2 + implementation_groups: + - IG8 + question: + question_type: text + question_choices: null + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.5.1.2:question:1 + text: What infrastructure support is needed to support a shift to an at-home + workforce? + - urn: urn:intuitem:risk:req_node:cisa-scrm:node285 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:8 + name: Diversity of Supply Base + implementation_groups: + - IG8 + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.6 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node285 + ref_id: '8.6' + implementation_groups: + - IG8 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.6:question:1 + text: Does your company consider supplier diversity to avoid single sources + and to reduce the occurrence of suppliers being susceptible to the same + threats to resilience? + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.7 + assessable: true + depth: 3 + parent_urn: urn:intuitem:risk:req_node:cisa-scrm:node285 + ref_id: '8.7' + implementation_groups: + - IG8 + question: + question_type: unique_choice + question_choices: *id001 + questions: + - urn: urn:intuitem:risk:req_node:cisa-scrm:8.7:question:1 + text: Does your company consider alternate offering delivery channels to + mitigate extended supplier outages to include cloud, network, telecommunication, + transportation, and packaging? diff --git a/backend/library/libraries/cmmc-2.0.yaml b/backend/library/libraries/cmmc-2.0.yaml index 528110c16..cd4179726 100644 --- a/backend/library/libraries/cmmc-2.0.yaml +++ b/backend/library/libraries/cmmc-2.0.yaml @@ -21,7 +21,7 @@ copyright: "Copyright 2020, 2021 Carnegie Mellon University and The Johns Hopkin \ ANY KIND WITH RESPECT TO FREEDOM FROM PATENT,\nTRADEMARK, OR COPYRIGHT INFRINGEMENT.\n\ [DISTRIBUTION STATEMENT A] Approved for public release.\nThis work is licensed to\ \ the public under the Creative Commons Attribution 4.0 International\nLicense." -version: 2 +version: 3 provider: DoD packager: intuitem objects: @@ -53,22 +53,27 @@ objects: \ acting on behalf of authorized users, or devices (including other information\ \ systems).\n\u2022 FAR Clause 52.204-21 b.1.i\n\u2022 NIST SP 800-171 Rev\ \ 2 3.1.1" - annotation: 'Determine if: - - [a] authorized users are identified; - - [b] processes acting on behalf of authorized users are identified; - - [c] devices (and other systems) authorized to connect to the system are identified; - - [d] system access is limited to authorized users; - - [e] system access is limited to processes acting on behalf of authorized users; - and - - [f] system access is limited to authorized devices (including other systems).' implementation_groups: - L1 + question: + question_type: "unique_choice" + question_choices: + - "Yes" + - "No" + - "N/A" + questions: + - urn: "urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:1" + text: "[a] authorized users are identified" + - urn: "urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:2" + text: "[b] processes acting on behalf of authorized users are identified" + - urn: "urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:3" + text: "[c] devices (and other systems) authorized to connect to the system are identified" + - urn: "urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:4" + text: "[d] system access is limited to authorized users" + - urn: "urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:5" + text: "[e] system access is limited to processes acting on behalf of authorized users" + - urn: "urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:6" + text: "[f] system access is limited to authorized devices (including other systems)" - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.2 assessable: true depth: 2 diff --git a/backend/library/utils.py b/backend/library/utils.py index 212f866e2..074110ea2 100644 --- a/backend/library/utils.py +++ b/backend/library/utils.py @@ -89,6 +89,7 @@ def import_requirement_node(self, framework_object: Framework): default_locale=framework_object.default_locale, translations=self.requirement_data.get("translations", {}), is_published=True, + question=self.requirement_data.get("question"), ) for threat in self.requirement_data.get("threats", []): diff --git a/backend/locale/fr/LC_MESSAGES/django.mo b/backend/locale/fr/LC_MESSAGES/django.mo index 2c90dd0c8..4e9ee24d9 100644 Binary files a/backend/locale/fr/LC_MESSAGES/django.mo and b/backend/locale/fr/LC_MESSAGES/django.mo differ diff --git a/backend/locale/fr/LC_MESSAGES/django.po b/backend/locale/fr/LC_MESSAGES/django.po index 3501710da..0f8fd93e6 100644 --- a/backend/locale/fr/LC_MESSAGES/django.po +++ b/backend/locale/fr/LC_MESSAGES/django.po @@ -8,7 +8,7 @@ msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2024-08-26 08:54+0000\n" +"POT-Creation-Date: 2024-09-13 19:22+0000\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" @@ -17,140 +17,229 @@ msgstr "" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" "Plural-Forms: nplurals=2; plural=(n > 1);\n" -#: iam/models.py:67 + +#: iam/models.py:75 msgid "GLOBAL" msgstr "" -#: iam/models.py:68 +#: iam/models.py:76 msgid "DOMAIN" msgstr "" #: iam/models.py:77 +msgid "ENCLAVE" +msgstr "" + +#: iam/models.py:86 msgid "parent folder" msgstr "" -#: iam/models.py:87 +#: iam/models.py:96 msgid "Folder" msgstr "" -#: iam/models.py:88 +#: iam/models.py:97 msgid "Folders" msgstr "" -#: iam/models.py:209 +#: iam/models.py:221 msgid "user group" msgstr "" -#: iam/models.py:210 iam/models.py:317 +#: iam/models.py:222 iam/models.py:350 msgid "user groups" msgstr "" -#: iam/models.py:255 +#: iam/models.py:279 msgid "Welcome to Ciso Assistant!" msgstr "" -#: iam/models.py:294 +#: iam/models.py:326 msgid "last name" msgstr "" -#: iam/models.py:295 +#: iam/models.py:327 msgid "first name" msgstr "" -#: iam/models.py:300 +#: iam/models.py:333 msgid "active" msgstr "" -#: iam/models.py:303 +#: iam/models.py:336 msgid "" "Designates whether this user should be treated as active. Unselect this " "instead of deleting accounts." msgstr "" -#: iam/models.py:307 +#: iam/models.py:340 msgid "date joined" msgstr "" -#: iam/models.py:309 +#: iam/models.py:342 msgid "superuser status" msgstr "" -#: iam/models.py:312 +#: iam/models.py:345 msgid "" "Designates that this user has all permissions without explicitly assigning " "them." msgstr "" -#: iam/models.py:320 +#: iam/models.py:353 msgid "" "The user groups this user belongs to. A user will get all permissions " "granted to each of their user groups." msgstr "" -#: iam/models.py:335 +#: iam/models.py:368 msgid "user" msgstr "" -#: iam/models.py:336 +#: iam/models.py:369 msgid "users" msgstr "" -#: iam/models.py:479 +#: iam/models.py:511 msgid "permissions" msgstr "" -#: iam/models.py:494 +#: iam/models.py:526 msgid "Domain" msgstr "" -#: iam/models.py:500 +#: iam/models.py:532 msgid "Role" msgstr "" -#: iam/models.py:501 +#: iam/models.py:533 msgid "sub folders are visible" msgstr "" -#: iam/sso/models.py:61 +#: iam/sso/models.py:73 msgid "is enabled" msgstr "" -#: iam/sso/models.py:66 +#: iam/sso/models.py:78 msgid "provider" msgstr "" -#: iam/sso/models.py:70 +#: iam/sso/models.py:82 msgid "provider ID" msgstr "" -#: iam/sso/models.py:74 +#: iam/sso/models.py:86 msgid "name" msgstr "" -#: iam/sso/models.py:76 +#: iam/sso/models.py:88 msgid "client id" msgstr "" -#: iam/sso/models.py:78 +#: iam/sso/models.py:90 msgid "App ID, or consumer key" msgstr "" -#: iam/sso/models.py:82 +#: iam/sso/models.py:94 msgid "secret key" msgstr "" -#: iam/sso/models.py:85 +#: iam/sso/models.py:97 msgid "API secret, client secret, or consumer secret" msgstr "" -#: iam/sso/models.py:88 +#: iam/sso/models.py:100 msgid "key" msgstr "" -#: iam/sso/models.py:88 +#: iam/sso/models.py:100 msgid "Key" msgstr "" #: iam/views.py:96 msgid "CISO Assistant: Password Reset" msgstr "" + +#: tprm/models.py:20 +msgid "Owned folders" +msgstr "" + +#: tprm/models.py:27 tprm/models.py:82 +msgid "Entity" +msgstr "" + +#: tprm/models.py:28 +msgid "Entities" +msgstr "" + +#: tprm/models.py:33 +msgid "Blocker" +msgstr "" + +#: tprm/models.py:34 +msgid "Warning" +msgstr "" + +#: tprm/models.py:35 +msgid "Ok" +msgstr "" + +#: tprm/models.py:36 +msgid "Not applicable" +msgstr "" + +#: tprm/models.py:38 tprm/models.py:115 +msgid "Criticality" +msgstr "" + +#: tprm/models.py:39 +msgid "Penetration" +msgstr "" + +#: tprm/models.py:40 +msgid "Dependency" +msgstr "" + +#: tprm/models.py:41 +msgid "Maturity" +msgstr "" + +#: tprm/models.py:42 +msgid "Trust" +msgstr "" + +#: tprm/models.py:51 tprm/models.py:121 +msgid "Solutions" +msgstr "" + +#: tprm/models.py:62 +msgid "Conclusion" +msgstr "" + +#: tprm/models.py:68 +msgid "Entity assessment" +msgstr "" + +#: tprm/models.py:69 +msgid "Entity assessments" +msgstr "" + +#: tprm/models.py:104 +msgid "Provider entity" +msgstr "" + +#: tprm/models.py:110 +msgid "Recipient entity" +msgstr "" + +#: tprm/models.py:120 +msgid "Solution" +msgstr "" + +#: tprm/serializers.py:61 tprm/serializers.py:96 +msgid "Framework required" +msgstr "" + +#: tprm/serializers.py:116 +msgid "CISO Assistant: A questionnaire has been assigned to you" +msgstr "CISO Assistant: Un questionnaire vous a été assigné" diff --git a/backend/tprm/__init__.py b/backend/tprm/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/backend/tprm/apps.py b/backend/tprm/apps.py new file mode 100644 index 000000000..d5883e16c --- /dev/null +++ b/backend/tprm/apps.py @@ -0,0 +1,6 @@ +from django.apps import AppConfig + + +class TprmConfig(AppConfig): + default_auto_field = "django.db.models.BigAutoField" + name = "tprm" diff --git a/backend/tprm/migrations/0001_initial.py b/backend/tprm/migrations/0001_initial.py new file mode 100644 index 000000000..ec595766a --- /dev/null +++ b/backend/tprm/migrations/0001_initial.py @@ -0,0 +1,357 @@ +# Generated by Django 5.1 on 2024-09-13 19:01 + +import django.db.models.deletion +import iam.models +import uuid +from django.conf import settings +from django.db import migrations, models + + +class Migration(migrations.Migration): + initial = True + + dependencies = [ + ("core", "0028_complianceassessment_observation_and_more"), + ("iam", "0008_user_is_third_party"), + migrations.swappable_dependency(settings.AUTH_USER_MODEL), + ] + + operations = [ + migrations.CreateModel( + name="Entity", + fields=[ + ( + "id", + models.UUIDField( + default=uuid.uuid4, + editable=False, + primary_key=True, + serialize=False, + ), + ), + ( + "created_at", + models.DateTimeField(auto_now_add=True, verbose_name="Created at"), + ), + ( + "updated_at", + models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + ( + "is_published", + models.BooleanField(default=False, verbose_name="published"), + ), + ("name", models.CharField(max_length=200, verbose_name="Name")), + ( + "description", + models.TextField(blank=True, null=True, verbose_name="Description"), + ), + ("mission", models.TextField(blank=True)), + ("reference_link", models.URLField(blank=True, null=True)), + ("builtin", models.BooleanField(default=False)), + ( + "folder", + models.ForeignKey( + default=iam.models.Folder.get_root_folder_id, + on_delete=django.db.models.deletion.CASCADE, + related_name="%(class)s_folder", + to="iam.folder", + ), + ), + ( + "owned_folders", + models.ManyToManyField( + blank=True, + related_name="owner", + to="iam.folder", + verbose_name="Owned folders", + ), + ), + ], + options={ + "verbose_name": "Entity", + "verbose_name_plural": "Entities", + }, + ), + migrations.CreateModel( + name="Representative", + fields=[ + ( + "id", + models.UUIDField( + default=uuid.uuid4, + editable=False, + primary_key=True, + serialize=False, + ), + ), + ( + "created_at", + models.DateTimeField(auto_now_add=True, verbose_name="Created at"), + ), + ( + "updated_at", + models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + ( + "is_published", + models.BooleanField(default=False, verbose_name="published"), + ), + ("email", models.EmailField(max_length=254, unique=True)), + ("first_name", models.CharField(blank=True, max_length=255)), + ("last_name", models.CharField(blank=True, max_length=255)), + ("phone", models.CharField(blank=True, max_length=255)), + ("role", models.CharField(blank=True, max_length=255)), + ("description", models.TextField(blank=True)), + ( + "entity", + models.ForeignKey( + on_delete=django.db.models.deletion.CASCADE, + related_name="representatives", + to="tprm.entity", + verbose_name="Entity", + ), + ), + ( + "user", + models.ForeignKey( + null=True, + on_delete=django.db.models.deletion.SET_NULL, + to=settings.AUTH_USER_MODEL, + ), + ), + ], + options={ + "abstract": False, + }, + ), + migrations.CreateModel( + name="Solution", + fields=[ + ( + "id", + models.UUIDField( + default=uuid.uuid4, + editable=False, + primary_key=True, + serialize=False, + ), + ), + ( + "created_at", + models.DateTimeField(auto_now_add=True, verbose_name="Created at"), + ), + ( + "updated_at", + models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + ( + "is_published", + models.BooleanField(default=False, verbose_name="published"), + ), + ("name", models.CharField(max_length=200, verbose_name="Name")), + ( + "description", + models.TextField(blank=True, null=True, verbose_name="Description"), + ), + ("ref_id", models.CharField(blank=True, max_length=255)), + ( + "criticality", + models.IntegerField(default=0, verbose_name="Criticality"), + ), + ( + "provider_entity", + models.ForeignKey( + on_delete=django.db.models.deletion.CASCADE, + related_name="provided_solutions", + to="tprm.entity", + verbose_name="Provider entity", + ), + ), + ( + "recipient_entity", + models.ForeignKey( + blank=True, + null=True, + on_delete=django.db.models.deletion.CASCADE, + related_name="received_solutions", + to="tprm.entity", + verbose_name="Recipient entity", + ), + ), + ], + options={ + "verbose_name": "Solution", + "verbose_name_plural": "Solutions", + }, + ), + migrations.CreateModel( + name="EntityAssessment", + fields=[ + ( + "id", + models.UUIDField( + default=uuid.uuid4, + editable=False, + primary_key=True, + serialize=False, + ), + ), + ( + "created_at", + models.DateTimeField(auto_now_add=True, verbose_name="Created at"), + ), + ( + "updated_at", + models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + ( + "is_published", + models.BooleanField(default=False, verbose_name="published"), + ), + ("name", models.CharField(max_length=200, verbose_name="Name")), + ( + "description", + models.TextField(blank=True, null=True, verbose_name="Description"), + ), + ("eta", models.DateField(blank=True, null=True, verbose_name="ETA")), + ( + "due_date", + models.DateField(blank=True, null=True, verbose_name="Due date"), + ), + ( + "version", + models.CharField( + blank=True, + default="1.0", + help_text="Version of the compliance assessment (eg. 1.0, 2.0, etc.)", + max_length=100, + null=True, + verbose_name="Version", + ), + ), + ( + "status", + models.CharField( + blank=True, + choices=[ + ("planned", "Planned"), + ("in_progress", "In progress"), + ("in_review", "In review"), + ("done", "Done"), + ("deprecated", "Deprecated"), + ], + default="planned", + max_length=100, + null=True, + verbose_name="Status", + ), + ), + ( + "observation", + models.TextField(blank=True, null=True, verbose_name="Observation"), + ), + ( + "criticality", + models.IntegerField(default=0, verbose_name="Criticality"), + ), + ( + "penetration", + models.IntegerField(default=0, verbose_name="Penetration"), + ), + ( + "dependency", + models.IntegerField(default=0, verbose_name="Dependency"), + ), + ("maturity", models.IntegerField(default=0, verbose_name="Maturity")), + ("trust", models.IntegerField(default=0, verbose_name="Trust")), + ( + "conclusion", + models.CharField( + blank=True, + choices=[ + ("blocker", "Blocker"), + ("warning", "Warning"), + ("ok", "Ok"), + ("not_applicable", "Not applicable"), + ], + max_length=14, + null=True, + verbose_name="Conclusion", + ), + ), + ( + "authors", + models.ManyToManyField( + blank=True, + related_name="%(class)s_authors", + to=settings.AUTH_USER_MODEL, + verbose_name="Authors", + ), + ), + ( + "compliance_assessment", + models.ForeignKey( + blank=True, + null=True, + on_delete=django.db.models.deletion.SET_NULL, + to="core.complianceassessment", + ), + ), + ( + "entity", + models.ForeignKey( + on_delete=django.db.models.deletion.CASCADE, to="tprm.entity" + ), + ), + ( + "evidence", + models.ForeignKey( + blank=True, + null=True, + on_delete=django.db.models.deletion.SET_NULL, + to="core.evidence", + ), + ), + ( + "folder", + models.ForeignKey( + default=iam.models.Folder.get_root_folder_id, + on_delete=django.db.models.deletion.CASCADE, + related_name="%(class)s_folder", + to="iam.folder", + ), + ), + ( + "project", + models.ForeignKey( + on_delete=django.db.models.deletion.CASCADE, + to="core.project", + verbose_name="Project", + ), + ), + ( + "reviewers", + models.ManyToManyField( + blank=True, + related_name="%(class)s_reviewers", + to=settings.AUTH_USER_MODEL, + verbose_name="Reviewers", + ), + ), + ( + "solutions", + models.ManyToManyField( + blank=True, + related_name="entity_assessments", + to="tprm.solution", + verbose_name="Solutions", + ), + ), + ], + options={ + "verbose_name": "Entity assessment", + "verbose_name_plural": "Entity assessments", + }, + ), + ] diff --git a/backend/tprm/migrations/__init__.py b/backend/tprm/migrations/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/backend/tprm/models.py b/backend/tprm/models.py new file mode 100644 index 000000000..40caa82bb --- /dev/null +++ b/backend/tprm/models.py @@ -0,0 +1,121 @@ +from django.db import models +from django.utils.translation import gettext_lazy as _ +from core.base_models import NameDescriptionMixin, AbstractBaseModel +from core.models import Assessment, ComplianceAssessment, Evidence +from iam.models import FolderMixin, PublishInRootFolderMixin +from iam.views import User + + +class Entity(NameDescriptionMixin, FolderMixin, PublishInRootFolderMixin): + """ + An entity represents a legal entity, a corporate body, an administrative body, an association + """ + + mission = models.TextField(blank=True) + reference_link = models.URLField(blank=True, null=True) + owned_folders = models.ManyToManyField( + "iam.Folder", + related_name="owner", + blank=True, + verbose_name=_("Owned folders"), + ) + builtin = models.BooleanField(default=False) + + fields_to_check = ["name"] + + class Meta: + verbose_name = _("Entity") + verbose_name_plural = _("Entities") + + +class EntityAssessment(Assessment): + class Conclusion(models.TextChoices): + BLOCKER = "blocker", _("Blocker") + WARNING = "warning", _("Warning") + OK = "ok", _("Ok") + NA = "not_applicable", _("Not applicable") + + criticality = models.IntegerField(default=0, verbose_name=_("Criticality")) + penetration = models.IntegerField(default=0, verbose_name=_("Penetration")) + dependency = models.IntegerField(default=0, verbose_name=_("Dependency")) + maturity = models.IntegerField(default=0, verbose_name=_("Maturity")) + trust = models.IntegerField(default=0, verbose_name=_("Trust")) + entity = models.ForeignKey( + Entity, + on_delete=models.CASCADE, + ) + solutions = models.ManyToManyField( + "tprm.Solution", + related_name="entity_assessments", + blank=True, + verbose_name=_("Solutions"), + ) + compliance_assessment = models.ForeignKey( + ComplianceAssessment, on_delete=models.SET_NULL, blank=True, null=True + ) + evidence = models.ForeignKey( + Evidence, on_delete=models.SET_NULL, blank=True, null=True + ) + conclusion = models.CharField( + max_length=14, + choices=Conclusion.choices, + verbose_name=_("Conclusion"), + blank=True, + null=True, + ) + + class Meta: + verbose_name = _("Entity assessment") + verbose_name_plural = _("Entity assessments") + + +class Representative(AbstractBaseModel): + """ + This represents a person that is linked to an entity (typically an employee), + and that is relevant for the main entity, like a contact person for an assessment + """ + + entity = models.ForeignKey( + Entity, + on_delete=models.CASCADE, + related_name="representatives", + verbose_name=_("Entity"), + ) + email = models.EmailField(unique=True) + first_name = models.CharField(max_length=255, blank=True) + last_name = models.CharField(max_length=255, blank=True) + phone = models.CharField(max_length=255, blank=True) + role = models.CharField(max_length=255, blank=True) + description = models.TextField(blank=True) + user = models.ForeignKey(User, on_delete=models.SET_NULL, null=True) + + fields_to_check = ["email"] + + +class Solution(NameDescriptionMixin): + """ + A solution represents a product or service that is offered by an entity + """ + + provider_entity = models.ForeignKey( + Entity, + on_delete=models.CASCADE, + related_name="provided_solutions", + verbose_name=_("Provider entity"), + ) + recipient_entity = models.ForeignKey( + Entity, + on_delete=models.CASCADE, + related_name="received_solutions", + verbose_name=_("Recipient entity"), + null=True, + blank=True, + ) + ref_id = models.CharField(max_length=255, blank=True) + criticality = models.IntegerField(default=0, verbose_name=_("Criticality")) + + fields_to_check = ["name"] + + class Meta: + verbose_name = _("Solution") + verbose_name_plural = _("Solutions") diff --git a/backend/tprm/serializers.py b/backend/tprm/serializers.py new file mode 100644 index 000000000..a5218959f --- /dev/null +++ b/backend/tprm/serializers.py @@ -0,0 +1,223 @@ +from rest_framework import serializers +from core.models import ComplianceAssessment, Framework + +from core.serializer_fields import FieldsRelatedField +from core.serializers import BaseModelSerializer +from core.utils import RoleCodename, UserGroupCodename +from iam.models import Folder, Role, RoleAssignment, UserGroup +from django.contrib.auth import get_user_model +from tprm.models import Entity, EntityAssessment, Representative, Solution +from django.utils.translation import gettext_lazy as _ +from ciso_assistant.settings import EMAIL_HOST, EMAIL_HOST_RESCUE + +import structlog + +logger = structlog.get_logger(__name__) + +User = get_user_model() + + +class EntityReadSerializer(BaseModelSerializer): + folder = FieldsRelatedField() + owned_folders = FieldsRelatedField(many=True) + + class Meta: + model = Entity + exclude = [] + + +class EntityWriteSerializer(BaseModelSerializer): + class Meta: + model = Entity + exclude = ["owned_folders"] + + +class EntityAssessmentReadSerializer(BaseModelSerializer): + compliance_assessment = FieldsRelatedField() + evidence = FieldsRelatedField() + project = FieldsRelatedField() + entity = FieldsRelatedField() + folder = FieldsRelatedField() + solutions = FieldsRelatedField(many=True) + authors = FieldsRelatedField(many=True) + reviewers = FieldsRelatedField(many=True) + + class Meta: + model = EntityAssessment + exclude = ["penetration", "dependency", "maturity", "trust"] + + +class EntityAssessmentWriteSerializer(BaseModelSerializer): + create_audit = serializers.BooleanField(default=True) + framework = serializers.PrimaryKeyRelatedField( + queryset=Framework.objects.all(), required=False + ) + selected_implementation_groups = serializers.ListField( + child=serializers.CharField(), required=False + ) + + def _extract_audit_data(self, validated_data): + audit_data = { + "create_audit": validated_data.pop("create_audit", False), + "framework": validated_data.pop("framework", None), + "selected_implementation_groups": validated_data.pop( + "selected_implementation_groups", None + ), + } + return audit_data + + def _create_or_update_audit(self, instance, audit_data): + if audit_data["create_audit"]: + if not audit_data["framework"]: + raise serializers.ValidationError( + {"framework": [_("Framework required")]} + ) + + audit = ComplianceAssessment.objects.create( + name=instance.name, + framework=audit_data["framework"], + project=instance.project, + selected_implementation_groups=audit_data[ + "selected_implementation_groups" + ], + ) + + if not instance.compliance_assessment: + enclave = Folder.objects.create( + content_type=Folder.ContentType.ENCLAVE, + name=f"{instance.project.name}/{instance.name}", + parent_folder=instance.folder, + ) + audit.folder = enclave + audit.save() + + audit.create_requirement_assessments() + audit.authors.set(instance.authors.all()) + audit.reviewers.set(instance.reviewers.all()) + instance.compliance_assessment = audit + instance.save() + + def _assign_third_party_respondents( + self, instance: EntityAssessment, third_party_users: set[User] + ): + if instance.compliance_assessment: + enclave = instance.compliance_assessment.folder + respondents, _ = UserGroup.objects.get_or_create( + name=UserGroupCodename.THIRD_PARTY_RESPONDENT, + folder=enclave, + builtin=True, + ) + role_assignment, _ = RoleAssignment.objects.get_or_create( + user_group=respondents, + role=Role.objects.get(name=RoleCodename.THIRD_PARTY_RESPONDENT), + builtin=True, + folder=enclave, + is_recursive=True, + ) + role_assignment.perimeter_folders.add(enclave) + for user in third_party_users: + if not user.is_third_party: + logger.warning("User is not a third-party", user=user) + user.user_groups.add(respondents) + + def _send_author_emails(self, instance, authors_to_email: set): + if EMAIL_HOST or EMAIL_HOST_RESCUE: + for author in authors_to_email: + try: + author.mailing( + email_template_name="tprm/third_party_email.html", + subject=_( + "CISO Assistant: A questionnaire has been assigned to you" + ), + object="compliance-assessments", + object_id=instance.compliance_assessment.id, + ) + except Exception as e: + print(f"Failed to send email to {author}: {e}") + + def create(self, validated_data): + audit_data = self._extract_audit_data(validated_data) + instance = super().create(validated_data) + self._create_or_update_audit(instance, audit_data) + self._assign_third_party_respondents(instance, set(instance.authors.all())) + self._send_author_emails(instance, set(instance.authors.all())) + return instance + + def update(self, instance: EntityAssessment, validated_data): + audit_data = self._extract_audit_data(validated_data) + new_authors = set(validated_data.get("authors", [])) - set( + instance.authors.all() + ) + instance = super().update(instance, validated_data) + + if not instance.compliance_assessment: + self._create_or_update_audit(instance, audit_data) + + self._assign_third_party_respondents(instance, new_authors) + self._send_author_emails(instance, new_authors) + return instance + + class Meta: + model = EntityAssessment + exclude = [] + + +class RepresentativeReadSerializer(BaseModelSerializer): + entity = FieldsRelatedField() + user = FieldsRelatedField() + + class Meta: + model = Representative + exclude = [] + + +class RepresentativeWriteSerializer(BaseModelSerializer): + create_user = serializers.BooleanField(default=False) + + def _create_or_update_user(self, instance, user): + if not user: + return + user = User.objects.filter( + email=instance.email, + ).first() + if not user: + user = User.objects.create_user( + email=instance.email, + first_name=instance.first_name, + last_name=instance.last_name, + ) + user.is_third_party = True + user.save() + instance.user = user + instance.save() + + def create(self, validated_data): + user = validated_data.pop("create_user", False) + instance = super().create(validated_data) + self._create_or_update_user(instance, user) + return instance + + def update(self, instance, validated_data): + user = validated_data.pop("create_user", False) + instance = super().update(instance, validated_data) + self._create_or_update_user(instance, user) + return instance + + class Meta: + model = Representative + exclude = [] + + +class SolutionReadSerializer(BaseModelSerializer): + provider_entity = FieldsRelatedField() + recipient_entity = FieldsRelatedField() + + class Meta: + model = Solution + exclude = [] + + +class SolutionWriteSerializer(BaseModelSerializer): + class Meta: + model = Solution + exclude = ["recipient_entity"] diff --git a/backend/tprm/tests.py b/backend/tprm/tests.py new file mode 100644 index 000000000..7ce503c2d --- /dev/null +++ b/backend/tprm/tests.py @@ -0,0 +1,3 @@ +from django.test import TestCase + +# Create your tests here. diff --git a/backend/tprm/views.py b/backend/tprm/views.py new file mode 100644 index 000000000..0afedcd1d --- /dev/null +++ b/backend/tprm/views.py @@ -0,0 +1,81 @@ +from rest_framework.response import Response +from iam.models import Folder +from core.views import BaseModelViewSet as AbstractBaseModelViewSet +from tprm.models import Entity, Representative, Solution, EntityAssessment +from rest_framework.decorators import action +import structlog + +logger = structlog.get_logger(__name__) + + +class BaseModelViewSet(AbstractBaseModelViewSet): + serializers_module = "tprm.serializers" + + +# Create your views here. +class EntityViewSet(BaseModelViewSet): + """ + API endpoint that allows entities to be viewed or edited. + """ + + model = Entity + filterset_fields = ["folder"] + + +class EntityAssessmentViewSet(BaseModelViewSet): + """ + API endpoint that allows entity assessments to be viewed or edited. + """ + + model = EntityAssessment + filterset_fields = ["status", "project", "project__folder", "authors", "entity"] + + def destroy(self, request, *args, **kwargs): + instance = self.get_object() + if instance.compliance_assessment: + folder = instance.compliance_assessment.folder + instance.compliance_assessment.delete() + if folder.content_type == Folder.ContentType.ENCLAVE: + folder.delete() + else: + logger.warning("Compliance assessment folder is not an Enclave", folder) + + return super().destroy(request, *args, **kwargs) + + @action(detail=False, name="Get status choices") + def status(self, request): + return Response(dict(EntityAssessment.Status.choices)) + + @action(detail=False, name="Get conclusion choices") + def conclusion(self, request): + return Response(dict(EntityAssessment.Conclusion.choices)) + + +class RepresentativeViewSet(BaseModelViewSet): + """ + API endpoint that allows representatives to be viewed or edited. + """ + + def destroy(self, request, *args, **kwargs): + instance = self.get_object() + if instance.user: + instance.user.delete() + + return super().destroy(request, *args, **kwargs) + + model = Representative + filterset_fields = ["entity"] + + +class SolutionViewSet(BaseModelViewSet): + """ + API endpoint that allows solutions to be viewed or edited. + """ + + model = Solution + + def perform_create(self, serializer): + serializer.save() + solution = serializer.instance + solution.recipient_entity = Entity.objects.get(builtin=True) + solution.save() diff --git a/frontend/messages/de.json b/frontend/messages/de.json index d196d4e6c..be5dad315 100644 --- a/frontend/messages/de.json +++ b/frontend/messages/de.json @@ -37,6 +37,9 @@ "associatedDomains": "Zugehörige Domänen", "associatedProjects": "Zugehörige Projekte", "associatedUsers": "Zugehörige Benutzer", + "associatedEntityAssessments": "Bewertungen verbundener Unternehmen", + "associatedRepresentatives": "Assoziierte Vertreter", + "associatedSolutions": "Zugehörige Lösungen", "home": "Startseite", "edit": "Bearbeiten", "changePassword": "Passwort ändern", @@ -469,6 +472,7 @@ "inProgress": "In Bearbeitung", "inReview": "In Überprüfung", "deprecated": "Veraltet", + "onHold": "In der Warteschleife", "done": "Erledigt", "nonCompliant": "Nicht konform", "nonCompliantMinor": "Nicht konformer Minderjähriger", @@ -623,6 +627,31 @@ "duplicate": "Duplikat", "duplicateRiskAssessment": "Duplizieren Sie die Risikobewertung", "size": "Größe", + "entity": "Juristische Person", + "entities": "Entitäten", + "addEntity": "Entität hinzufügen", + "referenceLink": "Referenzlink", + "mission": "Mission", + "ownedFolders": "Eigene Domänen", + "entityAssessment": "Unternehmensbewertung", + "entityAssessments": "Entitätsbewertungen", + "addEntityAssessment": "Entitätsbewertung hinzufügen", + "criticality": "Kritikalität", + "penetration": "Penetration", + "dependency": "Abhängigkeit", + "trust": "Vertrauen", + "solutions": "Lösungen", + "solution": "Lösung", + "addSolution": "Lösung hinzufügen", + "providerEntity": "Anbieterentität", + "addProduct": "Produkt hinzufügen", + "representatives": "Vertreter", + "representative": "Vertreter", + "addRepresentative": "Vertreter hinzufügen", + "phone": "Telefon", + "role": "Rolle", + "question": "Frage", + "recipientEntity": "Empfänger", "financial": "Finanzen", "legal": "Rechtliches", "reputation": "Reputation", @@ -631,5 +660,14 @@ "integrity": "Integrität", "availability": "Verfügbarkeit", "authenticity": "Authentizität", + "reviewObservation": "Beobachtung überprüfen", + "reviewObservationSemiColon": "Überprüfungsbeobachtung:", + "reviewConclusion": "Fazit der Überprüfung", + "reviewConclusionSemiColon": "Fazit des Reviews:", + "review": "Rezension", + "conclusionSemiColon": "Abschluss:", + "observationSemiColon": "Beobachtung:", + "tableMode": "Tabellenmodus", + "owner": "Eigentümer", "waitingRiskAcceptances": "Hallo! Sie haben derzeit {number} Risiko{s} zur Annahme ausstehend. Sie finden sie auf der Registerkarte „Risiken“." } diff --git a/frontend/messages/en.json b/frontend/messages/en.json index 086b06642..018ef4d71 100644 --- a/frontend/messages/en.json +++ b/frontend/messages/en.json @@ -37,6 +37,9 @@ "associatedDomains": "Associated domains", "associatedProjects": "Associated projects", "associatedUsers": "Associated users", + "associatedEntityAssessments": "Associated entity assessments", + "associatedRepresentatives": "Associated representatives", + "associatedSolutions": "Associated solutions", "home": "Home", "edit": "Edit", "changePassword": "Change password", @@ -89,8 +92,8 @@ "name": "Name", "description": "Description", "parentDomain": "Parent domain", - "ref": "Ref", - "refId": "Ref ID", + "ref": "Reference", + "refId": "Reference ID", "businessValue": "Business value", "email": "Email", "firstName": "First name", @@ -112,7 +115,7 @@ "riskMatrix": "Risk matrix", "riskMatrixColon": "Risk matrix:", "project": "Project", - "folder": "Folder", + "folder": "Domain", "riskAssessment": "Risk assessment", "threat": "Threat", "framework": "Framework", @@ -171,6 +174,7 @@ "dueDate": "Due date", "attachment": "Attachment", "observation": "Observation", + "noObservation": "No observation", "importMatrices": "Import matrices", "importFrameworks": "Import frameworks", "summary": "Summary", @@ -669,6 +673,32 @@ "duplicate": "Duplicate", "duplicateRiskAssessment": "Duplicate the risk assessment", "size": "Size", + "entity": "Entity", + "entities": "Entities", + "addEntity": "Add entity", + "referenceLink": "Reference link", + "mission": "Mission", + "ownedFolders": "Owned domains", + "thirdParty": "Third party", + "entityAssessment": "Entity assessment", + "entityAssessments": "Entity assessments", + "addEntityAssessment": "Add entity assessment", + "criticality": "Criticality", + "penetration": "Penetration", + "dependency": "Dependency", + "trust": "Trust", + "solutions": "Solutions", + "solution": "Solution", + "addSolution": "Add solution", + "providerEntity": "Provider entity", + "addProduct": "Add product", + "representatives": "Representatives", + "representative": "Representative", + "addRepresentative": "Add representative", + "phone": "Phone", + "role": "Role", + "question": "Question", + "recipientEntity": "Recipient entity", "financial": "Financial", "legal": "Legal", "reputation": "Reputation", @@ -677,6 +707,25 @@ "integrity": "Integrity", "availability": "Availability", "authenticity": "Authenticity", + "reviewObservation": "Review observation", + "reviewObservationSemiColon": "Review observation:", + "reviewConclusion": "Review conclusion", + "reviewConclusionSemiColon": "Review conclusion:", + "review": "Review", + "conclusionSemiColon": "Conclusion:", + "observationSemiColon": "Observation:", + "tableMode": "Table mode", "owner": "Owner", - "waitingRiskAcceptances": "Hello! You currently have {number} risk acceptance{s} pending. You can find them in the risk tab." + "waitingRiskAcceptances": "Hello! You currently have {number} risk acceptance{s} pending. You can find them in the risk tab.", + "answer": "Answer", + "questionnaireMode": "Questionnaire mode", + "assessmentMode": "Assessment mode", + "createAudit": "Create audit", + "createAuditHelpText": "Create an audit alongside the entity assessment", + "questionnaire": "Questionnaire", + "conclusion": "Conclusion", + "blocker": "Blocker", + "createUser": "Create user", + "createUserHelpText": "Create or link a third party user to the representative based on the email", + "nameDuplicate": "Name already exists" } diff --git a/frontend/messages/es.json b/frontend/messages/es.json index d234f17b6..c0c919e59 100644 --- a/frontend/messages/es.json +++ b/frontend/messages/es.json @@ -37,6 +37,9 @@ "associatedDomains": "Dominios asociados", "associatedProjects": "Proyectos asociados", "associatedUsers": "Usuarios asociados", + "associatedEntityAssessments": "Evaluaciones de entidades asociadas", + "associatedRepresentatives": "Representantes asociados", + "associatedSolutions": "Soluciones asociadas", "home": "Inicio", "edit": "Editar", "changePassword": "Cambiar contraseña", @@ -469,6 +472,7 @@ "inProgress": "En progreso", "inReview": "En revisión", "deprecated": "Obsoleto", + "onHold": "En espera", "done": "Hecho", "nonCompliant": "No conforme", "nonCompliantMinor": "Menor no conforme", @@ -623,6 +627,31 @@ "duplicate": "Duplicar", "duplicateRiskAssessment": "Duplicar la evaluación de riesgo", "size": "Tamaño", + "entity": "Entidad", + "entities": "Entidades", + "addEntity": "Agregar entidad", + "referenceLink": "Enlace de referencia", + "mission": "Misión", + "ownedFolders": "Dominios propios", + "entityAssessment": "Evaluación de entidades", + "entityAssessments": "Evaluaciones de entidades", + "addEntityAssessment": "Añadir evaluación de entidad", + "criticality": "Criticidad", + "penetration": "Penetración", + "dependency": "Dependencia", + "trust": "Confianza", + "solutions": "Soluciones", + "solution": "Solución", + "addSolution": "Añadir solución", + "providerEntity": "Entidad proveedora", + "addProduct": "Añadir producto", + "representatives": "Representantes", + "representative": "Representante", + "addRepresentative": "Agregar representante", + "phone": "Teléfono", + "role": "Role", + "question": "Pregunta", + "recipientEntity": "Entidad destinataria", "financial": "Finanzas", "legal": "Jurídico", "reputation": "Reputación", @@ -631,6 +660,14 @@ "integrity": "Integridad", "availability": "Disponibilidad", "authenticity": "Autenticidad", + "reviewObservation": "Revisar la observación", + "reviewObservationSemiColon": "Observación de la revisión:", + "reviewConclusion": "Conclusión de la revisión", + "reviewConclusionSemiColon": "Conclusión de la revisión:", + "review": "Revisar", + "conclusionSemiColon": "Conclusión:", + "observationSemiColon": "Observación:", + "tableMode": "Modo de tabla", "owner": "Titular", "waitingRiskAcceptances": "Hola! Actualmente tienes {number} riesgo{s} aceptación pendiente. Puedes encontrarlos en la pestaña de riesgo." } diff --git a/frontend/messages/fr.json b/frontend/messages/fr.json index e5f10e9f1..ff5d384c8 100644 --- a/frontend/messages/fr.json +++ b/frontend/messages/fr.json @@ -37,6 +37,9 @@ "associatedDomains": "Domaines associés", "associatedProjects": "Projets associés", "associatedUsers": "Utilisateurs associés", + "associatedEntityAssessments": "Évaluations des entités associées", + "associatedRepresentatives": "Représentants associés", + "associatedSolutions": "Solutions associées", "home": "Accueil", "edit": "Modifier", "changePassword": "Changer le mot de passe", @@ -469,6 +472,7 @@ "inProgress": "En cours", "inReview": "En révision", "deprecated": "Déprécié", + "onHold": "En attente", "done": "Terminé", "nonCompliant": "Non conforme", "nonCompliantMinor": "Mineur non conforme", @@ -623,6 +627,31 @@ "duplicate": "Dupliquer", "duplicateRiskAssessment": "Dupliquer l’évaluation de risque", "size": "Taille", + "entity": "Entité", + "entities": "Entités", + "addEntity": "Ajouter une entité", + "referenceLink": "Lien de référence", + "mission": "Mission", + "ownedFolders": "Domaines possédés", + "entityAssessment": "Évaluation de l'entité", + "entityAssessments": "Évaluations des entités", + "addEntityAssessment": "Ajouter une évaluation d'entité", + "criticality": "Criticité", + "penetration": "Pénétration", + "dependency": "Dépendance", + "trust": "Confiance", + "solutions": "Solutions", + "solution": "Solution", + "addSolution": "Ajouter une solution", + "providerEntity": "Entité fournisseur", + "addProduct": "Ajouter un produit", + "representatives": "Représentants", + "representative": "Représentant", + "addRepresentative": "Ajouter un représentant", + "phone": "Téléphone", + "role": "Rôle", + "question": "Question", + "recipientEntity": "Entité destinataire", "financial": "Financier", "legal": "Juridique", "reputation": "Réputation", @@ -631,6 +660,14 @@ "integrity": "Intégrité", "availability": "Disponibilité", "authenticity": "Authenticité", + "reviewObservation": "Observation de révision", + "reviewObservationSemiColon": "Observation de révision :", + "reviewConclusion": "Conclusion de l'examen", + "reviewConclusionSemiColon": "Conclusion de l'examen :", + "review": "Revoir", + "conclusionSemiColon": "Conclusion:", + "observationSemiColon": "Observation:", + "tableMode": "Mode tableau", "owner": "Propriétaire", "waitingRiskAcceptances": "Bonjour ! Vous avez actuellement {number} risque{s} en attente d'acceptation. Vous pouvez les retrouver dans l'onglet risque." } diff --git a/frontend/messages/it.json b/frontend/messages/it.json index c42eda4e9..ae912b2db 100644 --- a/frontend/messages/it.json +++ b/frontend/messages/it.json @@ -37,6 +37,9 @@ "associatedDomains": "Domini associati", "associatedProjects": "Progetti associati", "associatedUsers": "Utenti associati", + "associatedEntityAssessments": "Valutazioni di entità associate", + "associatedRepresentatives": "Rappresentanti associati", + "associatedSolutions": "Soluzioni associate", "home": "Home", "edit": "Modifica", "changePassword": "Cambia password", @@ -469,6 +472,7 @@ "inProgress": "In corso", "inReview": "In revisione", "deprecated": "Deprecato", + "onHold": "In attesa", "done": "Fatto", "nonCompliant": "Non conforme", "nonCompliantMinor": "Minore non conforme", @@ -623,6 +627,31 @@ "duplicate": "Duplicare", "duplicateRiskAssessment": "Duplicare la valutazione del rischio", "size": "Dimensione", + "entity": "Entità", + "entities": "Entità", + "addEntity": "Aggiungi entità", + "referenceLink": "Link di riferimento", + "mission": "Missione", + "ownedFolders": "Domini di proprietà", + "entityAssessment": "Valutazione dell'entità", + "entityAssessments": "Valutazioni dell'entità", + "addEntityAssessment": "Aggiungere la valutazione dell'entità", + "criticality": "Criticità", + "penetration": "Penetrazione", + "dependency": "Dipendenza", + "trust": "Fiducia", + "solutions": "Soluzioni", + "solution": "Soluzione", + "addSolution": "Aggiungi soluzione", + "providerEntity": "Ente fornitore", + "addProduct": "Aggiungi prodotto", + "representatives": "Rappresentanti", + "representative": "Rappresentante", + "addRepresentative": "Aggiungi rappresentante", + "phone": "Telefono", + "role": "Ruolo", + "question": "Domanda", + "recipientEntity": "Entità destinataria", "financial": "Finanziario", "legal": "Legale", "reputation": "Reputazione", @@ -631,5 +660,14 @@ "integrity": "Integrità", "availability": "Disponibilità", "authenticity": "Autenticità", + "reviewObservation": "Osservazione di revisione", + "reviewObservationSemiColon": "Osservazione di revisione:", + "reviewConclusion": "Conclusione della revisione", + "reviewConclusionSemiColon": "Conclusione della recensione:", + "review": "Revisione", + "conclusionSemiColon": "Conclusione:", + "observationSemiColon": "Osservazione:", + "tableMode": "Modalità tabella", + "owner": "Proprietario", "waitingRiskAcceptances": "Ciao! Al momento hai {number} rischi{s} in attesa di accettazione. Puoi trovarli nella scheda rischi." } diff --git a/frontend/messages/nl.json b/frontend/messages/nl.json index d1744b3fc..b72ab707c 100644 --- a/frontend/messages/nl.json +++ b/frontend/messages/nl.json @@ -37,6 +37,9 @@ "associatedDomains": "Geassocieerde domeinen", "associatedProjects": "Geassocieerde projecten", "associatedUsers": "Geassocieerde gebruikers", + "associatedEntityAssessments": "Beoordelingen van geassocieerde entiteiten", + "associatedRepresentatives": "Geassocieerde vertegenwoordigers", + "associatedSolutions": "Geassocieerde oplossingen", "home": "Startpagina", "edit": "Bewerken", "changePassword": "Wachtwoord wijzigen", @@ -469,6 +472,7 @@ "inProgress": "In uitvoering", "inReview": "In beoordeling", "deprecated": "Verouderd", + "onHold": "In de wacht", "done": "Gedaan", "nonCompliant": "Niet compliant", "nonCompliantMinor": "Niet-conforme minor", @@ -623,6 +627,31 @@ "duplicate": "Duplicaat", "duplicateRiskAssessment": "Dupliceer de risicobeoordeling", "size": "Grootte", + "entity": "Entiteit", + "entities": "Entiteiten", + "addEntity": "Entiteit toevoegen", + "referenceLink": "Referentielink", + "mission": "Missie", + "ownedFolders": "Eigendom domeinen", + "entityAssessment": "Entiteitsbeoordeling", + "entityAssessments": "Entiteitsbeoordelingen", + "addEntityAssessment": "Entiteitsbeoordeling toevoegen", + "criticality": "Kritiek", + "penetration": "Penetratie", + "dependency": "Afhankelijkheid", + "trust": "Vertrouwen", + "solutions": "Oplossingen", + "solution": "Oplossing", + "addSolution": "Oplossing toevoegen", + "providerEntity": "Leverancier entiteit", + "addProduct": "Product toevoegen", + "representatives": "Vertegenwoordigers", + "representative": "Vertegenwoordiger", + "addRepresentative": "Vertegenwoordiger toevoegen", + "phone": "Telefoon", + "role": "Rol", + "question": "Vraag", + "recipientEntity": "Ontvangende entiteit", "financial": "Financieel", "legal": "Juridisch", "reputation": "Reputatie", @@ -631,5 +660,14 @@ "integrity": "Integriteit", "availability": "Beschikbaarheid", "authenticity": "Authenticiteit", + "reviewObservation": "Observatie herzien", + "reviewObservationSemiColon": "Beoordeling observatie:", + "reviewConclusion": "Conclusie van de beoordeling", + "reviewConclusionSemiColon": "Conclusie van de review:", + "review": "Beoordeling", + "conclusionSemiColon": "Conclusie:", + "observationSemiColon": "Observatie:", + "tableMode": "Tabelmodus", + "owner": "Eigenaar", "waitingRiskAcceptances": "Hallo! U hebt momenteel {number} risico{s} acceptatie in behandeling. U kunt ze vinden in het tabblad risico." } diff --git a/frontend/messages/pl.json b/frontend/messages/pl.json index 372def52c..e0a90fd52 100644 --- a/frontend/messages/pl.json +++ b/frontend/messages/pl.json @@ -37,6 +37,9 @@ "associatedDomains": "Powiązane domeny", "associatedProjects": "Powiązane projekty", "associatedUsers": "Powiązani użytkownicy", + "associatedEntityAssessments": "Oceny podmiotów stowarzyszonych", + "associatedRepresentatives": "Przedstawiciele stowarzyszeni", + "associatedSolutions": "Powiązane rozwiązania", "home": "Strona główna", "edit": "Edytuj", "changePassword": "Zmień hasło", @@ -469,6 +472,7 @@ "inProgress": "W trakcie", "inReview": "W przeglądzie", "deprecated": "Przestarzały", + "onHold": "Wstrzymany", "done": "Zrobione", "nonCompliant": "Niezgodny", "nonCompliantMinor": "Niezgodny nieletni", @@ -660,6 +664,31 @@ "duplicate": "Duplikować", "duplicateRiskAssessment": "Powielić ocenę ryzyka", "size": "Rozmiar", + "entity": "Podmiot", + "entities": "Podmioty", + "addEntity": "Dodaj jednostkę", + "referenceLink": "Link referencyjny", + "mission": "Misja", + "ownedFolders": "Posiadane domeny", + "entityAssessment": "Ocena podmiotu", + "entityAssessments": "Oceny podmiotów", + "addEntityAssessment": "Dodaj ocenę podmiotu", + "criticality": "Krytyczność", + "penetration": "Penetracja", + "dependency": "Zależność", + "trust": "Zaufanie", + "solutions": "Rozwiązania", + "solution": "Rozwiązanie", + "addSolution": "Dodaj rozwiązanie", + "providerEntity": "Podmiot świadczący usługi", + "addProduct": "Dodaj produkt", + "representatives": "Przedstawiciele", + "representative": "Przedstawiciel", + "addRepresentative": "Dodaj przedstawiciela", + "phone": "Telefon", + "role": "Rola", + "question": "Pytanie", + "recipientEntity": "Podmiot odbierający", "financial": "Finansowy", "legal": "Prawne", "reputation": "Reputacja", @@ -668,5 +697,14 @@ "integrity": "Integralność", "availability": "Dostępność", "authenticity": "Autentyczność", + "reviewObservation": "Przegląd obserwacji", + "reviewObservationSemiColon": "Przegląd obserwacji:", + "reviewConclusion": "Wniosek z przeglądu", + "reviewConclusionSemiColon": "Wnioski z przeglądu:", + "review": "Recenzja", + "conclusionSemiColon": "Wniosek:", + "observationSemiColon": "Obserwacja:", + "tableMode": "Tryb tabeli", + "owner": "Właściciel", "waitingRiskAcceptances": "Cześć! Obecnie masz {number} ryzyko{s} oczekujące na akceptację. Możesz je znaleźć w zakładce ryzyko." } diff --git a/frontend/messages/pt.json b/frontend/messages/pt.json index 6bc885405..5c857055e 100644 --- a/frontend/messages/pt.json +++ b/frontend/messages/pt.json @@ -37,6 +37,9 @@ "associatedDomains": "Domínios associados", "associatedProjects": "Projetos associados", "associatedUsers": "Usuários associados", + "associatedEntityAssessments": "Avaliações de entidades associadas", + "associatedRepresentatives": "Representantes associados", + "associatedSolutions": "Soluções associadas", "home": "Início", "edit": "Editar", "changePassword": "Alterar senha", @@ -469,6 +472,7 @@ "inProgress": "Em andamento", "inReview": "Em revisão", "deprecated": "Descontinuado", + "onHold": "Em espera", "done": "Concluído", "nonCompliant": "Não conforme", "nonCompliantMinor": "Menor não conforme", @@ -623,6 +627,31 @@ "duplicate": "Duplicado", "duplicateRiskAssessment": "Duplicar a avaliação de risco", "size": "Tamanho", + "entity": "Entidade", + "entities": "Entidades", + "addEntity": "Adicionar entidade", + "referenceLink": "Link de referência", + "mission": "Missão", + "ownedFolders": "Domínios próprios", + "entityAssessment": "Avaliação de entidade", + "entityAssessments": "Avaliações de entidades", + "addEntityAssessment": "Adicionar avaliação de entidade", + "criticality": "Criticidade", + "penetration": "Penetração", + "dependency": "Dependência", + "trust": "Confiar", + "solutions": "Soluções", + "solution": "Solução", + "addSolution": "Adicionar solução", + "providerEntity": "Entidade provedora", + "addProduct": "Adicionar produto", + "representatives": "Representantes", + "representative": "Representante", + "addRepresentative": "Adicionar representante", + "phone": "Telefone", + "role": "Papel", + "question": "Pergunta", + "recipientEntity": "Entidade beneficiária", "financial": "Financeiro", "legal": "Jurídica", "reputation": "Reputação", @@ -631,5 +660,14 @@ "integrity": "Integridade", "availability": "Acessibilidade", "authenticity": "Autenticidade", + "reviewObservation": "Observação de revisão", + "reviewObservationSemiColon": "Observação da revisão:", + "reviewConclusion": "Conclusão da revisão", + "reviewConclusionSemiColon": "Conclusão da revisão:", + "review": "Análise", + "conclusionSemiColon": "Conclusão:", + "observationSemiColon": "Observação:", + "tableMode": "Modo de tabela", + "owner": "Proprietário", "waitingRiskAcceptances": "Olá! No momento, você tem {number} aceitação de risco{s} pendente. Você pode encontrá-los na aba de risco." } diff --git a/frontend/src/lib/components/DetailView/DetailView.svelte b/frontend/src/lib/components/DetailView/DetailView.svelte new file mode 100644 index 000000000..ec59b9440 --- /dev/null +++ b/frontend/src/lib/components/DetailView/DetailView.svelte @@ -0,0 +1,303 @@ + + +
+ {#if data.data.state === m.submitted() && $page.data.user.id === data.data.approver.id} +
+
+ {m.riskAcceptanceReviewMessage()} +
+
+ + +
+
+ {:else if data.data.state === m.accept()} +
+
+ {m.riskAcceptanceValidatedMessage()} +
+ {#if $page.data.user.id === data.data.approver.id} +
+ +
+ {/if} +
+ {/if} +
+
+ {#each Object.entries(data.data).filter( ([key, _]) => (fields.length > 0 ? fields.includes(key) : true && !exclude.includes(key)) ) as [key, value]} +
+
+ {safeTranslate(key)} +
+
    +
  • + {#if value !== null && value !== undefined && value !== ''} + {#if key === 'library'} + {@const itemHref = `/libraries/${value.urn}`} + {value.name} + {:else if Array.isArray(value)} + {#if Object.keys(value).length > 0} +
      + {#each value as val} +
    • + {#if val.str && val.id} + {@const itemHref = `/${ + URL_MODEL_MAP[data.urlModel]['foreignKeyFields']?.find( + (item) => item.field === key + )?.urlModel + }/${val.id}`} + {val.str} + {:else} + {value} + {/if} +
      • + {/each} +
    + {:else} + -- + {/if} + {:else if value.id} + {@const itemHref = `/${ + URL_MODEL_MAP[data.urlModel]['foreignKeyFields']?.find( + (item) => item.field === key + )?.urlModel + }/${value.id}`} + {value.str} + {:else if isURL(value) && !value.startsWith('urn')} + {value} + {:else if ISO_8601_REGEX.test(value)} + {formatDateOrDateTime(value, languageTag())} + {:else if m[toCamelCase((value.str || value.name) ?? value)]} + {safeTranslate((value.str || value.name) ?? value)} + {:else} + {(value.str || value.name) ?? value} + {/if} + {:else} + -- + {/if} +
    • +
+
+ {/each} +
+ {#if displayEditButton()} + {m.edit()} + {/if} +
+
+ +{#if Object.keys(data.relatedModels).length > 0} +
+ + {#each Object.entries(data.relatedModels) as [urlmodel, model], index} + + {safeTranslate(model.info.localNamePlural)} + {#if model.table.body.length > 0} + {model.table.body.length} + {/if} + + {/each} + + {#each Object.entries(data.relatedModels) as [urlmodel, model], index} + {#if tabSet === index} +
+

+ {safeTranslate('associated' + capitalizeFirstLetter(model.info.localNamePlural))} +

+
+ {#if model.table} + + + + {/if} + {/if} + {/each} + + +
+{/if} diff --git a/frontend/src/lib/components/Forms/AutocompleteSelect.svelte b/frontend/src/lib/components/Forms/AutocompleteSelect.svelte index 86b9b1324..62f09f517 100644 --- a/frontend/src/lib/components/Forms/AutocompleteSelect.svelte +++ b/frontend/src/lib/components/Forms/AutocompleteSelect.svelte @@ -17,8 +17,9 @@ export let form; export let multiple = false; export let nullable = false; + export let mandatory = false; - export let hide = false; + export let hidden = false; export let translateOptions = true; export let cacheLock: CacheLock = { promise: new Promise((res) => res(null)), @@ -82,9 +83,9 @@ } -