{ "assessment-results": { "uuid": "275e2d2d-f5cb-5532-80df-e3f3d3658a27", "metadata": { "title": "Nordvec Trust Snapshot, Assessment Results", "last-modified": "2026-10-19T14:59:56.726Z", "version": "1.vgyJXQF_pFQn", "oscal-version": "1.2.2", "props": [ { "name": "generator", "ns": "https://nordvec.eu/ns/compliance", "value": "nordvec-trust-snapshot-exporter" } ] }, "import-ap": { "href": "#179bf3ff-8fc4-5a3b-ae4e-c7c55060d3fb" }, "back-matter": { "resources": [ { "uuid": "179bf3ff-8fc4-5a3b-ae4e-c7c55060d3fb", "title": "Implicit assessment plan", "description": "This assessment is produced deterministically by the Nordvec trust-snapshot pipeline; there is no separate OSCAL assessment-plan document." } ] }, "results": [ { "uuid": "8a55d114-f2ff-5fa6-858d-472caa9c6eff", "title": "Nordvec trust snapshot control assessment", "description": "Automated assessment of every distilled compliance obligation against its cited code controls, generated from the version-tracked compliance corpus and re-verified in CI.", "start": "2026-10-19T14:59:56.726Z", "reviewed-controls": { "control-selections": [ { "include-all": {} } ] }, "observations": [ { "uuid": "a614bfe7-7daf-55ef-a650-4b89fffdcde4", "description": "Cited code evidence for \"Store accounting records so they cannot be altered or lost within the retention period\" (Bogføringsloven): 1 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "tests/rls/usage-retention.test.ts", "description": "Control implementation cited in tests/rls/usage-retention.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "3d324ff8-21fa-57e4-b95b-f655847ea381", "description": "Cited code evidence for \"Retain accounting records for at least five years after the financial year ends\" (Bogføringsloven): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/maintenance/dataLifecycle.ts", "description": "Control implementation cited in apps/worker/src/maintenance/dataLifecycle.ts." }, { "href": "tests/rls/usage-retention.test.ts", "description": "Control implementation cited in tests/rls/usage-retention.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "e7734573-42c7-5d3f-92d6-423ffe5caebe", "description": "Cited code evidence for \"Protect confidentiality and integrity of data\" (CRA): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "c31e239b-3cc5-5829-af38-85bcf2d9fbf1", "description": "Cited code evidence for \"Secure by design and secure by default\" (CRA): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "a22e774c-cc1c-5327-87cf-164c50156d53", "description": "Cited code evidence for \"Report actively exploited vulnerabilities and severe incidents\" (CRA): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "4f72307e-c0e1-5d54-9820-9d3ea9f239e8", "description": "Cited code evidence for \"Coordinated vulnerability disclosure policy\" (CRA): 3 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "SECURITY.md", "description": "Control implementation cited in SECURITY.md." }, { "href": "apps/web/public/.well-known/security.txt", "description": "Control implementation cited in apps/web/public/.well-known/security.txt." }, { "href": "packages/partial-content/SECURITY.md", "description": "Control implementation cited in packages/partial-content/SECURITY.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "9ed7e65d-1030-557b-bdbb-c9b4dd7da371", "description": "Cited code evidence for \"Identify and document components (SBOM)\" (CRA): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/sbom-release.yml", "description": "Control implementation cited in .github/workflows/sbom-release.yml." }, { "href": "bun.lock", "description": "Control implementation cited in bun.lock." }, { "href": "scripts/deps/generate-sbom.ts", "description": "Control implementation cited in scripts/deps/generate-sbom.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "59b4c1f7-3dd2-582a-beb8-59e1f990785a", "description": "Cited code evidence for \"Monitor upstream components for advisories and record each decision\" (CRA): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "scripts/lib/__tests__/digest-evidence.test.ts", "description": "Control implementation cited in scripts/lib/__tests__/digest-evidence.test.ts." }, { "href": "scripts/setup/digest-review.ts", "description": "Control implementation cited in scripts/setup/digest-review.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "befd1e07-1ae5-5b05-9d06-0e9728734788", "description": "Cited code evidence for \"Identify and address vulnerabilities without delay\" (CRA): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." }, { "href": "bunfig.toml", "description": "Control implementation cited in bunfig.toml." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "43383702-b29f-513a-8b84-23d018044be0", "description": "Cited code evidence for \"Compare only products that meet the same needs or serve the same purpose\" (Comparative Advertising): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/compare/__tests__/compare.test.ts", "description": "Control implementation cited in apps/web/lib/compare/__tests__/compare.test.ts." }, { "href": "apps/web/lib/compare/features.ts", "description": "Control implementation cited in apps/web/lib/compare/features.ts." }, { "href": "apps/web/lib/compare/nordvec.ts", "description": "Control implementation cited in apps/web/lib/compare/nordvec.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "feba1600-a955-5968-aeef-87d771df851f", "description": "Cited code evidence for \"Make no comparison that is misleading about either product\" (Comparative Advertising): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/compare/render.ts", "description": "Control implementation cited in apps/web/lib/compare/render.ts." }, { "href": "scripts/ci/__tests__/comparative-claims.test.ts", "description": "Control implementation cited in scripts/ci/__tests__/comparative-claims.test.ts." }, { "href": "scripts/ci/comparative-claims.ts", "description": "Control implementation cited in scripts/ci/comparative-claims.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "81c33258-2e34-5697-96d8-a07f05bab856", "description": "Cited code evidence for \"Neither discredit the competitor nor trade on its marks\" (Comparative Advertising): 4 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/components/marketing/CompareTable.tsx", "description": "Control implementation cited in apps/web/components/marketing/CompareTable.tsx." }, { "href": "apps/web/lib/compare/__tests__/compare.test.ts", "description": "Control implementation cited in apps/web/lib/compare/__tests__/compare.test.ts." }, { "href": "apps/web/lib/compare/comparative-claims.ts", "description": "Control implementation cited in apps/web/lib/compare/comparative-claims.ts." }, { "href": "scripts/ci/comparative-claims.ts", "description": "Control implementation cited in scripts/ci/comparative-claims.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "e6c0fe68-1678-5fd0-9254-bb043c95aee7", "description": "Cited code evidence for \"Compare material, relevant, verifiable and representative features, objectively\" (Comparative Advertising): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/compare/features.ts", "description": "Control implementation cited in apps/web/lib/compare/features.ts." }, { "href": "scripts/ci/__tests__/comparative-claims.test.ts", "description": "Control implementation cited in scripts/ci/__tests__/comparative-claims.test.ts." }, { "href": "scripts/ci/comparative-claims.ts", "description": "Control implementation cited in scripts/ci/comparative-claims.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "ae6b2179-25ee-5a59-826f-9d8f26d343a5", "description": "Cited code evidence for \"Keep every comparison current, because cessation needs no proof of loss\" (Comparative Advertising): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "scripts/ci/__tests__/comparative-claims.test.ts", "description": "Control implementation cited in scripts/ci/__tests__/comparative-claims.test.ts." }, { "href": "scripts/ci/comparative-claims.ts", "description": "Control implementation cited in scripts/ci/comparative-claims.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "4805b90d-d8a4-5b87-874f-f54bf7997c64", "description": "Cited code evidence for \"Treat any sentence that identifies another product as comparative advertising\" (Comparative Advertising): 4 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/compare/comparative-claims.ts", "description": "Control implementation cited in apps/web/lib/compare/comparative-claims.ts." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "scripts/ci/__tests__/comparative-claims.test.ts", "description": "Control implementation cited in scripts/ci/__tests__/comparative-claims.test.ts." }, { "href": "scripts/ci/comparative-claims.ts", "description": "Control implementation cited in scripts/ci/comparative-claims.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "6e0d78ce-789e-579b-bda9-f14fb2a08b36", "description": "Cited code evidence for \"Publish supplementary cybersecurity information if certified\" (Cybersecurity Act): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/public/.well-known/security.txt", "description": "Control implementation cited in apps/web/public/.well-known/security.txt." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "2769c3b4-6984-59f2-a8a4-f592cf3f868e", "description": "Cited code evidence for \"Hold the security objectives a certification scheme would require\" (Cybersecurity Act): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/security-measures.md", "description": "Control implementation cited in docs/compliance/security-measures.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "cd8eff25-b19e-53c5-8398-bddeba77c455", "description": "Cited code evidence for \"Safeguard protected data against unlawful international transfer\" (DGA): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/shared/src/storage/residency.ts", "description": "Control implementation cited in packages/shared/src/storage/residency.ts." }, { "href": "packages/shared/src/storage/s3-adapter.ts", "description": "Control implementation cited in packages/shared/src/storage/s3-adapter.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "7a5f8f18-c783-5ff0-b743-a85297e477b9", "description": "Cited code evidence for \"Anomalous-activity detection\" (DORA): 3 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/logger.ts", "description": "Control implementation cited in apps/web/lib/logger.ts." }, { "href": "apps/web/sentry.shared.config.ts", "description": "Control implementation cited in apps/web/sentry.shared.config.ts." }, { "href": "apps/worker/src/utils/circuitBreaker.ts", "description": "Control implementation cited in apps/worker/src/utils/circuitBreaker.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "2037ea14-5a78-5a32-bfe7-440ff9c46175", "description": "Cited code evidence for \"Protection and prevention controls\" (DORA): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "4be34f2d-f1a1-5e4f-a156-a12fe9d8430f", "description": "Cited code evidence for \"Classify and report major incidents to customers\" (DORA): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "60aa3763-f05b-58ef-9693-8a218eda9a0b", "description": "Cited code evidence for \"ICT incident management process\" (DORA): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "e752081a-2ce1-5055-907a-dc2a60cc1cc9", "description": "Cited code evidence for \"Let anyone notify allegedly illegal content\" (DSA): 4 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/app/api/dsa/notices/__tests__/dsa-notices-route.test.ts", "description": "Control implementation cited in apps/web/app/api/dsa/notices/__tests__/dsa-notices-route.test.ts." }, { "href": "apps/web/lib/console/__tests__/dsa-mail.test.ts", "description": "Control implementation cited in apps/web/lib/console/__tests__/dsa-mail.test.ts." }, { "href": "docs/compliance/dsa-notice-and-action-procedure.md", "description": "Control implementation cited in docs/compliance/dsa-notice-and-action-procedure.md." }, { "href": "tests/rls/tenant-operator-holds.test.ts", "description": "Control implementation cited in tests/rls/tenant-operator-holds.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "fbe8e374-7c4d-5432-9fee-8f479e25898c", "description": "Cited code evidence for \"Report suspected threats to life or safety\" (DSA): 2 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/dsa-notice-and-action-procedure.md", "description": "Control implementation cited in docs/compliance/dsa-notice-and-action-procedure.md." }, { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "7a3a0538-4b6f-5a1e-a3d4-2fc03cda8b80", "description": "Cited code evidence for \"Give a statement of reasons for every restriction\" (DSA): 4 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/console/__tests__/dsa-mail.test.ts", "description": "Control implementation cited in apps/web/lib/console/__tests__/dsa-mail.test.ts." }, { "href": "docs/compliance/dsa-notice-and-action-procedure.md", "description": "Control implementation cited in docs/compliance/dsa-notice-and-action-procedure.md." }, { "href": "packages/console-api/__tests__/operator-actions.test.ts", "description": "Control implementation cited in packages/console-api/__tests__/operator-actions.test.ts." }, { "href": "tests/rls/tenant-operator-holds.test.ts", "description": "Control implementation cited in tests/rls/tenant-operator-holds.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "1ce4dc07-ca0d-52d4-8066-72c072f3fa22", "description": "Cited code evidence for \"Publish single points of contact for authorities and for users\" (DSA): 3 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/legal/__tests__/revisions.test.ts", "description": "Control implementation cited in apps/web/lib/legal/__tests__/revisions.test.ts." }, { "href": "apps/web/messages/en.json", "description": "Control implementation cited in apps/web/messages/en.json." }, { "href": "docs/compliance/dsa-notice-and-action-procedure.md", "description": "Control implementation cited in docs/compliance/dsa-notice-and-action-procedure.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "7db9ed9f-b507-55cc-b6be-4f76f7819beb", "description": "Cited code evidence for \"State usage restrictions and moderation in the terms\" (DSA): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/legal/__tests__/revisions.test.ts", "description": "Control implementation cited in apps/web/lib/legal/__tests__/revisions.test.ts." }, { "href": "apps/web/messages/en.json", "description": "Control implementation cited in apps/web/messages/en.json." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "b2fcddd2-6183-5869-898a-0165e911b8c2", "description": "Cited code evidence for \"Export customer data in a structured, common, machine-readable format\" (Data Act): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/export/accountExport.ts", "description": "Control implementation cited in apps/worker/src/export/accountExport.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "ace289e9-ecc7-505f-ba7f-5845299c388b", "description": "Cited code evidence for \"Safeguard against unlawful third-country governmental access\" (Data Act): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/shared/src/storage/residency.ts", "description": "Control implementation cited in packages/shared/src/storage/residency.ts." }, { "href": "packages/shared/src/storage/s3-adapter.ts", "description": "Control implementation cited in packages/shared/src/storage/s3-adapter.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "0a5bd66d-acb1-5490-9711-ff23c9a450ca", "description": "Cited code evidence for \"Publish where customer data is processed and stored\" (Data Act): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/app/%5Blocale%5D/(marketing)/data-sovereignty/page.tsx", "description": "Control implementation cited in apps/web/app/[locale]/(marketing)/data-sovereignty/page.tsx." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "907d1c45-4b58-5263-86cd-dafd349b6e6f", "description": "Cited code evidence for \"Design and provide the service to the accessibility requirements\" (EAA): 7 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/e2e.yml", "description": "Control implementation cited in .github/workflows/e2e.yml." }, { "href": "apps/web/e2e/accessibility.a11y.ts", "description": "Control implementation cited in apps/web/e2e/accessibility.a11y.ts." }, { "href": "apps/web/e2e/app.a11y.ts", "description": "Control implementation cited in apps/web/e2e/app.a11y.ts." }, { "href": "apps/web/e2e/support/wcag.ts", "description": "Control implementation cited in apps/web/e2e/support/wcag.ts." }, { "href": "apps/web/oxlint.config.mts", "description": "Control implementation cited in apps/web/oxlint.config.mts." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "scripts/ci/a11y-affected.ts", "description": "Control implementation cited in scripts/ci/a11y-affected.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "b39f40a0-e3f7-5e52-b2c8-b7a6abc225be", "description": "Cited code evidence for \"Meet the harmonised standard once it is cited, for presumption of conformity\" (EAA): 4 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/e2e.yml", "description": "Control implementation cited in .github/workflows/e2e.yml." }, { "href": "apps/web/e2e/support/axe.ts", "description": "Control implementation cited in apps/web/e2e/support/axe.ts." }, { "href": "apps/web/e2e/support/wcag.ts", "description": "Control implementation cited in apps/web/e2e/support/wcag.ts." }, { "href": "apps/web/oxlint.config.mts", "description": "Control implementation cited in apps/web/oxlint.config.mts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "4f5f3590-c266-5396-ad21-23e5ca743222", "description": "Cited code evidence for \"Publish an accessibility statement (how the service meets the requirements)\" (EAA): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/app/%5Blocale%5D/(marketing)/accessibility/page.tsx", "description": "Control implementation cited in apps/web/app/[locale]/(marketing)/accessibility/page.tsx." }, { "href": "apps/web/messages/en.json", "description": "Control implementation cited in apps/web/messages/en.json." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "52f0a299-40f1-5140-99a7-dcaa2adc8d7c", "description": "Cited code evidence for \"Promote a sufficient level of AI literacy in staff operating the AI system\" (EU AI Act): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/ai-literacy-note.md", "description": "Control implementation cited in docs/compliance/ai-literacy-note.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "99a722c1-7cba-537a-b6fb-b9f3207d3582", "description": "Cited code evidence for \"Automatic record-keeping / logging (Art 12)\" (EU AI Act): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/audit.ts", "description": "Control implementation cited in apps/web/lib/audit.ts." }, { "href": "packages/shared/logging.ts", "description": "Control implementation cited in packages/shared/logging.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "c63d1fc7-5daf-563c-9bdd-5b9c1f879b21", "description": "Cited code evidence for \"Mark AI-generated content (Art 50)\" (EU AI Act): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/app/api/generated-files/%5Bid%5D/download/route.ts", "description": "Control implementation cited in apps/web/app/api/generated-files/[id]/download/route.ts." }, { "href": "packages/shared/src/__tests__/ai-provenance.test.ts", "description": "Control implementation cited in packages/shared/src/__tests__/ai-provenance.test.ts." }, { "href": "packages/shared/src/ai-provenance.ts", "description": "Control implementation cited in packages/shared/src/ai-provenance.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "ef4b4eef-9227-59e8-811a-788eee8927c7", "description": "Cited code evidence for \"Disclose AI interaction to users (Art 50)\" (EU AI Act): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/components/chat/ChatInterface.tsx", "description": "Control implementation cited in apps/web/components/chat/ChatInterface.tsx." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "909b1887-0df1-515e-bcf6-86020834552e", "description": "Cited code evidence for \"Support data-subject access and erasure\" (EUDPR): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/export/__tests__/accountExport.test.ts", "description": "Control implementation cited in apps/worker/src/export/__tests__/accountExport.test.ts." }, { "href": "apps/worker/src/export/accountExport.ts", "description": "Control implementation cited in apps/worker/src/export/accountExport.ts." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "bc28dc4b-59ca-54cc-b269-a493bff9f67c", "description": "Cited code evidence for \"Apply appropriate security of processing\" (EUDPR): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "1c0b0376-3922-5f17-a4d6-32f201ca7434", "description": "Cited code evidence for \"Restrict international transfers to lawful bases\" (EUDPR): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/shared/src/storage/residency.ts", "description": "Control implementation cited in packages/shared/src/storage/residency.ts." }, { "href": "packages/shared/src/storage/s3-adapter.ts", "description": "Control implementation cited in packages/shared/src/storage/s3-adapter.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "66ff7a6a-50eb-5825-a0f0-82e3f857bfeb", "description": "Cited code evidence for \"Give the controller the technical facts it needs for its DPIA and works-council process\" (Employee Monitoring): 3 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/data-processing-agreement-b2b.md", "description": "Control implementation cited in docs/compliance/data-processing-agreement-b2b.md." }, { "href": "docs/compliance/dpia-ai-document-processing.md", "description": "Control implementation cited in docs/compliance/dpia-ai-document-processing.md." }, { "href": "docs/compliance/en/dpia-ai-document-processing.md", "description": "Control implementation cited in docs/compliance/en/dpia-ai-document-processing.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "2082deb7-57fe-5056-b4dc-6b8a607101bf", "description": "Cited code evidence for \"Offer minimization levers the controller can invoke to keep its assessment defensible\" (Employee Monitoring): 6 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/microsoft/__tests__/importTeams.test.ts", "description": "Control implementation cited in apps/worker/src/microsoft/__tests__/importTeams.test.ts." }, { "href": "apps/worker/src/microsoft/importTeams.ts", "description": "Control implementation cited in apps/worker/src/microsoft/importTeams.ts." }, { "href": "apps/worker/src/slack/__tests__/importSlack.test.ts", "description": "Control implementation cited in apps/worker/src/slack/__tests__/importSlack.test.ts." }, { "href": "apps/worker/src/slack/importSlack.ts", "description": "Control implementation cited in apps/worker/src/slack/importSlack.ts." }, { "href": "apps/worker/src/utils/__tests__/hierarchyLoaders.test.ts", "description": "Control implementation cited in apps/worker/src/utils/__tests__/hierarchyLoaders.test.ts." }, { "href": "docs/compliance/dpia-ai-document-processing.md", "description": "Control implementation cited in docs/compliance/dpia-ai-document-processing.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "d6004e1c-73d3-5e3a-8248-f5f4e3b18a2e", "description": "Cited code evidence for \"Allocate employment-law compliance to the controller in the DPA and name the instruments\" (Employee Monitoring): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/data-processing-agreement-b2b.md", "description": "Control implementation cited in docs/compliance/data-processing-agreement-b2b.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "b9304363-f72c-5798-bff1-a62b02b9e9d7", "description": "Cited code evidence for \"Process connected employee data only on documented controller instruction\" (Employee Monitoring): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/data-processing-agreement-b2b.md", "description": "Control implementation cited in docs/compliance/data-processing-agreement-b2b.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "3e7d238c-4f8c-5b30-9692-39053f7a6638", "description": "Cited code evidence for \"Provide in-product transparency surfaces and an admin compliance kill-switch\" (Employee Monitoring): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/components/settings/KnowledgeBaseSettings.tsx", "description": "Control implementation cited in apps/web/components/settings/KnowledgeBaseSettings.tsx." }, { "href": "packages/shared/src/__tests__/guard-kit.test.ts", "description": "Control implementation cited in packages/shared/src/__tests__/guard-kit.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "a9361428-ff29-5c5f-bb0f-c2cde061a584", "description": "Cited code evidence for \"Synthetic or anonymised data outside production\" (GDPR): 6 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/non-production-data-exception-log.md", "description": "Control implementation cited in docs/compliance/non-production-data-exception-log.md." }, { "href": "docs/compliance/non-production-data-policy.md", "description": "Control implementation cited in docs/compliance/non-production-data-policy.md." }, { "href": "packages/shared/__tests__/non-production-allowances.test.ts", "description": "Control implementation cited in packages/shared/__tests__/non-production-allowances.test.ts." }, { "href": "packages/shared/src/deployment-corroboration.ts", "description": "Control implementation cited in packages/shared/src/deployment-corroboration.ts." }, { "href": "scripts/ci/__tests__/check-non-production-data.test.ts", "description": "Control implementation cited in scripts/ci/__tests__/check-non-production-data.test.ts." }, { "href": "scripts/ci/check-non-production-data.ts", "description": "Control implementation cited in scripts/ci/check-non-production-data.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "fcbe4562-0c3a-50a8-a549-4d9370d383c5", "description": "Cited code evidence for \"Maintain records of processing activities (ROPA)\" (GDPR): 3 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/gdpr-art-30-register.md", "description": "Control implementation cited in docs/compliance/gdpr-art-30-register.md." }, { "href": "docs/compliance/gdpr-data-inventory.json", "description": "Control implementation cited in docs/compliance/gdpr-data-inventory.json." }, { "href": "scripts/ci/build-gdpr-inventory.ts", "description": "Control implementation cited in scripts/ci/build-gdpr-inventory.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "3bdca72c-bc63-5226-9562-48bb85ac9a53", "description": "Cited code evidence for \"Fulfil right of access (export of a data subject's data)\" (GDPR): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/export/__tests__/accountExport.test.ts", "description": "Control implementation cited in apps/worker/src/export/__tests__/accountExport.test.ts." }, { "href": "apps/worker/src/export/__tests__/exportCoverage.sweep.test.ts", "description": "Control implementation cited in apps/worker/src/export/__tests__/exportCoverage.sweep.test.ts." }, { "href": "apps/worker/src/export/accountExport.ts", "description": "Control implementation cited in apps/worker/src/export/accountExport.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "ecd56f16-b356-55f0-afb2-ca70d04545ab", "description": "Cited code evidence for \"Fulfil right to erasure across all stores\" (GDPR): 5 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/app/api/account/delete/cancel/route.ts", "description": "Control implementation cited in apps/web/app/api/account/delete/cancel/route.ts." }, { "href": "apps/worker/src/maintenance/__tests__/erasureDriver.test.ts", "description": "Control implementation cited in apps/worker/src/maintenance/__tests__/erasureDriver.test.ts." }, { "href": "apps/worker/src/maintenance/erasureDriver.ts", "description": "Control implementation cited in apps/worker/src/maintenance/erasureDriver.ts." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/erasure-cooling-off.test.ts", "description": "Control implementation cited in tests/rls/erasure-cooling-off.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "3e1c2aaf-433a-5156-a24e-b1a1c582df3c", "description": "Cited code evidence for \"Honour objection to processing\" (GDPR): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/dsar-register.test.ts", "description": "Control implementation cited in tests/rls/dsar-register.test.ts." }, { "href": "tests/rls/memory-user-switch.test.ts", "description": "Control implementation cited in tests/rls/memory-user-switch.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "f5317adf-111b-5de7-b4a9-362d8bc0b4da", "description": "Cited code evidence for \"Fulfil right to data portability\" (GDPR): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/export/__tests__/accountExport.test.ts", "description": "Control implementation cited in apps/worker/src/export/__tests__/accountExport.test.ts." }, { "href": "apps/worker/src/export/__tests__/exportCoverage.sweep.test.ts", "description": "Control implementation cited in apps/worker/src/export/__tests__/exportCoverage.sweep.test.ts." }, { "href": "apps/worker/src/export/accountExport.ts", "description": "Control implementation cited in apps/worker/src/export/accountExport.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "093918fb-a668-57d6-8afe-ba3290475897", "description": "Cited code evidence for \"Fulfil right to rectification\" (GDPR): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/api/handlers/memories.ts", "description": "Control implementation cited in apps/web/lib/api/handlers/memories.ts." }, { "href": "apps/worker/src/utils/documentUpsert.ts", "description": "Control implementation cited in apps/worker/src/utils/documentUpsert.ts." }, { "href": "tests/rls/dsar-register.test.ts", "description": "Control implementation cited in tests/rls/dsar-register.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "7a744d82-8565-5ac2-9fc7-b85a9be99858", "description": "Cited code evidence for \"Fulfil right to restriction of processing\" (GDPR): 4 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/api/handlers/memories.ts", "description": "Control implementation cited in apps/web/lib/api/handlers/memories.ts." }, { "href": "apps/worker/src/document/processDocument.ts", "description": "Control implementation cited in apps/worker/src/document/processDocument.ts." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/dsar-register.test.ts", "description": "Control implementation cited in tests/rls/dsar-register.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "401e4048-5123-5814-83ad-03ec73c0d1ce", "description": "Cited code evidence for \"Capture and allow withdrawal of consent\" (GDPR): 4 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/security/__tests__/csp.test.ts", "description": "Control implementation cited in apps/web/lib/security/__tests__/csp.test.ts." }, { "href": "apps/web/lib/security/csp.ts", "description": "Control implementation cited in apps/web/lib/security/csp.ts." }, { "href": "docs/compliance/en/cookie-policy.md", "description": "Control implementation cited in docs/compliance/en/cookie-policy.md." }, { "href": "tests/rls/waitlist.test.ts", "description": "Control implementation cited in tests/rls/waitlist.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "5a834912-f084-5f52-807c-d0c0638c0da1", "description": "Cited code evidence for \"Bind processors and subprocessors\" (GDPR): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/app/%5Blocale%5D/(marketing)/dpa/page.tsx", "description": "Control implementation cited in apps/web/app/[locale]/(marketing)/dpa/page.tsx." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "9dc88ced-a90d-51a0-8120-440978243006", "description": "Cited code evidence for \"Enforce storage limitation and retention\" (GDPR): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/shared/queue/schedules.ts", "description": "Control implementation cited in packages/shared/queue/schedules.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "2b4f4319-d4ee-5f04-84b7-5f9f6cdb59d7", "description": "Cited code evidence for \"Detect and notify personal data breaches\" (GDPR): 5 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/data-breach-notification-procedure.md", "description": "Control implementation cited in docs/compliance/data-breach-notification-procedure.md." }, { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." }, { "href": "scripts/ops/breach-register.ts", "description": "Control implementation cited in scripts/ops/breach-register.ts." }, { "href": "tests/rls/breach-notification.test.ts", "description": "Control implementation cited in tests/rls/breach-notification.test.ts." }, { "href": "tests/rls/breach-scope-reconstruction.test.ts", "description": "Control implementation cited in tests/rls/breach-scope-reconstruction.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "ab9e1496-b4d7-521b-9dad-cfa0594da0ec", "description": "Cited code evidence for \"Continuously assure access-control enforcement\" (GDPR): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/maintenance/__tests__/canaryAclProbe.test.ts", "description": "Control implementation cited in apps/worker/src/maintenance/__tests__/canaryAclProbe.test.ts." }, { "href": "apps/worker/src/maintenance/canaryAclProbe.ts", "description": "Control implementation cited in apps/worker/src/maintenance/canaryAclProbe.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "6bdc7f17-4264-5aea-bfe9-5b07d364d0e2", "description": "Control \"Scope ingestion credentials to least privilege\" (GDPR) was exercised against the running production system and held. Evidence: 3 record/source file(s), strength assessment.", "methods": [ "TEST" ], "relevant-evidence": [ { "href": "docs/compliance/db-control-assessment.json", "description": "Control implementation cited in docs/compliance/db-control-assessment.json." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-widen-scope.test.ts", "description": "Control implementation cited in tests/rls/document-acl-widen-scope.test.ts." } ], "collected": "2026-10-18T11:41:45.310Z", "expires": "2026-11-17T11:41:45.310Z" }, { "uuid": "29b1d208-6316-5b74-9a57-c5bf06d2953a", "description": "Cited code evidence for \"Enforce document permissions at query time\" (GDPR): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-enforcement.test.ts", "description": "Control implementation cited in tests/rls/document-acl-enforcement.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "7eb0cc77-2c00-5780-a74c-81dfe9576809", "description": "Cited code evidence for \"Resolve group access at query time\" (GDPR): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-truth-table.test.ts", "description": "Control implementation cited in tests/rls/document-acl-truth-table.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "63339a8b-6aa5-529e-b7be-3d91e55aba71", "description": "Cited code evidence for \"Apply appropriate technical + organisational security\" (GDPR): 5 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/app/api/documents/%5Bid%5D/stream/route.ts", "description": "Control implementation cited in apps/web/app/api/documents/[id]/stream/route.ts." }, { "href": "apps/web/app/api/documents/__tests__/stream-route.test.ts", "description": "Control implementation cited in apps/web/app/api/documents/__tests__/stream-route.test.ts." }, { "href": "apps/worker/src/utils/__tests__/storage.test.ts", "description": "Control implementation cited in apps/worker/src/utils/__tests__/storage.test.ts." }, { "href": "docs/compliance/security-measures.md", "description": "Control implementation cited in docs/compliance/security-measures.md." }, { "href": "packages/shared/src/storage/s3-config.ts", "description": "Control implementation cited in packages/shared/src/storage/s3-config.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "e2f7f4c8-6a25-5f4f-afb6-02cdade2e5bf", "description": "Control \"Enforce tenant isolation as a security measure\" (GDPR) was exercised against the running production system and held. Evidence: 3 record/source file(s), strength assessment.", "methods": [ "TEST" ], "relevant-evidence": [ { "href": "docs/compliance/db-control-assessment.json", "description": "Control implementation cited in docs/compliance/db-control-assessment.json." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-enforcement.test.ts", "description": "Control implementation cited in tests/rls/document-acl-enforcement.test.ts." } ], "collected": "2026-10-18T11:41:45.310Z", "expires": "2026-11-17T11:41:45.310Z" }, { "uuid": "815cc89d-365a-523b-a4a7-6b3642a604a0", "description": "Cited code evidence for \"Attribute customer-directed transfers (webhook destinations) correctly\" (GDPR): 2 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/webhook/docEventAggregator.ts", "description": "Control implementation cited in apps/worker/src/webhook/docEventAggregator.ts." }, { "href": "docs/compliance/data-processing-agreement-b2b.md", "description": "Control implementation cited in docs/compliance/data-processing-agreement-b2b.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "e7d66c55-9c0c-5384-896f-28d23c565164", "description": "Cited code evidence for \"Keep personal data in the EU / lawful-transfer only\" (GDPR): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/shared/src/storage/residency.ts", "description": "Control implementation cited in packages/shared/src/storage/residency.ts." }, { "href": "packages/shared/src/storage/s3-adapter.ts", "description": "Control implementation cited in packages/shared/src/storage/s3-adapter.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "f703c449-7de9-5ec7-8b8c-b495c12a5040", "description": "Cited code evidence for \"Serve a transparent privacy notice\" (GDPR): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/app/%5Blocale%5D/(marketing)/privacy/page.tsx", "description": "Control implementation cited in apps/web/app/[locale]/(marketing)/privacy/page.tsx." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "84219831-6f9c-55f4-a840-6995e50bf1b6", "description": "Cited code evidence for \"Report significant incidents on the NIS2 clock\" (NIS2): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "0782ca21-a814-54e8-b2e5-866607e1fb0c", "description": "Cited code evidence for \"Access control, MFA, and asset management\" (NIS2): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "5fe1ecd6-8c06-51c9-9222-d5c64abaf0c6", "description": "Cited code evidence for \"Incident handling\" (NIS2): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "26a61653-ce4f-5109-8d45-94d6c20d4f0c", "description": "Control \"Assess effectiveness of security measures\" (NIS2) was exercised against the running production system and held. Evidence: 2 record/source file(s), strength assessment.", "methods": [ "TEST" ], "relevant-evidence": [ { "href": "docs/compliance/db-control-assessment.json", "description": "Control implementation cited in docs/compliance/db-control-assessment.json." }, { "href": "docs/compliance/security-measures.md", "description": "Control implementation cited in docs/compliance/security-measures.md." } ], "collected": "2026-10-18T11:41:45.310Z", "expires": "2026-11-17T11:41:45.310Z" }, { "uuid": "0a462d0f-80ea-5dec-b78b-48ee1665fd6d", "description": "Cited code evidence for \"Secure development and vulnerability handling\" (NIS2): 2 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "SECURITY.md", "description": "Control implementation cited in SECURITY.md." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "3aa239e0-d51c-5b60-b35b-1754bc13d002", "description": "Cited code evidence for \"Supply-chain security\" (NIS2): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".npmrc", "description": "Control implementation cited in .npmrc." }, { "href": "bunfig.toml", "description": "Control implementation cited in bunfig.toml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "d2ab09cc-b044-54a7-b3b4-f58400e38b4a", "description": "Cited code evidence for \"Apply the Annex technical and methodological measures, proportionately and documented\" (NIS2 Impl Reg): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/security-measures.md", "description": "Control implementation cited in docs/compliance/security-measures.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "b480670f-b6e0-5480-8941-3b7573a2e3af", "description": "Cited code evidence for \"Prevent tenant data and system-prompt leakage through generated output\" (NIST AI 600-1): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/chat/__tests__/output-guard.test.ts", "description": "Control implementation cited in apps/web/lib/chat/__tests__/output-guard.test.ts." }, { "href": "apps/web/lib/chat/output-guard.ts", "description": "Control implementation cited in apps/web/lib/chat/output-guard.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "dec14cab-605f-5578-9d08-f43e2528c9f4", "description": "Cited code evidence for \"Gate abusive and jailbreak input before generation\" (NIST AI 600-1): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/chat/__tests__/chat-turn.test.ts", "description": "Control implementation cited in apps/web/lib/chat/__tests__/chat-turn.test.ts." }, { "href": "apps/web/lib/chat/chat-turn.ts", "description": "Control implementation cited in apps/web/lib/chat/chat-turn.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "369ebfac-bc0b-5da9-9110-1268efaa4d0d", "description": "Cited code evidence for \"Verify generated claims against the retrieved sources they cite\" (NIST AI 600-1): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/chat/__tests__/citation-verification.test.ts", "description": "Control implementation cited in apps/web/lib/chat/__tests__/citation-verification.test.ts." }, { "href": "apps/web/lib/chat/citation-verification.ts", "description": "Control implementation cited in apps/web/lib/chat/citation-verification.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "c6923613-2a95-59d9-9e94-b439dce873dd", "description": "Cited code evidence for \"Mark AI-generated artifacts with machine-readable provenance\" (NIST AI 600-1): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/shared/src/__tests__/ai-provenance.test.ts", "description": "Control implementation cited in packages/shared/src/__tests__/ai-provenance.test.ts." }, { "href": "packages/shared/src/ai-provenance.ts", "description": "Control implementation cited in packages/shared/src/ai-provenance.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "7c76f230-b99a-592d-b02e-b30d552ae3c9", "description": "Cited code evidence for \"Defend the generation pipeline against direct and indirect prompt injection\" (NIST AI 600-1): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/chat/__tests__/injection-eval.test.ts", "description": "Control implementation cited in apps/web/lib/chat/__tests__/injection-eval.test.ts." }, { "href": "apps/web/lib/chat/output-guard.ts", "description": "Control implementation cited in apps/web/lib/chat/output-guard.ts." }, { "href": "apps/web/lib/chat/xml-escape.ts", "description": "Control implementation cited in apps/web/lib/chat/xml-escape.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "ff7bf516-58c1-503d-b5fc-78b2e68f9ea4", "description": "Cited code evidence for \"Understand and document the AI legal and regulatory requirements we are subject to\" (NIST AI RMF): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/compliance-intelligence/catalog/frameworks.json", "description": "Control implementation cited in packages/compliance-intelligence/catalog/frameworks.json." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "8a60222d-1dbb-5f4a-8998-16d0a699b9cb", "description": "Cited code evidence for \"Define and document human oversight of AI output\" (NIST AI RMF): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/chat/citation-validator.ts", "description": "Control implementation cited in apps/web/lib/chat/citation-validator.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "3526e98b-5a7b-5291-b5dc-489a11790e73", "description": "Cited code evidence for \"Measure AI performance with defined test sets and metrics\" (NIST AI RMF): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "scripts/eval/embedding/metrics.ts", "description": "Control implementation cited in scripts/eval/embedding/metrics.ts." }, { "href": "scripts/eval/eval-retrieval.ts", "description": "Control implementation cited in scripts/eval/eval-retrieval.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "3772b3b1-436c-58c4-a613-076449821556", "description": "Cited code evidence for \"Monitor the AI system after deployment\" (NIST AI RMF): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/utils/tracing.ts", "description": "Control implementation cited in apps/worker/src/utils/tracing.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "07c141ec-76cc-580f-8f2a-15f4daa1b104", "description": "Cited code evidence for \"Examine the AI system's privacy risk\" (NIST AI RMF): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "c2277095-5c7f-5a38-b4c9-0062b84378ca", "description": "Cited code evidence for \"Handle failures and incidents in third-party AI dependencies\" (NIST AI RMF): 2 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/utils/circuitBreaker.ts", "description": "Control implementation cited in apps/worker/src/utils/circuitBreaker.ts." }, { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "420c1d7a-0866-56a6-afbc-57a5723def87", "description": "Cited code evidence for \"Manage third-party and pre-trained model risk\" (NIST AI RMF): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "scripts/eval/eval-model-compare.ts", "description": "Control implementation cited in scripts/eval/eval-model-compare.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "4ec5a9a8-5171-5e72-be58-2a9bdb857d43", "description": "Cited code evidence for \"Make AI output explainable and traceable to its sources\" (NIST AI RMF): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/chat/citation-validator.ts", "description": "Control implementation cited in apps/web/lib/chat/citation-validator.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "a9f93385-bee6-5d28-bd42-cf58e46f69f4", "description": "Cited code evidence for \"Detect: monitor for and analyze adverse events\" (NIST CSF 2.0): 2 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/logging.ts", "description": "Control implementation cited in apps/web/lib/logging.ts." }, { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "e993b396-44c6-51aa-ba0e-61fddd6072fb", "description": "Cited code evidence for \"Govern: understand obligations and manage cybersecurity + supply-chain risk\" (NIST CSF 2.0): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/security-measures.md", "description": "Control implementation cited in docs/compliance/security-measures.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "dea06767-027d-5999-a264-4a7e18016591", "description": "Cited code evidence for \"Identify: inventory assets and identify vulnerabilities\" (NIST CSF 2.0): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "4e1ce0fb-feae-5da9-9806-1c5d637a5797", "description": "Cited code evidence for \"Protect: identity, access control, and data security\" (NIST CSF 2.0): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "0042db91-a4ab-5915-81f2-720d0c2592b1", "description": "Cited code evidence for \"Respond: execute incident response and root-cause analysis\" (NIST CSF 2.0): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "b071267f-d867-58ed-ba3a-dff638a297a8", "description": "Cited code evidence for \"Apply engineering rigor in proportion to the worst consequence\" (NIST SP 800-160): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "packages/compliance-intelligence/src/__tests__/assessment.test.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/__tests__/assessment.test.ts." }, { "href": "packages/compliance-intelligence/src/subprocessors/assessment.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/subprocessors/assessment.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "6ed0f566-bbe2-57b7-ad3d-ac520256b74e", "description": "Cited code evidence for \"Base every trustworthiness judgment on evidence\" (NIST SP 800-160): 2 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "packages/compliance-intelligence/src/verify.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/verify.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "9a1caf2c-0934-5d46-8e00-c60d496db487", "description": "Cited code evidence for \"Detect departures from design intent early enough to respond\" (NIST SP 800-160): 4 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/maintenance/canaryAclProbe.ts", "description": "Control implementation cited in apps/worker/src/maintenance/canaryAclProbe.ts." }, { "href": "apps/worker/src/maintenance/logReview.ts", "description": "Control implementation cited in apps/worker/src/maintenance/logReview.ts." }, { "href": "scripts/ci/check-log-review.ts", "description": "Control implementation cited in scripts/ci/check-log-review.ts." }, { "href": "tests/rls/audit-log-immutability.test.ts", "description": "Control implementation cited in tests/rls/audit-log-immutability.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "501d8139-384b-51a2-b005-0740bd315b4a", "description": "Cited code evidence for \"Match the force and speed of a response to the loss scenario\" (NIST SP 800-160): 3 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." }, { "href": "packages/compliance-intelligence/incidents/drills.json", "description": "Control implementation cited in packages/compliance-intelligence/incidents/drills.json." }, { "href": "packages/compliance-intelligence/src/incidents/drill.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/incidents/drill.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "68ba5f1d-bb66-5da1-9702-ccca79d4c45a", "description": "Cited code evidence for \"Give each element the functions it needs and no more\" (NIST SP 800-160): 4 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "infra/interim/Caddyfile", "description": "Control implementation cited in infra/interim/Caddyfile." }, { "href": "infra/interim/nftables.conf", "description": "Control implementation cited in infra/interim/nftables.conf." }, { "href": "packages/shared/__tests__/egress.test.ts", "description": "Control implementation cited in packages/shared/__tests__/egress.test.ts." }, { "href": "packages/shared/src/egress.ts", "description": "Control implementation cited in packages/shared/src/egress.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "c86bd5b5-58e4-5bc6-a2bd-d966a577ac92", "description": "Cited code evidence for \"Keep resources available only while they are needed\" (NIST SP 800-160): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "scripts/ci/__tests__/retention-ledger.sweep.test.ts", "description": "Control implementation cited in scripts/ci/__tests__/retention-ledger.sweep.test.ts." }, { "href": "scripts/ci/retention-ledger.ts", "description": "Control implementation cited in scripts/ci/retention-ledger.ts." }, { "href": "tests/rls/audit-log-retention.test.ts", "description": "Control implementation cited in tests/rls/audit-log-retention.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "65ea1d83-d3f9-5c2c-8885-edfa9f2cb726", "description": "Cited code evidence for \"Depend on as few trusted elements as practicable\" (NIST SP 800-160): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "bunfig.toml", "description": "Control implementation cited in bunfig.toml." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "packages/compliance-intelligence/subprocessors/registry.json", "description": "Control implementation cited in packages/compliance-intelligence/subprocessors/registry.json." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "dba1b633-aaeb-5b1f-b58d-96644225b0a0", "description": "Cited code evidence for \"Reveal as little about the system as practicable\" (NIST SP 800-160): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "infra/interim/Caddyfile", "description": "Control implementation cited in infra/interim/Caddyfile." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "4ee6e11e-1af2-5587-9231-fd3af62be502", "description": "Cited code evidence for \"Keep the design as simple as practicable\" (NIST SP 800-160): 2 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "package.json", "description": "Control implementation cited in package.json." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "871886a0-483d-5b7d-85e0-01f1c616d59b", "description": "Control \"Separate domains with different protection needs\" (NIST SP 800-160) was exercised against the running production system and held. Evidence: 4 record/source file(s), strength assessment.", "methods": [ "TEST" ], "relevant-evidence": [ { "href": "docs/compliance/db-control-assessment.json", "description": "Control implementation cited in docs/compliance/db-control-assessment.json." }, { "href": "packages/console-api/src/pool.ts", "description": "Control implementation cited in packages/console-api/src/pool.ts." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-enforcement.test.ts", "description": "Control implementation cited in tests/rls/document-acl-enforcement.test.ts." } ], "collected": "2026-10-18T11:41:45.310Z", "expires": "2026-11-17T11:41:45.310Z" }, { "uuid": "5ed39ee2-8269-51e7-bdb2-367f07bc817f", "description": "Cited code evidence for \"Allocate each element only the privileges its functions need\" (NIST SP 800-160): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/console-api/src/pool.ts", "description": "Control implementation cited in packages/console-api/src/pool.ts." }, { "href": "scripts/ci/check-operator-accounts.ts", "description": "Control implementation cited in scripts/ci/check-operator-accounts.ts." }, { "href": "tests/rls/console-role-boundary.test.ts", "description": "Control implementation cited in tests/rls/console-role-boundary.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "72c20379-5de8-50a6-89e5-fc35a0560d22", "description": "Cited code evidence for \"Share resources among as few elements as necessary\" (NIST SP 800-160): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-enforcement.test.ts", "description": "Control implementation cited in tests/rls/document-acl-enforcement.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "558a3c1d-db6a-5903-aaa8-522d353eccd1", "description": "Cited code evidence for \"Mediate every access to and operation on an element\" (NIST SP 800-160): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "scripts/ci/check-route-auth.mjs", "description": "Control implementation cited in scripts/ci/check-route-auth.mjs." }, { "href": "tests/rls/document-acl-enforcement.test.ts", "description": "Control implementation cited in tests/rls/document-acl-enforcement.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "4a4c94eb-07cd-5b3a-9afb-b0c07b3f5c83", "description": "Control \"Route control functions through a reference monitor\" (NIST SP 800-160) was exercised against the running production system and held. Evidence: 2 record/source file(s), strength assessment.", "methods": [ "TEST" ], "relevant-evidence": [ { "href": "docs/compliance/db-control-assessment.json", "description": "Control implementation cited in docs/compliance/db-control-assessment.json." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-18T11:41:45.310Z", "expires": "2026-11-17T11:41:45.310Z" }, { "uuid": "ee85d2c1-c209-5d57-a59e-79b9f4a0bd80", "description": "Cited code evidence for \"Scale protection to the worst failure of the element protected\" (NIST SP 800-160): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/compliance-intelligence/src/__tests__/risk.test.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/__tests__/risk.test.ts." }, { "href": "packages/compliance-intelligence/src/subprocessors/risk.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/subprocessors/risk.ts." }, { "href": "packages/shared/src/deployment-classification.ts", "description": "Control implementation cited in packages/shared/src/deployment-classification.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "e68517a9-a46b-5e31-83e2-0e5a369c0a4e", "description": "Cited code evidence for \"Trust an element only as far as its failure could cost\" (NIST SP 800-160): 3 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "bunfig.toml", "description": "Control implementation cited in bunfig.toml." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "packages/compliance-intelligence/subprocessors/assessments.json", "description": "Control implementation cited in packages/compliance-intelligence/subprocessors/assessments.json." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "d27df788-c6f6-5c35-96d5-11015aa0adf9", "description": "Cited code evidence for \"Keep protection unbroken for as long as it is needed\" (NIST SP 800-160): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/shared/__tests__/postgres-tls-coverage.sweep.test.ts", "description": "Control implementation cited in packages/shared/__tests__/postgres-tls-coverage.sweep.test.ts." }, { "href": "packages/shared/src/postgres/tls-policy.ts", "description": "Control implementation cited in packages/shared/src/postgres/tls-policy.ts." }, { "href": "packages/shared/src/redis/connection-policy.ts", "description": "Control implementation cited in packages/shared/src/redis/connection-policy.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "1d1c2149-76ec-5c57-9f29-0816cde3e313", "description": "Cited code evidence for \"Layer independent mechanisms so one failure is not the loss\" (NIST SP 800-160): 5 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/proxy.ts", "description": "Control implementation cited in apps/web/proxy.ts." }, { "href": "infra/interim/Caddyfile", "description": "Control implementation cited in infra/interim/Caddyfile." }, { "href": "infra/interim/nftables.conf", "description": "Control implementation cited in infra/interim/nftables.conf." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-enforcement.test.ts", "description": "Control implementation cited in tests/rls/document-acl-enforcement.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "c35fbde4-7157-509d-afcb-13003848c6e6", "description": "Cited code evidence for \"Operate well clear of the threshold where loss begins\" (NIST SP 800-160): 3 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/api/orpc-middleware.ts", "description": "Control implementation cited in apps/web/lib/api/orpc-middleware.ts." }, { "href": "infra/interim/Caddyfile", "description": "Control implementation cited in infra/interim/Caddyfile." }, { "href": "scripts/deploy/edge-allowlist.ts", "description": "Control implementation cited in scripts/deploy/edge-allowlist.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "8272027a-c791-5ba3-9118-71e732a89581", "description": "Cited code evidence for \"Ship the most protective configuration as the default\" (NIST SP 800-160): 4 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/env.ts", "description": "Control implementation cited in apps/web/lib/env.ts." }, { "href": "infra/interim/nftables.conf", "description": "Control implementation cited in infra/interim/nftables.conf." }, { "href": "packages/shared/__tests__/postgres-tls-policy.test.ts", "description": "Control implementation cited in packages/shared/__tests__/postgres-tls-policy.test.ts." }, { "href": "packages/shared/src/postgres/tls-policy.ts", "description": "Control implementation cited in packages/shared/src/postgres/tls-policy.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "34bbdd4b-df1e-5bb3-a497-9b3314a0b3f6", "description": "Cited code evidence for \"Fail into a safe state\" (NIST SP 800-160): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/shared/__tests__/egress.test.ts", "description": "Control implementation cited in packages/shared/__tests__/egress.test.ts." }, { "href": "packages/shared/src/egress.ts", "description": "Control implementation cited in packages/shared/src/egress.ts." }, { "href": "scripts/deploy/__tests__/edge-allowlist.test.ts", "description": "Control implementation cited in scripts/deploy/__tests__/edge-allowlist.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "d8460584-6dbd-59ea-8108-62627ea146a6", "description": "Cited code evidence for \"Keep the abstractions that describe the system simple and exact\" (NIST SP 800-160): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/compliance-intelligence/oxlint.config.mts", "description": "Control implementation cited in packages/compliance-intelligence/oxlint.config.mts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "6c552cb0-ce21-5952-877f-784bd90347aa", "description": "Cited code evidence for \"Deploy and operate a secure development toolchain\" (NIST SSDF): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "ffbc6561-f10b-50c0-ba51-e6a690b1d2f3", "description": "Cited code evidence for \"Acquire and verify well-secured third-party components\" (NIST SSDF): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." }, { "href": "bunfig.toml", "description": "Control implementation cited in bunfig.toml." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "179b6c1f-20a5-5f22-96a8-0eff3bd41866", "description": "Cited code evidence for \"Review and analyze code against secure coding standards\" (NIST SSDF): 2 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "scripts/ci/sast-changed.mjs", "description": "Control implementation cited in scripts/ci/sast-changed.mjs." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "22e4e9bf-07ec-561d-abd6-6c6668ef3594", "description": "Cited code evidence for \"Test executable code and triage findings\" (NIST SSDF): 1 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "91b93e46-adbb-5784-9d5a-06007d3995c1", "description": "Cited code evidence for \"Ship secure-by-default settings\" (NIST SSDF): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/env.ts", "description": "Control implementation cited in apps/web/lib/env.ts." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "393edc4a-1022-53a9-aa09-f9330826e9e1", "description": "Cited code evidence for \"Protect stored code from unauthorized access and tampering\" (NIST SSDF): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "868186a5-98e2-553e-a407-0866366923df", "description": "Cited code evidence for \"Maintain a vulnerability disclosure and remediation policy\" (NIST SSDF): 2 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "SECURITY.md", "description": "Control implementation cited in SECURITY.md." }, { "href": "apps/web/public/.well-known/security.txt", "description": "Control implementation cited in apps/web/public/.well-known/security.txt." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "a743c828-31fa-57f8-b019-9fe836aa5499", "description": "Cited code evidence for \"Identify vulnerabilities in code and third-party components on an ongoing basis\" (NIST SSDF): 2 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "SECURITY.md", "description": "Control implementation cited in SECURITY.md." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "620c0ef6-ea9e-54cd-924f-c0b078670381", "description": "Cited code evidence for \"Rate limiting and anti-automation controls\" (OWASP ASVS): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/api/__tests__/orpc-rate-limit.test.ts", "description": "Control implementation cited in apps/web/lib/api/__tests__/orpc-rate-limit.test.ts." }, { "href": "apps/web/lib/api/orpc-middleware.ts", "description": "Control implementation cited in apps/web/lib/api/orpc-middleware.ts." }, { "href": "apps/web/lib/middleware/__tests__/rate-limit-strategy.test.ts", "description": "Control implementation cited in apps/web/lib/middleware/__tests__/rate-limit-strategy.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "1c123b29-a4e5-5938-a234-81757d450453", "description": "Control \"Enforce function- and data-level authorization at a trusted layer\" (OWASP ASVS) was exercised against the running production system and held. Evidence: 3 record/source file(s), strength assessment.", "methods": [ "TEST" ], "relevant-evidence": [ { "href": "docs/compliance/db-control-assessment.json", "description": "Control implementation cited in docs/compliance/db-control-assessment.json." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-enforcement.test.ts", "description": "Control implementation cited in tests/rls/document-acl-enforcement.test.ts." } ], "collected": "2026-10-18T11:41:45.310Z", "expires": "2026-11-17T11:41:45.310Z" }, { "uuid": "5d174201-ebac-56f6-a15f-5d4e1d27c51e", "description": "Cited code evidence for \"Classify sensitive data and bound its retention\" (OWASP ASVS): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/shared/queue/schedules.ts", "description": "Control implementation cited in packages/shared/queue/schedules.ts." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "4d7689fc-cbe4-5d52-af56-d67a6f84b12a", "description": "Cited code evidence for \"Validate uploaded files by type, extension, and size\" (OWASP ASVS): 4 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/utils/__tests__/fileValidation.test.ts", "description": "Control implementation cited in apps/worker/src/utils/__tests__/fileValidation.test.ts." }, { "href": "apps/worker/src/utils/fileValidation.ts", "description": "Control implementation cited in apps/worker/src/utils/fileValidation.ts." }, { "href": "packages/shared/__tests__/file-registry.test.ts", "description": "Control implementation cited in packages/shared/__tests__/file-registry.test.ts." }, { "href": "packages/shared/src/file-registry.ts", "description": "Control implementation cited in packages/shared/src/file-registry.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "230f6dc9-334b-57d0-8f4b-bc4c05394029", "description": "Cited code evidence for \"Protect against Server-Side Request Forgery\" (OWASP ASVS): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/utils/safeDownload.ts", "description": "Control implementation cited in apps/worker/src/utils/safeDownload.ts." }, { "href": "packages/shared/__tests__/ssrf.test.ts", "description": "Control implementation cited in packages/shared/__tests__/ssrf.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "cf14296f-e41d-5471-8eb5-5ff34cc2b56b", "description": "Cited code evidence for \"Structured security logging with correlation and no sensitive data\" (OWASP ASVS): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/logging.ts", "description": "Control implementation cited in apps/web/lib/logging.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "d1fbeab6-243a-5c0b-9150-85959c194e04", "description": "Cited code evidence for \"Manage third-party components with remediation timeframes and an SBOM\" (OWASP ASVS): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." }, { "href": "bunfig.toml", "description": "Control implementation cited in bunfig.toml." }, { "href": "scripts/deps/generate-sbom.ts", "description": "Control implementation cited in scripts/deps/generate-sbom.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "4a0bca2d-036b-5cf6-9574-33595c292e8b", "description": "Cited code evidence for \"Constrain agent functionality, permissions, and autonomy\" (OWASP LLM Top 10): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/api/v1-guc.ts", "description": "Control implementation cited in apps/web/lib/api/v1-guc.ts." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "6743b1ba-af94-5866-b1bd-49f331e4f33b", "description": "Cited code evidence for \"Protect training/RAG data integrity against poisoning\" (OWASP LLM Top 10): 2 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/chat/__tests__/injection-eval.test.ts", "description": "Control implementation cited in apps/web/lib/chat/__tests__/injection-eval.test.ts." }, { "href": "apps/web/lib/chat/xml-escape.ts", "description": "Control implementation cited in apps/web/lib/chat/xml-escape.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "a33fa9b1-1561-5029-b897-71dbd971ed15", "description": "Cited code evidence for \"Prevent unauthorized retrieval of sensitive data from the knowledge base\" (OWASP LLM Top 10): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-enforcement.test.ts", "description": "Control implementation cited in tests/rls/document-acl-enforcement.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "209fc33f-9c19-5d49-bd10-e44cd1727955", "description": "Cited code evidence for \"Partition the vector store per tenant with permission-aware retrieval\" (OWASP LLM Top 10): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-enforcement.test.ts", "description": "Control implementation cited in tests/rls/document-acl-enforcement.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "427b10b5-003a-5026-9477-4258c5c8cdf7", "description": "Cited code evidence for \"Ground answers and surface source citations to counter hallucination\" (OWASP LLM Top 10): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/chat/citation-coverage.ts", "description": "Control implementation cited in apps/web/lib/chat/citation-coverage.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "c5b95dba-ba2c-59f7-a0f5-d9077de52fc2", "description": "Cited code evidence for \"Mitigate direct and indirect prompt injection\" (OWASP LLM Top 10): 5 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/chat/__tests__/injection-eval.test.ts", "description": "Control implementation cited in apps/web/lib/chat/__tests__/injection-eval.test.ts." }, { "href": "apps/web/lib/chat/__tests__/output-guard.test.ts", "description": "Control implementation cited in apps/web/lib/chat/__tests__/output-guard.test.ts." }, { "href": "apps/web/lib/chat/output-guard.ts", "description": "Control implementation cited in apps/web/lib/chat/output-guard.ts." }, { "href": "apps/web/lib/chat/xml-escape.ts", "description": "Control implementation cited in apps/web/lib/chat/xml-escape.ts." }, { "href": "scripts/eval/eval-injection.ts", "description": "Control implementation cited in scripts/eval/eval-injection.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "6d6fb312-d012-5027-a711-e6ba4f9b0bb2", "description": "Cited code evidence for \"Handle model output as untrusted before downstream use\" (OWASP LLM Top 10): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/chat/citation-validator.ts", "description": "Control implementation cited in apps/web/lib/chat/citation-validator.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "869f992f-a499-5c25-adce-bedbcfee939e", "description": "Cited code evidence for \"Keep secrets and authorization out of the system prompt\" (OWASP LLM Top 10): 4 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/chat/__tests__/output-guard.test.ts", "description": "Control implementation cited in apps/web/lib/chat/__tests__/output-guard.test.ts." }, { "href": "apps/web/lib/chat/output-guard.ts", "description": "Control implementation cited in apps/web/lib/chat/output-guard.ts." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "351bf4a9-9bc9-5e15-a718-7f21eff0d18e", "description": "Cited code evidence for \"Bound inference consumption with rate limits and quotas\" (OWASP LLM Top 10): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/api/orpc-middleware.ts", "description": "Control implementation cited in apps/web/lib/api/orpc-middleware.ts." }, { "href": "apps/worker/src/utils/__tests__/embeddingQuota.test.ts", "description": "Control implementation cited in apps/worker/src/utils/__tests__/embeddingQuota.test.ts." }, { "href": "apps/worker/src/utils/embeddingQuota.ts", "description": "Control implementation cited in apps/worker/src/utils/embeddingQuota.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "881f055e-64db-57bc-8098-0287d3397919", "description": "Cited code evidence for \"Secure the model and dependency supply chain\" (OWASP LLM Top 10): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." }, { "href": "bunfig.toml", "description": "Control implementation cited in bunfig.toml." }, { "href": "scripts/deps/license-policy.ts", "description": "Control implementation cited in scripts/deps/license-policy.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "a5670b8f-c2b4-59a4-bc3a-313c27e5b0d4", "description": "Control \"Prevent broken access control\" (OWASP Top 10) was exercised against the running production system and held. Evidence: 3 record/source file(s), strength assessment.", "methods": [ "TEST" ], "relevant-evidence": [ { "href": "docs/compliance/db-control-assessment.json", "description": "Control implementation cited in docs/compliance/db-control-assessment.json." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-enforcement.test.ts", "description": "Control implementation cited in tests/rls/document-acl-enforcement.test.ts." } ], "collected": "2026-10-18T11:41:45.310Z", "expires": "2026-11-17T11:41:45.310Z" }, { "uuid": "e9fa2905-c9ce-59e9-b5fb-e898b65862c0", "description": "Cited code evidence for \"Harden identification and authentication\" (OWASP Top 10): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/api/orpc-middleware.ts", "description": "Control implementation cited in apps/web/lib/api/orpc-middleware.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "bf065053-7e0b-5013-b145-ea96e662f3f2", "description": "Cited code evidence for \"Avoid security misconfiguration\" (OWASP Top 10): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/env.ts", "description": "Control implementation cited in apps/web/lib/env.ts." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "b939dc3b-6c7a-525e-b6cc-bb39515c30a4", "description": "Cited code evidence for \"Protect software and data integrity\" (OWASP Top 10): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." }, { "href": "bunfig.toml", "description": "Control implementation cited in bunfig.toml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "31bbba6f-23a0-519a-b47b-f0e83776f1e7", "description": "Cited code evidence for \"Ensure security logging and monitoring\" (OWASP Top 10): 2 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/logging.ts", "description": "Control implementation cited in apps/web/lib/logging.ts." }, { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "c9b3b62f-2aae-5b83-a5a6-6037860d9a35", "description": "Cited code evidence for \"Prevent Server-Side Request Forgery\" (OWASP Top 10): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/utils/__tests__/safeDownload.test.ts", "description": "Control implementation cited in apps/worker/src/utils/__tests__/safeDownload.test.ts." }, { "href": "apps/worker/src/utils/safeDownload.ts", "description": "Control implementation cited in apps/worker/src/utils/safeDownload.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "3687ad7f-df8b-5b68-af55-1a9aed581435", "description": "Cited code evidence for \"Manage vulnerable and outdated components\" (OWASP Top 10): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." }, { "href": "bunfig.toml", "description": "Control implementation cited in bunfig.toml." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "5549b5b8-f469-5e13-99bc-c87dfbe7e752", "description": "Cited code evidence for \"Safeguard user data against corruption and loss\" (PLD): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "92fd9ff3-cdab-5666-b6e9-4964968ec312", "description": "Cited code evidence for \"Preserve records so relevant evidence can be disclosed\" (PLD): 2 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/logging.ts", "description": "Control implementation cited in apps/web/lib/logging.ts." }, { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "4ab3ca90-884b-5a0e-8e95-ac707fc24de5", "description": "Cited code evidence for \"Meet safety-relevant cybersecurity requirements to avoid presumed defectiveness\" (PLD): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/security-measures.md", "description": "Control implementation cited in docs/compliance/security-measures.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "64517ac0-0722-5379-be28-c1a27affb3db", "description": "Cited code evidence for \"Supply the security updates needed to maintain safety\" (PLD): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." }, { "href": "bunfig.toml", "description": "Control implementation cited in bunfig.toml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "a8013b03-6181-51bc-84a6-a4507fc0cf47", "description": "Cited code evidence for \"Market without creating confusion with a competitor's products or marks\" (UCPD): 4 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/compare/__tests__/compare.test.ts", "description": "Control implementation cited in apps/web/lib/compare/__tests__/compare.test.ts." }, { "href": "apps/web/lib/compare/comparative-claims.ts", "description": "Control implementation cited in apps/web/lib/compare/comparative-claims.ts." }, { "href": "apps/web/lib/compare/competitors.ts", "description": "Control implementation cited in apps/web/lib/compare/competitors.ts." }, { "href": "scripts/ci/comparative-claims.ts", "description": "Control implementation cited in scripts/ci/comparative-claims.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "839b4859-9453-558f-9ea8-3fd6e89df6e3", "description": "Cited code evidence for \"Publish none of the per-se unfair practices\" (UCPD): 6 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "packages/compliance-intelligence/claims/environmental-claims.json", "description": "Control implementation cited in packages/compliance-intelligence/claims/environmental-claims.json." }, { "href": "packages/compliance-intelligence/claims/lexicon.json", "description": "Control implementation cited in packages/compliance-intelligence/claims/lexicon.json." }, { "href": "packages/compliance-intelligence/trust-snapshot.json", "description": "Control implementation cited in packages/compliance-intelligence/trust-snapshot.json." }, { "href": "scripts/ci/__tests__/check-green-claims.test.ts", "description": "Control implementation cited in scripts/ci/__tests__/check-green-claims.test.ts." }, { "href": "scripts/ci/check-green-claims.ts", "description": "Control implementation cited in scripts/ci/check-green-claims.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "2fad230c-401f-5053-a8f6-3036626c835a", "description": "Cited code evidence for \"Publish no false or deceptive statement about the product, the price or the trader\" (UCPD): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/compliance-intelligence/claims/registry.json", "description": "Control implementation cited in packages/compliance-intelligence/claims/registry.json." }, { "href": "scripts/ci/__tests__/check-claims.test.ts", "description": "Control implementation cited in scripts/ci/__tests__/check-claims.test.ts." }, { "href": "scripts/ci/check-claims.ts", "description": "Control implementation cited in scripts/ci/check-claims.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "bbab14fa-237d-5ed5-bed1-98038a8376ec", "description": "Cited code evidence for \"State the material information at the invitation to purchase\" (UCPD): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/billing/plan-views.ts", "description": "Control implementation cited in apps/web/lib/billing/plan-views.ts." }, { "href": "apps/web/lib/brand.ts", "description": "Control implementation cited in apps/web/lib/brand.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "24a7e1e2-807c-5c40-a0da-0adb6e65378e", "description": "Cited code evidence for \"Treat every published marketing sentence as a B2C commercial practice\" (UCPD): 2 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "scripts/ci/check-claims.ts", "description": "Control implementation cited in scripts/ci/check-claims.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "2874529d-96fb-55bc-b90d-65a311faeeb4", "description": "Cited code evidence for \"Hold the evidence for every factual marketing claim, ready on demand\" (UCPD): 4 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "packages/compliance-intelligence/claims/registry.json", "description": "Control implementation cited in packages/compliance-intelligence/claims/registry.json." }, { "href": "scripts/ci/__tests__/comparative-claims.test.ts", "description": "Control implementation cited in scripts/ci/__tests__/comparative-claims.test.ts." }, { "href": "scripts/ci/comparative-claims.ts", "description": "Control implementation cited in scripts/ci/comparative-claims.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "76a2627b-2135-5a40-94d4-833ac0c54331", "description": "Cited code evidence for \"Keep what a sustainability report says apart from what marketing may claim\" (VSME): 4 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "packages/compliance-intelligence/claims/environmental-claims.json", "description": "Control implementation cited in packages/compliance-intelligence/claims/environmental-claims.json." }, { "href": "scripts/ci/__tests__/check-green-claims.test.ts", "description": "Control implementation cited in scripts/ci/__tests__/check-green-claims.test.ts." }, { "href": "scripts/ci/check-green-claims.ts", "description": "Control implementation cited in scripts/ci/check-green-claims.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "322c3199-7af9-5325-acc2-61ab9d13987e", "description": "Cited code evidence for \"Enforce an automated WCAG 2.2 AA scan over key surfaces in CI\" (WCAG 2.2): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/e2e.yml", "description": "Control implementation cited in .github/workflows/e2e.yml." }, { "href": "apps/web/e2e/support/axe.ts", "description": "Control implementation cited in apps/web/e2e/support/axe.ts." }, { "href": "apps/web/e2e/support/wcag.ts", "description": "Control implementation cited in apps/web/e2e/support/wcag.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "63128753-5751-59b1-b8c1-a7fda82a8e9c", "description": "Cited code evidence for \"Say which checkpoints carry a stamp, and claim nothing more\" (eIDAS): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/app/api/trust/__tests__/audit-chain-route.test.ts", "description": "Control implementation cited in apps/web/app/api/trust/__tests__/audit-chain-route.test.ts." }, { "href": "apps/web/lib/trust/audit-chain.ts", "description": "Control implementation cited in apps/web/lib/trust/audit-chain.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "49baf54c-dd57-5054-b1b5-abaa53a6fcc2", "description": "Cited code evidence for \"Anchor audit-chain checkpoints with a qualified electronic time stamp\" (eIDAS): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/maintenance/__tests__/auditChain.test.ts", "description": "Control implementation cited in apps/worker/src/maintenance/__tests__/auditChain.test.ts." }, { "href": "packages/shared/src/__tests__/rfc3161.test.ts", "description": "Control implementation cited in packages/shared/src/__tests__/rfc3161.test.ts." }, { "href": "tests/rls/audit-chain.test.ts", "description": "Control implementation cited in tests/rls/audit-chain.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "605acdf6-9dac-575e-8459-dac6781faf34", "description": "Cited code evidence for \"Verify the stamp's binding to the data before relying on it\" (eIDAS): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/maintenance/__tests__/auditChain.test.ts", "description": "Control implementation cited in apps/worker/src/maintenance/__tests__/auditChain.test.ts." }, { "href": "packages/shared/src/__tests__/rfc3161.test.ts", "description": "Control implementation cited in packages/shared/src/__tests__/rfc3161.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "b39a99ad-a85e-5b9b-be4d-68caf9798ffb", "description": "Cited code evidence for \"Confidentiality of communications and usage\" (ePrivacy): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "038c701c-3b72-50eb-8253-a95daa90bfec", "description": "Cited code evidence for \"Consent before non-essential storage or access on the user's device\" (ePrivacy): 3 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/security/__tests__/csp.test.ts", "description": "Control implementation cited in apps/web/lib/security/__tests__/csp.test.ts." }, { "href": "apps/web/lib/security/csp.ts", "description": "Control implementation cited in apps/web/lib/security/csp.ts." }, { "href": "docs/compliance/en/cookie-policy.md", "description": "Control implementation cited in docs/compliance/en/cookie-policy.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "2ad6309b-3391-5bc9-aaf5-06343c1eecdb", "description": "Cited code evidence for \"Opt-in for unsolicited electronic marketing\" (ePrivacy): 5 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/app/api/waitlist/__tests__/waitlist-routes.test.ts", "description": "Control implementation cited in apps/web/app/api/waitlist/__tests__/waitlist-routes.test.ts." }, { "href": "apps/web/app/api/waitlist/route.ts", "description": "Control implementation cited in apps/web/app/api/waitlist/route.ts." }, { "href": "apps/worker/src/maintenance/__tests__/weeklyBriefing.test.ts", "description": "Control implementation cited in apps/worker/src/maintenance/__tests__/weeklyBriefing.test.ts." }, { "href": "apps/worker/src/maintenance/weeklyBriefing.ts", "description": "Control implementation cited in apps/worker/src/maintenance/weeklyBriefing.ts." }, { "href": "docs/compliance/en/privacy-policy.md", "description": "Control implementation cited in docs/compliance/en/privacy-policy.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "a57014ff-52d2-5c19-bf0b-462fa3ef13cc", "description": "Cited code evidence for \"Security of the service\" (ePrivacy): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/security-measures.md", "description": "Control implementation cited in docs/compliance/security-measures.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "ff4fad20-8c72-51d3-98fc-9763160bdb62", "description": "Cited code evidence for \"Encrypt customer data in transit and at rest\" (BSI C5): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/utils/__tests__/storage.test.ts", "description": "Control implementation cited in apps/worker/src/utils/__tests__/storage.test.ts." }, { "href": "packages/shared/src/storage/s3-config.ts", "description": "Control implementation cited in packages/shared/src/storage/s3-config.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "277d0236-440e-5f6e-92fe-e251e0a3c9dd", "description": "Control \"Isolate tenants with database-enforced logical access control\" (BSI C5) was exercised against the running production system and held. Evidence: 3 record/source file(s), strength assessment.", "methods": [ "TEST" ], "relevant-evidence": [ { "href": "docs/compliance/db-control-assessment.json", "description": "Control implementation cited in docs/compliance/db-control-assessment.json." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-enforcement.test.ts", "description": "Control implementation cited in tests/rls/document-acl-enforcement.test.ts." } ], "collected": "2026-10-18T11:41:45.310Z", "expires": "2026-11-17T11:41:45.310Z" }, { "uuid": "6ccef006-9f26-506c-a809-624d41fb4e00", "description": "Cited code evidence for \"Operate a reachable security-incident intake channel\" (BSI C5): 3 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "SECURITY.md", "description": "Control implementation cited in SECURITY.md." }, { "href": "apps/web/public/.well-known/security.txt", "description": "Control implementation cited in apps/web/public/.well-known/security.txt." }, { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "1a7a81b9-3c5e-5ac5-a0aa-40770b5bbd10", "description": "Cited code evidence for \"Record security-relevant events in a tamper-protected audit trail\" (BSI C5): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/audit-log-immutability.test.ts", "description": "Control implementation cited in tests/rls/audit-log-immutability.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "c15b63c7-afd1-593e-af50-48bab6edacf3", "description": "Cited code evidence for \"Detect and remediate known vulnerabilities in dependencies\" (BSI C5): 4 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." }, { "href": "SECURITY.md", "description": "Control implementation cited in SECURITY.md." }, { "href": "bunfig.toml", "description": "Control implementation cited in bunfig.toml." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "4090f861-a8b6-55a8-a64e-b7ed6e04aefd", "description": "Cited code evidence for \"Disclose subservice providers with per-entity transfer basis and enforce the register in CI\" (BSI C5): 2 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." }, { "href": "packages/compliance-intelligence/subprocessors/registry.json", "description": "Control implementation cited in packages/compliance-intelligence/subprocessors/registry.json." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "31416333-d3dd-52d8-9590-2a643892a95d", "description": "Cited code evidence for \"Defined process for granting and revoking access\" (CIS Controls): 5 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/auth/__tests__/session-revocation.test.ts", "description": "Control implementation cited in apps/web/lib/auth/__tests__/session-revocation.test.ts." }, { "href": "apps/web/lib/auth/session-revocation.ts", "description": "Control implementation cited in apps/web/lib/auth/session-revocation.ts." }, { "href": "apps/web/lib/middleware/proxy-auth.ts", "description": "Control implementation cited in apps/web/lib/middleware/proxy-auth.ts." }, { "href": "apps/worker/src/maintenance/sessionUnrevoke.ts", "description": "Control implementation cited in apps/worker/src/maintenance/sessionUnrevoke.ts." }, { "href": "packages/shared/src/session-lift.ts", "description": "Control implementation cited in packages/shared/src/session-lift.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "9cc66b02-6180-5350-a28f-ba46858f4da4", "description": "Cited code evidence for \"Account inventory, dormancy sweep and separated administrative accounts\" (CIS Controls): 11 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/maintenance/__tests__/dormantApiKeys.test.ts", "description": "Control implementation cited in apps/worker/src/maintenance/__tests__/dormantApiKeys.test.ts." }, { "href": "apps/worker/src/maintenance/dormantApiKeys.ts", "description": "Control implementation cited in apps/worker/src/maintenance/dormantApiKeys.ts." }, { "href": "apps/worker/src/maintenance/ghostSweep.ts", "description": "Control implementation cited in apps/worker/src/maintenance/ghostSweep.ts." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "packages/console-api/src/pool.ts", "description": "Control implementation cited in packages/console-api/src/pool.ts." }, { "href": "scripts/ci/__tests__/check-operator-accounts.test.ts", "description": "Control implementation cited in scripts/ci/__tests__/check-operator-accounts.test.ts." }, { "href": "scripts/ci/check-operator-accounts.ts", "description": "Control implementation cited in scripts/ci/check-operator-accounts.ts." }, { "href": "scripts/ci/lib/operator-principals.ts", "description": "Control implementation cited in scripts/ci/lib/operator-principals.ts." }, { "href": "scripts/db/console-role-arms.ts", "description": "Control implementation cited in scripts/db/console-role-arms.ts." }, { "href": "tests/rls/console-role-boundary.test.ts", "description": "Control implementation cited in tests/rls/console-role-boundary.test.ts." }, { "href": "tests/rls/dormant-api-keys.test.ts", "description": "Control implementation cited in tests/rls/dormant-api-keys.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "87cbc1d2-7e85-5664-acd9-81c9e0cfb5d6", "description": "Cited code evidence for \"Multi-factor authentication on exposed and administrative access\" (CIS Controls): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/console-api/__tests__/identity-ceremony.test.ts", "description": "Control implementation cited in packages/console-api/__tests__/identity-ceremony.test.ts." }, { "href": "packages/console-api/src/identity/ceremony.ts", "description": "Control implementation cited in packages/console-api/src/identity/ceremony.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "68f6bed0-8cee-5d49-ba05-d98f6173f39d", "description": "Cited code evidence for \"Application security testing on every change\" (CIS Controls): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." }, { "href": ".github/workflows/dast.yml", "description": "Control implementation cited in .github/workflows/dast.yml." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "e11c552f-e51b-5f07-9801-5df334bd94c4", "description": "Cited code evidence for \"A secure development process with root-cause analysis and secure design defaults\" (CIS Controls): 4 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/sdlc.md", "description": "Control implementation cited in docs/compliance/sdlc.md." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "packages/shared/src/ssrf.ts", "description": "Control implementation cited in packages/shared/src/ssrf.ts." }, { "href": "scripts/ci/check-route-auth.mjs", "description": "Control implementation cited in scripts/ci/check-route-auth.mjs." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "1f54b58a-9ac8-5e5e-916b-a8a2d21cb8fb", "description": "Cited code evidence for \"Vetted components for security functions rather than hand-rolled ones\" (CIS Controls): 4 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/shared/__tests__/token-encryption.test.ts", "description": "Control implementation cited in packages/shared/__tests__/token-encryption.test.ts." }, { "href": "packages/shared/__tests__/webhook-signing.test.ts", "description": "Control implementation cited in packages/shared/__tests__/webhook-signing.test.ts." }, { "href": "packages/shared/crypto/token-encryption.ts", "description": "Control implementation cited in packages/shared/crypto/token-encryption.ts." }, { "href": "packages/shared/src/webhook-signing.ts", "description": "Control implementation cited in packages/shared/src/webhook-signing.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "fe9b21a4-ee0d-5479-9365-159e78e4cb87", "description": "Cited code evidence for \"Stated logging requirements, a retention window, and review of what is logged\" (CIS Controls): 7 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/maintenance/canaryAclProbe.ts", "description": "Control implementation cited in apps/worker/src/maintenance/canaryAclProbe.ts." }, { "href": "apps/worker/src/maintenance/dbControlAssessment.ts", "description": "Control implementation cited in apps/worker/src/maintenance/dbControlAssessment.ts." }, { "href": "apps/worker/src/maintenance/logReview.ts", "description": "Control implementation cited in apps/worker/src/maintenance/logReview.ts." }, { "href": "apps/worker/src/maintenance/partitionRetention.ts", "description": "Control implementation cited in apps/worker/src/maintenance/partitionRetention.ts." }, { "href": "packages/shared/__tests__/log-review.test.ts", "description": "Control implementation cited in packages/shared/__tests__/log-review.test.ts." }, { "href": "scripts/ci/check-log-review.ts", "description": "Control implementation cited in scripts/ci/check-log-review.ts." }, { "href": "tests/rls/partition-retention.test.ts", "description": "Control implementation cited in tests/rls/partition-retention.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "8ac10833-1fb6-51f8-bfa6-f65edd127868", "description": "Cited code evidence for \"Audit logging of access to sensitive data\" (CIS Controls): 5 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/app/api/documents/%5Bid%5D/stream/route.ts", "description": "Control implementation cited in apps/web/app/api/documents/[id]/stream/route.ts." }, { "href": "apps/web/app/api/documents/__tests__/stream-route.test.ts", "description": "Control implementation cited in apps/web/app/api/documents/__tests__/stream-route.test.ts." }, { "href": "apps/web/lib/audit.ts", "description": "Control implementation cited in apps/web/lib/audit.ts." }, { "href": "packages/shared/src/audit-chain.ts", "description": "Control implementation cited in packages/shared/src/audit-chain.ts." }, { "href": "tests/rls/audit-log-immutability.test.ts", "description": "Control implementation cited in tests/rls/audit-log-immutability.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "8b48e0f4-9322-5f5b-b8e7-bedca662b2ce", "description": "Cited code evidence for \"Data classification and documented data flows\" (CIS Controls): 4 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/services.md", "description": "Control implementation cited in docs/services.md." }, { "href": "packages/compliance-intelligence/subprocessors/revisions.json", "description": "Control implementation cited in packages/compliance-intelligence/subprocessors/revisions.json." }, { "href": "packages/shared/src/deployment-classification.ts", "description": "Control implementation cited in packages/shared/src/deployment-classification.ts." }, { "href": "packages/shared/src/storage/s3-config.ts", "description": "Control implementation cited in packages/shared/src/storage/s3-config.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "d8451d8c-885f-54bf-a5bf-e6f779c0f247", "description": "Cited code evidence for \"A data-management process and an inventory of the sensitive data held\" (CIS Controls): 4 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/export/__tests__/exportCoverage.sweep.test.ts", "description": "Control implementation cited in apps/worker/src/export/__tests__/exportCoverage.sweep.test.ts." }, { "href": "docs/compliance/gdpr-art-30-register.md", "description": "Control implementation cited in docs/compliance/gdpr-art-30-register.md." }, { "href": "docs/compliance/gdpr-data-inventory.json", "description": "Control implementation cited in docs/compliance/gdpr-data-inventory.json." }, { "href": "scripts/ci/__tests__/retention-ledger.sweep.test.ts", "description": "Control implementation cited in scripts/ci/__tests__/retention-ledger.sweep.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "2cf1acd0-d0ae-548e-92da-8dbc15c0d210", "description": "Cited code evidence for \"Enforced retention and disposal\" (CIS Controls): 4 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/maintenance/sourceRetention.ts", "description": "Control implementation cited in apps/worker/src/maintenance/sourceRetention.ts." }, { "href": "scripts/ci/__tests__/retention-ledger.sweep.test.ts", "description": "Control implementation cited in scripts/ci/__tests__/retention-ledger.sweep.test.ts." }, { "href": "scripts/ci/retention-ledger.ts", "description": "Control implementation cited in scripts/ci/retention-ledger.ts." }, { "href": "tests/rls/audit-log-retention.test.ts", "description": "Control implementation cited in tests/rls/audit-log-retention.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "2363af77-f6f4-546c-ad1a-1063ecfe17bc", "description": "Cited code evidence for \"Encryption of data at rest\" (CIS Controls): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/shared/__tests__/token-encryption.test.ts", "description": "Control implementation cited in packages/shared/__tests__/token-encryption.test.ts." }, { "href": "packages/shared/crypto/token-encryption.ts", "description": "Control implementation cited in packages/shared/crypto/token-encryption.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "e106a465-3a62-5f7c-b702-b674105e4092", "description": "Cited code evidence for \"Encryption of data in transit\" (CIS Controls): 4 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/shared/__tests__/postgres-tls-coverage.sweep.test.ts", "description": "Control implementation cited in packages/shared/__tests__/postgres-tls-coverage.sweep.test.ts." }, { "href": "packages/shared/src/eu-endpoint.ts", "description": "Control implementation cited in packages/shared/src/eu-endpoint.ts." }, { "href": "packages/shared/src/postgres/tls-policy.ts", "description": "Control implementation cited in packages/shared/src/postgres/tls-policy.ts." }, { "href": "packages/shared/src/redis/connection-policy.ts", "description": "Control implementation cited in packages/shared/src/redis/connection-policy.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "6ca0b5f9-80df-5050-8dcd-d5f5a801b75b", "description": "Cited code evidence for \"Encryption of data at rest on end-user devices\" (CIS Controls): 6 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/desktop/scripts/verify-store.ts", "description": "Control implementation cited in apps/desktop/scripts/verify-store.ts." }, { "href": "apps/desktop/src/store/at-rest-conformance.ts", "description": "Control implementation cited in apps/desktop/src/store/at-rest-conformance.ts." }, { "href": "apps/desktop/src/store/cipher.ts", "description": "Control implementation cited in apps/desktop/src/store/cipher.ts." }, { "href": "apps/desktop/src/store/node-file-io.ts", "description": "Control implementation cited in apps/desktop/src/store/node-file-io.ts." }, { "href": "apps/desktop/src/store/store-key.ts", "description": "Control implementation cited in apps/desktop/src/store/store-key.ts." }, { "href": "apps/desktop/test/store-encryption.test.ts", "description": "Control implementation cited in apps/desktop/test/store-encryption.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "4af612a1-93ab-52d9-be5c-0efcdd7a9e3b", "description": "Control \"Access control lists scoped to the data owner\" (CIS Controls) was exercised against the running production system and held. Evidence: 3 record/source file(s), strength assessment.", "methods": [ "TEST" ], "relevant-evidence": [ { "href": "docs/compliance/db-control-assessment.json", "description": "Control implementation cited in docs/compliance/db-control-assessment.json." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-enforcement.test.ts", "description": "Control implementation cited in tests/rls/document-acl-enforcement.test.ts." } ], "collected": "2026-10-18T11:41:45.310Z", "expires": "2026-11-17T11:41:45.310Z" }, { "uuid": "f6e3b55e-7d77-5734-a27e-b4d752179bda", "description": "Cited code evidence for \"Routine exercises of the incident-response process\" (CIS Controls): 5 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/incident-response-drill-script.md", "description": "Control implementation cited in docs/compliance/incident-response-drill-script.md." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "packages/compliance-intelligence/incidents/drills.json", "description": "Control implementation cited in packages/compliance-intelligence/incidents/drills.json." }, { "href": "packages/compliance-intelligence/src/__tests__/drill.test.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/__tests__/drill.test.ts." }, { "href": "packages/compliance-intelligence/src/incidents/drill.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/incidents/drill.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "07e7f04a-487e-5845-8d80-a5cff62e005e", "description": "Cited code evidence for \"An incident-response process with a named owner, a reporting route and a review step\" (CIS Controls): 4 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "SECURITY.md", "description": "Control implementation cited in SECURITY.md." }, { "href": "docs/compliance/data-breach-notification-procedure.md", "description": "Control implementation cited in docs/compliance/data-breach-notification-procedure.md." }, { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." }, { "href": "docs/compliance/security-incident-log.md", "description": "Control implementation cited in docs/compliance/security-incident-log.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "7c0809f5-22f3-5e6e-8e51-9e9493f4f65b", "description": "Cited code evidence for \"Malware defences over the content the product ingests\" (CIS Controls): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/documents/types.ts", "description": "Control implementation cited in apps/web/lib/documents/types.ts." }, { "href": "apps/worker/src/utils/__tests__/malwareScanner.test.ts", "description": "Control implementation cited in apps/worker/src/utils/__tests__/malwareScanner.test.ts." }, { "href": "apps/worker/src/utils/malwareScanner.ts", "description": "Control implementation cited in apps/worker/src/utils/malwareScanner.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "fe564007-c036-5025-adbb-5098ef5728fc", "description": "Cited code evidence for \"Separated production, staging and development environments\" (CIS Controls): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/shared/__tests__/deployment-classification.test.ts", "description": "Control implementation cited in packages/shared/__tests__/deployment-classification.test.ts." }, { "href": "packages/shared/src/deployment-classification.ts", "description": "Control implementation cited in packages/shared/src/deployment-classification.ts." }, { "href": "scripts/setup/promote-to-production.ts", "description": "Control implementation cited in scripts/setup/promote-to-production.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "ae4dcc83-d215-5a89-9236-1a4f1b20a31c", "description": "Cited code evidence for \"Assessment of service providers against their classification\" (CIS Controls): 4 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "packages/compliance-intelligence/src/__tests__/assessment.test.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/__tests__/assessment.test.ts." }, { "href": "packages/compliance-intelligence/src/subprocessors/assessment.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/subprocessors/assessment.ts." }, { "href": "packages/compliance-intelligence/subprocessors/assessments.json", "description": "Control implementation cited in packages/compliance-intelligence/subprocessors/assessments.json." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "3950354c-b629-5b21-8d44-980acb846cc7", "description": "Cited code evidence for \"Decommissioning a service provider\" (CIS Controls): 4 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "packages/compliance-intelligence/src/__tests__/assessment.test.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/__tests__/assessment.test.ts." }, { "href": "packages/compliance-intelligence/src/subprocessors/assessment.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/subprocessors/assessment.ts." }, { "href": "scripts/ci/check-subprocessor-coverage.ts", "description": "Control implementation cited in scripts/ci/check-subprocessor-coverage.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "58363e76-527a-5b9b-88b7-6e0ad61537d0", "description": "Cited code evidence for \"Risk classification of service providers\" (CIS Controls): 4 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "packages/compliance-intelligence/src/__tests__/risk.test.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/__tests__/risk.test.ts." }, { "href": "packages/compliance-intelligence/src/subprocessors/risk.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/subprocessors/risk.ts." }, { "href": "packages/compliance-intelligence/subprocessors/risk-classification.md", "description": "Control implementation cited in packages/compliance-intelligence/subprocessors/risk-classification.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "7a3da9de-f517-5371-bcab-611b246bcc8e", "description": "Cited code evidence for \"Security requirements in service provider arrangements\" (CIS Controls): 4 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "packages/compliance-intelligence/subprocessors/registry.json", "description": "Control implementation cited in packages/compliance-intelligence/subprocessors/registry.json." }, { "href": "packages/compliance-intelligence/subprocessors/revisions.json", "description": "Control implementation cited in packages/compliance-intelligence/subprocessors/revisions.json." }, { "href": "scripts/ci/check-subprocessor-coverage.ts", "description": "Control implementation cited in scripts/ci/check-subprocessor-coverage.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "7d9d6fda-bf81-5a3e-8930-fcdddd3e3de2", "description": "Cited code evidence for \"Inventory of third-party components and service providers\" (CIS Controls): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "scripts/ci/check-bun-version.ts", "description": "Control implementation cited in scripts/ci/check-bun-version.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "7cb1ade5-abca-5d8e-8b1d-1c615c29004f", "description": "Cited code evidence for \"Vulnerability management process for the software we ship\" (CIS Controls): 3 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." }, { "href": "SECURITY.md", "description": "Control implementation cited in SECURITY.md." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "03d31950-7a60-5e23-9144-f78d16a3292f", "description": "Cited code evidence for \"A published intake channel for vulnerability reports, and a severity scale behind it\" (CIS Controls): 3 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "SECURITY.md", "description": "Control implementation cited in SECURITY.md." }, { "href": "apps/web/public/.well-known/security.txt", "description": "Control implementation cited in apps/web/public/.well-known/security.txt." }, { "href": "scripts/deps/audit-classify.ts", "description": "Control implementation cited in scripts/deps/audit-classify.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "614154aa-374a-5096-829c-145096e046b0", "description": "Cited code evidence for \"Meet the clause 9 web requirements of the version we engineer to\" (EN 301 549): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/e2e.yml", "description": "Control implementation cited in .github/workflows/e2e.yml." }, { "href": "apps/web/e2e/support/axe.ts", "description": "Control implementation cited in apps/web/e2e/support/axe.ts." }, { "href": "apps/web/e2e/support/wcag.ts", "description": "Control implementation cited in apps/web/e2e/support/wcag.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "5b3a5ee1-ea22-549b-9566-a7f2d9406db0", "description": "Cited code evidence for \"Audit records cannot be silently altered once captured\" (ISO 15489-1): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/audit-log-immutability.test.ts", "description": "Control implementation cited in tests/rls/audit-log-immutability.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "89c1e7b5-0732-59b4-97aa-8321601dc637", "description": "Cited code evidence for \"Every auditable event is captured with typed, enumerated metadata\" (ISO 15489-1): 4 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/__tests__/audit.test.ts", "description": "Control implementation cited in apps/web/lib/__tests__/audit.test.ts." }, { "href": "apps/web/lib/audit.ts", "description": "Control implementation cited in apps/web/lib/audit.ts." }, { "href": "packages/shared/__tests__/audit-vocabulary-coverage.sweep.test.ts", "description": "Control implementation cited in packages/shared/__tests__/audit-vocabulary-coverage.sweep.test.ts." }, { "href": "packages/shared/src/audit-actions.ts", "description": "Control implementation cited in packages/shared/src/audit-actions.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "47f48e0f-c721-5c68-babc-29c272840ee9", "description": "Cited code evidence for \"Records stay retrievable to authorised reviewers throughout retention\" (ISO 15489-1): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/app/api/tenant/audit-export/route.ts", "description": "Control implementation cited in apps/web/app/api/tenant/audit-export/route.ts." }, { "href": "apps/web/lib/api/__tests__/handlers-audit-log.test.ts", "description": "Control implementation cited in apps/web/lib/api/__tests__/handlers-audit-log.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "8f6bbdf3-75ea-5db5-961f-0080dc574d95", "description": "Cited code evidence for \"Audit logs are purged on a fixed, floored schedule\" (ISO 15489-1): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/maintenance/dataLifecycle.ts", "description": "Control implementation cited in apps/worker/src/maintenance/dataLifecycle.ts." }, { "href": "tests/rls/audit-log-retention.test.ts", "description": "Control implementation cited in tests/rls/audit-log-retention.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "26636dcd-b993-5981-8113-02dec7ca86ce", "description": "Cited code evidence for \"Every destructive action leaves a reason-coded, honest receipt\" (ISO 15489-1): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/gdpr-erasure.test.ts", "description": "Control implementation cited in tests/rls/gdpr-erasure.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "c3bab2ae-fc0c-5605-93e5-06c939095347", "description": "Cited code evidence for \"Raw telemetry is frozen to a long-lived ledger before it is purged\" (ISO 15489-1): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/usage-retention.test.ts", "description": "Control implementation cited in tests/rls/usage-retention.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "e96fd38c-6814-58a7-98e9-0a3d33ce3b88", "description": "Cited code evidence for \"Data accuracy: extracted content faithfully represents the source\" (ISO 25012): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/utils/__tests__/extraction.test.ts", "description": "Control implementation cited in apps/worker/src/utils/__tests__/extraction.test.ts." }, { "href": "apps/worker/src/utils/extraction.ts", "description": "Control implementation cited in apps/worker/src/utils/extraction.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "139eac45-2974-5412-969d-b1f753931bbd", "description": "Cited code evidence for \"Data completeness: every ingested document is searchable or visibly failed\" (ISO 25012): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/maintenance/__tests__/corpusIntegrity.test.ts", "description": "Control implementation cited in apps/worker/src/maintenance/__tests__/corpusIntegrity.test.ts." }, { "href": "apps/worker/src/maintenance/corpusIntegrity.ts", "description": "Control implementation cited in apps/worker/src/maintenance/corpusIntegrity.ts." }, { "href": "tests/rls/connector-coverage.test.ts", "description": "Control implementation cited in tests/rls/connector-coverage.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "10192c07-71ab-59c4-99f0-4036cde71a1e", "description": "Cited code evidence for \"Data consistency: derived stores agree with the document they describe\" (ISO 25012): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/utils/stagedChunkCommit.ts", "description": "Control implementation cited in apps/worker/src/utils/stagedChunkCommit.ts." }, { "href": "tests/rls/document-commit-lifecycle.test.ts", "description": "Control implementation cited in tests/rls/document-commit-lifecycle.test.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "7c06bd82-5c86-5563-84d2-77325545539f", "description": "Cited code evidence for \"Data currentness: the index tracks the source over time\" (ISO 25012): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/utils/__tests__/pruneUnseen.test.ts", "description": "Control implementation cited in apps/worker/src/utils/__tests__/pruneUnseen.test.ts." }, { "href": "apps/worker/src/utils/pruneUnseen.ts", "description": "Control implementation cited in apps/worker/src/utils/pruneUnseen.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "6fd254f9-082e-5eb3-aca0-80888639de7a", "description": "Cited code evidence for \"Data confidentiality: content is reachable only by authorised principals\" (ISO 25012): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "de0216e8-683f-58b8-972d-06ccb6c2c29f", "description": "Cited code evidence for \"Data traceability: retrieved content is attributable to its source\" (ISO 25012): 2 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/chat/__tests__/citation-verification.test.ts", "description": "Control implementation cited in apps/web/lib/chat/__tests__/citation-verification.test.ts." }, { "href": "apps/web/lib/chat/citation-verification.ts", "description": "Control implementation cited in apps/web/lib/chat/citation-verification.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "d7538ea1-17a0-5e62-bbf9-5ce09c54551d", "description": "Control \"Access control on a need-to-use basis\" (ISO 27001) was exercised against the running production system and held. Evidence: 4 record/source file(s), strength assessment.", "methods": [ "TEST" ], "relevant-evidence": [ { "href": "docs/compliance/access-management-policy.md", "description": "Control implementation cited in docs/compliance/access-management-policy.md." }, { "href": "docs/compliance/db-control-assessment.json", "description": "Control implementation cited in docs/compliance/db-control-assessment.json." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-enforcement.test.ts", "description": "Control implementation cited in tests/rls/document-acl-enforcement.test.ts." } ], "collected": "2026-10-18T11:41:45.310Z", "expires": "2026-11-17T11:41:45.310Z" }, { "uuid": "98f3eca1-9c5a-5c38-826c-2a0d85410fcf", "description": "Cited code evidence for \"Provision and revoke access rights over the lifecycle\" (ISO 27001): 3 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/api/v1-guc.ts", "description": "Control implementation cited in apps/web/lib/api/v1-guc.ts." }, { "href": "docs/compliance/access-management-policy.md", "description": "Control implementation cited in docs/compliance/access-management-policy.md." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "3d1af478-82a8-5ea3-b3d8-6ae7fb2e615a", "description": "Cited code evidence for \"Information security incident management\" (ISO 27001): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "249a4923-a922-55db-b672-8647060fed8a", "description": "Cited code evidence for \"Security requirements inside supplier agreements\" (ISO 27001): 3 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." }, { "href": "packages/compliance-intelligence/src/__tests__/assessment.test.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/__tests__/assessment.test.ts." }, { "href": "packages/compliance-intelligence/src/subprocessors/assessment.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/subprocessors/assessment.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "b8aab189-247e-585b-bbdd-bed4f90ae335", "description": "Cited code evidence for \"Security in supplier and subprocessor relationships\" (ISO 27001): 4 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".npmrc", "description": "Control implementation cited in .npmrc." }, { "href": "bunfig.toml", "description": "Control implementation cited in bunfig.toml." }, { "href": "packages/compliance-intelligence/src/__tests__/risk.test.ts", "description": "Control implementation cited in packages/compliance-intelligence/src/__tests__/risk.test.ts." }, { "href": "packages/compliance-intelligence/subprocessors/risk-classification.md", "description": "Control implementation cited in packages/compliance-intelligence/subprocessors/risk-classification.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "7e6eb03a-aa94-5627-a3cf-bcf3bb3b8f7b", "description": "Cited code evidence for \"Prevent leakage of information\" (ISO 27001): 4 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/chat/credential-screen.ts", "description": "Control implementation cited in apps/web/lib/chat/credential-screen.ts." }, { "href": "apps/worker/src/utils/safeDownload.ts", "description": "Control implementation cited in apps/worker/src/utils/safeDownload.ts." }, { "href": "docs/compliance/data-classification-policy.md", "description": "Control implementation cited in docs/compliance/data-classification-policy.md." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "4fa6697b-9f85-5735-ab98-8f13ce82864e", "description": "Control \"Restrict access to information within applications\" (ISO 27001) was exercised against the running production system and held. Evidence: 3 record/source file(s), strength assessment.", "methods": [ "TEST" ], "relevant-evidence": [ { "href": "docs/compliance/db-control-assessment.json", "description": "Control implementation cited in docs/compliance/db-control-assessment.json." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-enforcement.test.ts", "description": "Control implementation cited in tests/rls/document-acl-enforcement.test.ts." } ], "collected": "2026-10-18T11:41:45.310Z", "expires": "2026-11-17T11:41:45.310Z" }, { "uuid": "8301bdd5-c134-539c-bed7-95b089eb4903", "description": "Cited code evidence for \"Security-relevant event logging\" (ISO 27001): 3 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/app/api/documents/%5Bid%5D/stream/route.ts", "description": "Control implementation cited in apps/web/app/api/documents/[id]/stream/route.ts." }, { "href": "apps/web/lib/audit.ts", "description": "Control implementation cited in apps/web/lib/audit.ts." }, { "href": "packages/shared/logging.ts", "description": "Control implementation cited in packages/shared/logging.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "ce37a0bd-1ed8-51b5-8f16-d86628cef432", "description": "Cited code evidence for \"Monitoring for anomalous behaviour\" (ISO 27001): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/sentry.shared.config.ts", "description": "Control implementation cited in apps/web/sentry.shared.config.ts." }, { "href": "apps/worker/src/utils/circuitBreaker.ts", "description": "Control implementation cited in apps/worker/src/utils/circuitBreaker.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "f48e66d6-7846-5141-8310-995573af06a0", "description": "Cited code evidence for \"Secure authentication including MFA\" (ISO 27001): 2 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/env.ts", "description": "Control implementation cited in apps/web/lib/env.ts." }, { "href": "docs/compliance/access-management-policy.md", "description": "Control implementation cited in docs/compliance/access-management-policy.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "2b0a3044-5810-545c-80fe-fdff669153ed", "description": "Cited code evidence for \"Secure coding and application security testing\" (ISO 27001): 2 source file(s), strength gate.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "42f69c5c-a04d-55b9-87a7-adc63e64dfdb", "description": "Cited code evidence for \"Secure development lifecycle\" (ISO 27001): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "628451b9-97fc-5805-966e-73b3171d3956", "description": "Cited code evidence for \"Track and remediate technical vulnerabilities on a defined cadence\" (ISO 27001): 4 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." }, { "href": "SECURITY.md", "description": "Control implementation cited in SECURITY.md." }, { "href": "bunfig.toml", "description": "Control implementation cited in bunfig.toml." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "b919f81d-c4a8-544a-a7fc-a5cc7568a00d", "description": "Cited code evidence for \"Fulfil PII principals' access, correction, and erasure rights\" (ISO 27701): 3 source file(s), strength test.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/export/__tests__/accountExport.test.ts", "description": "Control implementation cited in apps/worker/src/export/__tests__/accountExport.test.ts." }, { "href": "apps/worker/src/export/accountExport.ts", "description": "Control implementation cited in apps/worker/src/export/accountExport.ts." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "4fa2735a-9d7f-5aed-8b77-40c1af91c66b", "description": "Cited code evidence for \"Privacy by design and by default\" (ISO 27701): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "19a12f9c-2d55-5102-ac90-adcd875cdcc2", "description": "Cited code evidence for \"Limit retention and dispose of PII\" (ISO 27701): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "packages/shared/queue/schedules.ts", "description": "Control implementation cited in packages/shared/queue/schedules.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "e275f1fc-7195-5122-8e33-e556cbc26103", "description": "Cited code evidence for \"Notify controllers of privacy incidents\" (ISO 27701): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "5096df14-53eb-56d2-9c32-cb35a5fdc4c3", "description": "Cited code evidence for \"Keep records and logs of AI operation\" (ISO 42001): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/lib/logger.ts", "description": "Control implementation cited in apps/web/lib/logger.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "f0af8d55-65b7-5fb5-8870-a5ac06e729fc", "description": "Cited code evidence for \"Ensure AI robustness, accuracy, and security\" (ISO 42001): 2 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/utils/safeDownload.ts", "description": "Control implementation cited in apps/worker/src/utils/safeDownload.ts." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "d6d9e4b8-53cb-50ad-9e6c-cf522f278334", "description": "Cited code evidence for \"Govern data used by AI systems\" (ISO 42001): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "b240cdac-51e6-5858-ad02-1ab222dc2c25", "description": "Cited code evidence for \"Provide information about AI systems to interested parties\" (ISO 42001): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/components/chat/ChatInterface.tsx", "description": "Control implementation cited in apps/web/components/chat/ChatInterface.tsx." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "34c31331-513c-5b4a-b4ef-46a301f94bb8", "description": "Cited code evidence for \"Monitor the system for anomalies and security events\" (SOC 2): 3 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/web/app/api/documents/%5Bid%5D/stream/route.ts", "description": "Control implementation cited in apps/web/app/api/documents/[id]/stream/route.ts." }, { "href": "apps/web/sentry.shared.config.ts", "description": "Control implementation cited in apps/web/sentry.shared.config.ts." }, { "href": "apps/worker/src/utils/circuitBreaker.ts", "description": "Control implementation cited in apps/worker/src/utils/circuitBreaker.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "42954bc3-e249-551b-8425-fcf7e89d54db", "description": "Cited code evidence for \"Protect system boundaries against external threats\" (SOC 2): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "apps/worker/src/utils/safeDownload.ts", "description": "Control implementation cited in apps/worker/src/utils/safeDownload.ts." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "e1ff8d0b-3a23-5f6b-8491-e75af65e6fde", "description": "Cited code evidence for \"Authorize, test, and control changes\" (SOC 2): 2 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/sdlc.md", "description": "Control implementation cited in docs/compliance/sdlc.md." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "f5798671-157f-5bcb-b3fa-72b30bc94d8b", "description": "Cited code evidence for \"Respond to and recover from security incidents\" (SOC 2): 1 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/incident-response-runbook.md", "description": "Control implementation cited in docs/compliance/incident-response-runbook.md." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "0bda1c18-c1e6-515e-9cd1-ed31bad9c957", "description": "Control \"Logical access is restricted to authorized identities\" (SOC 2) was exercised against the running production system and held. Evidence: 4 record/source file(s), strength assessment.", "methods": [ "TEST" ], "relevant-evidence": [ { "href": "docs/compliance/access-management-policy.md", "description": "Control implementation cited in docs/compliance/access-management-policy.md." }, { "href": "docs/compliance/db-control-assessment.json", "description": "Control implementation cited in docs/compliance/db-control-assessment.json." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." }, { "href": "tests/rls/document-acl-enforcement.test.ts", "description": "Control implementation cited in tests/rls/document-acl-enforcement.test.ts." } ], "collected": "2026-10-18T11:41:45.310Z", "expires": "2026-11-17T11:41:45.310Z" }, { "uuid": "d33b0de7-c4d5-5a6f-8531-113cbf44b4b2", "description": "Cited code evidence for \"The system, its boundary and its data flows are described from the code\" (SOC 2): 3 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/gdpr-art-30-register.md", "description": "Control implementation cited in docs/compliance/gdpr-art-30-register.md." }, { "href": "docs/services.md", "description": "Control implementation cited in docs/services.md." }, { "href": "package.json", "description": "Control implementation cited in package.json." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "06d54784-4fdc-5d4f-b09b-6e702a7ca6a2", "description": "Cited code evidence for \"Manage vendor and subprocessor risk\" (SOC 2): 1 source file(s), strength code.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "bunfig.toml", "description": "Control implementation cited in bunfig.toml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "0d1bcb75-c41c-5560-b82e-2ba5f38d54af", "description": "Cited code evidence for \"Detect and remediate vulnerabilities and misconfiguration\" (SOC 2): 4 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": ".github/workflows/ci.yml", "description": "Control implementation cited in .github/workflows/ci.yml." }, { "href": "SECURITY.md", "description": "Control implementation cited in SECURITY.md." }, { "href": "bunfig.toml", "description": "Control implementation cited in bunfig.toml." }, { "href": "lefthook.yml", "description": "Control implementation cited in lefthook.yml." } ], "collected": "2026-10-19T14:59:56.726Z" }, { "uuid": "f7117b1e-bc9b-5011-9977-c29c14e64aef", "description": "Cited code evidence for \"Protect confidential information over its lifecycle\" (SOC 2): 2 source file(s), strength artifact.", "methods": [ "EXAMINE" ], "relevant-evidence": [ { "href": "docs/compliance/data-classification-policy.md", "description": "Control implementation cited in docs/compliance/data-classification-policy.md." }, { "href": "supabase/migrations/00000000000000_baseline.sql", "description": "Control implementation cited in supabase/migrations/00000000000000_baseline.sql." } ], "collected": "2026-10-19T14:59:56.726Z" } ], "findings": [ { "uuid": "cc47da36-7363-5155-8c09-1412e4d32fe9", "title": "Store accounting records so they cannot be altered or lost within the retention period", "description": "Accounting material must be kept securely for the whole retention period: safeguarded against destruction, loss, and after-the-fact modification. The ledger closes a month exactly once (no re-freeze with different numbers) and purge refuses to touch months still inside the retention window.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "bogfoeringsloven" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "protect-records-from-loss-and-alteration" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "integrity" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "para_12" } ], "target": { "type": "statement-id", "target-id": "bogfoeringsloven.protect-records-from-loss-and-alteration", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "a614bfe7-7daf-55ef-a650-4b89fffdcde4" } ] }, { "uuid": "1ae9d56f-36a5-53e3-9e8d-981eae2db515", "title": "Retain accounting records for at least five years after the financial year ends", "description": "Keep accounting material, including the transaction records that support invoicing, for at least 5 years from the end of the financial year it concerns. The usage ledger is kept ~10 years to also satisfy the stricter German horizon (HGB s. 257) while the DE bookkeeping-nexus question is open.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "bogfoeringsloven" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "retain-accounting-records-five-years" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "retention" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "para_12" } ], "target": { "type": "statement-id", "target-id": "bogfoeringsloven.retain-accounting-records-five-years", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "3d324ff8-21fa-57e4-b95b-f655847ea381" } ] }, { "uuid": "48e9731f-20fd-5e4b-bb1c-a15fa17d04fe", "title": "Notify incidents if designated", "description": "If designated as a critical entity, notify the competent authority without undue delay of incidents that significantly disrupt or have the potential to significantly disrupt the provision of essential services.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cer" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-notification-if-designated" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-reporting" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_15" } ], "target": { "type": "statement-id", "target-id": "cer.incident-notification-if-designated", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "9d4f22ad-8593-50c5-ad22-f9fe4edf5daf", "title": "Take resilience measures if designated", "description": "If designated as a critical entity, carry out a risk assessment and take appropriate and proportionate technical, security, and organisational measures to ensure resilience, including physical protection, continuity, and incident handling.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cer" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "resilience-measures-if-designated" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "resilience" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_12" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_13" } ], "target": { "type": "statement-id", "target-id": "cer.resilience-measures-if-designated", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "19218062-e4b0-54f9-ac1f-51492317179c", "title": "Determine critical-entity applicability", "description": "Determine whether the organisation is a critical entity within a CER essential sector as designated by a Member State; the resilience obligations apply only to entities so designated for providing an essential service above the relevant threshold.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cer" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "scope-applicability-determination" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "scope" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_1" } ], "target": { "type": "statement-id", "target-id": "cer.scope-applicability-determination", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "b740233e-d0f0-5ef2-a245-9a97fd0ac1f4", "title": "Conformity assessment, EU declaration, and CE marking", "description": "Carry out the applicable conformity assessment, draw up the EU declaration of conformity, and affix the CE marking before placing an in-scope product on the market.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cra" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "conformity-and-ce-marking" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "conformity" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "planned" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_27" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_28" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_29" } ], "target": { "type": "statement-id", "target-id": "cra.conformity-and-ce-marking", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "planned" } } }, { "uuid": "104f180a-ff96-5a69-844e-8b0ec48f6c6c", "title": "Maintain technical documentation", "description": "Draw up and keep current the technical documentation demonstrating the product meets the essential cybersecurity requirements, including the risk assessment and vulnerability-handling processes.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cra" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "technical-documentation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "conformity" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_31" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_13" } ], "target": { "type": "statement-id", "target-id": "cra.technical-documentation", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "818b43e3-b288-5174-a56c-7efe970b70f6", "title": "Protect confidentiality and integrity of data", "description": "Protect the confidentiality and integrity of stored, transmitted, and processed data through encryption and access controls, and process only data adequate and relevant to the product's function (data minimisation).", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cra" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "data-confidentiality-integrity" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "essential-requirements" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_6" } ], "target": { "type": "statement-id", "target-id": "cra.data-confidentiality-integrity", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "e7734573-42c7-5d3f-92d6-423ffe5caebe" } ] }, { "uuid": "6eac3215-6e1b-5518-9db6-181cfcdd9836", "title": "Secure by design and secure by default", "description": "Design, develop, and produce the product so it is secure by design and delivered in a secure-by-default configuration: minimal attack surface, least functionality enabled by default, and protection against unauthorised access.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cra" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "secure-by-design-default" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "essential-requirements" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_13" } ], "target": { "type": "statement-id", "target-id": "cra.secure-by-design-default", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "c31e239b-3cc5-5829-af38-85bcf2d9fbf1" } ] }, { "uuid": "06da6bd0-1617-5fd8-9c26-0ca79e18bdce", "title": "Report actively exploited vulnerabilities and severe incidents", "description": "Report actively exploited vulnerabilities and severe incidents affecting an in-scope product’s security to the CSIRT of main establishment (Denmark: CFCS) and ENISA via the single reporting platform: early warning within 24 hours, notification within 72 hours, and a final report within 14 days of a corrective measure being available (exploited vulnerability) or 1 month (severe incident), with an intermediate report on request. Inform impacted users of the vulnerability or incident and the mitigations they can deploy, in a structured machine-readable format where appropriate (Art 14(8)); this is a duty in its own right, not a consequence of the regulator notification. Scope attaches by product surface: the desktop client (with the backend functionality it cannot work without, which is that product’s remote data processing solution) and any distributed SDK or package supplied commercially; the bare hosted SaaS is not a product with digital elements, and non-monetized FOSS (partial-content) is exempt while it stays non-monetized.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cra" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "vulnerability-incident-reporting" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "reporting" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_14" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_64" } ], "target": { "type": "statement-id", "target-id": "cra.vulnerability-incident-reporting", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "a22e774c-cc1c-5327-87cf-164c50156d53" } ] }, { "uuid": "79a40981-44a7-5cfa-b11c-ffa231a27ac3", "title": "Coordinated vulnerability disclosure policy", "description": "Put in place and enforce a coordinated vulnerability disclosure policy with a single point of contact, so reporters can disclose vulnerabilities responsibly and receive a coordinated response.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cra" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "coordinated-vulnerability-disclosure" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "vulnerability-handling" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_13" } ], "target": { "type": "statement-id", "target-id": "cra.coordinated-vulnerability-disclosure", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "4f72307e-c0e1-5d54-9820-9d3ea9f239e8" } ] }, { "uuid": "86bf469a-54a0-5c77-89c5-485fcc4fda05", "title": "Provide security updates over the support period", "description": "Provide security updates that remediate vulnerabilities during the product's support period, free of charge and, where feasible, separately from feature updates, with clear information to users.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cra" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "security-updates" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "vulnerability-handling" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_13" } ], "target": { "type": "statement-id", "target-id": "cra.security-updates", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "edb7b1d7-ca88-5514-b894-9ab39dfdf2a7", "title": "Identify and document components (SBOM)", "description": "Identify and document the components contained in the product, including through a software bill of materials in a commonly used, machine-readable format, so vulnerable components can be found and tracked.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cra" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "software-bill-of-materials" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "vulnerability-handling" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_13" } ], "target": { "type": "statement-id", "target-id": "cra.software-bill-of-materials", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "9ed7e65d-1030-557b-bdbb-c9b4dd7da371" } ] }, { "uuid": "d235986b-d6b8-5e15-948d-69eea14a082d", "title": "Monitor upstream components for advisories and record each decision", "description": "Continuously monitor the components the product depends on for newly disclosed vulnerabilities and upstream changes that affect them, decide on each finding (remediate, schedule, accept the risk with a stated reason), and keep a record of when the sources were consulted, what they returned against the shipped versions, what was decided and by which role, so the handling process is demonstrable and not merely asserted.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cra" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "upstream-dependency-advisory-monitoring" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "vulnerability-handling" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_13" } ], "target": { "type": "statement-id", "target-id": "cra.upstream-dependency-advisory-monitoring", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "59b4c1f7-3dd2-582a-beb8-59e1f990785a" } ] }, { "uuid": "04e18ab5-87ab-58f4-b897-5e53af2366fe", "title": "Identify and address vulnerabilities without delay", "description": "Operate a process to identify and address vulnerabilities in the product and its components without delay, including regular testing and remediation, so no product ships with a known exploitable vulnerability.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cra" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "vulnerability-handling" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "vulnerability-handling" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_13" } ], "target": { "type": "statement-id", "target-id": "cra.vulnerability-handling", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "befd1e07-1ae5-5b05-9d06-0e9728734788" } ] }, { "uuid": "18dd4476-136e-5c97-9a52-2e5e6700cc3d", "title": "Compare only products that meet the same needs or serve the same purpose", "description": "The comparison must be between goods or services meeting the same needs or intended for the same purpose (art_4 point b). A comparison page states the category it compares within, and a product that serves a different purpose is not placed in the table to make ours look complete.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "comparative-advertising" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "compare-like-with-like" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "conditions" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_4" } ], "target": { "type": "statement-id", "target-id": "comparative-advertising.compare-like-with-like", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "43383702-b29f-513a-8b84-23d018044be0" } ] }, { "uuid": "7e74c8c3-838c-5e35-b4f2-390f8e0b5237", "title": "Make no comparison that is misleading about either product", "description": "A comparison is permitted only if it is not misleading within the meaning of art_2, art_3 and art_8 of this directive or of the misleading-action and misleading-omission rules of the UCPD (art_4 point a). Misleading advertising is any advertising that in any way, including its presentation, deceives or is likely to deceive those it reaches and is likely to affect their economic behaviour or injure a competitor (art_2), assessed on all its features and in particular the characteristics, price and attributes it states (art_3).", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "comparative-advertising" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "comparison-not-misleading" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "conditions" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_4" } ], "target": { "type": "statement-id", "target-id": "comparative-advertising.comparison-not-misleading", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "feba1600-a955-5968-aeef-87d771df851f" } ] }, { "uuid": "45a6a511-eb96-5ac9-8a65-f173f5795429", "title": "Neither discredit the competitor nor trade on its marks", "description": "The comparison must not discredit or denigrate the competitor's marks, names, goods, services, activities or circumstances (art_4 point d), must not take unfair advantage of the reputation of the competitor's marks or names (art_4 point f), must not present the product as an imitation or replica of a product bearing a protected mark (art_4 point g), and must not create confusion between the advertiser and the competitor or between their marks, goods or services (art_4 point h).", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "comparative-advertising" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "no-denigration-no-free-riding-no-confusion" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "conditions" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_4" } ], "target": { "type": "statement-id", "target-id": "comparative-advertising.no-denigration-no-free-riding-no-confusion", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "81c33258-2e34-5697-96d8-a07f05bab856" } ] }, { "uuid": "3f890baf-d1e7-5879-958c-0131b59d275f", "title": "Compare material, relevant, verifiable and representative features, objectively", "description": "The comparison must objectively compare one or more material, relevant, verifiable and representative features of the products, which may include price (art_4 point c). A cell is a fact a reader can check against a public source, never an adjective, an opinion or a score the advertiser assigned; a feature is chosen because a buyer decides on it, not because the advertiser wins it.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "comparative-advertising" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "objective-verifiable-representative-features" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "conditions" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_4" } ], "target": { "type": "statement-id", "target-id": "comparative-advertising.objective-verifiable-representative-features", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "e6c0fe68-1678-5fd0-9254-bb043c95aee7" } ] }, { "uuid": "0c0bf5fc-3d61-5262-b92a-3db9afc37563", "title": "Keep every comparison current, because cessation needs no proof of loss", "description": "Member States give competitors and bodies with a legitimate interest the means to obtain an order for the cessation of unlawful comparative advertising, or its prohibition before publication, without proof of actual loss, intention or negligence, under an accelerated procedure with interim or definitive effect (art_5). A comparison is therefore only as lawful as its currency: the compared fact is owned by the competitor, who can change it without notice.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "comparative-advertising" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "cessation-without-proof-of-loss" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "enforcement" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "comparative-advertising.cessation-without-proof-of-loss", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "ae6b2179-25ee-5a59-826f-9d8f26d343a5" } ] }, { "uuid": "51953541-017d-514c-aae5-2d37efc77fcd", "title": "Treat any sentence that identifies another product as comparative advertising", "description": "Advertising is the making of a representation in any form in connection with a trade to promote the supply of goods or services, and comparative advertising is any advertising which explicitly or by implication identifies a competitor or goods or services offered by a competitor (art_2). The conditions of art_4 therefore attach to a sentence the moment it names or alludes to another product, wherever on the site it sits.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "comparative-advertising" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "identification-is-the-trigger" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "scope" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" } ], "target": { "type": "statement-id", "target-id": "comparative-advertising.identification-is-the-trigger", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "4805b90d-d8a4-5b87-874f-f54bf7997c64" } ] }, { "uuid": "94bbb819-d226-5ac9-9cce-4bccbf119f12", "title": "Monitor the certification framework for a relevant or mandatory scheme", "description": "Track the European cybersecurity certification framework for a scheme relevant to our category (notably the EUCS cloud-services scheme) and for any Union or national law that makes such a scheme mandatory, since certification is otherwise voluntary.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-cybersecurity-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "certification-framework-monitoring" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "certification-framework" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_46" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_56" } ], "target": { "type": "statement-id", "target-id": "eu-cybersecurity-act.certification-framework-monitoring", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "8c5cbaf7-da88-55aa-aad2-51b043a45667", "title": "Understand the basic-level self-assessment route", "description": "For a scheme at the 'basic' assurance level covering low-risk services, understand that conformity self-assessment under the provider's own responsibility is permitted, allowing an EU statement of conformity to be issued without a third-party certificate.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-cybersecurity-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "conformity-self-assessment-option" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "conformity-assessment" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_52" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_53" } ], "target": { "type": "statement-id", "target-id": "eu-cybersecurity-act.conformity-self-assessment-option", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "1ac9bfe3-5a13-5f9e-af6f-deb8088bd8f4", "title": "Publish supplementary cybersecurity information if certified", "description": "If a product/service is certified or an EU statement of conformity is issued, publish the supplementary cybersecurity information: secure configuration/operation guidance, the period during which security support is offered, and a contact for receiving vulnerability reports.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-cybersecurity-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "supplementary-cybersecurity-information" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "information" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_55" } ], "target": { "type": "statement-id", "target-id": "eu-cybersecurity-act.supplementary-cybersecurity-information", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "6e0d78ce-789e-579b-bda9-f14fb2a08b36" } ] }, { "uuid": "4260fe85-bfb8-53c4-b2ee-c47b44c5267e", "title": "Hold the security objectives a certification scheme would require", "description": "Be able to demonstrate the security objectives that European cybersecurity certification schemes require: protecting stored/transmitted/processed data against unauthorised access or disclosure throughout the lifecycle, access control, resilience/availability, secure-by-default configuration, and vulnerability handling.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-cybersecurity-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "security-objectives-readiness" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "security-objectives" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_51" } ], "target": { "type": "statement-id", "target-id": "eu-cybersecurity-act.security-objectives-readiness", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "2769c3b4-6984-59f2-a8a4-f592cf3f868e" } ] }, { "uuid": "1bfcbc2a-1ac0-5ac9-b5f5-a1870f0af9e0", "title": "Notify and meet neutrality conditions if providing intermediation", "description": "If providing data intermediation services, notify the competent authority before starting, and meet the structural conditions, in particular neutrality: the intermediary must not use the intermediated data for its own purposes and must keep intermediation structurally separate from other services.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dga" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "notification-and-conditions-if-intermediation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-intermediation" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_11" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_12" } ], "target": { "type": "statement-id", "target-id": "dga.notification-and-conditions-if-intermediation", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "e7a3ca4a-7345-545e-9286-a782ef2252e0", "title": "Determine data-intermediation / altruism applicability", "description": "Determine whether the service constitutes a data intermediation service, a data altruism organisation, or a re-user of protected public-sector data; the DGA's structural and notification duties attach only to those activities.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dga" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "scope-not-a-data-intermediary" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "scope" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_1" } ], "target": { "type": "statement-id", "target-id": "dga.scope-not-a-data-intermediary", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "62cfff70-111d-56f8-8241-ea16b3084a1e", "title": "Safeguard protected data against unlawful international transfer", "description": "Where handling protected categories of data covered by the DGA, take measures to prevent unlawful international transfer of or governmental access to that data.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dga" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "international-transfer-safeguards" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "transfers" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_31" } ], "target": { "type": "statement-id", "target-id": "dga.international-transfer-safeguards", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "cd8eff25-b19e-53c5-8398-bddeba77c455" } ] }, { "uuid": "c5ef2d5c-c539-5650-90ac-dce7c0fa0688", "title": "ICT governance and accountability", "description": "Maintain clear governance for ICT resilience: defined roles, management accountability for ICT risk, and documented policies. As a provider we must be able to evidence this to financial customers assessing us under their own DORA framework.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dora" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ict-governance" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "governance" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_6" } ], "target": { "type": "statement-id", "target-id": "dora.ict-governance", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "9b2bdf0c-32b0-58f8-87e5-4ef845b4b2e0", "title": "Anomalous-activity detection", "description": "Detect anomalous activity and ICT incidents promptly: monitoring, logging, alerting with thresholds that surface breaches and performance anomalies fast enough to meet reporting clocks.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dora" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "detection" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "ict-risk-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_10" } ], "target": { "type": "statement-id", "target-id": "dora.detection", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "7a5f8f18-c783-5ff0-b743-a85297e477b9" } ] }, { "uuid": "086bfce7-3396-5193-9b69-7ec17e45d5de", "title": "Protection and prevention controls", "description": "Implement security controls that protect ICT systems and data from compromise: access control, encryption, network security, secure configuration. Overlaps NIS2 Art 21 and GDPR Art 32; one control set can satisfy all three.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dora" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "protection-prevention" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "ict-risk-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_9" } ], "target": { "type": "statement-id", "target-id": "dora.protection-prevention", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "2037ea14-5a78-5a32-bfe7-440ff9c46175" } ] }, { "uuid": "d95a89a8-6453-5247-87fe-684e43c92193", "title": "Response, recovery, and backup", "description": "Maintain response-and-recovery procedures and backup policies with tested restoration: defined RTO/RPO, backups isolated from the primary, and periodic restore tests. Cover the primary DB, object storage, and the vector index.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dora" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "response-recovery-backup" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "ict-risk-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_11" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_12" } ], "target": { "type": "statement-id", "target-id": "dora.response-recovery-backup", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "5913fac1-2ee4-5aec-9bfc-0c62fe8e97e7", "title": "Classify and report major incidents to customers", "description": "Classify ICT incidents by DORA criteria and, as a provider, notify affected financial customers of major incidents fast enough for them to meet their own regulatory reporting deadlines. Provide the data they need to report to competent authorities.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dora" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-classification-reporting" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_18" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_19" } ], "target": { "type": "statement-id", "target-id": "dora.incident-classification-reporting", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "4be34f2d-f1a1-5e4f-a156-a12fe9d8430f" } ] }, { "uuid": "4975b439-9b34-54cd-861e-3b09bfb7ac4a", "title": "ICT incident management process", "description": "Run a defined ICT-incident management process: detect, log, classify, and manage incidents to resolution with a clear internal workflow and roles.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dora" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-management-process" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_17" } ], "target": { "type": "statement-id", "target-id": "dora.incident-management-process", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "60aa3763-f05b-58ef-9693-8a218eda9a0b" } ] }, { "uuid": "e30ef090-bb35-55d3-b752-21101ab5cecd", "title": "Cyber-threat information sharing (optional)", "description": "Optionally participate in trusted cyber-threat-intelligence information-sharing arrangements, within data-protection limits, to strengthen collective resilience.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dora" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "threat-information-sharing" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "information-sharing" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_45" } ], "target": { "type": "statement-id", "target-id": "dora.threat-information-sharing", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "e4e8a31e-7a71-5eed-8c8f-ea12cbe126a5", "title": "Support digital operational resilience testing", "description": "Enable and support resilience testing: vulnerability assessment and testing of ICT tools/systems, and cooperation with customers' threat-led penetration testing where our service is in scope.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dora" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "resilience-testing" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "resilience-testing" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_24" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_25" } ], "target": { "type": "statement-id", "target-id": "dora.resilience-testing", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "2302af4e-2a5b-5384-af39-ed6977d2826f", "title": "Subcontracting and concentration-risk transparency", "description": "Disclose the chain of subcontractors that support the service (model/embedding providers, storage, connectors) so financial customers can assess ICT concentration risk, and control material subcontracting changes.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dora" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "concentration-subcontracting-transparency" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "third-party-risk" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_29" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_28" } ], "target": { "type": "statement-id", "target-id": "dora.concentration-subcontracting-transparency", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "c0b5fbd8-842a-5a30-8bd1-39bdac4ce1e6", "title": "DORA Art 30 contractual provisions", "description": "Contracts with financial customers must carry the Art 30 provisions: service descriptions and SLAs, data location, access/audit/inspection rights, incident cooperation, subcontracting conditions, and exit/termination assistance. Our standard terms must support these.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dora" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "third-party-contract-clauses" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "third-party-risk" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "planned" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_30" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_28" } ], "target": { "type": "statement-id", "target-id": "dora.third-party-contract-clauses", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "planned" } } }, { "uuid": "6de304d0-3a3f-52b9-a5d6-0ae5f9b0efaa", "title": "Let anyone notify allegedly illegal content", "description": "Provide an easy, electronic notice mechanism for any individual or entity to report specific allegedly illegal content, confirm receipt, decide in a timely, diligent, non-arbitrary and objective manner, and tell the notifier the outcome and the redress available.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dsa" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "notice-and-action" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "content-moderation" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "residual-gap", "ns": "https://nordvec.eu/ns/compliance", "value": "A failed notification mail is not retried automatically." }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_16" } ], "target": { "type": "statement-id", "target-id": "dsa.notice-and-action", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "e752081a-2ce1-5055-907a-dc2a60cc1cc9" } ] }, { "uuid": "a419a014-9179-5558-90ae-819bdf0c7c4d", "title": "Report suspected threats to life or safety", "description": "Promptly inform the competent law-enforcement or judicial authorities when information gives rise to a suspicion of a criminal offence involving a threat to the life or safety of persons.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dsa" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "notify-suspected-serious-crime" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "content-moderation" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_18" } ], "target": { "type": "statement-id", "target-id": "dsa.notify-suspected-serious-crime", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "fbe8e374-7c4d-5432-9fee-8f479e25898c" } ] }, { "uuid": "a8d2e684-4a99-5c66-9883-7901ec9dddcc", "title": "Give a statement of reasons for every restriction", "description": "When restricting content, an account, or payments because content is illegal or breaches the terms, give the affected user a clear and specific statement of reasons: the measure, the facts, whether automation was used, the legal or contractual ground, and the redress available.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dsa" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "statement-of-reasons" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "content-moderation" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "residual-gap", "ns": "https://nordvec.eu/ns/compliance", "value": "A failed notification mail is not retried automatically." }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_17" } ], "target": { "type": "statement-id", "target-id": "dsa.statement-of-reasons", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "7a3a0538-4b6f-5a1e-a3d4-2fc03cda8b80" } ] }, { "uuid": "8a1808d2-635d-54c2-97c6-91a73f8c9b16", "title": "Classify the service: hosting service, not an online platform", "description": "Determine the intermediary-service tier, since the due-diligence duties stack by tier: every intermediary service, then hosting services, then online platforms, then very large platforms.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dsa" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "scope-hosting-not-platform" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "scope" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_6" } ], "target": { "type": "statement-id", "target-id": "dsa.scope-hosting-not-platform", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "197c03ba-e4ea-5338-8ac5-26e2382fb156", "title": "Publish single points of contact for authorities and for users", "description": "Designate and publish an electronic single point of contact for Member State authorities, the Commission and the Board, and one for recipients of the service that is not solely automated, stating the languages it handles.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dsa" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "points-of-contact" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "transparency" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_11" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_12" } ], "target": { "type": "statement-id", "target-id": "dsa.points-of-contact", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "1ce4dc07-ca0d-52d4-8066-72c072f3fa22" } ] }, { "uuid": "eae39199-549d-5796-be4a-bfc98ac746ee", "title": "State usage restrictions and moderation in the terms", "description": "Include in the terms and conditions, in clear and plain language, any restrictions on use of the service, including the policies, procedures, measures and tools used for content moderation and the internal complaint handling.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dsa" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "terms-and-conditions-transparency" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "transparency" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "residual-gap", "ns": "https://nordvec.eu/ns/compliance", "value": "The translated terms have no clause-by-clause legal review." }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_14" } ], "target": { "type": "statement-id", "target-id": "dsa.terms-and-conditions-transparency", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "7db9ed9f-b507-55cc-b6be-4f76f7819beb" } ] }, { "uuid": "5eeafa31-aa2b-5308-8810-59a313593c94", "title": "Annual transparency report, exempt while a micro or small enterprise", "description": "Publish an annual machine-readable report on content moderation; providers that are micro or small enterprises and not very large online platforms are exempt.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "dsa" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "transparency-report-small-enterprise" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "transparency" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_15" } ], "target": { "type": "statement-id", "target-id": "dsa.transparency-report-small-enterprise", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "8ef28843-6d68-54fb-9823-a1fb6ebb571a", "title": "Use open, documented formats for exported data", "description": "Support the essential interoperability requirements by exporting data using open interoperability specifications or documented, commonly used formats, so that switched data remains usable and, where relevant, services can be used in parallel.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "data-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "interoperability-open-formats" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "interoperability" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_33" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_34" } ], "target": { "type": "statement-id", "target-id": "data-act.interoperability-open-formats", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "1c45a08f-82d7-5d4e-8afb-4be253d7a344", "title": "Export customer data in a structured, common, machine-readable format", "description": "On switching or termination, make the customer's exportable data and digital assets available in a structured, commonly used, and machine-readable format so the data can be ported to another service.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "data-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "data-export-portability" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "portability" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_30" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "data-act.data-export-portability", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "b2fcddd2-6183-5869-898a-0165e911b8c2" } ] }, { "uuid": "5fe7b9e7-86e2-57f8-87e0-801f51463ce5", "title": "Safeguard against unlawful third-country governmental access", "description": "Take adequate technical, organisational, and legal measures to prevent international and third-country governmental access to, or transfer of, non-personal data held in the Union where such access would conflict with Union or national law.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "data-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "international-government-access-safeguards" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "sovereignty" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_32" } ], "target": { "type": "statement-id", "target-id": "data-act.international-government-access-safeguards", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "ace289e9-ecc7-505f-ba7f-5845299c388b" } ] }, { "uuid": "dad62027-a55e-5f09-9538-b1d77d80511d", "title": "Remove switching and data-egress charges", "description": "Do not impose switching charges on customers for changing provider; from 12 January 2027 switching charges must be withdrawn, and only cost-based data-egress charges are permitted during any transition period as allowed by the Act.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "data-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "switching-charges-removal" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "switching" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_29" } ], "target": { "type": "statement-id", "target-id": "data-act.switching-charges-removal", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "ab61172d-84a4-5306-b102-f5baba0a6e27", "title": "Enable customers to switch or terminate the service", "description": "Remove pre-commercial, commercial, technical, contractual, and organisational obstacles that prevent a customer from switching to another provider or to on-premises infrastructure, including defined maximum notice and transition periods and provider assistance during the switch.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "data-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "switching-enablement" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "switching" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_23" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_25" } ], "target": { "type": "statement-id", "target-id": "data-act.switching-enablement", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "756b6bd0-34d4-5d4d-9e72-ad9bd6d1f912", "title": "Publish where customer data is processed and stored", "description": "Make available up-to-date information about the jurisdiction(s) in which the infrastructure used to process the customer's data is located, so customers can assess international-access exposure.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "data-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "international-access-transparency" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "transparency" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_28" } ], "target": { "type": "statement-id", "target-id": "data-act.international-access-transparency", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "0a5bd66d-acb1-5490-9711-ff23c9a450ca" } ] }, { "uuid": "226c70bc-528d-5668-a985-37196338c809", "title": "Design and provide the service to the accessibility requirements", "description": "Where in scope, design and provide the service in accordance with the accessibility requirements of Annex I (Sections III/IV), so the service is perceivable, operable, understandable, and robust for persons with disabilities, and keep procedures so it stays conformant as the service changes.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eaa" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "service-accessibility-requirements" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "accessibility" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "7" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_13" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_4" } ], "target": { "type": "statement-id", "target-id": "eaa.service-accessibility-requirements", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "907d1c45-4b58-5263-86cd-dafd349b6e6f" } ] }, { "uuid": "9865751d-848c-54fc-8869-c3f1aa1d2d62", "title": "Document any disproportionate-burden or fundamental-alteration claim", "description": "If relying on the exemption that compliance would require a fundamental alteration or impose a disproportionate burden, carry out and document the assessment against the Annex VI criteria, keep it for five years, renew it on service change and at least every five years, and notify the competent authority. Funding received specifically to improve accessibility disqualifies the disproportionate-burden claim.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eaa" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "disproportionate-burden-assessment" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "conformity" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_14" } ], "target": { "type": "statement-id", "target-id": "eaa.disproportionate-burden-assessment", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "da334ab4-3054-56eb-9550-b0f91a394fcb", "title": "Meet the harmonised standard once it is cited, for presumption of conformity", "description": "Conformity with harmonised standards whose references are published in the Official Journal confers a presumption of conformity with the EAA accessibility requirements, but only for a version cited under this Directive. No version of EN 301 549 is cited under the EAA yet (v3.2.1 is cited under the Web Accessibility Directive only), so the route today is to meet the Annex I requirements directly and target the version expected to be cited: EN 301 549 v4.1.1, whose web clauses map to WCAG 2.2 AA.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eaa" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "presumption-of-conformity-en301549" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "conformity" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_15" } ], "target": { "type": "statement-id", "target-id": "eaa.presumption-of-conformity-en301549", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "b39f40a0-e3f7-5e52-b2c8-b7a6abc225be" } ] }, { "uuid": "ddef1ec6-3a09-57c0-8365-41b595af2ea9", "title": "Publish an accessibility statement (how the service meets the requirements)", "description": "Prepare and make publicly available, in accessible written and oral formats, the information required by Annex V explaining how the service meets the applicable accessibility requirements, and keep it current for as long as the service operates.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eaa" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "accessibility-statement" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "information" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_13" } ], "target": { "type": "statement-id", "target-id": "eaa.accessibility-statement", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "4f5f3590-c266-5396-ad21-23e5ca743222" } ] }, { "uuid": "72191c85-d6aa-5039-9d9e-db1c5aeaadf9", "title": "Determine EAA scope and the microenterprise service-provider exemption", "description": "Establish whether, and which parts of, the offering fall under the EAA. It applies to services provided to consumers (natural persons outside their trade/business), including e-commerce services; services provided solely to businesses for professional use are outside that consumer scope. Microenterprise service providers are exempt from the service accessibility requirements. Record the determination, because scope changes when the company grows past microenterprise size or exposes a consumer-facing e-commerce/signup surface.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eaa" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "scope-and-microenterprise-exemption" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "scope" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_4" } ], "target": { "type": "statement-id", "target-id": "eaa.scope-and-microenterprise-exemption", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "2a594f25-5cfd-5eac-bc69-f005f4a21a31", "title": "Ensure accuracy, robustness and cybersecurity (Art 15)", "description": "For high-risk systems, achieve appropriate accuracy, robustness and cybersecurity, including resilience to adversarial inputs. For our platform this maps directly to prompt-injection and indirect-injection defenses on the RAG/copilot surface and to retrieval-quality monitoring.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "robustness-cybersecurity" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "accuracy-robustness" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_15" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.robustness-cybersecurity", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "03baa77a-3673-5dd0-b99a-733e289ab0da", "title": "Data and data governance for high-risk (Art 10)", "description": "If high-risk, apply data governance to training/validation/testing data: relevance, representativeness, error-checking, and bias examination. For a RAG system this extends to the curation and provenance of the indexed corpus.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "data-governance" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-governance" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_10" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.data-governance", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "e55cb77b-e54e-5dc7-ae89-a09e5ec41c04", "title": "Promote a sufficient level of AI literacy in staff operating the AI system", "description": "Take measures to promote a sufficient level of AI literacy (technical knowledge, the context the system is used in, and its limits) in staff and other persons operating or using the AI system on our behalf. Binds providers AND deployers of ANY AI system regardless of risk tier; applied since 2 Feb 2025. The Digital Omnibus on AI (in force Jul 2026) softened Art 4 from an obligation of result (ensure) to an obligation of effort (promote); mandatory human-oversight training for HIGH-RISK deployers is carved out and remains binding. Pre-Omnibus 'ensure' phrasing is stale and must not be cited in new copy.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-literacy" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "deployer-obligations" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_4" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.ai-literacy", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "52f0a299-40f1-5140-99a7-dcaa2adc8d7c" } ] }, { "uuid": "52c610fe-f248-5d30-bb57-bc6088e9c444", "title": "Deployer obligations for high-risk use (Art 26)", "description": "As a deployer of a high-risk system, follow the provider's instructions, assign competent human oversight, monitor operation, keep logs, and inform affected persons where required. Where we deploy on a customer's behalf, delineate who is the deployer.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "deployer-duties" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "deployer-obligations" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_26" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.deployer-duties", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "ea60fc8a-c6c0-5047-8f49-588176cba57f", "title": "Consume upstream GPAI provider documentation", "description": "As a downstream integrator of general-purpose AI models, obtain and retain the Art 53 technical documentation and usage information the GPAI provider must supply, and respect their acceptable-use and copyright terms. We are not a GPAI provider ourselves.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "gpai-upstream-docs" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "gpai" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_53" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_55" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.gpai-upstream-docs", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "fcf6ef2d-1b8d-519c-86fe-c0fcdaf9dbbc", "title": "Design for human oversight (Art 14)", "description": "For high-risk deployment, ensure the system can be effectively overseen by humans: outputs are reviewable, the assistant is decision-support not autonomous action, and a human can disregard or reverse its output.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "human-oversight" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "human-oversight" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_14" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.human-oversight", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "58c5307e-f514-52e5-aae3-936cb1f11670", "title": "Fundamental-rights impact assessment (Art 27)", "description": "Certain high-risk deployers (public bodies, essential-service providers) must complete a fundamental-rights impact assessment before use. Provide the inputs (system purpose, affected groups, risks) needed for a customer to complete theirs.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "fundamental-rights-impact" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "impact-assessment" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_27" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.fundamental-rights-impact", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "36e4805b-6780-5cfd-a5d9-aed4eab4c579", "title": "Registration and post-market monitoring (Art 49, 72)", "description": "If we become a provider of a high-risk system, register it in the EU database (Art 49) and run a post-market monitoring plan (Art 72) that collects performance/incident data and feeds corrective action.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "registration-post-market" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "post-market" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_49" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_72" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.registration-post-market", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "4c37ebd1-22f7-50e7-8c5d-c56970bdd2d7", "title": "Never implement prohibited AI practices", "description": "The product must never do any Art 5 practice: subliminal/manipulative techniques causing harm, exploiting vulnerabilities, social scoring, untargeted facial-image scraping, emotion inference in workplace/education, or biometric categorisation of sensitive traits. This is an absolute design constraint, not risk-tiered.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "prohibited-practices" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "prohibited-practices" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.prohibited-practices", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "6fdde6bf-c28b-5daf-b8a8-685b63767678", "title": "Provide instructions and information to deployers (Art 13)", "description": "If we are a provider of a high-risk system, supply deployers with clear instructions for use: capabilities, limitations, intended purpose, human-oversight measures, and expected accuracy, so they can use it lawfully.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "provider-instructions" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "provider-obligations" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_13" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_16" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.provider-instructions", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "f02d9c01-5a79-501c-a5f0-5d3cd8af2090", "title": "Automatic record-keeping / logging (Art 12)", "description": "High-risk systems must automatically log events over their lifetime to enable traceability. For us: retain query/response and retrieval-decision logs sufficient to reconstruct behaviour, within GDPR retention limits.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "record-keeping-logs" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "record-keeping" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_12" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.record-keeping-logs", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "99a722c1-7cba-537a-b6fb-b9f3207d3582" } ] }, { "uuid": "0f3495e9-e36b-5b08-95c8-dc9c8ca9561e", "title": "Classify the system's risk tier and record it", "description": "Formally classify the assistant against Annex III. A general document-search/chat copilot is limited-risk (Art 50 only); it becomes high-risk if marketed for an Annex III use (e.g. employment screening, creditworthiness, essential services). Record the classification and re-run it when features or target verticals change.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "risk-classification" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "risk-classification" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_6" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.risk-classification", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "7895e018-de3c-5b0e-a74c-50dedadda4d2", "title": "Mark AI-generated content (Art 50)", "description": "AI-generated or manipulated output (text, images, audio) must be marked as artificially generated in a machine-readable way where feasible, so downstream consumers and users are not misled about provenance. Exemption currency (final Guidelines, adopted 20 Jul 2026): standard/assistive editing now expressly includes machine translation (summaries and substantive rewrites still require marking), and a narrow B2B/industrial carve-out applies only when three cumulative conditions are met (strictly technical output; a limited pre-defined professional audience inside the organisation; no intended external sharing plus safeguards against foreseeable misuse). Transitional: systems on the market before 2 Aug 2026 have until 2 Dec 2026 for this marking duty only (Digital Omnibus, not Art 50 itself).", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-content-marking" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "transparency" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_50" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.ai-content-marking", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "c63d1fc7-5daf-563c-9bdd-5b9c1f879b21" } ] }, { "uuid": "a1b65fe0-7823-5b86-a906-e048fa8b58fe", "title": "Disclose AI interaction to users (Art 50)", "description": "Users must be informed they are interacting with an AI system unless it is obvious. This applies regardless of risk tier. The chat surface must make the AI nature clear at first contact.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-interaction-transparency" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "transparency" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_50" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.ai-interaction-transparency", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "ef4b4eef-9227-59e8-811a-788eee8927c7" } ] }, { "uuid": "c1de0251-093a-5bdc-b26d-efe6fcb089d1", "title": "Support the right to explanation (Art 86)", "description": "A person subject to a high-risk-AI-assisted decision with significant effect has the right to a meaningful explanation of the role the AI played. Retain enough context (retrieved sources, decision rationale) to explain an individual output.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "right-to-explanation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "transparency" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_86" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.right-to-explanation", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "cd596904-1d24-5a61-b8b3-fa6c3ce56bdf", "title": "Determine and manage our AI-value-chain role", "description": "Establish whether we are a deployer, a provider, or both. Putting the assistant on the market under our name, or substantially modifying a third-party model, makes us a provider with the corresponding obligations (Art 25). Track this per feature.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-ai-act" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "value-chain-role" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "value-chain" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_25" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_16" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_26" } ], "target": { "type": "statement-id", "target-id": "eu-ai-act.value-chain-role", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "e59eea32-dc19-51de-a3ac-d141bbfae6a7", "title": "Support data-subject access and erasure", "description": "Enable the controller to fulfil data-subject rights of access and erasure, by providing the ability to retrieve a data subject's personal data and to delete it across all stores on request.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eudpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "data-subject-access-and-erasure" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-subject-rights" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_17" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_19" } ], "target": { "type": "statement-id", "target-id": "eudpr.data-subject-access-and-erasure", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "909b1887-0df1-515e-bcf6-86020834552e" } ] }, { "uuid": "87d3a5d9-4087-59ff-acac-e088cc11a8b7", "title": "Maintain records of processing activities", "description": "Maintain a record of processing activities, and as a processor maintain a record of all categories of processing carried out on behalf of a controller, available to the supervisor on request.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eudpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "records-of-processing" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "records" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_31" } ], "target": { "type": "statement-id", "target-id": "eudpr.records-of-processing", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "74806144-8e79-5d54-beac-621dcdca3248", "title": "Support EU-institution customers as an EUDPR processor", "description": "Recognise that when an EU institution or body is the customer, that institution is the controller under the EUDPR and Nordvec is its processor; provide processing under the controller's documented instructions with GDPR-equivalent safeguards and a data processing agreement.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eudpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "scope-processor-role-for-eu-institutions" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "scope" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_29" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_30" } ], "target": { "type": "statement-id", "target-id": "eudpr.scope-processor-role-for-eu-institutions", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "3dca53a3-291d-5ad2-acc7-001e41153641", "title": "Apply appropriate security of processing", "description": "Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate encryption and measures ensuring confidentiality, integrity, availability, and resilience of processing systems.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eudpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "security-of-processing" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_33" } ], "target": { "type": "statement-id", "target-id": "eudpr.security-of-processing", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "bc28dc4b-59ca-54cc-b269-a493bff9f67c" } ] }, { "uuid": "9e430c91-3b47-504d-8e22-6e68f67ae9a9", "title": "Restrict international transfers to lawful bases", "description": "Transfer personal data to a third country or international organisation only on the basis of an adequacy decision or appropriate safeguards, so processing remains protected.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eudpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "international-transfers" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "transfers" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_46" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_47" } ], "target": { "type": "statement-id", "target-id": "eudpr.international-transfers", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "1c0b0376-3922-5f17-a4d6-32f201ca7434" } ] }, { "uuid": "0807fe41-9410-5b40-b408-a2aa16b4a986", "title": "Give the controller the technical facts it needs for its DPIA and works-council process", "description": "Under Art 28(3)(f), provide accurate technical documentation of what a connected source ingests, how it is retained, and who can query it, so the controller can conduct its own Art 35 DPIA and satisfy its works-council or CSE documentation duty. The vendor supplies inputs; the controller owns the assessment.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "employee-monitoring" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "assist-controller-documentation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "assist-controller" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr-art-28" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr-art-35" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr-art-88" } ], "target": { "type": "statement-id", "target-id": "employee-monitoring.assist-controller-documentation", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "66ff7a6a-50eb-5825-a0f0-82e3f857bfeb" } ] }, { "uuid": "c5e4b4cb-3623-56f9-9ebf-05a0b9533d49", "title": "Design org-wide connection as a deliberate, acknowledged administrator action", "description": "Where a source can be promoted to organization-wide (making employee content searchable across the tenant), design it as a deliberate administrator action with explicit opt-in and an audit-logged acknowledgement that any required works-council or CSE step is complete, so the controller's labour-law step is recorded before the data is broadly exposed.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "employee-monitoring" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "deliberate-org-connection-action" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "assist-controller" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr-art-88" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "de-betrvg-87" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "at-arbvg-96" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "nl-wor-27" } ], "target": { "type": "statement-id", "target-id": "employee-monitoring.deliberate-org-connection-action", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "44568b43-df9c-5266-af88-758cd62c01f1", "title": "Offer minimization levers the controller can invoke to keep its assessment defensible", "description": "Offer data-minimization controls (excluding personal uploads, per-source scoping, excluding private/direct messages) so the controller can narrow what an employee-comms source exposes and keep its own proportionality assessment defensible. The vendor cannot decide minimization for the controller; it must offer the lever.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "employee-monitoring" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "data-minimization-options" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "minimization-enablement" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr-art-25" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr-art-88" } ], "target": { "type": "statement-id", "target-id": "employee-monitoring.data-minimization-options", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "2082deb7-57fe-5056-b4dc-6b8a607101bf" } ] }, { "uuid": "ecfca0fc-6760-53f5-a785-b6b9f2ca30e0", "title": "Allocate employment-law compliance to the controller in the DPA and name the instruments", "description": "The data processing agreement must state that employment and labour-law compliance is the controller's responsibility when it connects organization-wide sources that make employee content AI-searchable, naming the concrete national duties (works-council co-determination, CSE consultation) and the employee-monitoring notices, so the allocation is explicit and not assumed.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "employee-monitoring" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "dpa-labour-law-allocation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "processor-terms" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr-art-28" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "de-betrvg-87" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "fr-ctrav-l2312-38" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "nl-wor-27" } ], "target": { "type": "statement-id", "target-id": "employee-monitoring.dpa-labour-law-allocation", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "d6004e1c-73d3-5e3a-8248-f5f4e3b18a2e" } ] }, { "uuid": "3137c665-26d7-5d8e-89bb-6453e1298306", "title": "Process connected employee data only on documented controller instruction", "description": "Employee data reached through a connected source is processed only on the controller's documented instruction (Art 28(3)(a)); the vendor does not repurpose it for its own ends, and the controller's active use of an integration is the complete instruction.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "employee-monitoring" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "no-repurposing-beyond-instructions" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "processor-terms" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr-art-28" } ], "target": { "type": "statement-id", "target-id": "employee-monitoring.no-repurposing-beyond-instructions", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "b9304363-f72c-5798-bff1-a62b02b9e9d7" } ] }, { "uuid": "9baccad1-dbae-5a1c-966a-c9bc5feb18a2", "title": "Provide in-product transparency surfaces and an admin compliance kill-switch", "description": "Provide the in-product surfaces a controller needs to inform its workforce (Art 13/14 enablement) and an administrator control to disable a feature where a works-council or minimization duty requires it, so the controller can operate its own transparency and co-determination obligations.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "employee-monitoring" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "employee-transparency-enablement" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "transparency-enablement" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr-art-13" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr-art-88" } ], "target": { "type": "statement-id", "target-id": "employee-monitoring.employee-transparency-enablement", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "3e7d238c-4f8c-5b30-9692-39053f7a6638" } ] }, { "uuid": "dcc6643f-21ca-54d4-a3fb-cb45825e8202", "title": "Demonstrate controller accountability", "description": "Be able to demonstrate compliance: policies, this obligations register with implementation status, audit logs, and evidence trails that an enterprise or SOC 2/ISO auditor can inspect.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "controller-accountability" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "accountability" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_24" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "gdpr.controller-accountability", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "6f99f73e-e608-575b-bdc2-224854092b2a", "title": "Data protection by design and by default", "description": "Bake data minimisation, purpose limitation, and privacy defaults into features: collect only what a purpose needs, default to the least-exposing setting, and pseudonymise where feasible (e.g. no PII in logs, per Project Rule 11).", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "data-protection-by-design" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "accountability" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_25" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "gdpr.data-protection-by-design", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "054ca61e-2350-5b0a-a6fe-f611f1ed2993", "title": "Run a DPIA for high-risk processing", "description": "Where processing is likely high-risk (large-scale profiling, systematic monitoring, special-category data in documents), complete a data protection impact assessment before deployment and revisit on material change.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "dpia-high-risk" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "accountability" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_35" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_24" } ], "target": { "type": "statement-id", "target-id": "gdpr.dpia-high-risk", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "833089a4-5096-5b63-b588-5b69a1ea2352", "title": "Assess and document whether a Data Protection Officer must be designated", "description": "Determine whether Art 37(1)(b) applies (core activities consisting of regular and systematic monitoring of data subjects on a large scale) and either designate a DPO or record the reasoned determination that none is required. Enterprise procurement asks for this determination either way.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "dpo-designation-assessment" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "accountability" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_37" } ], "target": { "type": "statement-id", "target-id": "gdpr.dpo-designation-assessment", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "b051c1d7-519e-585b-87c4-08061bba09cc", "title": "Synthetic or anonymised data outside production", "description": "Development, test, evaluation and preview environments run on synthetic or anonymised data. Production personal data enters them only under a recorded, approved, time-boxed exception, closed by deletion. A copy in a non-production environment is the same personal data under weaker controls: outside the production access model, outside its retention schedule, and outside its erasure path, so an Art 17 request deletes the production rows and the copy survives.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "non-production-data" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "accountability" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "6" }, { "name": "residual-gap", "ns": "https://nordvec.eu/ns/compliance", "value": "The check reads the repository, not a running database." }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_25" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "gdpr.non-production-data", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "a9361428-ff29-5c5f-bb0f-c2cde061a584" } ] }, { "uuid": "8274635b-c607-5e36-a091-7d64c520e175", "title": "Maintain records of processing activities (ROPA)", "description": "Keep a record of processing activities: purposes, categories of data and subjects, recipients, transfers, retention, and security measures. This distillation is a machine-readable seed for that record.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "records-of-processing" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "accountability" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_30" } ], "target": { "type": "statement-id", "target-id": "gdpr.records-of-processing", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "fcbe4562-0c3a-50a8-a549-4d9370d383c5" } ] }, { "uuid": "455b837d-d3e6-56ea-9c52-165af5419e5e", "title": "Constrain solely-automated decisions", "description": "Do not make decisions with legal/similarly-significant effect based solely on automated processing without a lawful exception; where AI output drives such a decision, provide human review and contest paths.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "automated-decision-safeguards" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "automated-decisions" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_22" } ], "target": { "type": "statement-id", "target-id": "gdpr.automated-decision-safeguards", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "36451558-0e48-509e-a94e-4725cfa9cb63", "title": "Communicate erasure and rectification to every recipient", "description": "When personal data is rectified or erased, communicate that change to each recipient to whom the data was disclosed, unless doing so proves impossible or involves disproportionate effort, and be able to tell the data subject who those recipients are if they ask. For this platform the recipient classes are subprocessors that held copies (embedding provider, object storage, email vendor, error telemetry) and tenant-configured webhook endpoints that received document/event payloads.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "erasure-recipient-notification" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-subject-rights" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_19" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_17" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_16" } ], "target": { "type": "statement-id", "target-id": "gdpr.erasure-recipient-notification", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "f5e874ee-96c0-5a0d-b98b-72777945b9af", "title": "Suspend erasure under a legal hold, fail-closed", "description": "Where personal data must be retained to comply with a legal obligation or for the establishment, exercise, or defence of legal claims, suspend erasure of exactly that data for the duration of the hold, evaluate the hold before any deletion begins, and treat a missing or unreadable hold record as blocking (fail-closed), never as permission to proceed.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "legal-hold" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-subject-rights" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "planned" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_17" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_6" } ], "target": { "type": "statement-id", "target-id": "gdpr.legal-hold", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "planned" } } }, { "uuid": "38c51bcb-d017-5152-83a6-e5da0e48603d", "title": "Fulfil right of access (export of a data subject's data)", "description": "On request, produce all personal data held about a data subject across primary store, document chunks, embeddings, chat history, and logs, plus the metadata in Art 15 (purposes, recipients, retention, source), within one month.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "right-of-access" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-subject-rights" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_15" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_12" } ], "target": { "type": "statement-id", "target-id": "gdpr.right-of-access", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "3bdca72c-bc63-5226-9562-48bb85ac9a53" } ] }, { "uuid": "cc989aa8-c487-51d2-a8a5-02f8bd0235ba", "title": "Fulfil right to erasure across all stores", "description": "On an erasure request, hard-delete a data subject's personal data across primary DB, document chunks, embeddings/vector index, chat history, caches, and backups (or document backup-rotation exclusion), within the SLA, and log the erasure with an audit trail including failures.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "right-to-erasure" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-subject-rights" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_17" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "gdpr.right-to-erasure", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "ecd56f16-b356-55f0-afb2-ca70d04545ab" } ] }, { "uuid": "40a1b9e7-1437-53f0-bb25-671987f3eecb", "title": "Honour objection to processing", "description": "Allow a data subject to object to processing based on legitimate interests (and unconditionally to direct marketing), and stop the processing unless compelling legitimate grounds are documented.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "right-to-object" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-subject-rights" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_21" } ], "target": { "type": "statement-id", "target-id": "gdpr.right-to-object", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "3e1c2aaf-433a-5156-a24e-b1a1c582df3c" } ] }, { "uuid": "7ff39545-4329-54fc-aece-f3f4a08621c5", "title": "Fulfil right to data portability", "description": "Export the data subject's provided data in a structured, commonly-used, machine-readable format (e.g. JSON) where processing is by consent or contract and automated.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "right-to-portability" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-subject-rights" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_20" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_15" } ], "target": { "type": "statement-id", "target-id": "gdpr.right-to-portability", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "f5317adf-111b-5de7-b4a9-362d8bc0b4da" } ] }, { "uuid": "262d5ce6-4670-5fdf-91b3-bc5e045c89fd", "title": "Fulfil right to rectification", "description": "Allow correction of inaccurate personal data and propagate it to derived artifacts: re-index the affected documents and re-embed so stale text does not persist in retrieval.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "right-to-rectification" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-subject-rights" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_16" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "gdpr.right-to-rectification", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "093918fb-a668-57d6-8afe-ba3290475897" } ] }, { "uuid": "61e97a05-0e17-56c5-9f44-56b063b3cc0b", "title": "Fulfil right to restriction of processing", "description": "Support a restriction flag that suspends processing (exclude the data from retrieval/embedding/analytics) while retaining storage, without deleting, and reversible.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "right-to-restriction" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-subject-rights" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_18" } ], "target": { "type": "statement-id", "target-id": "gdpr.right-to-restriction", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "7a744d82-8565-5ac2-9fc7-b85a9be99858" } ] }, { "uuid": "004dc83b-9a98-5480-8efe-6c4c862abce4", "title": "Document whether the service is offered to children and gate consent accordingly", "description": "Where an information society service is offered directly to a child and relies on consent, Art 8 requires parental consent below the applicable age (13 in Denmark, up to 16 in other member states). Determine and record whether the B2C self-serve motion is offered to children, and add age assurance if it ever is.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "childrens-consent-determination" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "lawful-basis" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_8" } ], "target": { "type": "statement-id", "target-id": "gdpr.childrens-consent-determination", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "f1a33448-7658-5943-a239-041ef5733f63", "title": "Capture and allow withdrawal of consent", "description": "Where consent is the basis (e.g. optional AI features, marketing), capture it as a freely-given, specific, unambiguous, logged action, and make withdrawal as easy as giving it. Withdrawal must stop the dependent processing.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "consent-capture-withdraw" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "lawful-basis" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_7" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_6" } ], "target": { "type": "statement-id", "target-id": "gdpr.consent-capture-withdraw", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "401e4048-5123-5814-83ad-03ec73c0d1ce" } ] }, { "uuid": "66f62697-d912-51cc-93d4-1e4db357bb99", "title": "Record a lawful basis per processing purpose", "description": "Every processing purpose (document indexing, embedding, chat, connector sync, analytics) must be tied to a stored lawful basis per tenant. Do not process personal data for a purpose that lacks a recorded basis.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "lawful-basis-record" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "lawful-basis" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "gdpr.lawful-basis-record", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "89944a93-d0f1-55ac-a154-d42e033c7ff0", "title": "Bind processors and subprocessors", "description": "Every subprocessor (LLM/embedding providers, object storage, hosting, email, error telemetry) must be under an Art 28 data processing agreement, listed in the notice, and offer sufficient guarantees. Maintain a current subprocessor list. Connector sources are brought by the user, who authorises reads of their own data: they process for the user, not for us, and are recorded as sources in the Art 30 register rather than as subprocessors.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "processor-agreements" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "processor" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_28" } ], "target": { "type": "statement-id", "target-id": "gdpr.processor-agreements", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "5a834912-f084-5f52-807c-d0c0638c0da1" } ] }, { "uuid": "61ef3f54-00ac-5979-b916-ab0023b928b0", "title": "Return or delete all personal data on contract termination", "description": "On termination of processing services, at the controller's choice, return or delete all personal data processed on the controller's behalf and delete existing copies, unless retention is legally required. For a multi-tenant controller this is the whole-tenant offboarding deliverable, a distinct duty from an individual data subject's erasure request.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "processor-return-or-delete" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "processor" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "planned" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_28" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "gdpr.processor-return-or-delete", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "planned" } } }, { "uuid": "c8640db8-e7b5-5f93-b074-cd9c38b3d638", "title": "Enforce storage limitation and retention", "description": "Do not keep personal data longer than the purpose needs. Enforce per-tenant retention that expires chat history, ingested documents, and derived embeddings/logs on schedule, and delete on account closure.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "storage-limitation-retention" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "retention" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "gdpr.storage-limitation-retention", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "9dc88ced-a90d-51a0-8120-440978243006" } ] }, { "uuid": "6784b748-0a67-5f5f-af06-a20f7aca8b24", "title": "Detect and notify personal data breaches", "description": "Detect breaches, notify the supervisory authority within 72 hours where risk arises, and inform affected data subjects when the risk is high. Maintain an internal breach register regardless of notifiability.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "breach-notification" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_33" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_34" } ], "target": { "type": "statement-id", "target-id": "gdpr.breach-notification", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "2b4f4319-d4ee-5f04-84b7-5f9f6cdb59d7" } ] }, { "uuid": "b9e1a9aa-e703-511d-8193-fc5c8de6e5f5", "title": "Continuously assure access-control enforcement", "description": "Do not rely on a one-time test that access control works; exercise the enforcement paths on a schedule in production and alert on any access that should not occur, so a regression is caught in operation rather than only at build time.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "continuous-access-control-assurance" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_32" } ], "target": { "type": "statement-id", "target-id": "gdpr.continuous-access-control-assurance", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "ab9e1496-b4d7-521b-9dad-cfa0594da0ec" } ] }, { "uuid": "e99d3232-076f-5554-b927-d6a2a0afd250", "title": "Scope ingestion credentials to least privilege", "description": "Prevent an automated ingestion credential from broadening a restricted document to organisation-wide visibility. Widening a previously-restricted document must require a separate, elevated authority and must be recorded as a privileged action.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "least-privilege-ingestion-credentials" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "assessment" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_32" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "gdpr.least-privilege-ingestion-credentials", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "6bdc7f17-4264-5aea-bfe9-5b07d364d0e2" } ] }, { "uuid": "5451b164-1aea-553a-925a-108537072021", "title": "Enforce document permissions at query time", "description": "Evaluate document-level access against live permissions on every retrieval, so a revoked share or an erased principal is excluded from the very next query. Enforcement must not depend on a periodically synchronised copy of permissions.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "query-time-access-enforcement" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_32" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_17" } ], "target": { "type": "statement-id", "target-id": "gdpr.query-time-access-enforcement", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "29b1d208-6316-5b74-9a57-c5bf06d2953a" } ] }, { "uuid": "7374abb8-82f7-5d38-a569-f1d91b1056c7", "title": "Resolve group access at query time", "description": "Resolve group and nested-group membership at query time from live data rather than pre-expanding it into a stored copy, so document access always reflects the current group structure and a membership change cannot leave stale access behind.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "query-time-group-resolution" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_32" } ], "target": { "type": "statement-id", "target-id": "gdpr.query-time-group-resolution", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "7eb0cc77-2c00-5780-a74c-81dfe9576809" } ] }, { "uuid": "4bafe596-7653-5c3f-acaf-31d7c2551395", "title": "Apply appropriate technical + organisational security", "description": "Encrypt personal data in transit and at rest, enforce least privilege, and maintain confidentiality, integrity, availability and resilience proportionate to risk (Art 32). Cover the vector store and object storage, not just the primary DB.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "security-of-processing" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "5" }, { "name": "residual-gap", "ns": "https://nordvec.eu/ns/compliance", "value": "A database timing side channel is an accepted residual risk, with compensating controls." }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_32" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "gdpr.security-of-processing", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "63339a8b-6aa5-529e-b7be-3d91e55aba71" } ] }, { "uuid": "4baa009c-d790-5a46-9d14-a3bac57f2dd4", "title": "Enforce tenant isolation as a security measure", "description": "Guarantee one tenant's personal data can never surface in another tenant's retrieval, chat, or exports. Isolation must hold at the row level and in the vector search path.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "tenant-isolation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "assessment" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_32" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "gdpr.tenant-isolation", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "e2f7f4c8-6a25-5f4f-afb6-02cdade2e5bf" } ] }, { "uuid": "e73068c4-c81f-575c-b7ce-8815a573c8e7", "title": "Attribute customer-directed transfers (webhook destinations) correctly", "description": "When the customer (data controller) registers an outbound delivery destination (a webhook endpoint URL) that resolves outside the EU/EEA, the transmission satisfies the EDPB Guidelines 05/2021 three cumulative transfer criteria and is a Chapter V transfer that the processor executes on the controller's documented instruction (Art 28(3)(a): the registration itself is the instruction). The lawful-basis responsibility under Art 44-49 for that destination sits with the controller who chose it, not with the processor's subprocessor selection. The processor's duties are: transmit only on the documented instruction, minimise the transferred surface (Art 5(1)(c): identifiers, counts and timestamps, never content), and record the responsibility split contractually in the DPA. This is the controller-instructed-destination angle; the vendor-selection angle is covered by eu-data-residency.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "customer-directed-transfers" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "transfers" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_44" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_46" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_28" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "gdpr.customer-directed-transfers", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "815cc89d-365a-523b-a4a7-6b3642a604a0" } ] }, { "uuid": "64efe3a6-b892-5320-b712-de1a078632bd", "title": "Keep personal data in the EU / lawful-transfer only", "description": "Keep all user personal data in EU regions. Any processing that would leave the EU/EEA needs an Art 44-49 basis (adequacy or safeguards). Prefer EU-region model/embedding/storage endpoints to avoid transfers entirely.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "eu-data-residency" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "transfers" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_44" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_46" } ], "target": { "type": "statement-id", "target-id": "gdpr.eu-data-residency", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "e7d66c55-9c0c-5384-896f-28d23c565164" } ] }, { "uuid": "c592f2e5-464d-50e0-8e8b-428d488d1edb", "title": "State the AI processing of personal data in the privacy notice", "description": "Where personal data is processed by the AI features (prompts, retrieved documents, memories, generated output), the privacy notice states that processing with its purposes and legal basis in the concise, intelligible form Art 12 requires, and, where any of it amounts to automated decision-making within Art 22, its existence and the logic involved (Art 13(2)(f) on direct collection, Art 14(2)(g) on indirect). Telling a person they are interacting with an AI system, and marking generated output, are EU AI Act Art 50 duties, not GDPR ones; they are tracked in the eu-ai-act distillation and only cross-referenced here.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-transparency" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "transparency" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_12" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_13" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_14" } ], "target": { "type": "statement-id", "target-id": "gdpr.ai-transparency", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "09bb1bd1-2b76-5970-ac86-9d1ac29e1724", "title": "Serve a transparent privacy notice", "description": "Present the Art 13/14 information (identity, purposes, legal basis, recipients incl. subprocessors and any non-EU transfer, retention, rights) in the user's language, concise and accessible, before or at collection.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "gdpr" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "transparency-notice" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "transparency" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_12" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_13" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_14" } ], "target": { "type": "statement-id", "target-id": "gdpr.transparency-notice", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "f703c449-7de9-5ec7-8b8c-b495c12a5040" } ] }, { "uuid": "1982154a-0455-5529-8ce1-ce0a716063bf", "title": "Management accountability for cybersecurity", "description": "Management must approve the cybersecurity risk-management measures, oversee their implementation, and receive training. Cyber risk is a board-level, documented responsibility, not solely an engineering concern.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "management-accountability" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "governance" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_20" } ], "target": { "type": "statement-id", "target-id": "nis2.management-accountability", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "b74c4ac9-4bb2-5803-9611-8748c9061c31", "title": "Report significant incidents on the NIS2 clock", "description": "For a significant incident, submit an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month, to the relevant CSIRT/authority, and inform affected recipients where appropriate.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-reporting-timeline" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-reporting" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_23" } ], "target": { "type": "statement-id", "target-id": "nis2.incident-reporting-timeline", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "84219831-6f9c-55f4-a840-6995e50bf1b6" } ] }, { "uuid": "4f04087c-c3eb-5b2c-8db0-7ea64b0a5b40", "title": "Register as an entity where required", "description": "Where in scope, register with the competent authority / be listed in the entity registry, keeping contact and service information current.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "entity-registration" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "registration" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_27" } ], "target": { "type": "statement-id", "target-id": "nis2.entity-registration", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "c56a6ef4-b699-5c68-9e40-16b2d554c3d5", "title": "Access control, MFA, and asset management", "description": "Enforce access control on a least-privilege basis, multi-factor authentication (or continuous/secured authentication), asset management, and secured communications for staff and administrative access.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "access-control-mfa" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "risk-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_21" } ], "target": { "type": "statement-id", "target-id": "nis2.access-control-mfa", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "0782ca21-a814-54e8-b2e5-866607e1fb0c" } ] }, { "uuid": "18c71511-edec-5384-a035-6af3c5730197", "title": "Business continuity, backup, and crisis management", "description": "Maintain business-continuity and disaster-recovery plans with tested backups and crisis-management procedures, so the service can be restored within defined objectives after a disruption.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "business-continuity-backup" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "risk-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_21" } ], "target": { "type": "statement-id", "target-id": "nis2.business-continuity-backup", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "54f5f327-5ea3-5d1f-afc7-ae6fc6d61ffc", "title": "Cryptography and encryption", "description": "Use cryptography and encryption appropriately: personal and sensitive data encrypted in transit and at rest, with sound key management.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "cryptography-encryption" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "risk-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_21" } ], "target": { "type": "statement-id", "target-id": "nis2.cryptography-encryption", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "3d4ef9fd-98f8-55d6-b9ec-6a22af44a7ab", "title": "Cyber hygiene and training", "description": "Maintain basic cyber-hygiene practices and provide security-awareness training to staff with access to systems or customer data.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "cyber-hygiene-training" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "risk-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_21" } ], "target": { "type": "statement-id", "target-id": "nis2.cyber-hygiene-training", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "007ca239-8648-5fea-ae0b-1140f51419b5", "title": "Incident handling", "description": "Operate an incident-handling capability: detection, triage, containment, eradication, recovery, and post-incident review, with defined roles and a runbook.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-handling" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "risk-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_21" } ], "target": { "type": "statement-id", "target-id": "nis2.incident-handling", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "5fe1ecd6-8c06-51c9-9222-d5c64abaf0c6" } ] }, { "uuid": "17aa5252-b2e5-548a-b7bd-7731c88abce3", "title": "Assess effectiveness of security measures", "description": "Have policies and procedures to assess the effectiveness of the cybersecurity risk-management measures (testing, audits, metrics), so controls are verified, not assumed.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "measures-effectiveness" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "risk-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "assessment" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_21" } ], "target": { "type": "statement-id", "target-id": "nis2.measures-effectiveness", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "26a61653-ce4f-5109-8d45-94d6c20d4f0c" } ] }, { "uuid": "40e7bd5b-e046-5a47-8b98-8d40b4d431b2", "title": "Risk analysis and information-security policy", "description": "Maintain a documented information-security policy and a risk-analysis process that identifies, assesses, and treats risks to the systems that process customer data.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "risk-analysis-infosec-policy" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "risk-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_21" } ], "target": { "type": "statement-id", "target-id": "nis2.risk-analysis-infosec-policy", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "1b38b649-94e5-5716-99bb-9025cddb947c", "title": "Secure development and vulnerability handling", "description": "Apply security in acquisition, development, and maintenance, including vulnerability handling and disclosure: track and remediate vulnerabilities in code and dependencies on a defined cadence.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "secure-development-vuln-handling" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "risk-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_21" } ], "target": { "type": "statement-id", "target-id": "nis2.secure-development-vuln-handling", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "0a462d0f-80ea-5dec-b78b-48ee1665fd6d" } ] }, { "uuid": "529d1ba6-ff52-535e-af73-3ba6bdfce89f", "title": "Supply-chain security", "description": "Address security in the supply chain: assess the security posture of suppliers and service providers (model/embedding vendors, storage, connectors) and manage supplier-related risk.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "supply-chain-security" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "supply-chain" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_21" } ], "target": { "type": "statement-id", "target-id": "nis2.supply-chain-security", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "3aa239e0-d51c-5b60-b35b-1754bc13d002" } ] }, { "uuid": "d86a11af-8948-51d5-b0d4-b910824c81f6", "title": "Apply the cloud/managed-service availability + integrity thresholds", "description": "For a cloud computing service provider (and, mutatis mutandis, a managed service provider), treat an incident as significant when the service is completely unavailable for more than 30 minutes, when availability is limited for more than 5% of Union users (or 1 million, whichever is smaller) for more than one hour, or when the confidentiality, integrity, or authenticity of processed data is compromised by a suspectedly malicious action or with impact on the same user threshold.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2-implementing" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "cloud-provider-incident-thresholds" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-reporting" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_7" } ], "target": { "type": "statement-id", "target-id": "nis2-implementing.cloud-provider-incident-thresholds", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "6d108f2e-9fe9-5c85-8d82-0736804eda2d", "title": "Aggregate recurring minor incidents into one significant incident", "description": "Treat individually non-significant incidents collectively as one significant incident where they occur at least twice within six months, share the same apparent root cause, and collectively meet the financial-loss criterion of Article 3(1)(a).", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2-implementing" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "recurring-incident-aggregation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-reporting" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_4" } ], "target": { "type": "statement-id", "target-id": "nis2-implementing.recurring-incident-aggregation", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "1b308a18-7db6-53cd-a55c-57d83d3de8c3", "title": "Classify incidents against the significant-incident criteria (starts the Art 23 clock)", "description": "Be able to determine whether an incident is 'significant' under the quantitative and qualitative criteria: direct financial loss exceeding EUR 500 000 or 5% of prior-year turnover (whichever is lower), exfiltration of trade secrets, death or considerable harm to a natural person's health, or a successful suspectedly-malicious unauthorised access capable of causing severe operational disruption. A significant incident triggers the NIS2 Art 23 reporting timeline.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2-implementing" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "significant-incident-classification" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-reporting" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" } ], "target": { "type": "statement-id", "target-id": "nis2-implementing.significant-incident-classification", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "551991cf-2426-5e2a-bfcc-3a14379c82de", "title": "Count user impact per the prescribed method", "description": "When calculating the number of users impacted for the availability thresholds, count both the customers holding a contract that grants access to the systems or services, and the natural and legal persons associated with business customers who use those systems or services.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2-implementing" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "user-impact-counting-method" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-reporting" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" } ], "target": { "type": "statement-id", "target-id": "nis2-implementing.user-impact-counting-method", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "8e474cfa-7106-562c-9e3f-af854ad289d2", "title": "Apply the Annex technical and methodological measures, proportionately and documented", "description": "Implement the technical and methodological cybersecurity risk-management requirements set out in the Regulation's Annex (the concrete specification of NIS2 Art 21(2) points (a)-(j)), sized to the entity's risk exposure, size, and incident likelihood. Where a requirement is qualified 'where appropriate', 'where applicable', or 'to the extent feasible' and is judged not to apply, document the reasoning comprehensibly.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nis2-implementing" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "apply-annex-technical-measures" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "risk-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" } ], "target": { "type": "statement-id", "target-id": "nis2-implementing.apply-annex-technical-measures", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "d2ab09cc-b044-54a7-b3b4-f58400e38b4a" } ] }, { "uuid": "938c6486-76e1-5aa9-9b32-9015c4308738", "title": "Prevent tenant data and system-prompt leakage through generated output", "description": "Retrieval is tenant-scoped at the database layer and the output stream is scanned for verbatim or codec-laundered system-prompt disclosure, so generation cannot become a data-exfiltration channel.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-600-1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "gai-data-privacy-leakage" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-privacy" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "data-privacy" } ], "target": { "type": "statement-id", "target-id": "nist-ai-600-1.gai-data-privacy-leakage", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "b480670f-b6e0-5480-8941-3b7573a2e3af" } ] }, { "uuid": "e6e19d66-0ff5-5692-b515-117566943e98", "title": "Gate abusive and jailbreak input before generation", "description": "User input passes a moderation gate (EU-jurisdiction classifier) before any generation spend, rejecting jailbreak and abusive prompts at the chat boundary.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-600-1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "gai-harmful-content-moderation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "harmful-content" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "harmful-content" } ], "target": { "type": "statement-id", "target-id": "nist-ai-600-1.gai-harmful-content-moderation", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "dec14cab-605f-5578-9d08-f43e2528c9f4" } ] }, { "uuid": "a0d5e4a3-d308-5293-9cfa-626368d32d01", "title": "Verify generated claims against the retrieved sources they cite", "description": "Every citation in a generated answer is verified against the actual retrieved chunks before it reaches the user, so a confabulated reference cannot masquerade as a grounded one.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-600-1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "gai-confabulation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "information-integrity" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "confabulation" } ], "target": { "type": "statement-id", "target-id": "nist-ai-600-1.gai-confabulation", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "369ebfac-bc0b-5da9-9110-1268efaa4d0d" } ] }, { "uuid": "0139e47a-c57c-593f-8878-e3dea182568c", "title": "Mark AI-generated artifacts with machine-readable provenance", "description": "Artifacts the assistant generates carry machine-readable AI-provenance marking in every shipped format, so downstream consumers can distinguish generated content from source material.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-600-1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "gai-information-integrity-provenance" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "information-integrity" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "information-integrity" } ], "target": { "type": "statement-id", "target-id": "nist-ai-600-1.gai-information-integrity-provenance", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "c6923613-2a95-59d9-9e94-b439dce873dd" } ] }, { "uuid": "9ee9358b-d21e-54cf-8766-bb6c9d0d4403", "title": "Defend the generation pipeline against direct and indirect prompt injection", "description": "Treat retrieved document content as untrusted data, not instructions: guard-wrap and escape untrusted blocks, neutralize marker forgery, and scan output for laundered exfiltration, so a document cannot hijack the assistant.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-600-1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "gai-information-security" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "information-security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "information-security" } ], "target": { "type": "statement-id", "target-id": "nist-ai-600-1.gai-information-security", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "7c76f230-b99a-592d-b02e-b30d552ae3c9" } ] }, { "uuid": "7c7c3bca-5e4e-532d-aa55-e424c2c8d62b", "title": "Document the AI system's capabilities, knowledge limits, and failure modes", "description": "State what the assistant can and cannot do, its knowledge cut-off and retrieval boundaries, and how outputs may be wrong, so operators and users interpret output correctly.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "map-capabilities-limits" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "capabilities-limits" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "map-2.2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "map-3.3" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.map-capabilities-limits", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "e4e1d662-b96a-5be4-bfe8-43fd6af75c00", "title": "Document the system's intended purpose, context, and requirements", "description": "Record the assistant's intended purpose, business context, target users, and system requirements (including privacy and residency), so downstream risk mapping has a defined scope.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "map-purpose-context" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "context-mapping" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "map-1.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "map-1.4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "map-1.6" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.map-purpose-context", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "eed4e4b4-6940-56b2-8e6d-5d794f115a02", "title": "Evaluate fairness and bias in AI output", "description": "Identify and evaluate fairness and bias risks appropriate to a document-grounded assistant (e.g. retrieval skew, answer bias from source imbalance).", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "measure-fairness-bias" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "fairness-bias" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "measure-2.11" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.measure-fairness-bias", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "b6ab8501-dd58-543e-9b11-6e7274ff1909", "title": "Maintain an inventory of AI systems and models in use", "description": "Keep an inventory of the AI systems and third-party models the product depends on (chat, embedding, reranker, planner), including provider, region, and decommissioning state, so ownership and lifecycle are tracked.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-system-inventory" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "governance-policy" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "govern-1.6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "govern-1.7" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.ai-system-inventory", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "6f2e687c-609c-5fff-8070-cccf87690875", "title": "Establish a documented AI risk-management process with periodic review", "description": "Define how the needed level of AI risk management is determined, executed, and periodically reviewed, so risk decisions are repeatable and auditable rather than ad hoc.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "risk-management-process" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "governance-policy" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "govern-1.3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "govern-1.5" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.risk-management-process", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "057eef25-2999-569c-bbbc-0de0279315f1", "title": "Encode the trustworthy-AI characteristics into engineering policy", "description": "Integrate the AI RMF trustworthiness characteristics (valid/reliable, safe, secure/resilient, accountable/transparent, explainable, privacy-enhanced, fair) into written engineering policy and design defaults, not just individual features.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "trustworthy-ai-in-policy" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "governance-policy" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "govern-1.2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "govern-1.4" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.trustworthy-ai-in-policy", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "e7c278ba-5449-5d4f-8f4b-3baf692ac7ad", "title": "Understand and document the AI legal and regulatory requirements we are subject to", "description": "Maintain a living, version-tracked record of the AI-relevant laws and standards the product must satisfy (EU AI Act, GDPR, DORA, NIST AI RMF/ISO 42001), so obligations are managed from an authoritative source rather than memory. Re-check when the source text changes.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "understand-ai-legal-requirements" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "governance-policy" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "govern-1.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "map-1.1" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.understand-ai-legal-requirements", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "ff7bf516-58c1-503d-b5fc-78b2e68f9ea4" } ] }, { "uuid": "0f8a7bfb-9849-5229-b52d-9a1c68c1e692", "title": "Define and document human oversight of AI output", "description": "Ensure a human can understand, review, and override the assistant's output, with oversight processes defined and assessed for the deployment context.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "human-oversight" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "human-oversight" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "map-3.5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "manage-1.1" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.human-oversight", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "8a60222d-1dbb-5f4a-8998-16d0a699b9cb" } ] }, { "uuid": "8e58e69d-f150-5727-958f-134f8c1f66cd", "title": "Provide feedback channels and communicate AI incidents", "description": "Give end users a way to report problems with AI output, and communicate incidents and errors to affected actors, feeding fixes back into the system.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "feedback-and-incident-comms" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-response" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "measure-3.3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "manage-4.3" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.feedback-and-incident-comms", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "045b20f1-580b-59c3-abe2-c4f2cfaf5294", "title": "Measure AI performance with defined test sets and metrics", "description": "Evaluate retrieval and generation quality against a maintained golden test set with documented metrics (recall, nDCG, MRR, hit-rate, schema validity), and re-run the evaluation to detect regressions.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "tevv-metrics-eval" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "measurement-tevv" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "measure-1.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "measure-2.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "measure-2.3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "measure-2.13" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.tevv-metrics-eval", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "3526e98b-5a7b-5291-b5dc-489a11790e73" } ] }, { "uuid": "c4c893d0-a27d-56eb-ae52-50d7a9498ad8", "title": "Monitor the AI system after deployment", "description": "Operate post-deployment monitoring of the AI pipeline (latency, errors, provider health, tracing) so degradations and incidents are detected in production.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "post-deployment-monitoring" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "post-market-monitoring" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "manage-4.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "measure-2.6" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.post-deployment-monitoring", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "3772b3b1-436c-58c4-a613-076449821556" } ] }, { "uuid": "1b574366-f499-5e62-87d6-30812f49c4d0", "title": "Examine the AI system's privacy risk", "description": "Assess and constrain the privacy risk of the AI pipeline: tenant isolation of retrieved context, no training on customer data, and EU data residency for model calls.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "measure-privacy" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "privacy-measurement" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "measure-2.10" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.measure-privacy", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "07c141ec-76cc-580f-8f2a-15f4daa1b104" } ] }, { "uuid": "0aed8018-1a0b-5c28-bd66-f357b911174f", "title": "Assign roles, accountability, and training for AI risk", "description": "Define who is accountable for mapping, measuring, and managing AI risk, with executive ownership and role-appropriate training and lines of communication.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-roles-accountability" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "roles-accountability" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "govern-2.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "govern-2.2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "govern-2.3" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.ai-roles-accountability", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "421e55ff-e657-551a-95da-b1108ae6b725", "title": "Evaluate AI system security and resilience", "description": "Assess the assistant for AI-specific security and resilience risks (prompt injection, data exfiltration via retrieval, provider failure) and confirm controls hold.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "measure-security-resilience" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "security-resilience" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "measure-2.7" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "manage-2.4" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.measure-security-resilience", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "30a1d3f8-d78c-5adb-8762-1e174d8e09d6", "title": "Handle failures and incidents in third-party AI dependencies", "description": "Contain failures of third-party AI services so a provider outage or fault degrades gracefully instead of cascading, and recovers automatically.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "third-party-ai-contingency" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "third-party-ai" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "govern-6.2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "manage-2.3" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.third-party-ai-contingency", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "c2277095-5c7f-5a38-b4c9-0062b84378ca" } ] }, { "uuid": "81d008ca-2362-5ffa-b333-00a957828cd4", "title": "Manage third-party and pre-trained model risk", "description": "Have policies and controls for the risks of third-party AI (the hosted models we call): assess provider terms, data handling, and region, and monitor pre-trained models used in the pipeline.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "third-party-ai-risk-policy" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "third-party-ai" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "govern-6.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "map-4.2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "manage-3.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "manage-3.2" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.third-party-ai-risk-policy", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "420c1d7a-0866-56a6-afbc-57a5723def87" } ] }, { "uuid": "1e9d632f-2533-5c41-97b9-b33d81ce92f4", "title": "Make AI output explainable and traceable to its sources", "description": "Ensure the assistant's answers are explainable via source attribution, so a user can trace each answer to the documents it was grounded in, and transparency/accountability risks are addressed.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-ai-rmf" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "measure-explainability-provenance" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "transparency-explainability" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "measure-2.8" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "measure-2.9" } ], "target": { "type": "statement-id", "target-id": "nist-ai-rmf.measure-explainability-provenance", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "4ec5a9a8-5171-5e72-be58-2a9bdb857d43" } ] }, { "uuid": "9a891102-220d-5e35-9ea2-2ed8c7a2329e", "title": "Detect: monitor for and analyze adverse events", "description": "Monitor systems and services to find potentially adverse events, and analyze detected events to understand the associated activity and impact.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-csf-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "de-detect" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "detect" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "DE.CM-01" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "DE.AE-02" } ], "target": { "type": "statement-id", "target-id": "nist-csf-2.de-detect", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "a9f93385-bee6-5d28-bd42-cf58e46f69f4" } ] }, { "uuid": "12a5a826-7a21-5b30-93c8-c35c5eb5215e", "title": "Govern: understand obligations and manage cybersecurity + supply-chain risk", "description": "Establish a cybersecurity risk-management strategy, understand the legal, regulatory, and contractual cybersecurity requirements that apply, and run a supply-chain risk-management program.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-csf-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "gv-govern" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "govern" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "GV.OC-03" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "GV.SC-01" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "GV.RM-01" } ], "target": { "type": "statement-id", "target-id": "nist-csf-2.gv-govern", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "e993b396-44c6-51aa-ba0e-61fddd6072fb" } ] }, { "uuid": "7be3d122-ea7a-575b-92e0-5a781f07257f", "title": "Identify: inventory assets and identify vulnerabilities", "description": "Maintain inventories of the assets (including software components) that enable the organization to achieve its purpose, and identify, validate, and record vulnerabilities in those assets.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-csf-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "id-identify" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "identify" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ID.AM-01" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ID.RA-01" } ], "target": { "type": "statement-id", "target-id": "nist-csf-2.id-identify", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "dea06767-027d-5999-a264-4a7e18016591" } ] }, { "uuid": "c40dd121-b122-5db8-9f77-0dca367459ab", "title": "Protect: identity, access control, and data security", "description": "Manage identities and access permissions on a least-privilege basis, and protect the confidentiality, integrity, and availability of data at rest and in transit.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-csf-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "pr-protect" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "protect" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "PR.AA-01" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "PR.AA-05" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "PR.DS-01" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "PR.DS-02" } ], "target": { "type": "statement-id", "target-id": "nist-csf-2.pr-protect", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "4e1ce0fb-feae-5da9-9806-1c5d637a5797" } ] }, { "uuid": "7518e55a-dcab-53ce-b2d9-5339192fd92f", "title": "Recover: restore services after an incident", "description": "Execute the recovery portion of the incident-response plan to restore assets and operations affected by an incident, and communicate recovery status to stakeholders.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-csf-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "rc-recover" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "recover" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "RC.RP-01" } ], "target": { "type": "statement-id", "target-id": "nist-csf-2.rc-recover", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "001f9b38-fefb-526f-88b0-3f2ddffd04ed", "title": "Respond: execute incident response and root-cause analysis", "description": "Execute an incident-response plan when an incident is declared, coordinate with relevant third parties, and analyze incidents to establish what happened and the root cause.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-csf-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "rs-respond" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "respond" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "RS.MA-01" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "RS.AN-03" } ], "target": { "type": "statement-id", "target-id": "nist-csf-2.rs-respond", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "0042db91-a4ab-5915-81f2-720d0c2592b1" } ] }, { "uuid": "8598e82a-2200-59c6-9c2d-a3e1cefbe01d", "title": "Apply engineering rigor in proportion to the worst consequence", "description": "The depth of review, testing and evidence for an engineering activity follows the most significant adverse effect that activity can cause.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e05-commensurate-rigor" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "assurance" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.30" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.5" } ], "target": { "type": "statement-id", "target-id": "E.5", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "b071267f-d867-58ed-ba3a-dff638a297a8" } ] }, { "uuid": "38c00983-e277-5831-9669-4a067afa1aa3", "title": "Base every trustworthiness judgment on evidence", "description": "A claim that an element is trustworthy rests on evidence that the criteria for trustworthiness are satisfied, and the evidence is checkable by someone other than its author.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e29-substantiated-trustworthiness" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "assurance" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "residual-gap", "ns": "https://nordvec.eu/ns/compliance", "value": "Most evidence shows a control is written, not that it runs." }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ca-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ca-7" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-11" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.29" } ], "target": { "type": "statement-id", "target-id": "E.29", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "6ed0f566-bbe2-57b7-ad3d-ac520256b74e" } ] }, { "uuid": "d9c04c0a-dc9d-533e-9a6a-7ae2f1db3811", "title": "Detect departures from design intent early enough to respond", "description": "Monitor the behaviour of the system and the conditions it runs in against a model of normal, and capture enough data (including who or what did it) for the response to be proportionate. Detection that arrives after the loss has run its course does not satisfy the principle.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e01-anomaly-detection" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "detection-and-response" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.21" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.1" } ], "target": { "type": "statement-id", "target-id": "E.1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "9a1caf2c-0934-5d46-8e00-c60d496db487" } ] }, { "uuid": "81274469-e7a3-5aea-858d-911e4fd8fbe2", "title": "Match the force and speed of a response to the loss scenario", "description": "Each loss scenario has a response whose immediacy and aggressiveness fit it: an automatic containment where minutes matter, a human decision where a wrong response would itself cause loss.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e04-commensurate-response" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "detection-and-response" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ir-4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ir-6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.4" } ], "target": { "type": "statement-id", "target-id": "E.4", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "501d8139-384b-51a2-b005-0740bd315b4a" } ] }, { "uuid": "50546a65-f663-53ab-a5e6-96f25b3c0fdb", "title": "Give each element the functions it needs and no more", "description": "Each element can do what its job requires and nothing beyond it: unused protocols, services, ports and response headers are absent rather than disabled by convention.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e14-least-functionality" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "minimisation" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cm-7" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.33" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.14" } ], "target": { "type": "statement-id", "target-id": "E.14", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "68ba5f1d-bb66-5da1-9702-ccca79d4c45a" } ] }, { "uuid": "8f685fea-f9b9-577d-a000-b68949e295af", "title": "Keep resources available only while they are needed", "description": "Data, credentials and capabilities exist only for the period they serve a purpose, then are removed, so a late compromise finds less to take.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e15-least-persistence" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "minimisation" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "residual-gap", "ns": "https://nordvec.eu/ns/compliance", "value": "Copies held by providers follow their terms, not our erasure ledger." }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-12" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "mp-6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.15" } ], "target": { "type": "statement-id", "target-id": "E.15", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "c86bd5b5-58e4-5bc6-a2bd-d966a577ac92" } ] }, { "uuid": "09ccae49-08ff-5862-8045-d99a981e93a0", "title": "Depend on as few trusted elements as practicable", "description": "The set of elements whose correct behaviour the security of the whole depends on is kept as small as practicable, because each trusted element is an assumption.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e20-minimal-trusted-elements" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "minimisation" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.13" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.9" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.20" } ], "target": { "type": "statement-id", "target-id": "E.20", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "65ea1d83-d3f9-5c2c-8885-edfa9f2cb726" } ] }, { "uuid": "f4b19a18-c85a-5089-9ca2-c0d66f65263a", "title": "Reveal as little about the system as practicable", "description": "The design discloses no more than it must about its structure, versions and internals to someone probing it.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e21-minimize-detectability" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "minimisation" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-30" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.21" } ], "target": { "type": "statement-id", "target-id": "E.21", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "dba1b633-aaeb-5b1f-b58d-96644225b0a0" } ] }, { "uuid": "510837ab-2f7d-5da4-8780-1a914d1148b4", "title": "Keep the design as simple as practicable", "description": "Complexity is treated as a source of vulnerability: the design is no more elaborate than the requirement forces, because only simple things can be analysed with confidence.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e25-reduced-complexity" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "minimisation" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.7" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.25" } ], "target": { "type": "statement-id", "target-id": "E.25", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "4ee6e11e-1af2-5587-9231-fd3af62be502" } ] }, { "uuid": "1842e940-6652-5823-b1f7-ca2780b4f800", "title": "Require more than one party for the most consequential operations", "description": "An operation whose misuse would be severe needs agreement from multiple authorised entities before it can run, so no single credential or person can perform it alone.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e10-distributed-privilege" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "privilege-and-access" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.15" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.10" } ], "target": { "type": "statement-id", "target-id": "E.10", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "ace312bb-4a55-52fd-87e8-96af7e3dcbb6", "title": "Separate domains with different protection needs", "description": "Domains that need different levels of protection are separated physically or logically, so a compromise or error in one does not reach the other. For a multi-tenant service the load-bearing domain boundary is the tenant.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e12-domain-separation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "privilege-and-access" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "assessment" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "residual-gap", "ns": "https://nordvec.eu/ns/compliance", "value": "Tenants share one database cluster; separation is logical." }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-32" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.12" } ], "target": { "type": "statement-id", "target-id": "E.12", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "871886a0-483d-5b7d-85e0-01f1c616d59b" } ] }, { "uuid": "1e14bd3c-8979-544d-a087-b116f07b4dc1", "title": "Protect an element only from less trustworthy elements", "description": "A more trustworthy element does not need to be shielded from a less trustworthy one it depends on being trusted by, which keeps protections cheap and the trust order explicit.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e13-hierarchical-protection" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "privilege-and-access" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.12" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.10" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.13" } ], "target": { "type": "statement-id", "target-id": "E.13", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "0b97e1fa-16e9-5226-adaa-cf1ec869da65", "title": "Allocate each element only the privileges its functions need", "description": "Every account, role, service and process holds the privileges required for its specified functions and no more, and privileged use is separable from ordinary use.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e16-least-privilege" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "privilege-and-access" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.14" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.16" } ], "target": { "type": "statement-id", "target-id": "E.16", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "5ed39ee2-8269-51e7-bdb2-367f07bc817f" } ] }, { "uuid": "8d771fae-5b81-564f-abba-8ddbfbfbd1a6", "title": "Share resources among as few elements as necessary", "description": "A resource is shared only when sharing is needed and then among the fewest elements, because every sharing path is a path for leakage or interference.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e17-least-sharing" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "privilege-and-access" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.17" } ], "target": { "type": "statement-id", "target-id": "E.17", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "72c20379-5de8-50a6-89e5-fc35a0560d22" } ] }, { "uuid": "1f1559a6-903e-50bd-94e2-4f620b35aaa5", "title": "Mediate every access to and operation on an element", "description": "No access to data or operation on a system element bypasses a mediating check: the check is the only path, not one of several.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e19-mediated-access" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "privilege-and-access" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.19" } ], "target": { "type": "statement-id", "target-id": "E.19", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "558a3c1d-db6a-5903-aaa8-522d353eccd1" } ] }, { "uuid": "81cdc7b6-5b0e-5c12-a74d-16272505cc1f", "title": "Route control functions through a reference monitor", "description": "Control functions follow the reference monitor properties: always invoked, tamper-proof, and small enough to verify.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e30-trustworthy-system-control" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "privilege-and-access" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "assessment" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-25" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.30" } ], "target": { "type": "statement-id", "target-id": "E.30", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "4a4c94eb-07cd-5b3a-9afb-b0c07b3f5c83" } ] }, { "uuid": "3bb7e838-a2e1-518c-94c4-6087cf6a2826", "title": "Scale protection to the worst failure of the element protected", "description": "The strength and kind of protection around an element follow from the most damaging outcome of that element failing, so the element carrying customer content is protected harder than one carrying nothing sensitive.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e03-commensurate-protection" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "protection-strength" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ra-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.28" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.3" } ], "target": { "type": "statement-id", "target-id": "E.3", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "ee85d2c1-c209-5d57-a59e-79b9f4a0bd80" } ] }, { "uuid": "b127a5e0-16c9-5756-89d8-195b7bc47d4c", "title": "Trust an element only as far as its failure could cost", "description": "An element is relied on to a degree that matches the harm its failure would cause: the more damaging the failure, the more evidence of trustworthiness the element needs before it is depended on.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e06-commensurate-trustworthiness" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "protection-strength" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.9" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sr-3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.6" } ], "target": { "type": "statement-id", "target-id": "E.6", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "e68517a9-a46b-5e31-83e2-0e5a369c0a4e" } ] }, { "uuid": "feedfb96-6c08-5603-82ae-1e15b52703fb", "title": "Keep protection unbroken for as long as it is needed", "description": "A protection works at every moment it is required, including during startup, failover and maintenance, rather than only in the steady state.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e08-continuous-protection" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "protection-strength" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.19" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-8" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.8" } ], "target": { "type": "statement-id", "target-id": "E.8", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "d27df788-c6f6-5c35-96d5-11015aa0adf9" } ] }, { "uuid": "5f8692ae-241b-5e45-a6cf-7255652644c9", "title": "Layer independent mechanisms so one failure is not the loss", "description": "Loss is prevented or limited by several coordinated mechanisms, each of which holds without relying on the others being intact.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e09-defense-in-depth" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "protection-strength" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-7" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.9" } ], "target": { "type": "statement-id", "target-id": "E.9", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "1d1c2149-76ec-5c57-9f29-0816cde3e313" } ] }, { "uuid": "8274b173-80c0-5b83-81fc-ee29b8239285", "title": "Operate well clear of the threshold where loss begins", "description": "The system runs in a state space with room to spare between normal operation and the point at which loss occurs, so a surge or fault does not tip it over.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e18-loss-margins" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "resilience" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.18" } ], "target": { "type": "statement-id", "target-id": "E.18", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "c35fbde4-7157-509d-afcb-13003848c6e6" } ] }, { "uuid": "8624ea34-f320-5c47-a029-3112fe9f5777", "title": "Ship the most protective configuration as the default", "description": "A fresh or unconfigured instance starts in the safest state; relaxing protection is an explicit act that leaves a record.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e22-protective-defaults" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "resilience" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.23" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-7.5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cm-6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.22" } ], "target": { "type": "statement-id", "target-id": "E.22", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "8272027a-c791-5ba3-9118-71e732a89581" } ] }, { "uuid": "b862e3fd-b7ba-52c5-8888-2d2026e89d43", "title": "Fail into a safe state", "description": "When an element fails it neither causes unacceptable loss nor sets off another loss scenario: the failure mode is closed rather than open.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e23-protective-failure" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "resilience" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.24" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-24" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.23" } ], "target": { "type": "statement-id", "target-id": "E.23", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "34bbdd4b-df1e-5bb3-a497-9b3314a0b3f6" } ] }, { "uuid": "d1d58fee-5a47-5c44-87a5-8794d7d8dff9", "title": "Recover without causing or leading to loss", "description": "Restoring an element returns it to a protected state: a recovery does not reopen a closed path, restore stale credentials or lose integrity.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e24-protective-recovery" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "resilience" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "planned" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.24" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cp-10" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cp-9" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.24" } ], "target": { "type": "statement-id", "target-id": "E.24", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "planned" } } }, { "uuid": "28785c3c-6d08-5d1b-be36-b41922290be7", "title": "Replicate critical functions where loss would be severe", "description": "A required capability is delivered by replicated functions or elements so a single failure does not remove it.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e26-redundancy" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "resilience" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "planned" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cp-9" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cp-6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.26" } ], "target": { "type": "statement-id", "target-id": "E.26", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "planned" } } }, { "uuid": "99a16126-a352-562f-ad71-a601b0e7a635", "title": "Keep the abstractions that describe the system simple and exact", "description": "Each component presents a small, precisely defined interface and hides its internal representation, so a reviewer can reason about it from the interface alone.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e02-clear-abstractions" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "structure" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.2" } ], "target": { "type": "statement-id", "target-id": "E.2", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "d8460584-6dbd-59ea-8108-62627ea146a6" } ] }, { "uuid": "be983b19-5720-5592-bb80-80c339ddbf36", "title": "Establish trustworthiness of each composition of elements", "description": "Trustworthy parts do not add up to a trustworthy whole by themselves: each aggregate of interacting elements needs its own argument that the combination holds.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e07-compositional-trustworthiness" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "structure" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.17" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-17" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.7" } ], "target": { "type": "statement-id", "target-id": "E.7", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "4f3fa54a-8aec-52cd-a000-99946441a3a5", "title": "Deliver critical capability through varied structure where it pays", "description": "Where a single flaw in one implementation would be severe, the capability is delivered through more than one structurally different implementation or varied behaviour.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e11-diversity" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "structure" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-29" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.11" } ], "target": { "type": "statement-id", "target-id": "E.11", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "e4a72cde-8cea-53a1-b3cb-ddf5f311b926", "title": "Make an element trustworthy with minimal dependence on others", "description": "An element achieves its own trustworthiness without leaning on the correct behaviour of many other elements.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e27-self-reliant-trustworthiness" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "structure" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.16" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.27" } ], "target": { "type": "statement-id", "target-id": "E.27", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "35c73a91-5edf-569c-aee7-a95993f7160a", "title": "Manage complexity by decomposing and composing in a structured way", "description": "The system is decomposed into elements with clear, limited interfaces and composed back through those interfaces, so each part can be reasoned about alone.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-160-v1r1" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "e28-structured-decomposition-and-composition" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "structure" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8.4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-17" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "E.28" } ], "target": { "type": "statement-id", "target-id": "E.28", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "83affc8e-8983-57ad-bb9e-bd7c43162a1b", "title": "Deploy and operate a secure development toolchain", "description": "Follow recommended security practices to deploy, operate, and maintain the tools and toolchains used to develop and release software, so the pipeline itself is not a weak link.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-218" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "po3-secure-toolchain" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "prepare-organization" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "PO.3.2" } ], "target": { "type": "statement-id", "target-id": "nist-800-218.po3-secure-toolchain", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "6c552cb0-ce21-5952-877f-784bd90347aa" } ] }, { "uuid": "1f4d2688-726e-57fd-95cc-c362d1426399", "title": "Acquire and verify well-secured third-party components", "description": "Acquire and maintain well-secured software components (libraries, frameworks) from trusted sources, and verify that acquired third-party components comply with organizational security requirements.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-218" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "pw4-well-secured-third-party-components" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "produce-well-secured" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "PW.4.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "PW.4.4" } ], "target": { "type": "statement-id", "target-id": "nist-800-218.pw4-well-secured-third-party-components", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "ffbc6561-f10b-50c0-ba51-e6a690b1d2f3" } ] }, { "uuid": "1a85fd4a-3bc9-5194-acf7-d9d23f60bbf0", "title": "Review and analyze code against secure coding standards", "description": "Determine and perform code review and/or automated code analysis against secure coding standards, recording and triaging discovered issues before release.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-218" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "pw7-code-review-and-analysis" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "produce-well-secured" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "PW.7.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "PW.7.2" } ], "target": { "type": "statement-id", "target-id": "nist-800-218.pw7-code-review-and-analysis", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "179b6c1f-20a5-5f22-96a8-0eff3bd41866" } ] }, { "uuid": "4b4d36b0-1777-5454-852d-5a0dcad06db0", "title": "Test executable code and triage findings", "description": "Scope, design, and perform testing of executable code, recording and triaging discovered issues so they are addressed before release.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-218" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "pw8-test-executable-code" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "produce-well-secured" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "PW.8.2" } ], "target": { "type": "statement-id", "target-id": "nist-800-218.pw8-test-executable-code", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "22e4e9bf-07ec-561d-abd6-6c6668ef3594" } ] }, { "uuid": "1519998b-ac2a-59de-921a-e09a0eebcfbb", "title": "Ship secure-by-default settings", "description": "Define a secure baseline by configuring each security-relevant setting so that the default configuration is secure, and so operators must consciously weaken rather than strengthen it.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-218" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "pw9-secure-default-configuration" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "produce-well-secured" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "PW.9.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "PW.9.2" } ], "target": { "type": "statement-id", "target-id": "nist-800-218.pw9-secure-default-configuration", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "91b93e46-adbb-5784-9d5a-06007d3995c1" } ] }, { "uuid": "ea71cb97-d652-54e6-9b9f-5bbca536e780", "title": "Protect stored code from unauthorized access and tampering", "description": "Store all forms of code (source, executable, configuration-as-code) based on least privilege so only authorized parties can access it, and protect it from unauthorized tampering.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-218" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ps1-protect-code-from-unauthorized-access" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "protect-software" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "PS.1.1" } ], "target": { "type": "statement-id", "target-id": "nist-800-218.ps1-protect-code-from-unauthorized-access", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "393edc4a-1022-53a9-aa09-f9330826e9e1" } ] }, { "uuid": "3fc7c7b4-f908-5a79-8d46-0ee71a9ce26e", "title": "Archive releases with integrity and provenance data", "description": "Securely archive the necessary files and supporting data (integrity verification information, provenance data) for each software release, and make integrity verification information available to acquirers where applicable.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-218" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ps3-release-provenance-archive" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "protect-software" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "PS.2.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "PS.3.1" } ], "target": { "type": "statement-id", "target-id": "nist-800-218.ps3-release-provenance-archive", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "15ef6592-b8ac-5399-ba90-59465317a6da", "title": "Maintain a vulnerability disclosure and remediation policy", "description": "Have a policy addressing vulnerability disclosure and remediation, and implement the roles, responsibilities, and processes to support it, including a researcher-facing contact.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-218" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "rv1-3-vulnerability-disclosure-policy" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "respond-to-vulnerabilities" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "RV.1.3" } ], "target": { "type": "statement-id", "target-id": "nist-800-218.rv1-3-vulnerability-disclosure-policy", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "868186a5-98e2-553e-a407-0866366923df" } ] }, { "uuid": "8563d22d-c3e6-5032-8ed9-24e6bcb37678", "title": "Identify vulnerabilities in code and third-party components on an ongoing basis", "description": "Continuously gather information on potential vulnerabilities in the software and its third-party components from public sources, and review/analyze/test code to identify or confirm previously undetected vulnerabilities.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "nist-800-218" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "rv1-identify-vulnerabilities" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "respond-to-vulnerabilities" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "RV.1.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "RV.1.2" } ], "target": { "type": "statement-id", "target-id": "nist-800-218.rv1-identify-vulnerabilities", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "a743c828-31fa-57f8-b019-9fe836aa5499" } ] }, { "uuid": "4690e4ea-f706-523f-a795-68c7df4d6c7e", "title": "Rate limiting and anti-automation controls", "description": "Implement rate limiting and anti-automation controls to protect against automated abuse, resource exhaustion, and brute-force attacks.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-asvs" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "anti-automation-rate-limiting" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "anti-automation" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V6.1.1" } ], "target": { "type": "statement-id", "target-id": "owasp-asvs.anti-automation-rate-limiting", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "620c0ef6-ea9e-54cd-924f-c0b078670381" } ] }, { "uuid": "b96b1c1b-5f26-57dc-ae4a-54cfcafbd704", "title": "Protect authentication against brute force and offer MFA", "description": "Implement controls against credential stuffing and password brute force, and support a multi-factor (or equivalent multi-mechanism) authentication option for user accounts.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-asvs" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "authentication-brute-force-and-mfa" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "authentication" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V6.3.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V6.3.3" } ], "target": { "type": "statement-id", "target-id": "owasp-asvs.authentication-brute-force-and-mfa", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "1890129e-8f24-5ff0-ab84-d43dd206650a", "title": "Enforce function- and data-level authorization at a trusted layer", "description": "Restrict function-level and data-specific access to consumers with explicit permissions, enforce authorization at a trusted service layer (not client-controllable), and base object access on the originating subject's permissions.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-asvs" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "authorization-data-and-function-level" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "authorization" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "assessment" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V8.2.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V8.2.2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V8.3.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V8.3.3" } ], "target": { "type": "statement-id", "target-id": "owasp-asvs.authorization-data-and-function-level", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "1c123b29-a4e5-5938-a234-81757d450453" } ] }, { "uuid": "d88c5286-6fc4-5925-b70a-df0a40dbff5f", "title": "Classify sensitive data and bound its retention", "description": "Identify and classify sensitive data into protection levels with documented protection requirements, return only the minimum sensitive data needed, and subject sensitive data to retention classification so outdated data is removed.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-asvs" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "data-protection-classification-and-retention" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-protection" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V14.1.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V14.2.6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V14.2.7" } ], "target": { "type": "statement-id", "target-id": "owasp-asvs.data-protection-classification-and-retention", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "5d174201-ebac-56f6-a15f-5d4e1d27c51e" } ] }, { "uuid": "0f903db4-608e-5e41-a314-05a26c80cf56", "title": "Validate uploaded files by type, extension, and size", "description": "Validate uploaded files against permitted types/extensions and maximum size, check compressed files against a maximum uncompressed size (zip-bomb defense), and enforce per-user storage/file-count quotas.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-asvs" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "file-upload-validation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "file-handling" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V5.1.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V5.2.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V5.2.3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V5.2.4" } ], "target": { "type": "statement-id", "target-id": "owasp-asvs.file-upload-validation", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "4d7689fc-cbe4-5d52-af56-d67a6f84b12a" } ] }, { "uuid": "ac675cb4-9ae1-50b6-b74d-c961f9bb3cf6", "title": "Prevent injection via parameterized queries and safe OS calls", "description": "Use parameterized queries, ORMs, or otherwise safe database access to prevent SQL/NoSQL injection, and avoid unsafe OS command construction from untrusted input.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-asvs" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "injection-prevention-queries" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "injection" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V1.2.4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V1.2.5" } ], "target": { "type": "statement-id", "target-id": "owasp-asvs.injection-prevention-queries", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "ea48aa0f-83f4-5ecf-92c0-a19042089e2e", "title": "Protect against Server-Side Request Forgery", "description": "Protect against SSRF by validating untrusted URLs against an allowlist and blocking access to internal/private address ranges before the server makes outbound requests on behalf of user input.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-asvs" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ssrf-protection" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "injection" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V1.3.6" } ], "target": { "type": "statement-id", "target-id": "owasp-asvs.ssrf-protection", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "230f6dc9-334b-57d0-8f4b-bc4c05394029" } ] }, { "uuid": "1b7542cf-5a70-5840-a1b9-32bc3c1b8b36", "title": "Structured security logging with correlation and no sensitive data", "description": "Emit security-event logs with sufficient correlatable metadata (when/where/who/what) in a common processable format, and enforce that logging respects data protection levels so sensitive data and direct identifiers are not written to logs.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-asvs" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "security-logging-metadata-and-sensitivity" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "logging" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V16.2.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V16.2.4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V16.2.5" } ], "target": { "type": "statement-id", "target-id": "owasp-asvs.security-logging-metadata-and-sensitivity", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "cf14296f-e41d-5471-8eb5-5ff34cc2b56b" } ] }, { "uuid": "26ae15b4-7499-5f0e-b930-c77383bb89a8", "title": "Context-aware output encoding and sanitization of rendered content", "description": "Apply context-appropriate output encoding for HTML/JS/URL contexts, and sanitize or disable user-supplied and model-generated scriptable content (Markdown, HTML, CSS) before rendering to prevent XSS.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-asvs" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "output-encoding-and-content-sanitization" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "output-encoding" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V1.2.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V1.3.5" } ], "target": { "type": "statement-id", "target-id": "owasp-asvs.output-encoding-and-content-sanitization", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "65aa25a4-8767-585d-bcc1-75e913b1e1c2", "title": "Manage third-party components with remediation timeframes and an SBOM", "description": "Maintain an inventory (SBOM) of third-party libraries and transitive dependencies, define risk-based remediation timeframes for vulnerable versions, and ensure the application contains only components within those timeframes and sourced from expected repositories.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-asvs" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "third-party-component-management" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "supply-chain" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V15.1.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V15.1.2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V15.2.1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "V15.2.4" } ], "target": { "type": "statement-id", "target-id": "owasp-asvs.third-party-component-management", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "d1fbeab6-243a-5c0b-9150-85959c194e04" } ] }, { "uuid": "3a417de3-e856-5251-b87f-e36c69e8ff35", "title": "Constrain agent functionality, permissions, and autonomy", "description": "Limit LLM-invoked tools/extensions to the minimum functionality needed, grant them least-privilege permissions on downstream systems, execute actions in the requesting user's security context, enforce complete mediation (authorization decided by downstream systems, not the LLM), and require human approval for high-impact actions.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-llm-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "llm06-excessive-agency" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "agency" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "llm06" } ], "target": { "type": "statement-id", "target-id": "owasp-llm-top-10.llm06-excessive-agency", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "4a0bca2d-036b-5cf6-9574-33595c292e8b" } ] }, { "uuid": "d6f7feb7-e506-5ad6-9a92-002dddd67943", "title": "Protect training/RAG data integrity against poisoning", "description": "Validate the integrity and provenance of data entering the knowledge base, detect hidden/adversarial content in ingested documents, restrict ingestion to trusted sources, and monitor for anomalous retrieval behaviour. Because user-supplied documents feed retrieval, treat the ingestion path as a poisoning surface.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-llm-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "llm04-data-and-model-poisoning" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-integrity" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "llm04" } ], "target": { "type": "statement-id", "target-id": "owasp-llm-top-10.llm04-data-and-model-poisoning", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "6743b1ba-af94-5866-b1bd-49f331e4f33b" } ] }, { "uuid": "050a818d-c29b-5b47-8a4b-7b261aca7d83", "title": "Prevent unauthorized retrieval of sensitive data from the knowledge base", "description": "Enforce least-privilege access to retrieved data so the model cannot surface another tenant's or user's content, and restrict which data sources the model can reach. Access to embeddings and chunks must be scoped to the requesting tenant/user/ACL, not left to system-prompt instructions.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-llm-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "llm02-sensitive-information-disclosure" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-protection" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "llm02" } ], "target": { "type": "statement-id", "target-id": "owasp-llm-top-10.llm02-sensitive-information-disclosure", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "a33fa9b1-1561-5029-b897-71dbd971ed15" } ] }, { "uuid": "e3db379b-0a97-5e58-ba06-10fb408ca6a3", "title": "Partition the vector store per tenant with permission-aware retrieval", "description": "Implement fine-grained, permission-aware access control over the vector and embedding store so that in a multi-tenant environment one tenant's queries can never retrieve another tenant's embeddings. Enforce strict logical/access partitioning of datasets in the vector database.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-llm-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "llm08-vector-and-embedding-weaknesses" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-protection" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "llm08" } ], "target": { "type": "statement-id", "target-id": "owasp-llm-top-10.llm08-vector-and-embedding-weaknesses", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "209fc33f-9c19-5d49-bd10-e44cd1727955" } ] }, { "uuid": "4a9c69b3-96d0-5925-a41f-eac838ab16ba", "title": "Ground answers and surface source citations to counter hallucination", "description": "Reduce misinformation and overreliance by grounding responses in retrieved, verified sources (RAG), attaching source citations, automatically validating key outputs, clearly labelling AI-generated content, and communicating reliability limits to users.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-llm-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "llm09-misinformation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "grounding" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "llm09" } ], "target": { "type": "statement-id", "target-id": "owasp-llm-top-10.llm09-misinformation", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "427b10b5-003a-5026-9477-4258c5c8cdf7" } ] }, { "uuid": "86fa47c2-7248-520f-a8f6-b7552a0f2659", "title": "Mitigate direct and indirect prompt injection", "description": "Constrain model behaviour with explicit system-prompt role/scope instructions, validate expected output formats with deterministic code, segregate and clearly denote untrusted external content (retrieved documents, tool results) so it cannot override instructions, enforce least-privilege on model-invoked functions, and require human approval for high-risk actions. Treat RAG-ingested content as an indirect-injection vector.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-llm-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "llm01-prompt-injection" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "input-security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "llm01" } ], "target": { "type": "statement-id", "target-id": "owasp-llm-top-10.llm01-prompt-injection", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "c5b95dba-ba2c-59f7-a0f5-d9077de52fc2" } ] }, { "uuid": "4a347ede-0a8a-518f-aed4-164ff6f06e54", "title": "Handle model output as untrusted before downstream use", "description": "Adopt a zero-trust stance on model output: apply context-aware encoding for rendered content (HTML/Markdown escaping to prevent XSS), never pass model output unsanitized into shells, SQL, file paths, or email templates, use parameterized queries, and apply a strict Content Security Policy.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-llm-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "llm05-improper-output-handling" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "output-security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "llm05" } ], "target": { "type": "statement-id", "target-id": "owasp-llm-top-10.llm05-improper-output-handling", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "6d6fb312-d012-5027-a711-e6ba4f9b0bb2" } ] }, { "uuid": "4c541299-0e93-5384-a2fd-3db78db8f092", "title": "Keep secrets and authorization out of the system prompt", "description": "Never place credentials, connection strings, or authorization logic in the system prompt; enforce privilege separation and authorization checks in deterministic, auditable systems outside the LLM. Assume the system prompt is discoverable and design so its disclosure carries no security impact.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-llm-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "llm07-system-prompt-leakage" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "prompt-security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "llm07" } ], "target": { "type": "statement-id", "target-id": "owasp-llm-top-10.llm07-system-prompt-leakage", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "869f992f-a499-5c25-adce-bedbcfee939e" } ] }, { "uuid": "c9d2ce23-56f4-5679-a84c-bca7cec833ab", "title": "Bound inference consumption with rate limits and quotas", "description": "Prevent denial-of-service and denial-of-wallet by applying per-source rate limiting and user quotas, validating input size, managing resource allocation, and monitoring for anomalous consumption. Guard the cost-per-use inference path against uncontrolled or automated abuse.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-llm-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "llm10-unbounded-consumption" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "resource-control" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "residual-gap", "ns": "https://nordvec.eu/ns/compliance", "value": "Three AI-specific threat classes are ranked low and are not addressed." }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "llm10" } ], "target": { "type": "statement-id", "target-id": "owasp-llm-top-10.llm10-unbounded-consumption", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "351bf4a9-9bc9-5e15-a718-7f21eff0d18e" } ] }, { "uuid": "0585e1ce-f190-569d-b507-f091d7addb19", "title": "Secure the model and dependency supply chain", "description": "Vet third-party models and data providers (terms, privacy, training-data usage), maintain an SBOM, scan and patch vulnerable/outdated components, and gate dependency updates against compromised releases. Use models only from verifiable sources.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-llm-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "llm03-supply-chain" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "supply-chain" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "llm03" } ], "target": { "type": "statement-id", "target-id": "owasp-llm-top-10.llm03-supply-chain", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "881f055e-64db-57bc-8098-0287d3397919" } ] }, { "uuid": "c4ca724a-690b-5a0e-a456-097c6ccb9156", "title": "Prevent broken access control", "description": "Enforce access control server-side on a deny-by-default basis so users cannot act outside their intended permissions or access other tenants' data.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "a01-broken-access-control" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "access-control" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "assessment" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "a01" } ], "target": { "type": "statement-id", "target-id": "owasp-top-10.a01-broken-access-control", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "a5670b8f-c2b4-59a4-bc3a-313c27e5b0d4" } ] }, { "uuid": "d09f1882-136c-5dac-ba3f-8bc6d7a78490", "title": "Harden identification and authentication", "description": "Protect authentication against automated attacks (credential stuffing, brute force), support strong/multi-factor authentication, and manage sessions securely.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "a07-identification-and-authentication-failures" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "authentication" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "a07" } ], "target": { "type": "statement-id", "target-id": "owasp-top-10.a07-identification-and-authentication-failures", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "e9fa2905-c9ce-59e9-b5fb-e898b65862c0" } ] }, { "uuid": "1f4a4474-61c8-585e-9a93-c7b2173ff59e", "title": "Avoid security misconfiguration", "description": "Ship hardened, secure-by-default configuration, validate configuration, and avoid exposing unnecessary features, verbose errors, or default credentials.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "a05-security-misconfiguration" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "configuration" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "a05" } ], "target": { "type": "statement-id", "target-id": "owasp-top-10.a05-security-misconfiguration", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "bf065053-7e0b-5013-b145-ea96e662f3f2" } ] }, { "uuid": "57010c58-02c7-50fd-b608-71d6a9e615d8", "title": "Protect data with sound cryptography", "description": "Protect data in transit and at rest with current cryptography and sound key management, and avoid weak or misconfigured algorithms and protocols.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "a02-cryptographic-failures" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "cryptography" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "a02" } ], "target": { "type": "statement-id", "target-id": "owasp-top-10.a02-cryptographic-failures", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "1c03d7d2-31f5-5d5d-90fd-cad4449d995e", "title": "Prevent injection", "description": "Prevent SQL/NoSQL/command/template injection through parameterized queries, safe APIs, and context-aware output encoding of untrusted input.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "a03-injection" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "injection" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "a03" } ], "target": { "type": "statement-id", "target-id": "owasp-top-10.a03-injection", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "4715a570-9f4a-5516-86b6-46cb67fd49dc", "title": "Protect software and data integrity", "description": "Protect against integrity failures in the software supply chain and CI/CD pipeline, and avoid insecure deserialization of untrusted data.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "a08-software-and-data-integrity-failures" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "integrity" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "a08" } ], "target": { "type": "statement-id", "target-id": "owasp-top-10.a08-software-and-data-integrity-failures", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "b939dc3b-6c7a-525e-b6cc-bb39515c30a4" } ] }, { "uuid": "fc4512f3-921d-5431-9f43-bc96b127a4a4", "title": "Ensure security logging and monitoring", "description": "Log security-relevant events with sufficient detail for detection and response, monitor for anomalies, and avoid logging sensitive data.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "a09-security-logging-and-monitoring-failures" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "logging" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "a09" } ], "target": { "type": "statement-id", "target-id": "owasp-top-10.a09-security-logging-and-monitoring-failures", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "31bbba6f-23a0-519a-b47b-f0e83776f1e7" } ] }, { "uuid": "9ae4be1e-69f3-5bac-b1b5-5a4103324d48", "title": "Address insecure design", "description": "Use secure design patterns and threat modeling so security is built into the architecture rather than bolted on, with defense-in-depth for high-risk flows.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "a04-insecure-design" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "secure-design" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "a04" } ], "target": { "type": "statement-id", "target-id": "owasp-top-10.a04-insecure-design", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "02c36f0a-e6b2-5c41-b67b-9d84fee93e06", "title": "Prevent Server-Side Request Forgery", "description": "Validate and restrict server-side requests built from user-supplied URLs, blocking access to internal and private address ranges.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "a10-server-side-request-forgery" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "ssrf" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "a10" } ], "target": { "type": "statement-id", "target-id": "owasp-top-10.a10-server-side-request-forgery", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "c9b3b62f-2aae-5b83-a5a6-6037860d9a35" } ] }, { "uuid": "0d109291-3514-53a6-9b52-f733502e1062", "title": "Manage vulnerable and outdated components", "description": "Maintain an inventory of components, monitor for known vulnerabilities, and patch or remove vulnerable and outdated dependencies on a defined cadence.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "owasp-top-10" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "a06-vulnerable-and-outdated-components" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "supply-chain" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "a06" } ], "target": { "type": "statement-id", "target-id": "owasp-top-10.a06-vulnerable-and-outdated-components", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "3687ad7f-df8b-5b68-af55-1a9aed581435" } ] }, { "uuid": "28934f80-79e4-574b-8f01-f9d2867a2d0a", "title": "Safeguard user data against corruption and loss", "description": "Protect user data against destruction or corruption, since destruction or corruption of data not used exclusively for professional purposes is a compensable head of damage under the PLD.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "pld" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "safeguard-user-data-integrity" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-integrity" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_6" } ], "target": { "type": "statement-id", "target-id": "pld.safeguard-user-data-integrity", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "5549b5b8-f469-5e13-99bc-c87dfbe7e752" } ] }, { "uuid": "b48cdf06-59f4-5482-bb94-8e4f400d6bac", "title": "Preserve records so relevant evidence can be disclosed", "description": "Maintain the records needed to disclose relevant evidence in a liability claim (design and risk documentation, audit and operational logs, provenance), because a failure to disclose relevant evidence when ordered creates a presumption of defectiveness. Retain the ability to present such evidence understandably while protecting trade secrets.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "pld" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "preserve-evidence-for-disclosure" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "evidence-disclosure" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_9" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_10" } ], "target": { "type": "statement-id", "target-id": "pld.preserve-evidence-for-disclosure", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "92fd9ff3-cdab-5666-b6e9-4964968ec312" } ] }, { "uuid": "0cceecc5-473e-5031-96d1-42c1d5c44f06", "title": "Track substantial modifications and manufacturer-role changes", "description": "Track substantial modifications to the product, since a party that substantially modifies a product outside the manufacturer's control and then makes it available becomes a manufacturer for liability purposes; keep the initial and updated risk assessments that define whether a change is substantial.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "pld" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "track-substantial-modifications" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "liability-attribution" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_8" } ], "target": { "type": "statement-id", "target-id": "pld.track-substantial-modifications", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "79cab35e-c99e-56ea-9829-feb2b389471e", "title": "Meet safety-relevant cybersecurity requirements to avoid presumed defectiveness", "description": "Assess and hold the safety a person is entitled to expect, including safety-relevant cybersecurity requirements, because a failure to comply with mandatory cybersecurity safety requirements creates a legal presumption that the product is defective, shifting the practical burden onto the manufacturer.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "pld" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "meet-cybersecurity-requirements-to-avoid-presumed-defect" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "product-safety" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_7" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_10" } ], "target": { "type": "statement-id", "target-id": "pld.meet-cybersecurity-requirements-to-avoid-presumed-defect", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "4ab3ca90-884b-5a0e-8e95-ac707fc24de5" } ] }, { "uuid": "36b9b422-f77c-58a3-bafc-e35a83be664b", "title": "Determine PLD scope for the software product and related services", "description": "Establish which offerings are in scope: software and digital 'related services' supplied in the course of a commercial activity are products/components under the PLD from 8 December 2026, while free and open-source software developed or supplied outside a commercial activity is exempt. Record the determination and the manufacturer role.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "pld" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "scope-software-as-product" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "scope" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_4" } ], "target": { "type": "statement-id", "target-id": "pld.scope-software-as-product", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "7e746a49-8464-5203-b85e-8994c105a151", "title": "Supply the security updates needed to maintain safety", "description": "Provide the software updates and upgrades necessary to maintain the product's safety for as long as it is within the manufacturer's control. A defect due to software, an update/upgrade, or the absence of a security update needed to maintain safety does not benefit from the liability exemption.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "pld" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "maintain-security-updates-within-control" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "update-maintenance" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_11" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_4" } ], "target": { "type": "statement-id", "target-id": "pld.maintain-security-updates-within-control", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "64517ac0-0722-5379-be28-c1a27affb3db" } ] }, { "uuid": "879440a5-b5c1-53b9-b9fd-b116e20cb32e", "title": "Market without creating confusion with a competitor's products or marks", "description": "Marketing, including comparative advertising, that creates confusion with the products, trade marks, trade names or other distinguishing marks of a competitor is a misleading practice when it affects the consumer's decision (art_6 paragraph 2 point a). Naming another product to identify it is lawful; borrowing its look, its mark or its name as one's own is not.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "ucpd" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "no-confusion-with-a-competitor" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "comparative" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_6" } ], "target": { "type": "statement-id", "target-id": "ucpd.no-confusion-with-a-competitor", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "a8013b03-6181-51bc-84a6-a4507fc0cf47" } ] }, { "uuid": "c2036f0b-83c2-5787-a0ee-77725f2d1090", "title": "Publish none of the per-se unfair practices", "description": "Annex I lists the practices that are unfair in all circumstances, with no distortion test (art_5 paragraph 5). The ones a software marketing site can commit: claiming to be a signatory to a code of conduct, displaying a trust or quality mark without authorisation, claiming approval or endorsement by a public or private body one does not have, creating false urgency, paid editorial content not identified as such, and, from the 2024/825 amendment, a sustainability label not based on a certification scheme or established by a public authority, a generic environmental claim without recognised excellent environmental performance, and a claim of neutral, reduced or positive environmental impact based on offsetting.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "ucpd" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "no-blacklisted-practice" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "misleading" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "ucpd.no-blacklisted-practice", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "839b4859-9453-558f-9ea8-3fd6e89df6e3" } ] }, { "uuid": "a066a5e5-87a9-5d7d-91bd-d621ddf73474", "title": "Publish no false or deceptive statement about the product, the price or the trader", "description": "A practice is misleading if it contains false information, or if its overall presentation deceives or is likely to deceive the average consumer even when factually correct, about the product's main characteristics (including geographical or commercial origin, the results to be expected, and the results and material features of tests or checks), the extent of the trader's commitments, sponsorship or approval, the price or how it is calculated, or the trader's attributes, approvals, affiliations and awards, where it causes a transactional decision the consumer would not otherwise have taken (art_6 paragraph 1). Advertising a benefit that does not result from any feature of the product or business is misleading in the same way (art_6 paragraph 2 point e).", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "ucpd" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "no-misleading-actions" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "misleading" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_6" } ], "target": { "type": "statement-id", "target-id": "ucpd.no-misleading-actions", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "2fad230c-401f-5053-a8f6-3036626c835a" } ] }, { "uuid": "b2d6aae0-29ba-5cd8-a086-dfea80ca8b85", "title": "State the material information at the invitation to purchase", "description": "Omitting, hiding or presenting unclearly the material information the average consumer needs to decide is a misleading omission (art_7 paragraphs 1 and 2). At an invitation to purchase the material information includes the main characteristics of the product, the trader's identity and geographical address, the price inclusive of taxes or the manner in which it is calculated plus any additional charges, and the existence of a right of withdrawal where one applies (art_7 paragraph 4). Where consumer reviews are shown, whether and how the trader ensures they come from real customers is material too (art_7 paragraph 6).", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "ucpd" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "no-misleading-omissions-in-the-offer" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "misleading" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_7" } ], "target": { "type": "statement-id", "target-id": "ucpd.no-misleading-omissions-in-the-offer", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "bbab14fa-237d-5ed5-bed1-98038a8376ec" } ] }, { "uuid": "48cadc3c-e0ed-5057-addc-2419e77a5cf6", "title": "Treat every published marketing sentence as a B2C commercial practice", "description": "A commercial practice is any act, omission, course of conduct, representation or commercial communication, including advertising and marketing, directly connected with the promotion, sale or supply of a product to consumers (art_2). The directive applies to every such practice before, during and after a transaction (art_3), and the general clause prohibits any practice contrary to professional diligence that distorts the average consumer's transactional decision (art_5). The public site reaches consumers in every locale it publishes, so every published sentence is inside the scope, not only the pricing page.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "ucpd" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "scope-every-published-sentence" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "scope" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "ucpd.scope-every-published-sentence", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "24a7e1e2-807c-5c40-a0da-0adb6e65378e" } ] }, { "uuid": "9181d4e9-d4a7-5674-a99b-102dec553fba", "title": "Hold the evidence for every factual marketing claim, ready on demand", "description": "Courts and administrative authorities may require the trader to furnish evidence of the accuracy of factual claims made in a commercial practice, and may treat a claim as inaccurate when the evidence is not furnished or is insufficient (art_12). The burden sits with the trader from the moment the claim is published, so the evidence must exist before the sentence does, not be assembled after a complaint.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "ucpd" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "substantiate-every-factual-claim" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "substantiation" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_12" } ], "target": { "type": "statement-id", "target-id": "ucpd.substantiate-every-factual-claim", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "2874529d-96fb-55bc-b90d-65a311faeeb4" } ] }, { "uuid": "53de7a18-d84b-5e84-97da-f39428d6068a", "title": "B3: report total energy consumption", "description": "Report total energy consumption in MWh and, where the data allows, a breakdown of electricity as reflected in utility billings and of fuels into renewable and non-renewable. Voluntary for undertakings with 10 employees or fewer. Evidence typically held: electricity and heating invoices, fuel card statements, landlord service charge statements, energy supply contracts and guarantees of origin, meter readings. Value chain cap (Annex II): applies to undertakings with more than 10 employees; the datapoint is voluntary at 10 employees or fewer.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "b3-energy-consumption" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "basic-environment" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 32" } ], "target": { "type": "statement-id", "target-id": "B3", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "1a242d37-3b3a-5fda-b2e2-a0d958fbf2a1", "title": "B3: report estimated gross scope 1 and scope 2 greenhouse gas emissions", "description": "Report estimated absolute gross emissions in tonnes of CO2 equivalent following the GHG Protocol Corporate Standard (2004): scope 1 from owned or controlled sources and location-based scope 2 from purchased energy. Voluntary for undertakings with 10 employees or fewer. Evidence typically held: the energy documents above, fleet fuel receipts and mileage logs, refrigerant top-up and service records, grid emission factor tables. Value chain cap (Annex II): applies to undertakings with more than 10 employees; the datapoint is voluntary at 10 employees or fewer.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "b3-ghg-emissions" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "basic-environment" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 33" } ], "target": { "type": "statement-id", "target-id": "B3", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "4c46c473-5b65-5a98-a4f5-bbfecee58796", "title": "B4: report pollution of air, water and soil", "description": "Report emissions of pollutants to air, water and soil from own operations that are reported to competent authorities under Union or national law, or voluntarily under an environmental management system. A link to an existing public report is enough. Evidence typically held: environmental permits, reports filed with the authority, environmental management system reports, inspection reports. Value chain cap (Annex II): outside the cap, so a reporting customer may not demand it as of right from a protected supplier.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "b4-pollution" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "basic-environment" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 34" } ], "target": { "type": "statement-id", "target-id": "B4", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "79678336-735d-55a4-b52e-270cc598a807", "title": "B5: disclose sites in or near biodiversity-sensitive areas", "description": "If the undertaking has sites in or near a biodiversity-sensitive area, disclose them and the name of the area. Evidence typically held: the site address list, planning and zoning permits, environmental impact assessments, authority maps of protected areas. Value chain cap (Annex II): outside the cap, so a reporting customer may not demand it as of right from a protected supplier.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "b5-biodiversity" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "basic-environment" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 35" } ], "target": { "type": "statement-id", "target-id": "B5", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "22edad32-39f4-59ca-97a0-1b08d7eab913", "title": "B6: report water withdrawal and, where relevant, consumption", "description": "Report total water withdrawal and, if production processes consume significant water, water consumption as withdrawal minus discharge, with the amount consumed at sites in water-stressed areas shown separately. Voluntary for undertakings with 10 employees or fewer. Evidence typically held: water utility invoices, meter readings, discharge permits. Value chain cap (Annex II): para 36 only, for undertakings with more than 10 employees.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "b6-water" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "basic-environment" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "paras 36-37" } ], "target": { "type": "statement-id", "target-id": "B6", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "30ba8ae6-380c-559e-9868-4e3be37adcfb", "title": "B7: report circular economy practice and waste", "description": "Say whether circular economy principles are applied and how, report total waste generated with the hazardous and non-hazardous split, the share diverted to recycling or reuse, and, in sectors with significant material flows, the annual mass flow of relevant materials. All of B7 is voluntary for undertakings with 10 employees or fewer. Evidence typically held: waste contractor invoices and consignment notes, recycling collection statements, hazardous waste manifests, material purchasing records, packaging specifications. Value chain cap (Annex II): para 38 first sentence and para 39(a) and (b), for undertakings with more than 10 employees.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "b7-resource-use-and-waste" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "basic-environment" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B7" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "paras 38-39" } ], "target": { "type": "statement-id", "target-id": "B7", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "66b32ce9-d7fb-5242-b498-17c37c2405bb", "title": "B1: state the basis for preparation", "description": "State whether the report follows Option A (Basic Module only) or Option B (Basic and Comprehensive Modules) with an explicit statement of compliance, name any disclosure omitted under the omission rules, say whether the report is individual or consolidated, and for a consolidated report list the subsidiaries with their registered addresses. Evidence typically held: the signed management report or board minute choosing the scope, group structure chart, company registry extracts for each subsidiary. Value chain cap (Annex II): applies to undertakings of every size. (points (a) and (c)).", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "b1-basis-for-preparation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "basic-general" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "rct_3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 27(a)-(d)" } ], "target": { "type": "statement-id", "target-id": "B1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "fc6d6360-2bf0-5080-83b7-5b371ff67c91", "title": "B1: describe sustainability certifications and labels held", "description": "If the undertaking holds a sustainability-related certification or label, briefly describe it, including the issuer, date and rating score where relevant. Evidence typically held: certificates and audit reports (for example an environmental management or occupational safety certification), the issuer's scoring letter, a registration number with the scheme. Value chain cap (Annex II): outside the cap, so a reporting customer may not demand it as of right from a protected supplier. Anything copied from these descriptions into marketing re-enters ucpd (see reports-and-claims-stay-truthful).", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "b1-certifications-and-labels" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "basic-general" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 28" } ], "target": { "type": "statement-id", "target-id": "B1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "948581fb-1882-5061-8fab-69e0aa17f5c9", "title": "B1: report the undertaking's identifying and size data", "description": "Report legal form, NACE sector code or codes, balance sheet total, turnover, number of employees as headcount or full-time equivalents, the country of primary operations and location of significant assets, and the geolocation of sites owned, leased or managed. Evidence typically held: company registry extract, annual report and financial statements, payroll or HR headcount export, lease agreements and property registers for site addresses. Value chain cap (Annex II): applies to undertakings of every size.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "b1-undertaking-profile" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "basic-general" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 27(e)(i)-(vii)" } ], "target": { "type": "statement-id", "target-id": "B1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "692560d1-4c18-51ae-b823-2862321de82f", "title": "B2: state sustainability practices, policies and future initiatives", "description": "If the undertaking has practices, policies or future initiatives for a more sustainable economy, say so, and state whether it has concrete practices (for example reducing water and electricity use or preventing pollution), policies on sustainability issues and whether they are public, forward-looking plans under way, and targets that monitor the policies. Evidence typically held: written policies (environmental, health and safety, HR, anti-corruption), board minutes approving plans, supplier code of conduct, project plans, partnership agreements. Value chain cap (Annex II): outside the cap, so a reporting customer may not demand it as of right from a protected supplier.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "b2-practices-policies-initiatives" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "basic-general" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "paras 29-31" } ], "target": { "type": "statement-id", "target-id": "B2", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "d78836be-8986-5e37-86f0-42b1d06de1d5", "title": "B11: report anti-corruption and anti-bribery convictions and fines", "description": "Where there were convictions or fines in the reporting period, report their number and the total amount of fines for violating anti-corruption and anti-bribery law. Evidence typically held: court or authority decisions, counsel's letters, fine payment records. Value chain cap (Annex II): outside the cap, so a reporting customer may not demand it as of right from a protected supplier.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "b11-corruption-convictions-and-fines" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "basic-governance" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B11" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 43" } ], "target": { "type": "statement-id", "target-id": "B11", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "d106189b-6907-5796-9b05-e0bb57998f80", "title": "B10: report pay floor, collective bargaining and training", "description": "State whether employees are paid at or above the applicable minimum wage, report the gender pay gap if Union or national law already requires it (footnote 8 names Directive (EU) 2023/970), the percentage of employees covered by collective bargaining agreements, and the average annual training hours per employee. Evidence typically held: payroll export, collective agreements, training records or learning platform exports, a statutory pay gap report where one exists. Value chain cap (Annex II): points (a), (c) and (d), for undertakings of every size.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "b10-remuneration-bargaining-training" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "basic-social" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B10" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 42" } ], "target": { "type": "statement-id", "target-id": "B10", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "3e7559c8-3027-5118-aa07-647f3a10d77e", "title": "B8: report workforce characteristics", "description": "Report the number of employees as headcount or full-time equivalents by type of employment contract (temporary or permanent), by gender, and by country of the contract when operating in more than one country. Evidence typically held: payroll or HR system export, employment contracts, organisation chart. Value chain cap (Annex II): points (a) and (b), for undertakings of every size.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "b8-workforce-characteristics" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "basic-social" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B8" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 40" } ], "target": { "type": "statement-id", "target-id": "B8", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "6fd45513-6313-5b87-9960-db80d13d4eb0", "title": "B9: report work-related accidents", "description": "Report the number and rate of recordable work-related accidents and, subject to legal restrictions, the fatalities from recordable work-related accidents and ill health. Evidence typically held: the accident register, injury reports filed with the labour inspectorate, insurer claim records, timesheets for the hours worked that the rate needs. Value chain cap (Annex II): point (a), for undertakings of every size.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "b9-health-and-safety" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "basic-social" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B9" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 41" } ], "target": { "type": "statement-id", "target-id": "B9", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "6086bf45-6d94-56a5-96f4-263a4176a4cc", "title": "Comprehensive module: consider scope 3 emissions alongside B3", "description": "Where the undertaking's activities make scope 3 emissions relevant, it may quantify them, drawing on the fifteen categories of the GHG Protocol Corporate Value Chain Standard and including the significant categories by its own assessment. Scope 3 information is presented together with the B3 scope 1 and 2 figures. Evidence typically held: procurement ledgers, supplier invoices, business travel bookings, freight invoices. Value chain cap (Annex II): outside the cap, so a reporting customer may not demand it as of right from a protected supplier.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "c-scope-3-emissions" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "comprehensive-environment" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "Annex I paras 49-52" } ], "target": { "type": "statement-id", "target-id": "Annex_I_paras_49-52", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "a5c497d9-3e08-576e-999a-198335b73691", "title": "C3: report greenhouse gas reduction targets and any transition plan", "description": "If targets exist, report absolute scope 1 and 2 targets (and scope 3 where set) with target year and value, base year and value, units, the share of emissions covered and the main actions. An undertaking in a high climate impact sector may describe a transition plan for climate change mitigation, and if it has none says whether and when it will adopt one. Para 53 is voluntary for undertakings with 10 employees or fewer. Evidence typically held: climate strategy documents, board-approved targets, investment plans, the NACE classification that decides the sector question. Value chain cap (Annex II): outside the cap, so a reporting customer may not demand it as of right from a protected supplier.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "c3-ghg-reduction-targets-and-transition" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "comprehensive-environment" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "C3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "paras 53-55" } ], "target": { "type": "statement-id", "target-id": "C3", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "77cf2359-b18b-5816-8dc5-4df7967eac1e", "title": "C4: report climate-related hazards and transition risks", "description": "If climate-related hazards and transition events create risks, describe them, how exposure and sensitivity of assets, activities and the value chain were assessed, the time horizons and any adaptation actions. A rating of high, medium or low for the potential effects may be added. Para 56 is voluntary for undertakings with 10 employees or fewer. Evidence typically held: the risk register, insurer risk surveys, flood and hazard maps, business continuity plans. Value chain cap (Annex II): outside the cap, so a reporting customer may not demand it as of right from a protected supplier.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "c4-climate-risks" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "comprehensive-environment" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "C4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "paras 56-57" } ], "target": { "type": "statement-id", "target-id": "C4", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "930e2128-11ba-55bc-8345-3abf81201c43", "title": "C1: describe the business model and strategy", "description": "Describe significant groups of products and services, significant markets, main business relationships such as key suppliers, customers and distribution channels, and any elements of the strategy that relate to or affect sustainability issues. Points (a) to (d) are voluntary for undertakings with 10 employees or fewer. Evidence typically held: product catalogues, the annual report's business description, customer and supplier contracts and lists, strategy documents. Value chain cap (Annex II): points (a), (b) and (c), for undertakings with more than 10 employees.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "c1-strategy-and-business-model" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "comprehensive-general" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "C1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 46" } ], "target": { "type": "statement-id", "target-id": "C1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "ff4c2635-f174-5256-b215-f4354c71557f", "title": "C2: describe the B2 practices, policies and initiatives in more detail", "description": "Briefly describe the practices, policies and future initiatives already reported under B2, mention where they cover suppliers or customers, describe any targets that monitor the policies, and optionally name the most senior person or body accountable. Evidence typically held: policy documents, the supplier code of conduct, board mandates. Value chain cap (Annex II): outside the cap, so a reporting customer may not demand it as of right from a protected supplier.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "c2-practices-policies-initiatives-detail" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "comprehensive-general" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "C2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "paras 47-48" } ], "target": { "type": "statement-id", "target-id": "C2", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "3e44966f-f9af-5ba6-8a10-2a18837e9a03", "title": "C8: report revenues from sensitive sectors", "description": "If active in prohibited weapons, tobacco cultivation and production, the fossil fuel sector (with a coal, oil and gas split) or chemicals production (NACE Division 20.2), disclose the revenues derived from those activities. Evidence typically held: the revenue ledger by activity or NACE code, segment notes in the annual report. Value chain cap (Annex II): outside the cap, so a reporting customer may not demand it as of right from a protected supplier.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "c8-revenues-from-certain-activities" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "comprehensive-governance" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "C8" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 63" } ], "target": { "type": "statement-id", "target-id": "C8", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "fa4dfc3a-b176-5474-a9a3-51a795b8c479", "title": "C9: report the gender diversity ratio of the governance body", "description": "If the undertaking has a governance body, report its gender diversity ratio. Evidence typically held: the board or management register, articles of association, the annual report's management section. Value chain cap (Annex II): outside the cap, so a reporting customer may not demand it as of right from a protected supplier.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "c9-governance-gender-diversity" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "comprehensive-governance" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "C9" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 64" } ], "target": { "type": "statement-id", "target-id": "C9", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "59f0def8-fe08-5da6-9d0d-8a9221c49490", "title": "C5: report employee turnover and optional workforce detail", "description": "Report the employee turnover rate for the period (voluntary for undertakings with 10 employees or fewer) and optionally the female-to-male ratio at management level, the number of self-employed people without personnel who work exclusively for the undertaking, and temporary workers supplied by employment agencies. Evidence typically held: HR joiner and leaver exports, payroll, contractor agreements, staffing agency invoices. Value chain cap (Annex II): para 58, for undertakings with more than 10 employees.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "c5-additional-workforce-characteristics" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "comprehensive-social" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "C5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "paras 58-60" } ], "target": { "type": "statement-id", "target-id": "C5", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "b779be50-781c-5d3f-8847-0525f7e451e4", "title": "C6: report human rights policies and the complaints mechanism", "description": "Answer yes or no on whether there is a code of conduct or human rights policy for the own workforce, which of child labour, forced labour, human trafficking, discrimination, accident prevention or other topics it covers, and whether a complaints-handling mechanism exists for the own workforce. Points (a) and (c) are voluntary for undertakings with 10 employees or fewer. Evidence typically held: code of conduct, employee handbook, human rights policy, whistleblowing or grievance procedure. Value chain cap (Annex II): points (a) and (c), for undertakings with more than 10 employees.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "c6-human-rights-policies-and-processes" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "comprehensive-social" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "C6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 61" } ], "target": { "type": "statement-id", "target-id": "C6", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "1189b6ce-3c75-59eb-b044-e695d5513d67", "title": "C7: report confirmed human rights incidents", "description": "Answer yes or no on confirmed incidents in the own workforce involving child labour, forced labour, human trafficking, discrimination or other matters, optionally describe the actions taken, and report any confirmed incidents involving workers in the value chain, affected communities, consumers and end-users. Points (a) and (c) are voluntary for undertakings with 10 employees or fewer. Evidence typically held: grievance and incident logs, HR case records, supplier audit reports, complaint registers. Value chain cap (Annex II): para 62(a) and the first sentence of 62(c), for undertakings with more than 10 employees.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "c7-human-rights-incidents" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "comprehensive-social" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "C7" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "para 62" } ], "target": { "type": "statement-id", "target-id": "C7", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "f66acd41-f307-5c6a-bea6-ee70fb275afd", "title": "Keep what a sustainability report says apart from what marketing may claim", "description": "A report under the standard primarily informs business counterparties, and the undertaking decides whether to make it public (Annex I para 20). Any sentence, figure or badge from the report that reaches a consumer-facing page becomes a business-to-consumer commercial practice under ucpd, where the Directive (EU) 2024/825 amendments apply from 27 September 2026: a generic environmental claim without recognised excellent environmental performance, a sustainability label not based on a certification scheme or established by a public authority, and a claim of neutral, reduced or positive impact based on offsetting are unfair in all circumstances, and the trader must hold evidence for every factual claim (UCPD Art 12). Reporting a metric under B3 is disclosure; it does not give a trader recognised excellent environmental performance, so a marketing line that turns a reported figure into a general green or climate-friendly description is the exposure.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "reports-and-claims-stay-truthful" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "green-claims" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "rct_3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "Annex I para 20" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "UCPD Art 6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "UCPD Art 5(5)" } ], "target": { "type": "statement-id", "target-id": "Annex_I_para_20", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "76a2627b-2135-5a40-94d4-833ac0c54331" } ] }, { "uuid": "2786d810-a6dd-51cf-abab-5582457cea91", "title": "Prepare a report that is relevant, comparable and consistent with the financial statements", "description": "The report provides relevant, faithful, comparable, understandable and verifiable information. From the second year it carries prior-year comparatives except for metrics disclosed for the first time. Items under the if-applicable principle are reported only where the stated circumstances apply, and omission is taken to mean not applicable. A parent may consolidate subsidiaries, which then do not report separately. The report is annual when counterparties need annual updates and aligns with the financial reporting period. It may point to disclosures published elsewhere in the same document set. Information may be omitted only for a serious commercial prejudice, a trade secret, classified information or a legal protection, each omission is declared under B1 and reassessed at each reporting date, and the report is coherent with the financial statements.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "reporting-principles" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "scope" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "rct_3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "Annex I paras 10-23" } ], "target": { "type": "statement-id", "target-id": "Annex_I_paras_10-23", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "bf01ac9b-fa38-5286-8ec7-8d65a08ccc17", "title": "Use the standard only as a voluntary, modular framework", "description": "An undertaking that is not subject to mandatory reporting under Articles 19a and 29a of Directive 2013/34/EU may report sustainability information under the standard in Annex I (art_2). The standard is intended for undertakings with an average of up to 1 000 employees. It has two modules and the Basic Module is a prerequisite for the Comprehensive Module; a chosen module is complied with in its entirety, apart from items that apply only if the stated circumstances are met. Assurance is not required (recital 5). EFRAG practical guidance may be used but is not part of the standard (art_2).", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "voluntary-standard-scope" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "scope" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "rct_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "rct_3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "rct_5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "Annex I paras 1-9" } ], "target": { "type": "statement-id", "target-id": "Annex_I_paras_1-9", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "fd77e01e-4472-500c-824c-1a17352e28a2", "title": "Track the dates the regulation and its cap apply from", "description": "The delegated regulation was published in the Official Journal on 21 September 2026 and entered into force on the third day after publication, 24 September 2026, so the voluntary standard is usable from that date. The value chain cap in Article 3 applies from financial years beginning on or after 1 January 2027 (art_4, recitals 6 and 7).", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "entry-into-force-and-application" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "value-chain-cap" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "rct_6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "rct_7" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "Art 4" } ], "target": { "type": "statement-id", "target-id": "Art_4", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "018921c0-2275-5e68-a2c9-5d38cffe059e", "title": "Treat Recommendation (EU) 2025/1710 as no longer in effect", "description": "From the date of entry into force, Recommendation (EU) 2025/1710 on the voluntary standard for small and medium-sized undertakings produces no legal effects (recital 5). Questionnaires and procurement templates that cite the recommendation need to be read against Annex I of this regulation. Financial institutions are still encouraged to limit sustainability data requests to undertakings with 1 000 employees or fewer to the information in Annex I.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "supersedes-recommendation-2025-1710" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "value-chain-cap" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "rct_5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "Rec 2025/1710" } ], "target": { "type": "statement-id", "target-id": "Rec_2025_1710", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "90aa980f-c316-5c5c-bc63-9891350b6361", "title": "Answer reporting customers within the value chain cap", "description": "A reporting undertaking under Articles 19a and 29a of Directive 2013/34/EU may require from a supplier with an average of up to 1 000 employees no more than the datapoints in Annex II (art_1, art_3). Annex II lists the capped datapoints in two bands, for undertakings with 10 employees or fewer and for undertakings with more. Only essential datapoints are in the cap (recital 4). The cap governs information gathering for the customer's own sustainability reporting and leaves untouched requests needed for other Union or national legal obligations. Directive (EU) 2026/470 inserted the matching rights into Article 19a(3) of Directive 2013/34/EU: a protected undertaking may decline a request that exceeds the voluntary standard, the reporting undertaking may rely on a self-declaration of protected status, and a contract term that demands more is not binding on that point. Member States transpose Articles 1 to 3 of that Directive by 19 March 2027.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "vsme" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "value-chain-cap" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "value-chain-cap" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "rct_2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "rct_4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "Art 1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "Art 3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "Annex II" } ], "target": { "type": "statement-id", "target-id": "Art_1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "5a534fe7-e7bd-55bf-996a-53d48eae99f9", "title": "Enforce an automated WCAG 2.2 AA scan over key surfaces in CI", "description": "An automated accessibility suite runs the WCAG 2.2 AA ruleset against the app's key pages in the e2e pipeline and fails on violations, so regressions in markup-detectable criteria cannot land silently.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "wcag-2-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "automated-aa-conformance-gate" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "conformance" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "conformance-aa" } ], "target": { "type": "statement-id", "target-id": "wcag-2-2.automated-aa-conformance-gate", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "322c3199-7af9-5325-acc2-61ab9d13987e" } ] }, { "uuid": "7116c889-ee5f-598f-801b-34d9d74a1042", "title": "Audit key user journeys with assistive technology", "description": "The success criteria automated scanners cannot judge (focus order sanity, meaningful sequence, error-recovery comprehension, actual screen-reader usability of chat and document flows) require a periodic manual audit with assistive technology.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "wcag-2-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "manual-assistive-technology-audit" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "conformance" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "conformance-aa" } ], "target": { "type": "statement-id", "target-id": "wcag-2-2.manual-assistive-technology-audit", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "c9efa4de-b767-5be8-ae2e-7518b454258c", "title": "Say which checkpoints carry a stamp, and claim nothing more", "description": "The published verification document distinguishes anchored from unanchored checkpoints with a watermark that is null until a stamp exists, and describes an anchor as a qualified time stamp only once the provider is qualified; a stamp from a non-qualified provider is described as what it is, admissible under Art. 41(1) without the Art. 41(2) presumption.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eidas" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "disclosure-tracks-qualification" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "disclosure" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_41" } ], "target": { "type": "statement-id", "target-id": "eidas.disclosure-tracks-qualification", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "63128753-5751-59b1-b8c1-a7fda82a8e9c" } ] }, { "uuid": "0ac0025e-1b79-5102-9e53-7c104e8e0b59", "title": "Anchor audit-chain checkpoints with a qualified electronic time stamp", "description": "Bind each audit-chain checkpoint's canonical digest to a date and time through a qualified electronic time stamp (an electronic time stamp that meets Art. 42, issued by a qualified trust service provider), so the checkpoint enjoys the presumption of the accuracy of its time and of the integrity of the bound data (Art. 41(2)). A non-qualified stamp keeps admissibility (Art. 41(1)) but not the presumption, and nothing we publish may claim the presumption before the provider is qualified.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eidas" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "qualified-time-stamp-over-audit-checkpoints" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "evidence-integrity" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_41" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_42" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_3" } ], "target": { "type": "statement-id", "target-id": "eidas.qualified-time-stamp-over-audit-checkpoints", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "49baf54c-dd57-5054-b1b5-abaa53a6fcc2" } ] }, { "uuid": "9b39b910-c935-5b49-a249-71068462fe92", "title": "Verify the stamp's binding to the data before relying on it", "description": "Before storing or publishing a time stamp, verify that it binds the date and time to exactly the data it was requested over (the checkpoint digest and the request nonce), that the binding cannot be altered undetectably (the CMS signature over the token's signed content verifies with a signer certificate issued for time stamping), and that the token carries the time source's statement (genTime). Keep the token with the checkpoint so any reader can repeat the verification from the published document alone.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eidas" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "time-stamp-binding-verified-before-reliance" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "evidence-integrity" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_42" } ], "target": { "type": "statement-id", "target-id": "eidas.time-stamp-binding-verified-before-reliance", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "605acdf6-9dac-575e-8459-dac6781faf34" } ] }, { "uuid": "ddbbe903-3794-5f3c-a034-9b0f368abb41", "title": "Take stamps only from a provider on an EU trusted list", "description": "Choose a time-stamping provider whose qualified status for that service is granted by a Member State supervisory body and published on that state's trusted list (Art. 20-22); a stamp from such a provider is qualified and is recognised as qualified in every other Member State (Art. 24a(6)). Pin the provider's trust anchor from the trusted list, validate each token's certificate chain to it, and re-check the listing on the cadence at which the status can change (a conformity audit at least every 24 months, Art. 20(1)).", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eidas" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "provider-on-a-trusted-list" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "provider-selection" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "planned" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_20" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_21" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_22" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_24a" } ], "target": { "type": "statement-id", "target-id": "eidas.provider-on-a-trusted-list", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "planned" } } }, { "uuid": "0612533f-fb9e-56c1-a0dc-c1ca775a84f8", "title": "Confidentiality of communications and usage", "description": "Do not listen to, intercept, store, or otherwise monitor users' communications and their content beyond what is necessary to provide the requested service, without their consent.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eprivacy" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "confidentiality-of-communications" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "confidentiality" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "eprivacy.confidentiality-of-communications", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "b39a99ad-a85e-5b9b-be4d-68caf9798ffb" } ] }, { "uuid": "779a1c22-988a-5315-b659-a19fa2385a2c", "title": "Consent before non-essential storage or access on the user's device", "description": "Store information on, or read information from, a user's terminal equipment (cookies, localStorage, similar) only with prior informed consent, except where strictly necessary to provide the service. Consent must be an opt-in: non-essential categories default to off, and refusing must be as easy as accepting.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eprivacy" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "terminal-equipment-consent" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "cookies-and-tracking" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" } ], "target": { "type": "statement-id", "target-id": "eprivacy.terminal-equipment-consent", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "038c701c-3b72-50eb-8253-a95daa90bfec" } ] }, { "uuid": "8a962c70-d2e3-5a58-8053-37e33c6bbc18", "title": "Erase or anonymise traffic data when no longer needed", "description": "Erase or make anonymous traffic data (connection logs, technical metadata) when it is no longer needed to transmit the communication or to bill for the service, unless a lawful retention basis applies.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eprivacy" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "traffic-data-minimisation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-minimisation" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_6" } ], "target": { "type": "statement-id", "target-id": "eprivacy.traffic-data-minimisation", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "a815cd20-bc3a-5221-b15d-0e9b819028d6", "title": "Opt-in for unsolicited electronic marketing", "description": "Send unsolicited electronic marketing (email, similar) only to recipients who have given prior consent, with a clear opt-out in every message; the existing-customer soft opt-in for similar products is the only narrow exception.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eprivacy" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "electronic-marketing-consent" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "marketing" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_13" } ], "target": { "type": "statement-id", "target-id": "eprivacy.electronic-marketing-consent", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "2ad6309b-3391-5bc9-aaf5-06343c1eecdb" } ] }, { "uuid": "3c32b05c-dba0-576d-8d03-aac3406acf37", "title": "Apply GDPR where ePrivacy is silent", "description": "Treat ePrivacy as lex specialis for communications confidentiality and terminal-equipment access; where it is silent (lawful basis, data-subject rights, breach handling), the GDPR governs. National transpositions may add specifics.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eprivacy" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "relationship-with-gdpr" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "scope" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_15" } ], "target": { "type": "statement-id", "target-id": "eprivacy.relationship-with-gdpr", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "6cd04909-d386-5fd4-a1a0-e1678258ed3e", "title": "Security of the service", "description": "Take appropriate technical and organisational measures to safeguard the security of the service, and inform users of any particular risk of a security breach.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "eprivacy" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "security-of-service" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_4" } ], "target": { "type": "statement-id", "target-id": "eprivacy.security-of-service", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "a57014ff-52d2-5c19-bf0b-462fa3ef13cc" } ] }, { "uuid": "9652b12b-4c6d-57df-a78e-f552f222080e", "title": "Encrypt customer data in transit and at rest", "description": "All transport is TLS; at-rest encryption posture is asserted per storage provider and the S3 factory refuses to start without a declared at-rest posture, so an unencrypted backend cannot be wired in silently.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "bsi-c5" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "encryption-in-transit-at-rest" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "cryptography" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-8" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-28" } ], "target": { "type": "statement-id", "target-id": "bsi-c5.encryption-in-transit-at-rest", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "ff4fad20-8c72-51d3-98fc-9763160bdb62" } ] }, { "uuid": "799abf9a-ecec-5f88-810b-4b7a3be38a7e", "title": "Isolate tenants with database-enforced logical access control", "description": "Every data-plane table enforces row-level security and document ACLs resolve to a deny-set before retrieval, so one tenant's corpus is unreachable from another tenant's session even under application bugs.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "bsi-c5" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "tenant-isolation-logical-access" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "identity-access" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "assessment" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-3" } ], "target": { "type": "statement-id", "target-id": "bsi-c5.tenant-isolation-logical-access", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "277d0236-440e-5f6e-92fe-e251e0a3c9dd" } ] }, { "uuid": "6b554e52-3ece-54d3-a4ec-5eb0bfe725bf", "title": "Operate a reachable security-incident intake channel", "description": "A published, machine-discoverable channel exists for reporting security incidents and vulnerabilities, with a stated policy and expiry-managed contact data.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "bsi-c5" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-management" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ir-4" } ], "target": { "type": "statement-id", "target-id": "bsi-c5.incident-management", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "6ccef006-9f26-506c-a809-624d41fb4e00" } ] }, { "uuid": "54fd10c0-edab-55ee-8952-750f80d42fbe", "title": "Record security-relevant events in a tamper-protected audit trail", "description": "User actions are recorded to an append-only audit log whose modification and deletion paths are blocked by database triggers, with the sole narrow exception of identity-nulling for erasure.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "bsi-c5" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "logging-and-audit-immutability" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "operations" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-9" } ], "target": { "type": "statement-id", "target-id": "bsi-c5.logging-and-audit-immutability", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "1a7a81b9-3c5e-5ac5-a0aa-40770b5bbd10" } ] }, { "uuid": "4c7c6c67-d112-5bfd-85af-20d7b478b93c", "title": "Detect and remediate known vulnerabilities in dependencies", "description": "Dependencies are audited for known vulnerabilities on a defined cadence and a minimum-release-age cooldown blocks freshly published (potentially compromised) versions from entering the tree.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "bsi-c5" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "vulnerability-and-patch-management" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "operations" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ra-5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-2" } ], "target": { "type": "statement-id", "target-id": "bsi-c5.vulnerability-and-patch-management", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "c15b63c7-afd1-593e-af50-48bab6edacf3" } ] }, { "uuid": "3055fb84-23f6-524c-a91f-ed197de8feb6", "title": "Disclose subservice providers with per-entity transfer basis and enforce the register in CI", "description": "Maintain a typed register of every subservice provider that touches customer data (jurisdiction, parent company, transfer basis, third-country compulsion exposure) with reverse coverage against the code's actual credentials, published as the customer-facing disclosure.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "bsi-c5" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "subcontractor-transparency" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "subservice-providers" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-9" } ], "target": { "type": "statement-id", "target-id": "bsi-c5.subcontractor-transparency", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "4090f861-a8b6-55a8-a64e-b7ed6e04aefd" } ] }, { "uuid": "f32a5e35-dbae-5e8f-a0f3-819c80366d31", "title": "Defined process for granting and revoking access", "description": "Grant access through a defined process and revoke it through one, so that a departing user or a disconnected integration loses reach immediately rather than at the next review. Revocation must invalidate live sessions, not only future logins.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "access-granting-and-revoking" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "access-control-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "6.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "6.2" } ], "target": { "type": "statement-id", "target-id": "_6.1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "31416333-d3dd-52d8-9590-2a643892a95d" } ] }, { "uuid": "c037c209-9a3f-5cd0-bc94-3e150e4c63e2", "title": "Account inventory, dormancy sweep and separated administrative accounts", "description": "Know which accounts exist, including the service accounts nobody signs in as, disable the ones that have gone dormant, and keep administrative work on an account that cannot also do everyday work. The separation is only real if the everyday account cannot reach the administrative rights by asking for them.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "account-inventory-and-privileged-separation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "access-control-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "11" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "5.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "5.3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "5.4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "5.5" } ], "target": { "type": "statement-id", "target-id": "_5.1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "9cc66b02-6180-5350-a28f-ba46858f4da4" } ] }, { "uuid": "9b80aac3-8fce-570f-96a5-c8585a26d68e", "title": "Multi-factor authentication on exposed and administrative access", "description": "Require a second factor for externally exposed applications and for every administrative account, including administrative access held at a third-party provider. An operator account protected by a password alone is the shortest path to every tenant's data at once.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "mfa-for-administrative-access" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "access-control-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ia-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ia-5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "6.3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "6.5" } ], "target": { "type": "statement-id", "target-id": "_6.3", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "87cbc1d2-7e85-5664-acd9-81c9e0cfb5d6" } ] }, { "uuid": "25b15227-343c-5e38-b614-363cbedfc0a7", "title": "Role-based access control that is defined, not implied", "description": "Define roles and the rights attached to them explicitly, and derive a user's reach from their role rather than from accumulated individual grants. The definition has to be readable, because a role nobody can describe cannot be reviewed.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "role-based-access-control" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "access-control-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "6.8" } ], "target": { "type": "statement-id", "target-id": "_6.8", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "0b5cd29e-c298-523a-a01c-a098de1f65cf", "title": "Application security testing on every change", "description": "Test the application for security defects as it changes, both statically against the source and dynamically against the running system. Static analysis reaches the code that exists; only a dynamic test reaches what the deployed composition of that code actually answers, so one without the other covers half the duty.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "code-level-security-checks" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "application-security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-11" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "16.12" } ], "target": { "type": "statement-id", "target-id": "_16.12", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "68f6bed0-8cee-5d49-ba05-d98f6173f39d" } ] }, { "uuid": "e38c2390-a234-5595-ba86-eee3d35daeac", "title": "A secure development process with root-cause analysis and secure design defaults", "description": "Run a documented development process that addresses security, apply secure design principles so that the safe path is the default one rather than the remembered one, and analyse the root cause of defects rather than only their instances.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "secure-development-process" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "application-security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-15" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "16.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "16.3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "16.10" } ], "target": { "type": "statement-id", "target-id": "_16.1", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "e11c552f-e51b-5f07-9801-5df334bd94c4" } ] }, { "uuid": "34a65ea4-ef07-5512-9bcb-7cf134a23f83", "title": "Vetted components for security functions rather than hand-rolled ones", "description": "Use standard, vetted implementations for security-relevant functions (cryptography, signing, authentication, request validation) instead of writing them per call site. The failure mode is not one bad implementation but several nearly-identical ones that drift, so the control is a single owning module per primitive, imported rather than reconstructed.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "vetted-security-components" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "application-security" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-15" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "16.11" } ], "target": { "type": "statement-id", "target-id": "_16.11", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "1f54b58a-9ac8-5e5e-916b-a8a2d21cb8fb" } ] }, { "uuid": "8fcf982e-ae4b-59ed-87a3-c443df34cf12", "title": "Audit logs collected somewhere other than the host that wrote them", "description": "Collect audit records to a destination outside the system that produced them, so that losing or compromising that system does not also lose the record of what happened to it. This is the same duty whether the records are application audit records or network ones.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "log-centralisation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "audit-log-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "planned" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "8.9" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "13.1" } ], "target": { "type": "statement-id", "target-id": "_8.9", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "planned" } } }, { "uuid": "e78ea073-8fa8-5bf1-826f-cbce083d59e4", "title": "Stated logging requirements, a retention window, and review of what is logged", "description": "State what each surface must log before asking whether it does, keep those records long enough to investigate an incident found late, and review them for anomalies on a stated cadence. Collection without review produces evidence for an incident nobody noticed.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "logging-requirements-and-review" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "audit-log-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "7" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-11" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "8.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "8.10" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "8.11" } ], "target": { "type": "statement-id", "target-id": "_8.1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "fe9b21a4-ee0d-5479-9365-159e78e4cb87" } ] }, { "uuid": "a748a5fd-4b00-5d57-9670-6cc7048ae95c", "title": "Audit logging of access to sensitive data", "description": "Record who accessed sensitive data, when, and through which path, in a log detailed enough to reconstruct an incident afterwards. The log must not itself become a copy of the sensitive content it describes.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "sensitive-data-access-logging" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "audit-log-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-12" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "3.14" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "8.2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "8.5" } ], "target": { "type": "statement-id", "target-id": "_3.14", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "8ac10833-1fb6-51f8-bfa6-f65edd127868" } ] }, { "uuid": "e7ce8fc6-44cc-5543-8581-2a0bc32a441e", "title": "Data classification and documented data flows", "description": "Classify data by sensitivity so that handling rules can attach to the class rather than to a reader's judgement, and document where each class flows, including out to third parties. A flow map that stops at our own boundary answers none of the questions a customer asks.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "data-classification-and-flow-mapping" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-protection" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ra-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "3.7" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "3.8" } ], "target": { "type": "statement-id", "target-id": "_3.7", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "8b48e0f4-9322-5f5b-b8e7-bedca662b2ce" } ] }, { "uuid": "588d08a8-4090-50b8-b8bf-59c7ec17af1d", "title": "A data-management process and an inventory of the sensitive data held", "description": "Run a documented data-management process covering sensitivity, retention and disposal, and keep an inventory of the sensitive data actually held. An inventory maintained by hand rots, so the parts that can be derived from the running system should be derived from it.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "data-lifecycle-and-sensitive-data-inventory" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-protection" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-12" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pm-5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "3.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "3.2" } ], "target": { "type": "statement-id", "target-id": "_3.1", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "d8451d8c-885f-54bf-a5bf-e6f779c0f247" } ] }, { "uuid": "2188d546-a301-5f23-97d1-e78553ff929f", "title": "Enforced retention and disposal", "description": "Retain data only for a defined window and dispose of it when the window closes, by a mechanism that runs on its own rather than on a support request. Disposal must reach derived copies, not only the record a user can see.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "data-retention-and-disposal" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-protection" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "residual-gap", "ns": "https://nordvec.eu/ns/compliance", "value": "A cached copy of derived data can briefly outlive a deleted document." }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-12" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "mp-6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "3.4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "3.5" } ], "target": { "type": "statement-id", "target-id": "_3.4", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "2cf1acd0-d0ae-548e-92da-8dbc15c0d210" } ] }, { "uuid": "2c05a140-c722-53a9-a629-5769eeeac4bd", "title": "Encryption of data at rest", "description": "Encrypt stored data on servers, databases and object storage. Storage-layer encryption is the floor; credentials that grant access to third-party systems on a user's behalf warrant application-layer encryption, so that access to the storage device alone does not yield usable secrets.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "encrypt-data-at-rest" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-protection" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-28" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "3.11" } ], "target": { "type": "statement-id", "target-id": "_3.11", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "2363af77-f6f4-546c-ad1a-1063ecfe17bc" } ] }, { "uuid": "48a0dcf3-f466-58c9-bd0f-53b7716f0c07", "title": "Encryption of data in transit", "description": "Encrypt sensitive data on every network hop, including the hops inside our own estate: browser to application, application to database, application to inference provider, and worker to object storage. A hop terminated at a reverse proxy and continued in clear text does not satisfy this.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "encrypt-data-in-transit" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-protection" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-8" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-13" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "3.10" } ], "target": { "type": "statement-id", "target-id": "_3.10", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "e106a465-3a62-5f7c-b702-b674105e4092" } ] }, { "uuid": "6852fdca-30ca-5ddb-aabf-e8d596746954", "title": "Encryption of data at rest on end-user devices", "description": "Encrypt the data the product leaves on an end-user device. A desktop client that caches state locally puts a copy of that state outside every server-side control, so it needs its own protection at rest rather than inheriting the server's.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "endpoint-data-at-rest" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-protection" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-28" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "3.6" } ], "target": { "type": "statement-id", "target-id": "_3.6", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "6ca0b5f9-80df-5050-8dcd-d5f5a801b75b" } ] }, { "uuid": "fb0a7dbc-7ef3-5ee2-b0b0-29e1bdf3daa6", "title": "Access control lists scoped to the data owner", "description": "Restrict access to stored data through access control lists enforced by the storage layer itself rather than by the calling application. For a multi-tenant SaaS the load-bearing form is row-level isolation: a query issued in one tenant's context cannot return another tenant's rows even when the application layer is wrong.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "tenant-scoped-data-acls" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-protection" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "assessment" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "3.3" } ], "target": { "type": "statement-id", "target-id": "_3.3", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "4af612a1-93ab-52d9-be5c-0efcdd7a9e3b" } ] }, { "uuid": "39820cde-8fc1-53f2-bd63-a1b0118b5901", "title": "Automated backups with recovery actually tested", "description": "Back up automatically, protect the recovery data from the same compromise that would take the primary, and test a restore on a fixed cadence. An untested backup is an assumption; the test is what converts it into a control, and the measured restore time is the number that matters.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "automated-backups-and-tested-recovery" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-recovery" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "planned" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cp-9" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cp-10" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "11.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "11.2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "11.3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "11.4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "11.5" } ], "target": { "type": "statement-id", "target-id": "_11.1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "planned" } } }, { "uuid": "6f8f0762-c74f-52aa-aee7-34cf9dc0c6eb", "title": "Authenticated sending domain for outbound mail", "description": "Publish sender-authentication records so that mail claiming to come from our domain can be verified and mail that cannot be verified is handled as the policy says. A publish-and-forget posture is not enough: the records have to agree with the services that actually send, or the policy rejects our own mail.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "email-domain-authentication" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "email-protection" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "planned" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-8" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-20" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "9.5" } ], "target": { "type": "statement-id", "target-id": "_9.5", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "planned" } } }, { "uuid": "4deb9e3c-8722-5b93-9700-a114c73c8633", "title": "Routine exercises of the incident-response process", "description": "Exercise the incident-response process on a stated cadence, against scenarios written down in advance, and treat what the exercise gets wrong as the output. An exercise whose findings are not tracked to a close is a story about a rehearsal.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-response-exercises" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-response" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ir-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cp-4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "17.7" } ], "target": { "type": "statement-id", "target-id": "_17.7", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "f6e3b55e-7d77-5734-a27e-b4d752179bda" } ] }, { "uuid": "bc94e407-bfe7-5815-96b3-2bf12c5057da", "title": "An incident-response process with a named owner, a reporting route and a review step", "description": "Name who runs an incident, keep the contact list they will need, publish how anyone reports one, write the process down end to end, exercise it before it is needed, and review each incident afterwards. Every part of this is documentation, which is why the only real question is whether it exists and has been tried.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-response-process" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-response" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ir-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ir-4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ir-6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ir-8" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "17.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "17.2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "17.3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "17.4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "17.8" } ], "target": { "type": "statement-id", "target-id": "_17.1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "07e7f04a-487e-5845-8d80-a5cff62e005e" } ] }, { "uuid": "e92c2573-9146-520a-a621-0bd61b0bd4db", "title": "Malware defences over the content the product ingests", "description": "Scan the content that enters the system for malicious files and keep the detection signatures current automatically. For a platform with no managed endpoint fleet, the surface this safeguard actually protects is the ingestion path: files arriving from a user's upload or a connected source.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ingested-content-malware-scanning" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "malware-defenses" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "10.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "10.2" } ], "target": { "type": "statement-id", "target-id": "_10.1", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "7c0809f5-22f3-5e6e-8e51-9e9493f4f65b" } ] }, { "uuid": "bec02b00-fa95-5391-a0ad-1c8026cd5356", "title": "A penetration-testing programme, including as an authenticated user", "description": "Test the system the way an attacker would, on a stated cadence and with a defined scope, including from the position of a legitimate authenticated user. A multi-tenant platform's most valuable finding is reachable only from inside a session, so an unauthenticated test alone measures the wrong boundary.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "penetration-testing-programme" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "penetration-testing" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "planned" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ca-8" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ra-5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "16.13" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "18.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "18.2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "18.3" } ], "target": { "type": "statement-id", "target-id": "_16.13", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "planned" } } }, { "uuid": "90682c78-7f8f-5645-9229-79fcc55494d1", "title": "Separated production, staging and development environments", "description": "Keep production separate from the environments used to build and test, so that development data cannot reach production and a production credential cannot be picked up by a test run. Separation asserted in configuration is only as strong as what refuses when the assertion is missing.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "environment-separation" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "secure-configuration" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cm-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cm-4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "16.8" } ], "target": { "type": "statement-id", "target-id": "_16.8", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "fe564007-c036-5025-adbb-5098ef5728fc" } ] }, { "uuid": "1b7bd487-b483-545a-becc-0df1f0ec23d7", "title": "Standard hardening templates for the application infrastructure", "description": "Configure servers, containers and the database from a documented hardening baseline rather than from defaults, remove the services and default accounts that baseline does not need, restrict what each host will accept a connection from, and re-apply the baseline when a host is rebuilt. The baseline is only a control if compliance with it can be measured, so it has to be machine-checkable.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "hardening-configuration-templates" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "secure-configuration" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cm-6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cm-7" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "4.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "4.4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "4.6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "4.7" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "4.8" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "16.7" } ], "target": { "type": "statement-id", "target-id": "_4.1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "72d2ecfe-e83b-593f-8dfb-e8e4ea73cfdc", "title": "Assessment of service providers against their classification", "description": "Assess each service provider on a cadence that follows from its risk classification, record what was checked and where it was read, and let an assessment expire rather than stand indefinitely. The security requirements in the arrangement are what an assessment mostly checks, so the record has to name them one by one rather than reach a verdict as a whole.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "service-provider-assessment" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "supply-chain" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ra-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-9" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sr-6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "15.5" } ], "target": { "type": "statement-id", "target-id": "_15.5", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "ae4dcc83-d215-5a89-9236-1a4f1b20a31c" } ] }, { "uuid": "9e7a579d-e6d2-5537-92ab-8871c10d5549", "title": "Decommissioning a service provider", "description": "Ending a provider relationship has to leave evidence: what happened to the data we sent them, and that the credentials reaching them were revoked. Editing a row to say a provider is gone records the intention, not the act, and the credential is the part that outlives the intention.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "service-provider-decommissioning" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "supply-chain" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-9" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "mp-6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "15.7" } ], "target": { "type": "statement-id", "target-id": "_15.7", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "3950354c-b629-5b21-8d44-980acb846cc7" } ] }, { "uuid": "198dda90-5064-5d57-96e6-f9ec57993d89", "title": "Risk classification of service providers", "description": "Classify every service provider by the risk it carries, keep the classification current, and let it drive how much diligence the rest of the provider controls apply. A tier has to reflect what the provider can reach, whose law can compel it, who it engages in turn, and what our arrangement with it actually covers. The classification has to be derived from recorded facts rather than authored, because a tier table typed by hand describes the day it was written and nothing makes it move when a provider does.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "service-provider-risk-classification" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "supply-chain" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ra-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-9" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sr-3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "15.3" } ], "target": { "type": "statement-id", "target-id": "_15.3", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "58363e76-527a-5b9b-88b7-6e0ad61537d0" } ] }, { "uuid": "30499b50-e795-53d5-bfdb-88fe38e2941e", "title": "Security requirements in service provider arrangements", "description": "Bind service providers to security requirements in the arrangement itself, and monitor them against it afterwards. For a processor chain that touches customer data the requirements have to cover location of processing, sub-processing and breach notification, because those are the terms a customer will be audited on.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "service-provider-security-requirements" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "supply-chain" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-9" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sr-3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "15.2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "15.4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "15.6" } ], "target": { "type": "statement-id", "target-id": "_15.2", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "7a3da9de-f517-5371-bcab-611b246bcc8e" } ] }, { "uuid": "a98db995-4769-5492-b13b-426de746849c", "title": "Inventory of third-party components and service providers", "description": "Maintain a current inventory of the third-party software components the product ships, keep them on vendor-supported versions, and update them from trusted sources. The inventory must be generated from what actually ships, not from a list someone remembers to update, and an unsupported component has to be visible as such rather than merely old.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "third-party-component-inventory" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "supply-chain" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cm-8" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-9" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sr-3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "2.2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "15.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "16.4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "16.5" } ], "target": { "type": "statement-id", "target-id": "_2.2", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "7d9d6fda-bf81-5a3e-8930-fcdddd3e3de2" } ] }, { "uuid": "882cfbf2-352b-5221-9e65-2b46db3e5f79", "title": "Vulnerability management process for the software we ship", "description": "Run a documented vulnerability-management process, scan the software the product is built from automatically rather than on request, and remediate on a published timeline tied to severity. A scan whose findings have no remediation deadline is a report, not a control.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "automated-vulnerability-scanning" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "vulnerability-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ra-5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "7.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "7.2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "7.7" } ], "target": { "type": "statement-id", "target-id": "_7.1", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "7cb1ade5-abca-5d8e-8b1d-1c615c29004f" } ] }, { "uuid": "e97e4f06-7c22-5fa0-a633-68c5b7c696ef", "title": "Patching and vulnerability scanning of the hosts we will run", "description": "Patch operating systems and applications on a schedule, and scan both from inside the estate with credentials and from outside it as an attacker would. Each of these reaches defects the others cannot: an authenticated internal scan sees what is installed, an external scan sees what is exposed.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "host-patching-and-infrastructure-scanning" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "vulnerability-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ra-5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "7.3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "7.4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "7.5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "7.6" } ], "target": { "type": "statement-id", "target-id": "_7.3", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "b19a77d0-4f4d-5037-ba58-13a89c3d1cba", "title": "A published intake channel for vulnerability reports, and a severity scale behind it", "description": "Publish a way for anyone to report a vulnerability, including people with no relationship to us, and rate what arrives on a stated severity scale so that the response time follows from the rating rather than from who is asking.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "cis-controls" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "vulnerability-intake-and-severity-rating" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "vulnerability-management" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ra-5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "16.2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "16.6" } ], "target": { "type": "statement-id", "target-id": "_16.2", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "03d31950-7a60-5e23-9144-f78d16a3292f" } ] }, { "uuid": "09052956-c882-52a3-8625-7c26ede973ab", "title": "Meet the clause 9 web requirements of the version we engineer to", "description": "Conform to the standard's web clauses (which mirror WCAG success criteria at AA level) for the service's web surfaces. v4.1.1 aligns clause 9 to WCAG 2.2 AA, the bar the internal suite already enforces. Conformity yields a presumption of conformity only under an act whose Official Journal citation names this version: today none under the EAA, and v3.2.1 under the Web Accessibility Directive.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "en-301-549" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "web-clause-9-conformity" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "presumption" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "conformance-aa" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "9.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "9.2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "9.3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "9.4" } ], "target": { "type": "statement-id", "target-id": "_9.1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "614154aa-374a-5096-829c-145096e046b0" } ] }, { "uuid": "e9baaad6-83f5-59b1-9b5f-048689c606e7", "title": "Audit records cannot be silently altered once captured", "description": "Captured audit and activity records are protected against modification or deletion through ordinary write paths once written; any legitimate correction runs through a narrowly-scoped, controlled path, never a direct mutation.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-15489" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "audit-trail-authenticity" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "record-integrity" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-9" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "authenticity" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "integrity" } ], "target": { "type": "statement-id", "target-id": "authenticity", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "5b3a5ee1-ea22-549b-9566-a7f2d9406db0" } ] }, { "uuid": "314c6ee4-02e5-51c9-8006-f7ed4aa27211", "title": "Every auditable event is captured with typed, enumerated metadata", "description": "Auditable events are recorded with a fixed, enumerated event type and a typed metadata shape checked at the callsite, rather than reconstructed after the fact from free-text logs.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-15489" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "records-metadata-capture" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "record-integrity" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "metadata" } ], "target": { "type": "statement-id", "target-id": "metadata", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "89c1e7b5-0732-59b4-97aa-8321601dc637" } ] }, { "uuid": "ab5a2bdc-5a99-592f-9138-1c4fc021dfca", "title": "Records stay retrievable to authorised reviewers throughout retention", "description": "Authorised reviewers can locate, filter, and bulk-extract the record set throughout its retention period, gated by the same permission check the interactive viewer uses, and the export itself is audited.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-15489" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "records-remain-retrievable" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "record-usability" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-7" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "usability" } ], "target": { "type": "statement-id", "target-id": "usability", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "47f48e0f-c721-5c68-babc-29c272840ee9" } ] }, { "uuid": "f18bef44-b0a5-5d1e-9b03-51104c7eb164", "title": "Audit logs are purged on a fixed, floored schedule", "description": "Audit and activity logs are purged on a fixed schedule with a minimum-age floor rather than growing unbounded, on a path distinct from the usage-ledger disposition.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-15489" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "audit-log-retention-schedule" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "retention-and-disposition" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-11" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "retention-and-disposition" } ], "target": { "type": "statement-id", "target-id": "retention-and-disposition", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "8f6bbdf3-75ea-5db5-961f-0080dc574d95" } ] }, { "uuid": "595a1635-7d3d-52b5-a2e8-06d9398dc456", "title": "Every destructive action leaves a reason-coded, honest receipt", "description": "Every destructive or erasure action on a record leaves an append-only receipt recording what was removed, how many rows, and why, and the receipt cannot over-claim what actually happened.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-15489" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "erasure-disposition-trail" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "retention-and-disposition" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-11" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "disposition" } ], "target": { "type": "statement-id", "target-id": "disposition", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "26636dcd-b993-5981-8113-02dec7ca86ce" } ] }, { "uuid": "e50c5952-4ebf-5115-8096-b50fce69a7a8", "title": "Raw telemetry is frozen to a long-lived ledger before it is purged", "description": "Raw usage telemetry is closed into a long-lived aggregate on a fixed schedule before disposal, and disposal never runs ahead of the freeze, so the accounting record survives the purge of the raw rows.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-15489" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "usage-ledger-disposition" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "retention-and-disposition" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-12" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-11" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "retention-and-disposition" } ], "target": { "type": "statement-id", "target-id": "retention-and-disposition", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "c3bab2ae-fc0c-5605-93e5-06c939095347" } ] }, { "uuid": "626c2764-b2ec-5f25-8885-44f50c6aff05", "title": "Data accuracy: extracted content faithfully represents the source", "description": "Text extracted from an ingested file represents the source correctly, with a quality signal that routes poor extractions to a stronger path rather than indexing damaged content as if it were clean.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-25012" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "accuracy" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "inherent-data-quality" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "accuracy" } ], "target": { "type": "statement-id", "target-id": "accuracy", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "e96fd38c-6814-58a7-98e9-0a3d33ce3b88" } ] }, { "uuid": "1dddba25-d114-556f-a65e-c55f1d674711", "title": "Data completeness: every ingested document is searchable or visibly failed", "description": "The retrievable corpus reflects what was ingested: a document either reaches a searchable state or a terminal failed state with a recorded reason, never a silent blank that is present in the file list yet absent from the index.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-25012" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "completeness" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "inherent-data-quality" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_32" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "completeness" } ], "target": { "type": "statement-id", "target-id": "completeness", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "139eac45-2974-5412-969d-b1f753931bbd" } ] }, { "uuid": "8a0e7edf-2b5b-5ee8-aad9-8948cb53606e", "title": "Data consistency: derived stores agree with the document they describe", "description": "Chunks and embeddings derived from a document stay consistent with the document's own state, so a partially-written or half-deleted document cannot present as a whole, searchable one.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-25012" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "consistency" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "inherent-data-quality" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "consistency" } ], "target": { "type": "statement-id", "target-id": "consistency", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "10192c07-71ab-59c4-99f0-4036cde71a1e" } ] }, { "uuid": "d0bd4cdf-b08d-51f1-8bf0-b0856251bc89", "title": "Data currentness: the index tracks the source over time", "description": "As source documents change or are removed, the retrievable corpus reflects the current state: updates re-index and deletions propagate, so answers are not drawn from content that no longer exists at the source.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-25012" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "currentness" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "inherent-data-quality" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "residual-gap", "ns": "https://nordvec.eu/ns/compliance", "value": "No measured target yet for how old the search index may be." }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "currentness" } ], "target": { "type": "statement-id", "target-id": "currentness", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "7c06bd82-5c86-5563-84d2-77325545539f" } ] }, { "uuid": "acd373ad-48a3-51e4-8916-172f96e7a670", "title": "Data confidentiality: content is reachable only by authorised principals", "description": "Stored corpus data is accessible only to the tenant and users authorised to see it, enforced at the data layer rather than by application-code discretion.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-25012" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "confidentiality" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "system-dependent-data-quality" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_32" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "confidentiality" } ], "target": { "type": "statement-id", "target-id": "confidentiality", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "6fd254f9-082e-5eb3-aca0-80888639de7a" } ] }, { "uuid": "387e33de-e5e5-5cfc-87a8-9f1b8e3e8e1e", "title": "Data traceability: retrieved content is attributable to its source", "description": "Every unit of retrievable data can be traced to the source document and location it came from, so a generated answer's citations point at real, locatable provenance.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-25012" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "traceability" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "system-dependent-data-quality" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "traceability" } ], "target": { "type": "statement-id", "target-id": "traceability", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "de0216e8-683f-58b8-972d-06ccb6c2c29f" } ] }, { "uuid": "8407e75f-1eb7-53a5-9486-cb4735d12605", "title": "Access control on a need-to-use basis", "description": "Establish and enforce access control so that access to information and systems is restricted to what each identity needs. In a multi-tenant SaaS the load-bearing control is data-plane tenant isolation: no tenant can read another tenant's rows.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "access-control-policy" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "organizational" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "assessment" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.5.15" } ], "target": { "type": "statement-id", "target-id": "A.5.15", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "d7538ea1-17a0-5e62-bbf9-5ce09c54551d" } ] }, { "uuid": "18120cd8-2156-5f23-9e34-04aaef1a5300", "title": "ICT readiness for business continuity", "description": "Plan, implement, and test ICT continuity so the service can be restored within defined objectives after disruption, covering the primary database, object storage, and the vector index.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "business-continuity" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "organizational" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cp-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cp-10" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.5.29" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.5.30" } ], "target": { "type": "statement-id", "target-id": "A.5.29", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "998c933a-4fbd-590e-b387-a0554f445a30", "title": "Security for the use of cloud services", "description": "Define and manage security for the cloud services the platform consumes and offers, including data location, tenancy isolation, and provider responsibilities under the shared-responsibility model.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "cloud-services-security" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "organizational" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-9" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.5.23" } ], "target": { "type": "statement-id", "target-id": "A.5.23", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "dd65836d-bd43-5027-9e33-a3ef1762beda", "title": "Provision and revoke access rights over the lifecycle", "description": "Manage the full lifecycle of identities and access rights: provisioning, periodic review, and timely revocation on role change or departure, for both application users and administrative access.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "identity-access-provisioning" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "organizational" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.5.16" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.5.18" } ], "target": { "type": "statement-id", "target-id": "A.5.16", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "98f3eca1-9c5a-5c38-826c-2a0d85410fcf" } ] }, { "uuid": "54175bd1-72a7-5116-811c-5da6ed49f276", "title": "Information security incident management", "description": "Plan for and manage security incidents: a defined process to detect, report, assess, respond to, and learn from incidents, with roles and a runbook.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-management" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "organizational" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ir-4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ir-5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ir-6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.5.24" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.5.25" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.5.26" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.5.27" } ], "target": { "type": "statement-id", "target-id": "A.5.24", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "3d1af478-82a8-5ea3-b3d8-6ae7fb2e615a" } ] }, { "uuid": "b0889f92-f00f-563d-84d7-a7de508d3cb1", "title": "Security requirements inside supplier agreements", "description": "Establish which security requirements a supplier agreement has to carry, and check each of them per supplier rather than judging the relationship as a whole. A verdict on a supplier is not a verdict on the terms, and it is the terms that are enforceable.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "supplier-agreement-requirements" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "organizational" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-9" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.5.20" } ], "target": { "type": "statement-id", "target-id": "A.5.20", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "249a4923-a922-55db-b672-8647060fed8a" } ] }, { "uuid": "11518bff-4248-5d3f-9e97-c7b1da5e87fe", "title": "Security in supplier and subprocessor relationships", "description": "Assess and manage the security posture of suppliers and subprocessors (model/embedding vendors, storage, connectors), including how their compromise could reach our systems and data.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "supplier-security" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "organizational" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-9" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sr-3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.5.19" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.5.21" } ], "target": { "type": "statement-id", "target-id": "A.5.19", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "b8aab189-247e-585b-bbdd-bed4f90ae335" } ] }, { "uuid": "9d8ffa4c-b34c-546a-acce-4b671d38dc08", "title": "Encrypt data in transit and at rest under managed key policy", "description": "Use cryptography to protect confidentiality and integrity of data in transit and at rest, with sound key management appropriate to the data's sensitivity.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "cryptography" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "technological" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-13" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-12" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-28" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.8.24" } ], "target": { "type": "statement-id", "target-id": "A.8.24", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "9aa3dce7-de4b-553b-982b-3368fd6f7c06", "title": "Prevent leakage of information", "description": "Apply measures to prevent information from leaking across trust boundaries: tenant data-flow isolation, network segmentation, and controls on egress paths that could exfiltrate customer content.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "data-leakage-prevention" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "technological" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-7" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.8.12" } ], "target": { "type": "statement-id", "target-id": "A.8.12", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "7e6eb03a-aa94-5627-a3cf-bcf3bb3b8f7b" } ] }, { "uuid": "08fd2e54-2401-5b87-a56a-408d44ee471f", "title": "Restrict access to information within applications", "description": "Restrict access to information and application functions in line with the access-control policy, enforced at the data layer so authorization cannot be bypassed by a direct query path.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "information-access-restriction" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "technological" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "assessment" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.8.3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.8.4" } ], "target": { "type": "statement-id", "target-id": "A.8.3", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "4fa6697b-9f85-5735-ab98-8f13ce82864e" } ] }, { "uuid": "e2cb1b9a-83f8-5c1d-90c4-c2059b2fb1fa", "title": "Security-relevant event logging", "description": "Produce, protect, and retain logs recording security-relevant events (access, changes, failures) with enough fidelity to investigate incidents, without logging PII or customer content.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "logging" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "technological" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-12" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.8.15" } ], "target": { "type": "statement-id", "target-id": "A.8.15", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "8301bdd5-c134-539c-bed7-95b089eb4903" } ] }, { "uuid": "e85575fd-9c9b-5d5c-9ad1-ecbc6bfaa867", "title": "Monitoring for anomalous behaviour", "description": "Monitor systems for anomalous activity and potential security events, with alerting thresholds that surface incidents fast enough to meet regulatory reporting clocks.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "monitoring" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "technological" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.8.16" } ], "target": { "type": "statement-id", "target-id": "A.8.16", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "ce37a0bd-1ed8-51b5-8f16-d86628cef432" } ] }, { "uuid": "088a9ec0-6979-5483-a3a5-e6fe98399e0e", "title": "Secure authentication including MFA", "description": "Use secure authentication techniques proportionate to risk, including multi-factor authentication for privileged and administrative access, and safe secret/credential handling.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "secure-authentication" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "technological" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ia-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ia-5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.8.5" } ], "target": { "type": "statement-id", "target-id": "A.8.5", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "f48e66d6-7846-5141-8310-995573af06a0" } ] }, { "uuid": "c9b78aec-6b26-57cf-95d5-439b458b4e10", "title": "Secure coding and application security testing", "description": "Apply secure coding principles and test application security automatically: static analysis in the pipeline, secret detection, and dependency review, so insecure code is caught before release.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "secure-coding" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "technological" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "gate" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-11" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-15" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.8.28" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.8.29" } ], "target": { "type": "statement-id", "target-id": "A.8.28", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "2b0a3044-5810-545c-80fe-fdff669153ed" } ] }, { "uuid": "88fb202c-df98-5c20-a437-2bfdf2f89ce4", "title": "Secure development lifecycle", "description": "Establish and apply rules for secure development across the lifecycle: security in design, protected pipelines, separation of environments, and controls that keep secrets out of source.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "secure-development-lifecycle" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "technological" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-8" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.8.25" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.8.31" } ], "target": { "type": "statement-id", "target-id": "A.8.25", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "42f69c5c-a04d-55b9-87a7-adc63e64dfdb" } ] }, { "uuid": "ebf51c1e-d201-52ad-b15a-694a3078fb73", "title": "Track and remediate technical vulnerabilities on a defined cadence", "description": "Obtain information about technical vulnerabilities in the software and its dependencies, evaluate exposure, and remediate on a defined cadence, including third-party and transitive dependencies.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "technical-vulnerability-management" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "technological" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ra-5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.8.8" } ], "target": { "type": "statement-id", "target-id": "A.8.8", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "628451b9-97fc-5805-966e-73b3171d3956" } ] }, { "uuid": "6a655b37-8f80-5682-b69f-840fff0b00ca", "title": "Obtain and allow withdrawal of consent", "description": "Where processing relies on consent, obtain it in a recorded, unambiguous way and provide an equally easy mechanism to withdraw it, with withdrawal taking effect across all downstream processing.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27701" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "consent-management" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "pii-controller" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pt-4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pt-5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.7.3" } ], "target": { "type": "statement-id", "target-id": "A.7.3", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "ef64c371-7d9c-54dd-9a2a-8d838687ebb1", "title": "Fulfil PII principals' access, correction, and erasure rights", "description": "Provide mechanisms for PII principals to access, correct, and erase their PII, and to obtain a portable copy, within the required timeframes and across every store that holds the data.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27701" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "data-subject-rights" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "pii-controller" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "test" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pt-5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.7.3" } ], "target": { "type": "statement-id", "target-id": "A.7.3", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "b919f81d-c4a8-544a-a7fc-a5cc7568a00d" } ] }, { "uuid": "5ab2cef4-629c-569d-9b9a-d90e8b0898be", "title": "Record and control transfers of PII", "description": "Record the categories of PII transferred to third parties and jurisdictions, and control transfers so PII does not leave the permitted region or reach unauthorized recipients.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27701" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "pii-transfer-controls" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "pii-controller" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pt-7" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.7.5" } ], "target": { "type": "statement-id", "target-id": "A.7.5", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "d8e8c019-6227-5ba6-92b7-d969255e987d", "title": "Privacy by design and by default", "description": "Build privacy into processing: collect and expose the minimum PII needed, isolate it per tenant/principal, and default to the most privacy-protective settings so no principal's PII is accessible beyond its purpose.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27701" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "privacy-by-design-and-default" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "pii-controller" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pt-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-28" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.7.4" } ], "target": { "type": "statement-id", "target-id": "A.7.4", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "4fa2735a-9d7f-5aed-8b77-40c1af91c66b" } ] }, { "uuid": "a4cb8e70-c3a7-5cf8-8e4f-f4c0e995d333", "title": "Identify purposes and lawful basis for processing PII", "description": "Determine, document, and limit the purposes for which PII is processed, and establish a lawful basis for each purpose. Processing outside the recorded purpose is a violation.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27701" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "purpose-and-lawful-basis" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "pii-controller" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pt-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pt-3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.7.2" } ], "target": { "type": "statement-id", "target-id": "A.7.2", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "1dfc96af-85d4-589f-a157-5ff470463520", "title": "Limit retention and dispose of PII", "description": "Retain PII only as long as needed for the purpose, then delete or de-identify it, with disposal reaching every copy including derived data (embeddings, caches, backups).", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27701" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "retention-and-disposal" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "pii-controller" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-12" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pt-2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.7.4" } ], "target": { "type": "statement-id", "target-id": "A.7.4", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "19a12f9c-2d55-5102-ac90-adcd875cdcc2" } ] }, { "uuid": "cf3eeb4b-fe6c-54cb-bbd2-ce02a056e3ff", "title": "Provide transparency information to PII principals", "description": "Give PII principals clear information about the processing (identity, purposes, recipients, retention, rights) at or before collection, in accessible language.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27701" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "transparency-to-principals" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "pii-controller" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pt-5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pt-6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.7.3" } ], "target": { "type": "statement-id", "target-id": "A.7.3", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "7b25e46b-60cd-58c6-b00e-4f65b5cf7c43", "title": "Notify controllers of privacy incidents", "description": "Detect PII breaches and notify affected controllers without undue delay, with enough information for them to meet their own regulatory notification deadlines.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27701" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "privacy-incident-notification" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "pii-processor" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ir-6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pt-7" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B.8.5" } ], "target": { "type": "statement-id", "target-id": "B.8.5", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "e275f1fc-7195-5122-8e33-e556cbc26103" } ] }, { "uuid": "3f6f9b09-c18c-5029-9c8b-8ecdfb998765", "title": "Maintain records of PII processing", "description": "Keep records of the PII processing carried out on behalf of controllers (categories, purposes, recipients, transfers), sufficient to demonstrate accountability.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27701" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "processing-records" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "pii-processor" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pt-7" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B.8.4" } ], "target": { "type": "statement-id", "target-id": "B.8.4", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "7ede9e24-3aa9-5151-b661-e245eee38344", "title": "Process customer PII only on documented instructions", "description": "As a processor, process customer PII only on the controller's documented instructions, not for our own purposes, and support the controller's own PIMS obligations.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-27701" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "processor-instructions" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "pii-processor" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "planned" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pt-3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "B.8.2" } ], "target": { "type": "statement-id", "target-id": "B.8.2", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "planned" } } }, { "uuid": "5687f65e-1323-5404-a480-05a7e3ae29c7", "title": "Manage the AI system life cycle responsibly", "description": "Apply defined, repeatable processes across the AI system life cycle (objectives, design, verification, deployment, monitoring, retirement) with quality controls at each stage.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-42001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-lifecycle-management" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-lifecycle" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_17" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_9" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.6" } ], "target": { "type": "statement-id", "target-id": "A.6", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "908c16ba-f3c8-5277-b93e-d9497c50bdb7", "title": "Keep records and logs of AI operation", "description": "Record events over the AI system's operation sufficient to trace behaviour, investigate incidents, and demonstrate accountability, without logging PII or customer content.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-42001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-record-keeping" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-lifecycle" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_12" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.6" } ], "target": { "type": "statement-id", "target-id": "A.6", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "5096df14-53eb-56d2-9c32-cb35a5fdc4c3" } ] }, { "uuid": "9e6d836f-fd8b-5b6b-8c20-6fbc01a9f34c", "title": "Ensure AI robustness, accuracy, and security", "description": "Design AI systems to be accurate and robust against errors and adversarial manipulation (prompt injection, insecure output handling), with security controls proportionate to the risk.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-42001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-robustness-and-security" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-lifecycle" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_15" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.6" } ], "target": { "type": "statement-id", "target-id": "A.6", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "f0af8d55-65b7-5fb5-8870-a5ac06e729fc" } ] }, { "uuid": "cda4cb05-cab5-5e29-9714-a5cf60513890", "title": "Govern data used by AI systems", "description": "Manage the data used to build and operate AI systems for quality, relevance, provenance, and bias, and control how customer content flows into retrieval and generation.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-42001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "data-for-ai-systems" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-lifecycle" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_10" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.7" } ], "target": { "type": "statement-id", "target-id": "A.7", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "d6d9e4b8-53cb-50ad-9e6c-cf522f278334" } ] }, { "uuid": "0dd92ec1-9462-5f12-afb3-86128ea87576", "title": "Provide information about AI systems to interested parties", "description": "Give affected parties clear information that they are interacting with an AI system and about its capabilities, limitations, and intended use, sufficient to use it responsibly.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-42001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "transparency-to-interested-parties" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "data-and-transparency" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_13" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_50" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.8" } ], "target": { "type": "statement-id", "target-id": "A.8", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "b240cdac-51e6-5858-ad02-1ab222dc2c25" } ] }, { "uuid": "d4a32764-ff56-5be5-a0e7-131ebf06e4d0", "title": "Assess impacts of AI systems on individuals and society", "description": "Perform and document an assessment of the potential impacts of AI systems on individuals and groups (fairness, safety, fundamental rights) before and during deployment, and act on the findings.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-42001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-impact-assessment" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "management-system" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_27" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_9" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.5" } ], "target": { "type": "statement-id", "target-id": "A.5", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "9143fc41-99a2-5293-8efc-28c519728334", "title": "Establish an AI management policy", "description": "Define, approve, and maintain an AI policy setting the organisation's objectives and principles for responsible AI, aligned with its risk appetite and legal obligations.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-42001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-policy" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "management-system" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_9" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.2" } ], "target": { "type": "statement-id", "target-id": "A.2", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "e3b668a6-bd92-5c21-9e3a-869487d3b049", "title": "Assign AI roles, responsibilities, and accountability", "description": "Define who is accountable for AI systems across their lifecycle, with clear roles for development, deployment, oversight, and incident handling.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-42001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "ai-roles-accountability" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "management-system" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_9" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_26" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.3" } ], "target": { "type": "statement-id", "target-id": "A.3", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "a48c88e8-bef9-5cf8-b7c7-43fbfecd55f1", "title": "Ensure human oversight of AI use", "description": "Enable humans to oversee AI outputs, understand them, and intervene or override where consequential, rather than deferring automatically to the model.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-42001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "human-oversight-of-ai-use" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "oversight-and-third-parties" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_14" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_26" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.9" } ], "target": { "type": "statement-id", "target-id": "A.9", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "9f5f31b5-9a9b-518a-a44b-ba65629e2b6c", "title": "Manage third-party and model-provider relationships", "description": "Manage risks from third parties in the AI value chain (model/embedding providers, GPAI upstreams): understand their capabilities and limitations, and obtain the documentation needed to meet our own obligations.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "iso-42001" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "third-party-ai-relationships" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "oversight-and-third-parties" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_25" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "art_53" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A.10" } ], "target": { "type": "statement-id", "target-id": "A.10", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "25014802-3710-5e20-8ecf-415fcdf3db1e", "title": "Maintain availability through backup and recovery", "description": "Meet availability commitments through backup, recovery, and capacity management: tested restoration within defined objectives across all data stores.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "soc-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "availability-backup-recovery" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "availability" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "unverified" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cp-9" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cp-10" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A1.2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "A1.3" } ], "target": { "type": "statement-id", "target-id": "A1.2", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "unverified" } } }, { "uuid": "50dbd004-dd0e-516d-9406-3b4c9fa4fa21", "title": "Monitor the system for anomalies and security events", "description": "Monitor system components and operations to detect anomalies indicating a security event, with alerting fast enough to trigger the incident process within reporting deadlines.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "soc-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "anomaly-monitoring" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "common-criteria" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "au-6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "CC7.2" } ], "target": { "type": "statement-id", "target-id": "CC7.2", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "34c31331-513c-5b4a-b4ef-46a301f94bb8" } ] }, { "uuid": "05098031-71da-57da-86d8-673de4846fbe", "title": "Protect system boundaries against external threats", "description": "Protect the boundaries of the system: limit and inspect ingress/egress, and constrain outbound requests so the service cannot be turned into a pivot for exfiltration or internal network access.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "soc-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "boundary-protection" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "common-criteria" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-7" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "CC6.6" } ], "target": { "type": "statement-id", "target-id": "CC6.6", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "42954bc3-e249-551b-8425-fcf7e89d54db" } ] }, { "uuid": "bf23f7ed-529c-5a2e-87fe-b75e87b74740", "title": "Authorize, test, and control changes", "description": "Manage changes to infrastructure and software through an authorized, tested, controlled process: version control, review, protected pipelines, and separation of duties, so unauthorized or untested changes cannot reach production.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "soc-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "change-management" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "common-criteria" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cm-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cm-5" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "CC8.1" } ], "target": { "type": "statement-id", "target-id": "CC8.1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "e1ff8d0b-3a23-5f6b-8491-e75af65e6fde" } ] }, { "uuid": "16ac9f66-0f03-578c-9bd7-8c5a6689f680", "title": "Respond to and recover from security incidents", "description": "Evaluate security events, respond to identified incidents through a defined program, and recover affected systems and data to normal operation.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "soc-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "incident-response" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "common-criteria" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ir-4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ir-5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ir-6" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cp-10" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "CC7.3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "CC7.4" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "CC7.5" } ], "target": { "type": "statement-id", "target-id": "CC7.3", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "f5798671-157f-5bcb-b3fa-72b30bc94d8b" } ] }, { "uuid": "d9dc55f9-8933-5c09-b577-8bffbfcd22ea", "title": "Logical access is restricted to authorized identities", "description": "Restrict logical access to information assets to authorized users on a least-privilege basis. For a multi-tenant SaaS the decisive control is enforced tenant isolation at the data layer, so no identity can reach another tenant's data.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "soc-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "logical-access-security" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "common-criteria" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "assessment" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-6" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "CC6.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "CC6.3" } ], "target": { "type": "statement-id", "target-id": "CC6.1", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "0bda1c18-c1e6-515e-9cd1-ed31bad9c957" } ] }, { "uuid": "e52699d9-fbe9-53fa-871a-a61d40530ad2", "title": "The system, its boundary and its data flows are described from the code", "description": "Maintain a current description of the system an auditor and a customer can read: which components process which data, where each processor sits, how data enters and leaves the boundary, and on what schedule. The description must be generated from or checked against the running code, because a hand-kept narrative drifts from the system within a release.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "soc-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "system-description-and-data-flows" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "common-criteria" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pl-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "pl-8" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cm-8" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "CC2.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "CC2.3" } ], "target": { "type": "statement-id", "target-id": "CC2.1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "d33b0de7-c4d5-5a6f-8531-113cbf44b4b2" } ] }, { "uuid": "fffb9603-a43f-5494-82b8-b9d021b42455", "title": "Encrypt data in transmission", "description": "Protect data in transit with encryption and integrity controls appropriate to its sensitivity, across client, service, and inter-service links.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "soc-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "transmission-encryption" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "common-criteria" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "0" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-8" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-13" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "CC6.7" } ], "target": { "type": "statement-id", "target-id": "CC6.7", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } } }, { "uuid": "6939c7c1-9965-5b97-8185-68fedf3db367", "title": "Manage vendor and subprocessor risk", "description": "Assess and monitor the risk that vendors and subprocessors introduce, including their access to data and the impact of their compromise, and impose commitments through agreements.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "soc-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "vendor-risk-management" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "common-criteria" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "code" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "1" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sa-9" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sr-3" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "CC9.2" } ], "target": { "type": "statement-id", "target-id": "CC9.2", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "06d54784-4fdc-5d4f-b09b-6e702a7ca6a2" } ] }, { "uuid": "8b2fa303-aee9-58c7-bf1a-e0c05f3a40cb", "title": "Detect and remediate vulnerabilities and misconfiguration", "description": "Identify vulnerabilities and configuration weaknesses in the software and its dependencies through automated scanning, and remediate them on a defined cadence.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "soc-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "vulnerability-detection" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "common-criteria" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "implemented" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "4" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ra-5" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "si-2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "cm-2" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "CC7.1" } ], "target": { "type": "statement-id", "target-id": "CC7.1", "status": { "state": "satisfied", "reason": "pass" }, "implementation-status": { "state": "implemented" } }, "related-observations": [ { "observation-uuid": "0d1bcb75-c41c-5560-b82e-2ba5f38d54af" } ] }, { "uuid": "add6402f-2b47-512f-bbb0-fb569bdedec1", "title": "Protect confidential information over its lifecycle", "description": "Identify confidential information and protect it through access restriction and encryption from creation to disposal, including secure erasure when retention ends.", "props": [ { "name": "framework", "ns": "https://nordvec.eu/ns/compliance", "value": "soc-2" }, { "name": "obligation-id", "ns": "https://nordvec.eu/ns/compliance", "value": "confidentiality-protection" }, { "name": "category", "ns": "https://nordvec.eu/ns/compliance", "value": "confidentiality" }, { "name": "status", "ns": "https://nordvec.eu/ns/compliance", "value": "partial" }, { "name": "evidence-strength", "ns": "https://nordvec.eu/ns/compliance", "value": "artifact" }, { "name": "evidence-count", "ns": "https://nordvec.eu/ns/compliance", "value": "2" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "ac-3" }, { "name": "source-article", "ns": "https://nordvec.eu/ns/compliance", "value": "sc-28" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "C1.1" }, { "name": "standard-control", "ns": "https://nordvec.eu/ns/compliance", "value": "C1.2" } ], "target": { "type": "statement-id", "target-id": "C1.1", "status": { "state": "not-satisfied", "reason": "other" }, "implementation-status": { "state": "partial" } }, "related-observations": [ { "observation-uuid": "f7117b1e-bc9b-5011-9977-c29c14e64aef" } ] } ] } ] } }