MartinandClaude Opus 4.8
32ab91efbf
Datenmodell (Prisma, RLS): Supplier + SupplierAsset, SupplierAssessment, Contract, Nda, SupplierEvidence, ServiceResponsibility, Subcontractor, ManagementDecision, SupplierControl (globaler Katalog) + SupplierControlMaturity. - VDA-ISA-2027-Kap.-6-Mini-Katalog (Controls 6.1.1–6.1.3) mit Zielbild, Muss/Soll, Anforderungen für hoch/sehr hoch, Simplified Group Assessment, Ziel-Reifegrad 3 und Cross-Referenzen (ISO/NIST/BSI); im Seed befüllt - Lieferantenverzeichnis mit KPIs (gesamt, NIS2-relevant, ablaufend, Reviews fällig), Kritikalität, NIS2-Flag, Review-Fristen - Detail-Popup: Stammdaten (Sektor/Leistung/Datenkategorien/CIA), betroffene Assets, VDA-ISA-Reifegrade je Control (Ziel 3, farbige Balken), Nachweise (Angemessenheit + Ablauf), Assessments, Verträge (AV/DPA, Flow-down, Fristen), NDAs (Fristen), Shared-Responsibility- Matrix, Subunternehmer, Managemententscheidungen - Bearbeiten-Popup: Stammdaten (ein Speichern), Reifegrad je Control, Add/Delete für alle Kind-Entitäten, Löschen im ⋯-Menü - Regel 6.1.1: fehlt geprüfter Audit-/TISAX-Nachweis → Warnung, dass eine dokumentierte risikobasierte Managemententscheidung nötig ist - Server-Actions mit Zod/RBAC/Audit-Log; Seed mit Demo-Lieferant (TISAX-Label, AV/DPA, NDA, Assessment, RACI, Reifegrade) - Menüpunkt „Lieferanten" aktiv; Lieferant ↔ Asset verknüpft (Graph) Verifiziert: Register/Detail/Bearbeiten dunkel & vollständig, Reifegrad- Save (6.1.2→4 mit Audit), Managemententscheidungs-Logik. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
628 lines
23 KiB
TypeScript
628 lines
23 KiB
TypeScript
import "dotenv/config";
|
||
import { PrismaClient } from "@prisma/client";
|
||
import { PrismaPg } from "@prisma/adapter-pg";
|
||
import { hash } from "@node-rs/argon2";
|
||
import { PERMISSIONS, ROLE_DEFS } from "../src/server/rbac";
|
||
|
||
/**
|
||
* Seed: global permission catalog + demo tenant with roles and users.
|
||
* Idempotent (upserts) — safe to run repeatedly.
|
||
*/
|
||
|
||
const prisma = new PrismaClient({
|
||
adapter: new PrismaPg({ connectionString: process.env.DATABASE_URL }),
|
||
});
|
||
|
||
const DEMO_PASSWORD = "Demo1234!";
|
||
|
||
const THREATS = [
|
||
"Schadsoftware / Ransomware",
|
||
"Phishing / Social Engineering",
|
||
"Innentäter / Missbrauch von Berechtigungen",
|
||
"Diebstahl oder Verlust von Geräten",
|
||
"Ausfall von IT-Systemen oder Diensten",
|
||
"Ausfall eines Dienstleisters / Lieferanten",
|
||
"Stromausfall / Infrastrukturausfall",
|
||
"Feuer / Wasser / Elementarschäden",
|
||
"Unbefugter physischer Zutritt",
|
||
"Denial-of-Service-Angriff",
|
||
"Datenabfluss / Industriespionage",
|
||
"Fehlbedienung durch Mitarbeitende",
|
||
"Softwarefehler / fehlerhafte Updates",
|
||
"Kompromittierte Zugangsdaten",
|
||
"Rechtliche / regulatorische Verstöße",
|
||
];
|
||
|
||
const VULNERABILITIES = [
|
||
"Fehlende oder veraltete Backups",
|
||
"Fehlende Netzwerksegmentierung",
|
||
"Unzureichendes Patch-Management",
|
||
"Schwache oder wiederverwendete Passwörter",
|
||
"Fehlende Multi-Faktor-Authentifizierung",
|
||
"Übermäßige Berechtigungen / fehlendes Least-Privilege",
|
||
"Fehlende Awareness / Schulungen",
|
||
"Unverschlüsselte Datenträger oder Übertragungen",
|
||
"Kein Notfallkonzept / ungetesteter Wiederanlauf",
|
||
"Single Point of Failure (Technik oder Person)",
|
||
"Unzureichende Protokollierung / Überwachung",
|
||
"Veraltete oder nicht mehr unterstützte Software",
|
||
"Fehlende Vertrags-/AV-Regelungen mit Dienstleistern",
|
||
"Offene, ungenutzte Dienste und Ports",
|
||
"Unklare Verantwortlichkeiten",
|
||
];
|
||
|
||
async function main() {
|
||
// 0. Globale Kataloge Bedrohungen/Schwachstellen (Vorschläge, Freitext bleibt möglich)
|
||
for (const name of THREATS) {
|
||
await prisma.threat.upsert({ where: { name }, update: {}, create: { name } });
|
||
}
|
||
for (const name of VULNERABILITIES) {
|
||
await prisma.vulnerability.upsert({ where: { name }, update: {}, create: { name } });
|
||
}
|
||
console.log(`✔ Kataloge: ${THREATS.length} Bedrohungen, ${VULNERABILITIES.length} Schwachstellen`);
|
||
|
||
// 1. Global permission catalog
|
||
for (const key of PERMISSIONS) {
|
||
await prisma.permission.upsert({ where: { key }, update: {}, create: { key } });
|
||
}
|
||
console.log(`✔ ${PERMISSIONS.length} Permissions`);
|
||
|
||
// 2. Demo tenant
|
||
const tenant = await prisma.tenant.upsert({
|
||
where: { slug: "demo" },
|
||
update: {},
|
||
create: { name: "Demo GmbH", slug: "demo" },
|
||
});
|
||
|
||
// 3. Roles from blueprints, with permission bundles
|
||
for (const [key, def] of Object.entries(ROLE_DEFS)) {
|
||
const role = await prisma.role.upsert({
|
||
where: { tenantId_key: { tenantId: tenant.id, key } },
|
||
update: { name: def.name },
|
||
create: { tenantId: tenant.id, key, name: def.name },
|
||
});
|
||
const perms = await prisma.permission.findMany({
|
||
where: { key: { in: [...def.permissions] } },
|
||
});
|
||
for (const p of perms) {
|
||
await prisma.rolePermission.upsert({
|
||
where: { roleId_permissionId: { roleId: role.id, permissionId: p.id } },
|
||
update: {},
|
||
create: { roleId: role.id, permissionId: p.id },
|
||
});
|
||
}
|
||
}
|
||
console.log(`✔ Mandant "demo" mit ${Object.keys(ROLE_DEFS).length} Rollen`);
|
||
|
||
// 4. Demo users
|
||
const passwordHash = await hash(DEMO_PASSWORD);
|
||
const demoUsers: { email: string; name: string; roles: string[] }[] = [
|
||
{ email: "admin@demo.example", name: "Anna Admin", roles: ["tenant-admin", "isb"] },
|
||
{ email: "auditor@demo.example", name: "Axel Auditor", roles: ["auditor"] },
|
||
{ email: "owner@demo.example", name: "Oskar Owner", roles: ["owner"] },
|
||
{ email: "user@demo.example", name: "Ulla User", roles: ["user"] },
|
||
];
|
||
|
||
for (const u of demoUsers) {
|
||
const user = await prisma.user.upsert({
|
||
where: { tenantId_email: { tenantId: tenant.id, email: u.email } },
|
||
update: {},
|
||
create: {
|
||
tenantId: tenant.id,
|
||
email: u.email,
|
||
name: u.name,
|
||
passwordHash,
|
||
},
|
||
});
|
||
const roles = await prisma.role.findMany({
|
||
where: { tenantId: tenant.id, key: { in: u.roles } },
|
||
});
|
||
for (const r of roles) {
|
||
await prisma.userRole.upsert({
|
||
where: { userId_roleId: { userId: user.id, roleId: r.id } },
|
||
update: {},
|
||
create: { userId: user.id, roleId: r.id },
|
||
});
|
||
}
|
||
}
|
||
console.log(`✔ ${demoUsers.length} Demo-Nutzer (Passwort: ${DEMO_PASSWORD})`);
|
||
|
||
// 5. Beispiel-Assets, -Prozesse und BIA (nur wenn noch keine Assets existieren)
|
||
const assetCount = await prisma.asset.count({ where: { tenantId: tenant.id } });
|
||
if (assetCount === 0) {
|
||
const isb = await prisma.user.findUniqueOrThrow({
|
||
where: { tenantId_email: { tenantId: tenant.id, email: "admin@demo.example" } },
|
||
});
|
||
const owner = await prisma.user.findUniqueOrThrow({
|
||
where: { tenantId_email: { tenantId: tenant.id, email: "owner@demo.example" } },
|
||
});
|
||
|
||
const mk = (data: {
|
||
name: string;
|
||
type: "INFORMATION" | "SYSTEM" | "APPLICATION" | "LOCATION" | "SUPPLIER" | "PERSON" | "DATA";
|
||
c: number;
|
||
i: number;
|
||
a: number;
|
||
ownerId?: string;
|
||
location?: string;
|
||
tags?: string[];
|
||
description?: string;
|
||
}) =>
|
||
prisma.asset.create({
|
||
data: {
|
||
tenantId: tenant.id,
|
||
name: data.name,
|
||
type: data.type,
|
||
confidentiality: data.c,
|
||
integrity: data.i,
|
||
availability: data.a,
|
||
ownerId: data.ownerId,
|
||
location: data.location,
|
||
tags: data.tags ?? [],
|
||
description: data.description,
|
||
},
|
||
});
|
||
|
||
const erp = await mk({ name: "ERP-System", type: "SYSTEM", c: 3, i: 4, a: 3, ownerId: owner.id, location: "RZ Frankfurt", tags: ["kritisch", "kern"] });
|
||
const crm = await mk({ name: "Kundendatenbank", type: "DATA", c: 4, i: 3, a: 2, ownerId: isb.id, tags: ["dsgvo"] });
|
||
const auftraege = await mk({ name: "Auftragsdaten", type: "INFORMATION", c: 3, i: 4, a: 3, ownerId: owner.id });
|
||
const hoster = await mk({ name: "Cloud-Hoster (IaaS)", type: "SUPPLIER", c: 2, i: 3, a: 4, description: "Betreibt das Rechenzentrum für ERP und CRM." });
|
||
const buero = await mk({ name: "Bürostandort München", type: "LOCATION", c: 2, i: 2, a: 2 });
|
||
const itTeam = await mk({ name: "IT-Administration", type: "PERSON", c: 3, i: 3, a: 3 });
|
||
|
||
await prisma.assetRelation.createMany({
|
||
data: [
|
||
{ tenantId: tenant.id, assetId: erp.id, relatedAssetId: hoster.id, type: "depends_on" },
|
||
{ tenantId: tenant.id, assetId: crm.id, relatedAssetId: hoster.id, type: "depends_on" },
|
||
{ tenantId: tenant.id, assetId: erp.id, relatedAssetId: itTeam.id, type: "depends_on" },
|
||
],
|
||
});
|
||
|
||
const auftrag = await prisma.process.create({
|
||
data: {
|
||
tenantId: tenant.id,
|
||
name: "Auftragsabwicklung",
|
||
description: "Vom Kundenauftrag bis zur Auslieferung.",
|
||
category: "CORE",
|
||
ownerId: owner.id,
|
||
},
|
||
});
|
||
await prisma.processAsset.createMany({
|
||
data: [
|
||
{ tenantId: tenant.id, processId: auftrag.id, assetId: auftraege.id, role: "PRIMARY" },
|
||
{ tenantId: tenant.id, processId: auftrag.id, assetId: erp.id, role: "SECONDARY" },
|
||
{ tenantId: tenant.id, processId: auftrag.id, assetId: crm.id, role: "SECONDARY" },
|
||
{ tenantId: tenant.id, processId: auftrag.id, assetId: itTeam.id, role: "SECONDARY" },
|
||
],
|
||
});
|
||
await prisma.biaEntry.create({
|
||
data: {
|
||
tenantId: tenant.id,
|
||
processId: auftrag.id,
|
||
rtoHours: 8,
|
||
rpoHours: 4,
|
||
mtdHours: 24,
|
||
impactC: 2,
|
||
impactI: 4,
|
||
impactA: 3,
|
||
criticality: 4,
|
||
notes: "Ausfall > 1 Tag führt zu Lieferverzug und Vertragsstrafen.",
|
||
},
|
||
});
|
||
|
||
const vertrieb = await prisma.process.create({
|
||
data: {
|
||
tenantId: tenant.id,
|
||
name: "Kundenbetreuung",
|
||
description: "Anfragen, Angebote, Support.",
|
||
category: "SUPPORT",
|
||
ownerId: isb.id,
|
||
},
|
||
});
|
||
await prisma.processAsset.createMany({
|
||
data: [
|
||
{ tenantId: tenant.id, processId: vertrieb.id, assetId: crm.id, role: "PRIMARY" },
|
||
{ tenantId: tenant.id, processId: vertrieb.id, assetId: buero.id, role: "SECONDARY" },
|
||
],
|
||
});
|
||
await prisma.biaEntry.create({
|
||
data: {
|
||
tenantId: tenant.id,
|
||
processId: vertrieb.id,
|
||
rtoHours: 24,
|
||
rpoHours: 24,
|
||
mtdHours: 72,
|
||
impactC: 3,
|
||
impactI: 2,
|
||
impactA: 2,
|
||
criticality: 3,
|
||
notes: "Kundenkommunikation kann kurzfristig über Ausweichkanäle laufen.",
|
||
},
|
||
});
|
||
|
||
console.log("✔ Beispiel-Assets, -Prozesse und BIA angelegt");
|
||
}
|
||
|
||
// 6. Beispiel-Risiken (nur wenn noch keine existieren)
|
||
const riskCount = await prisma.risk.count({ where: { tenantId: tenant.id } });
|
||
if (riskCount === 0) {
|
||
const isb = await prisma.user.findUniqueOrThrow({
|
||
where: { tenantId_email: { tenantId: tenant.id, email: "admin@demo.example" } },
|
||
});
|
||
const byName = async (name: string) =>
|
||
prisma.asset.findFirstOrThrow({ where: { tenantId: tenant.id, name } });
|
||
const erp = await byName("ERP-System");
|
||
const crm = await byName("Kundendatenbank");
|
||
const hoster = await byName("Cloud-Hoster (IaaS)");
|
||
const auftrag = await prisma.process.findFirstOrThrow({
|
||
where: { tenantId: tenant.id, name: "Auftragsabwicklung" },
|
||
});
|
||
|
||
const risks: {
|
||
title: string;
|
||
threat: string;
|
||
vulnerability: string;
|
||
likelihood: number;
|
||
impact: number;
|
||
residual?: [number, number];
|
||
treatment: "AVOID" | "MITIGATE" | "TRANSFER" | "ACCEPT";
|
||
status: "OPEN" | "IN_TREATMENT" | "ACCEPTED" | "CLOSED";
|
||
assets: string[];
|
||
processId?: string;
|
||
description?: string;
|
||
}[] = [
|
||
{
|
||
title: "Ransomware auf ERP",
|
||
threat: "Schadsoftware / Verschlüsselungstrojaner",
|
||
vulnerability: "Fehlende Offline-Backups, Makro-Ausführung erlaubt",
|
||
likelihood: 4,
|
||
impact: 5,
|
||
residual: [2, 4],
|
||
treatment: "MITIGATE",
|
||
status: "IN_TREATMENT",
|
||
assets: [erp.id, crm.id],
|
||
processId: auftrag.id,
|
||
description: "Verschlüsselung der ERP-Datenbank würde die Auftragsabwicklung stoppen.",
|
||
},
|
||
{
|
||
title: "Ausfall Cloud-Hoster",
|
||
threat: "Ausfall des Rechenzentrums / Insolvenz Dienstleister",
|
||
vulnerability: "Kein Ausweich-Standort, Single Provider",
|
||
likelihood: 4,
|
||
impact: 4,
|
||
treatment: "TRANSFER",
|
||
status: "OPEN",
|
||
assets: [hoster.id, erp.id],
|
||
processId: auftrag.id,
|
||
},
|
||
{
|
||
title: "Phishing / Social Engineering",
|
||
threat: "Gezielte Phishing-Kampagnen",
|
||
vulnerability: "Fehlende Awareness-Schulungen",
|
||
likelihood: 3,
|
||
impact: 3,
|
||
residual: [2, 3],
|
||
treatment: "MITIGATE",
|
||
status: "IN_TREATMENT",
|
||
assets: [crm.id],
|
||
},
|
||
{
|
||
title: "Verlust mobiler Geräte",
|
||
threat: "Diebstahl/Verlust von Notebooks",
|
||
vulnerability: "Unvollständige Festplattenverschlüsselung",
|
||
likelihood: 2,
|
||
impact: 3,
|
||
treatment: "ACCEPT",
|
||
status: "ACCEPTED",
|
||
assets: [],
|
||
},
|
||
];
|
||
|
||
let refNo = 1;
|
||
for (const r of risks) {
|
||
const risk = await prisma.risk.create({
|
||
data: {
|
||
tenantId: tenant.id,
|
||
refNo: refNo++,
|
||
title: r.title,
|
||
description: r.description,
|
||
threat: r.threat,
|
||
vulnerability: r.vulnerability,
|
||
likelihood: r.likelihood,
|
||
impact: r.impact,
|
||
score: r.likelihood * r.impact,
|
||
residualLikelihood: r.residual?.[0],
|
||
residualImpact: r.residual?.[1],
|
||
residualScore: r.residual ? r.residual[0] * r.residual[1] : undefined,
|
||
treatment: r.treatment,
|
||
status: r.status,
|
||
ownerId: isb.id,
|
||
processId: r.processId,
|
||
},
|
||
});
|
||
for (const assetId of r.assets) {
|
||
await prisma.riskAsset.create({
|
||
data: { tenantId: tenant.id, riskId: risk.id, assetId },
|
||
});
|
||
}
|
||
}
|
||
console.log(`✔ ${risks.length} Beispiel-Risiken angelegt`);
|
||
}
|
||
|
||
// 7. Beispiel-Maßnahmen (nur wenn noch keine existieren) — bestimmen das Rest-Risiko
|
||
const measureCount = await prisma.measure.count({ where: { tenantId: tenant.id } });
|
||
if (measureCount === 0) {
|
||
const owner = await prisma.user.findUniqueOrThrow({
|
||
where: { tenantId_email: { tenantId: tenant.id, email: "owner@demo.example" } },
|
||
});
|
||
const riskByTitle = (title: string) =>
|
||
prisma.risk.findFirst({ where: { tenantId: tenant.id, title } });
|
||
|
||
const measures: {
|
||
title: string;
|
||
status: "OPEN" | "IN_PROGRESS" | "DONE";
|
||
priority: "LOW" | "MEDIUM" | "HIGH";
|
||
dueInDays?: number;
|
||
riskTitle?: string;
|
||
reduction?: [number, number]; // [Wahrscheinlichkeit, Schaden]
|
||
}[] = [
|
||
{
|
||
title: "Offline-Backups einführen (3-2-1-Regel)",
|
||
status: "IN_PROGRESS",
|
||
priority: "HIGH",
|
||
dueInDays: 14,
|
||
riskTitle: "Ransomware auf ERP",
|
||
reduction: [1, 1],
|
||
},
|
||
{
|
||
title: "Makro-Ausführung per GPO einschränken",
|
||
status: "OPEN",
|
||
priority: "HIGH",
|
||
dueInDays: 30,
|
||
riskTitle: "Ransomware auf ERP",
|
||
reduction: [1, 0],
|
||
},
|
||
{
|
||
title: "Awareness-Schulung Phishing (alle Mitarbeitenden)",
|
||
status: "IN_PROGRESS",
|
||
priority: "MEDIUM",
|
||
dueInDays: 45,
|
||
riskTitle: "Phishing / Social Engineering",
|
||
reduction: [1, 0],
|
||
},
|
||
{
|
||
title: "Notfallhandbuch aktualisieren",
|
||
status: "DONE",
|
||
priority: "MEDIUM",
|
||
},
|
||
];
|
||
|
||
let mRef = 1;
|
||
for (const m of measures) {
|
||
const measure = await prisma.measure.create({
|
||
data: {
|
||
tenantId: tenant.id,
|
||
refNo: mRef++,
|
||
title: m.title,
|
||
status: m.status,
|
||
priority: m.priority,
|
||
ownerId: owner.id,
|
||
dueDate: m.dueInDays
|
||
? new Date(Date.now() + m.dueInDays * 24 * 3600 * 1000)
|
||
: undefined,
|
||
},
|
||
});
|
||
if (m.riskTitle && m.reduction) {
|
||
const risk = await riskByTitle(m.riskTitle);
|
||
if (risk) {
|
||
await prisma.riskMeasure.create({
|
||
data: {
|
||
tenantId: tenant.id,
|
||
riskId: risk.id,
|
||
measureId: measure.id,
|
||
reductionLikelihood: m.reduction[0],
|
||
reductionImpact: m.reduction[1],
|
||
},
|
||
});
|
||
}
|
||
}
|
||
}
|
||
|
||
// Rest-Risiken aus den Maßnahmen ableiten (manuelle Alt-Werte ersetzen)
|
||
const allRisks = await prisma.risk.findMany({
|
||
where: { tenantId: tenant.id },
|
||
include: { riskMeasures: true },
|
||
});
|
||
for (const r of allRisks) {
|
||
if (r.riskMeasures.length === 0) {
|
||
await prisma.risk.update({
|
||
where: { id: r.id },
|
||
data: { residualLikelihood: null, residualImpact: null, residualScore: null },
|
||
});
|
||
} else {
|
||
const redL = r.riskMeasures.reduce((s, x) => s + x.reductionLikelihood, 0);
|
||
const redI = r.riskMeasures.reduce((s, x) => s + x.reductionImpact, 0);
|
||
const rl = Math.max(1, r.likelihood - redL);
|
||
const ri = Math.max(1, r.impact - redI);
|
||
await prisma.risk.update({
|
||
where: { id: r.id },
|
||
data: { residualLikelihood: rl, residualImpact: ri, residualScore: rl * ri },
|
||
});
|
||
}
|
||
}
|
||
console.log(`✔ ${measures.length} Beispiel-Maßnahmen angelegt, Rest-Risiken berechnet`);
|
||
}
|
||
|
||
// 8. VDA-ISA 2027 Kapitel 6 — Supplier Relationships (globaler Katalog)
|
||
const controls = [
|
||
{
|
||
ref: "6.1.1",
|
||
title:
|
||
"To what extent is information security ensured among contractors and cooperation partners?",
|
||
objective:
|
||
"Ein angemessenes Informationssicherheitsniveau wird auch bei der Zusammenarbeit mit Partnern und Auftragnehmern aufrechterhalten.",
|
||
mustReq:
|
||
"Auftragnehmer/Partner werden einer Sicherheitsrisikobewertung unterzogen; angemessenes Niveau vertraglich sichergestellt; Kundenanforderungen ggf. weitergegeben.",
|
||
shouldReq:
|
||
"Vertragliche Verpflichtung zur Weitergabe an Subunternehmer; Prüfung von Service-Reports/Dokumenten.",
|
||
highReq:
|
||
"Nachweis eines angemessenen Sicherheitsniveaus (geprüfter Fragebogen/Self-Assessment, Attest, Zertifikat, Lieferantenaudit) (C,I,A); Compliance dokumentiert, regelmäßig & anlassbezogen überwacht.",
|
||
veryHighReq:
|
||
"Nachweis durch Third-Party-Audit (adäquates TISAX-Label o. Ä.) oder Lieferantenaudit; ohne Audit: risikobasierte Managemententscheidung mit Protokoll (C,I,A); Transparenzpflichten gegenüber Kunden erfüllt.",
|
||
targetMaturity: 3,
|
||
simplifiedGroupAssessment: true,
|
||
references:
|
||
"ISO 27001:2022 A.5.19–A.5.22 · NIST CSF 2.0 GV.SC-02..06 · BSI OPS.2.1/OPS.2.2/OPS.3.1/ORP.2 · NIST SP800-53r5 MA-4, CA-3, CA-6, PM-16, PM-30, SR-2, SR-3, SR-6, SR-7, SR-8",
|
||
},
|
||
{
|
||
ref: "6.1.2",
|
||
title:
|
||
"To what extent is non-disclosure regarding the exchange of information contractually agreed?",
|
||
objective:
|
||
"Geheimhaltungsvereinbarungen schützen den Informationsaustausch über Organisationsgrenzen hinweg rechtlich.",
|
||
mustReq:
|
||
"Geheimhaltungsanforderungen bestimmt und erfüllt; allen Beteiligten bekannt; gültige NDAs vor Weitergabe sensibler Infos; regelmäßige Überprüfung.",
|
||
shouldReq:
|
||
"Geprüfte NDA-Vorlagen; NDAs mit Parteien, Informationsart, Gegenstand, Gültigkeit, Pflichten; Nachweis-/Auditrechte; Prozess zur Fristenüberwachung und rechtzeitigen Verlängerung.",
|
||
highReq: null,
|
||
veryHighReq: null,
|
||
targetMaturity: 3,
|
||
simplifiedGroupAssessment: true,
|
||
references: "ISO 27001:2022 A.5.14, A.6.6 · BSI OPS.2.1/OPS.2.2/OPS.3.1/ORP.5/CON.2",
|
||
},
|
||
{
|
||
ref: "6.1.3",
|
||
title:
|
||
"To what extent are the responsibilities between external IT service providers and the own organization defined?",
|
||
objective:
|
||
"Gemeinsames Verständnis der Verantwortungsteilung; alle Sicherheitsanforderungen umgesetzt und nachweislich dokumentiert.",
|
||
mustReq:
|
||
"Betroffene IT-Services identifiziert; Anforderungen bestimmt; verantwortliche Organisation je Anforderung definiert; Mechanismen für geteilte Verantwortung umgesetzt.",
|
||
shouldReq:
|
||
"Konfiguration konzeptioniert/umgesetzt/dokumentiert; zuständiges Personal geschult.",
|
||
highReq:
|
||
"Liste der IT-Services und Provider (C,I,A); ISA-Control-Anwendbarkeit bewertet; regelmäßige Security-Assessments; Nachweis der Pflichterfüllung; Integration in lokale Schutzmaßnahmen dokumentiert.",
|
||
veryHighReq: null,
|
||
targetMaturity: 3,
|
||
simplifiedGroupAssessment: false,
|
||
references:
|
||
"ISO 27001:2022 A.5.23, A.8.9 · ISO 27017 CLD.6.3.1 · IEC 62443-2-1 6.2.3 · NIST CSF 2.0 GV.OC-05, GV.SC-01/02 · BSI 200-2, OPS.2.1/OPS.2.2/OPS.3.1/ORP.2 · NIST SP800-53r5 MA-4, PT-1, PL-2",
|
||
},
|
||
];
|
||
for (const c of controls) {
|
||
await prisma.supplierControl.upsert({ where: { ref: c.ref }, update: c, create: c });
|
||
}
|
||
console.log(`✔ VDA-ISA 2027 Kap. 6: ${controls.length} Supplier-Controls`);
|
||
|
||
// 9. Demo-Lieferant mit Nachweisen/Verträgen (nur wenn noch keiner existiert)
|
||
const supplierCount = await prisma.supplier.count({ where: { tenantId: tenant.id } });
|
||
if (supplierCount === 0) {
|
||
const hoster = await prisma.asset.findFirst({
|
||
where: { tenantId: tenant.id, name: "Cloud-Hoster (IaaS)" },
|
||
});
|
||
const sup = await prisma.supplier.create({
|
||
data: {
|
||
tenantId: tenant.id,
|
||
refNo: 1,
|
||
name: "Cloud-Hoster GmbH",
|
||
sector: "IT-Dienstleistung / IaaS",
|
||
services: "Rechenzentrum, Virtualisierung, Backup für ERP & CRM",
|
||
criticality: 4,
|
||
dataCategories: ["Kundendaten", "Auftragsdaten"],
|
||
confidentiality: 3,
|
||
integrity: 3,
|
||
availability: 4,
|
||
nis2Relevant: true,
|
||
status: "ACTIVE",
|
||
contact: "security@cloud-hoster.example",
|
||
nextReview: new Date(Date.now() + 90 * 24 * 3600 * 1000),
|
||
},
|
||
});
|
||
if (hoster) {
|
||
await prisma.supplierAsset.create({
|
||
data: { tenantId: tenant.id, supplierId: sup.id, assetId: hoster.id },
|
||
});
|
||
}
|
||
await prisma.supplierEvidence.create({
|
||
data: {
|
||
tenantId: tenant.id,
|
||
supplierId: sup.id,
|
||
kind: "TISAX_LABEL",
|
||
name: "TISAX AL3 (info high)",
|
||
protectsCia: "C,I,A",
|
||
validTo: new Date(Date.now() + 200 * 24 * 3600 * 1000),
|
||
adequacyChecked: true,
|
||
},
|
||
});
|
||
await prisma.contract.create({
|
||
data: {
|
||
tenantId: tenant.id,
|
||
supplierId: sup.id,
|
||
type: "av_dpa",
|
||
avDpa: true,
|
||
securityClauses: true,
|
||
flowdown: true,
|
||
customerTransparency: false,
|
||
validFrom: new Date(Date.now() - 300 * 24 * 3600 * 1000),
|
||
validTo: new Date(Date.now() + 400 * 24 * 3600 * 1000),
|
||
reference: "AV-2025-014",
|
||
},
|
||
});
|
||
await prisma.nda.create({
|
||
data: {
|
||
tenantId: tenant.id,
|
||
supplierId: sup.id,
|
||
parties: "Demo GmbH ↔ Cloud-Hoster GmbH",
|
||
infoScope: "Betriebs- und Kundendaten",
|
||
subject: "Betrieb der ERP-/CRM-Infrastruktur",
|
||
validFrom: new Date(Date.now() - 300 * 24 * 3600 * 1000),
|
||
validTo: new Date(Date.now() + 60 * 24 * 3600 * 1000),
|
||
extensionStatus: "offen",
|
||
},
|
||
});
|
||
await prisma.supplierAssessment.create({
|
||
data: {
|
||
tenantId: tenant.id,
|
||
supplierId: sup.id,
|
||
type: "SELF_ASSESSMENT",
|
||
status: "EVALUATED",
|
||
score: 82,
|
||
date: new Date(Date.now() - 120 * 24 * 3600 * 1000),
|
||
nextReview: new Date(Date.now() + 245 * 24 * 3600 * 1000),
|
||
result: "angemessen",
|
||
},
|
||
});
|
||
await prisma.serviceResponsibility.create({
|
||
data: {
|
||
tenantId: tenant.id,
|
||
supplierId: sup.id,
|
||
itService: "IaaS-Plattform",
|
||
requirement: "Patch-Management der Hypervisor-Ebene",
|
||
responsibleParty: "SUPPLIER",
|
||
isaApplicability: "5.x IT/Cyber Security",
|
||
integratedLocalControls: "Sichere Authentisierung, Monitoring beim Kunden",
|
||
},
|
||
});
|
||
const dbControls = await prisma.supplierControl.findMany();
|
||
for (const c of dbControls) {
|
||
await prisma.supplierControlMaturity.create({
|
||
data: {
|
||
tenantId: tenant.id,
|
||
supplierId: sup.id,
|
||
controlId: c.id,
|
||
maturity: c.ref === "6.1.2" ? 2 : 3,
|
||
},
|
||
});
|
||
}
|
||
console.log("✔ Demo-Lieferant mit Nachweisen/Vertrag/NDA/Assessment angelegt");
|
||
}
|
||
}
|
||
|
||
main()
|
||
.then(() => prisma.$disconnect())
|
||
.catch(async (e) => {
|
||
console.error(e);
|
||
await prisma.$disconnect();
|
||
process.exit(1);
|
||
});
|