Referenz: docs/ISMS-Lieferantenmanagement-GEFIM.html Architektur: Lieferanten (und IT-Services) sind jetzt Assets. - AssetType += IT_SERVICE; SupplierProfile/ITServiceProfile als 1:1- Erweiterung eines Asset; alle Kind-Entitäten (Contract, Nda, SupplierEvidence, SupplierAssessment, ManagementDecision, Subcontractor, ServiceControlResponsibility, MaturityAssessment) hängen am Asset (keine parallele Datenhaltung). Migration + RLS; Demo neu geseedet. - Lieferanten erscheinen im Asset-Inventar (Filter „Lieferant"/„IT-Service"), tragen C/I/A, nutzbar in Graph/BIA/Risiko. Anforderungs-Engine (Herzstück, src/lib/supplier.ts): - Schutzbedarf aus max C/I/A der verknüpften Assets → Stufe normal/hoch/ sehr hoch; schaltet Anforderungen gestuft scharf (must/should/high/veryhigh) - Flache Anforderungsliste (nach Themen gruppiert) mit Status-Ableitung aus den hinterlegten Objekten, Referenz + Herkunfts-Control (6.1.1–6.1.3) - Gate-Logik: sehr hoch ohne Audit/Label → Kompensation (Management- entscheidung UND verknüpftes Risiko); „Risiko anlegen" erzeugt echten Risk - Konformität (Konform/Teilweise/Lücken/Handlung nötig) + berechneter Reifegrad; ISB-Freigabe (Abweichung nur mit Begründung → Audit-Log) - Cockpit-Detail mit Schutzbedarf-Banner + Live-Simulation der Stufe Verifiziert: Register mit abgeleiteter Stufe/Reifegrad/Konformität, Cockpit-Simulation (Tiers werden inaktiv), Gate bei sehr hoch ohne Audit, „Risiko anlegen" erzeugt R-005 im Risikomodul. Offen (Phase 2): Fragebogen-Builder, Self-Service-Portal, IT-Service- Detail mit RACI-Matrix, Klick im Asset-Inventar öffnet Cockpit, Scheduler-Automatisierung. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
240 lines
8.3 KiB
SQL
240 lines
8.3 KiB
SQL
-- CreateEnum
|
|
CREATE TYPE "SupplierLifecycle" AS ENUM ('ACTIVE', 'ONBOARDING', 'UNDER_REVIEW', 'OFFBOARDED');
|
|
|
|
-- CreateEnum
|
|
CREATE TYPE "RaciResponsibility" AS ENUM ('PROVIDER', 'US', 'SHARED');
|
|
|
|
-- AlterEnum
|
|
ALTER TYPE "AssetType" ADD VALUE 'IT_SERVICE';
|
|
|
|
-- DropForeignKey
|
|
ALTER TABLE "contracts" DROP CONSTRAINT "contracts_supplier_id_fkey";
|
|
|
|
-- DropForeignKey
|
|
ALTER TABLE "management_decisions" DROP CONSTRAINT "management_decisions_supplier_id_fkey";
|
|
|
|
-- DropForeignKey
|
|
ALTER TABLE "ndas" DROP CONSTRAINT "ndas_supplier_id_fkey";
|
|
|
|
-- DropForeignKey
|
|
ALTER TABLE "service_responsibilities" DROP CONSTRAINT "service_responsibilities_supplier_id_fkey";
|
|
|
|
-- DropForeignKey
|
|
ALTER TABLE "subcontractors" DROP CONSTRAINT "subcontractors_supplier_id_fkey";
|
|
|
|
-- DropForeignKey
|
|
ALTER TABLE "supplier_assessments" DROP CONSTRAINT "supplier_assessments_supplier_id_fkey";
|
|
|
|
-- DropForeignKey
|
|
ALTER TABLE "supplier_assets" DROP CONSTRAINT "supplier_assets_asset_id_fkey";
|
|
|
|
-- DropForeignKey
|
|
ALTER TABLE "supplier_assets" DROP CONSTRAINT "supplier_assets_supplier_id_fkey";
|
|
|
|
-- DropForeignKey
|
|
ALTER TABLE "supplier_control_maturity" DROP CONSTRAINT "supplier_control_maturity_control_id_fkey";
|
|
|
|
-- DropForeignKey
|
|
ALTER TABLE "supplier_control_maturity" DROP CONSTRAINT "supplier_control_maturity_supplier_id_fkey";
|
|
|
|
-- DropForeignKey
|
|
ALTER TABLE "supplier_evidence" DROP CONSTRAINT "supplier_evidence_supplier_id_fkey";
|
|
|
|
-- AlterTable
|
|
ALTER TABLE "contracts" DROP COLUMN "customer_transparency",
|
|
DROP COLUMN "supplier_id",
|
|
ADD COLUMN "asset_id" TEXT NOT NULL,
|
|
ADD COLUMN "customer_requirements_passed" BOOLEAN NOT NULL DEFAULT false;
|
|
|
|
-- AlterTable
|
|
ALTER TABLE "management_decisions" DROP COLUMN "supplier_id",
|
|
ADD COLUMN "asset_id" TEXT NOT NULL;
|
|
|
|
-- AlterTable
|
|
ALTER TABLE "ndas" DROP COLUMN "supplier_id",
|
|
ADD COLUMN "asset_id" TEXT NOT NULL,
|
|
ADD COLUMN "beyond_term" BOOLEAN NOT NULL DEFAULT false;
|
|
|
|
-- AlterTable
|
|
ALTER TABLE "subcontractors" DROP COLUMN "supplier_id",
|
|
ADD COLUMN "asset_id" TEXT NOT NULL;
|
|
|
|
-- AlterTable
|
|
ALTER TABLE "supplier_assessments" DROP COLUMN "status",
|
|
DROP COLUMN "supplier_id",
|
|
ADD COLUMN "asset_id" TEXT NOT NULL,
|
|
ADD COLUMN "self_score" INTEGER,
|
|
ADD COLUMN "verified_score" INTEGER;
|
|
|
|
-- AlterTable
|
|
ALTER TABLE "supplier_evidence" DROP COLUMN "supplier_id",
|
|
ADD COLUMN "asset_id" TEXT NOT NULL;
|
|
|
|
-- DropTable
|
|
DROP TABLE "service_responsibilities";
|
|
|
|
-- DropTable
|
|
DROP TABLE "supplier_assets";
|
|
|
|
-- DropTable
|
|
DROP TABLE "supplier_control_maturity";
|
|
|
|
-- DropTable
|
|
DROP TABLE "supplier_controls";
|
|
|
|
-- DropTable
|
|
DROP TABLE "suppliers";
|
|
|
|
-- DropEnum
|
|
DROP TYPE "AssessmentStatus";
|
|
|
|
-- DropEnum
|
|
DROP TYPE "ResponsibleParty";
|
|
|
|
-- DropEnum
|
|
DROP TYPE "SupplierStatus";
|
|
|
|
-- CreateTable
|
|
CREATE TABLE "supplier_profiles" (
|
|
"id" TEXT NOT NULL,
|
|
"tenant_id" TEXT NOT NULL,
|
|
"asset_id" TEXT NOT NULL,
|
|
"ref_no" INTEGER NOT NULL,
|
|
"sector" TEXT,
|
|
"service_desc" TEXT,
|
|
"criticality" INTEGER NOT NULL DEFAULT 1,
|
|
"data_categories" TEXT[] DEFAULT ARRAY[]::TEXT[],
|
|
"nis2_relevant" BOOLEAN NOT NULL DEFAULT false,
|
|
"lifecycle" "SupplierLifecycle" NOT NULL DEFAULT 'ACTIVE',
|
|
"contact" TEXT,
|
|
"tisax_label" TEXT,
|
|
"tisax_valid_to" TIMESTAMP(3),
|
|
"next_review" TIMESTAMP(3),
|
|
"notes" TEXT,
|
|
"created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
"updated_at" TIMESTAMP(3) NOT NULL,
|
|
"created_by" TEXT,
|
|
|
|
CONSTRAINT "supplier_profiles_pkey" PRIMARY KEY ("id")
|
|
);
|
|
|
|
-- CreateTable
|
|
CREATE TABLE "it_service_profiles" (
|
|
"id" TEXT NOT NULL,
|
|
"tenant_id" TEXT NOT NULL,
|
|
"asset_id" TEXT NOT NULL,
|
|
"ref_no" INTEGER NOT NULL,
|
|
"provider_asset_id" TEXT,
|
|
"criticality" INTEGER NOT NULL DEFAULT 1,
|
|
"internal" BOOLEAN NOT NULL DEFAULT false,
|
|
"notes" TEXT,
|
|
"created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
"updated_at" TIMESTAMP(3) NOT NULL,
|
|
"created_by" TEXT,
|
|
|
|
CONSTRAINT "it_service_profiles_pkey" PRIMARY KEY ("id")
|
|
);
|
|
|
|
-- CreateTable
|
|
CREATE TABLE "service_control_responsibilities" (
|
|
"id" TEXT NOT NULL,
|
|
"tenant_id" TEXT NOT NULL,
|
|
"asset_id" TEXT NOT NULL,
|
|
"control_ref" TEXT NOT NULL,
|
|
"title" TEXT,
|
|
"applicable" BOOLEAN NOT NULL DEFAULT true,
|
|
"responsibility" "RaciResponsibility" NOT NULL DEFAULT 'SHARED',
|
|
"evidence_ref" TEXT,
|
|
"created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
|
|
CONSTRAINT "service_control_responsibilities_pkey" PRIMARY KEY ("id")
|
|
);
|
|
|
|
-- CreateTable
|
|
CREATE TABLE "maturity_assessments" (
|
|
"id" TEXT NOT NULL,
|
|
"tenant_id" TEXT NOT NULL,
|
|
"asset_id" TEXT NOT NULL,
|
|
"self_value" DOUBLE PRECISION,
|
|
"verified_value" DOUBLE PRECISION,
|
|
"computed_value" DOUBLE PRECISION,
|
|
"isb_value" DOUBLE PRECISION,
|
|
"isb_justification" TEXT,
|
|
"approved_by" TEXT,
|
|
"approved_at" TIMESTAMP(3),
|
|
"updated_at" TIMESTAMP(3) NOT NULL,
|
|
|
|
CONSTRAINT "maturity_assessments_pkey" PRIMARY KEY ("id")
|
|
);
|
|
|
|
-- CreateIndex
|
|
CREATE UNIQUE INDEX "supplier_profiles_asset_id_key" ON "supplier_profiles"("asset_id");
|
|
|
|
-- CreateIndex
|
|
CREATE INDEX "supplier_profiles_tenant_id_idx" ON "supplier_profiles"("tenant_id");
|
|
|
|
-- CreateIndex
|
|
CREATE UNIQUE INDEX "supplier_profiles_tenant_id_ref_no_key" ON "supplier_profiles"("tenant_id", "ref_no");
|
|
|
|
-- CreateIndex
|
|
CREATE UNIQUE INDEX "it_service_profiles_asset_id_key" ON "it_service_profiles"("asset_id");
|
|
|
|
-- CreateIndex
|
|
CREATE INDEX "it_service_profiles_tenant_id_idx" ON "it_service_profiles"("tenant_id");
|
|
|
|
-- CreateIndex
|
|
CREATE UNIQUE INDEX "it_service_profiles_tenant_id_ref_no_key" ON "it_service_profiles"("tenant_id", "ref_no");
|
|
|
|
-- CreateIndex
|
|
CREATE INDEX "service_control_responsibilities_tenant_id_idx" ON "service_control_responsibilities"("tenant_id");
|
|
|
|
-- CreateIndex
|
|
CREATE UNIQUE INDEX "maturity_assessments_asset_id_key" ON "maturity_assessments"("asset_id");
|
|
|
|
-- CreateIndex
|
|
CREATE INDEX "maturity_assessments_tenant_id_idx" ON "maturity_assessments"("tenant_id");
|
|
|
|
-- AddForeignKey
|
|
ALTER TABLE "supplier_profiles" ADD CONSTRAINT "supplier_profiles_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
|
|
|
-- AddForeignKey
|
|
ALTER TABLE "it_service_profiles" ADD CONSTRAINT "it_service_profiles_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
|
|
|
-- AddForeignKey
|
|
ALTER TABLE "it_service_profiles" ADD CONSTRAINT "it_service_profiles_provider_asset_id_fkey" FOREIGN KEY ("provider_asset_id") REFERENCES "assets"("id") ON DELETE SET NULL ON UPDATE CASCADE;
|
|
|
|
-- AddForeignKey
|
|
ALTER TABLE "supplier_assessments" ADD CONSTRAINT "supplier_assessments_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
|
|
|
-- AddForeignKey
|
|
ALTER TABLE "supplier_evidence" ADD CONSTRAINT "supplier_evidence_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
|
|
|
-- AddForeignKey
|
|
ALTER TABLE "management_decisions" ADD CONSTRAINT "management_decisions_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
|
|
|
-- AddForeignKey
|
|
ALTER TABLE "contracts" ADD CONSTRAINT "contracts_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
|
|
|
-- AddForeignKey
|
|
ALTER TABLE "ndas" ADD CONSTRAINT "ndas_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
|
|
|
-- AddForeignKey
|
|
ALTER TABLE "subcontractors" ADD CONSTRAINT "subcontractors_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
|
|
|
-- AddForeignKey
|
|
ALTER TABLE "service_control_responsibilities" ADD CONSTRAINT "service_control_responsibilities_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
|
|
|
-- AddForeignKey
|
|
ALTER TABLE "maturity_assessments" ADD CONSTRAINT "maturity_assessments_asset_id_fkey" FOREIGN KEY ("asset_id") REFERENCES "assets"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
|
|
|
|
|
-- RLS für neue/umgestellte Lieferanten-Tabellen
|
|
DO $$
|
|
DECLARE t text;
|
|
BEGIN
|
|
FOREACH t IN ARRAY ARRAY['supplier_profiles','it_service_profiles','maturity_assessments','service_control_responsibilities'] LOOP
|
|
EXECUTE format('ALTER TABLE %I ENABLE ROW LEVEL SECURITY', t);
|
|
EXECUTE format('CREATE POLICY tenant_isolation ON %I USING (tenant_id = current_setting(''app.tenant_id'', true))', t);
|
|
END LOOP;
|
|
END $$;
|