Basis: Certvia dev@a48c5fb als Fundament für Craftvia
Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -0,0 +1,256 @@
|
||||
// Import des Standard-Prozess-Katalogs (M2 Strukturanalyse, Ebene 2) in das globale
|
||||
// Modell ProcessCatalogEntry. GLOBALER Content (kein tenantId), analog RiskCatalogEntry.
|
||||
// Idempotent (Upsert je `code`). Kuratierte Kern-/Management-/Unterstützungsprozesse
|
||||
// mit Vorschlägen für Träger-Asset-Typen, Standard-Risiken (→ RiskCatalogEntry.code)
|
||||
// und Info-Labels — angeboten im prozessgeführten Wizard-Schritt.
|
||||
|
||||
import type { AssetType, InfoLabel, PrismaClient, ProcessCategory } from "@prisma/client";
|
||||
|
||||
interface CatalogSeed {
|
||||
code: string;
|
||||
name: string;
|
||||
category: ProcessCategory;
|
||||
/** Katalog-Prozess-Tiefe: Code des übergeordneten Katalog-Prozesses (Teilprozess). */
|
||||
parentCode?: string;
|
||||
suggestedAssetTypes: AssetType[];
|
||||
suggestedRiskCodes: string[];
|
||||
suggestedInfoLabels: InfoLabel[];
|
||||
}
|
||||
|
||||
// „Neben"-Prozesse → SUPPORT (Vorgabe). Codes: P-<KAT><nr>, KAT = CORE|MGMT|SUP.
|
||||
const CATALOG: CatalogSeed[] = [
|
||||
// ── Kernprozesse ──────────────────────────────────────────────────────────
|
||||
{
|
||||
code: "P-CORE-01",
|
||||
name: "Auftragsabwicklung",
|
||||
category: "CORE",
|
||||
suggestedAssetTypes: ["INFORMATION", "DATA", "APPLICATION", "SYSTEM", "PERSON"],
|
||||
suggestedRiskCodes: ["R-OPS-01", "R-ORG-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-CORE-02",
|
||||
name: "Produktentwicklung / Engineering",
|
||||
category: "CORE",
|
||||
suggestedAssetTypes: ["INFORMATION", "DATA", "APPLICATION", "PERSON", "SUPPLIER"],
|
||||
suggestedRiskCodes: ["R-DEV-01", "R-PROTO-01"],
|
||||
suggestedInfoLabels: ["INFO_VERY_HIGH", "PROTOTYPE"],
|
||||
},
|
||||
{
|
||||
code: "P-CORE-03",
|
||||
name: "Produktion / Leistungserbringung",
|
||||
category: "CORE",
|
||||
suggestedAssetTypes: ["SYSTEM", "APPLICATION", "LOCATION", "PERSON"],
|
||||
suggestedRiskCodes: ["R-OPS-01", "R-PHY-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-CORE-04",
|
||||
name: "Vertrieb & Kundenbetreuung",
|
||||
category: "CORE",
|
||||
suggestedAssetTypes: ["INFORMATION", "DATA", "APPLICATION", "PERSON"],
|
||||
suggestedRiskCodes: ["R-DSGVO-01", "R-HR-01"],
|
||||
suggestedInfoLabels: ["PERSONAL_DATA"],
|
||||
},
|
||||
// ── Managementprozesse ──────────────────────────────────────────────────────
|
||||
{
|
||||
code: "P-MGMT-01",
|
||||
name: "Unternehmensführung & Strategie",
|
||||
category: "MANAGEMENT",
|
||||
suggestedAssetTypes: ["INFORMATION", "PERSON"],
|
||||
suggestedRiskCodes: ["R-ORG-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-MGMT-02",
|
||||
name: "Informationssicherheits-Management (ISMS)",
|
||||
category: "MANAGEMENT",
|
||||
suggestedAssetTypes: ["INFORMATION", "APPLICATION", "PERSON"],
|
||||
suggestedRiskCodes: ["R-ORG-01", "R-OPS-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-MGMT-03",
|
||||
name: "Risiko- & Compliance-Management",
|
||||
category: "MANAGEMENT",
|
||||
suggestedAssetTypes: ["INFORMATION", "PERSON"],
|
||||
suggestedRiskCodes: ["R-ORG-01", "R-DSGVO-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH", "PERSONAL_DATA"],
|
||||
},
|
||||
// ── Unterstützende Prozesse (inkl. „Neben"-Prozesse → SUPPORT) ────────────────
|
||||
{
|
||||
code: "P-SUP-01",
|
||||
name: "IT-Betrieb & Infrastruktur",
|
||||
category: "SUPPORT",
|
||||
suggestedAssetTypes: ["SYSTEM", "APPLICATION", "IT_SERVICE", "SOFTWARE", "SUPPLIER", "LOCATION"],
|
||||
suggestedRiskCodes: ["R-OPS-01", "R-NET-01", "R-IAM-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
// Teilprozesse von P-SUP-01 „IT-Betrieb & Infrastruktur" (parentCode).
|
||||
{
|
||||
code: "P-SUP-01-01",
|
||||
name: "Datensicherung & Wiederherstellung",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["SYSTEM", "IT_SERVICE", "DATA", "SOFTWARE"],
|
||||
suggestedRiskCodes: ["R-OPS-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-01-02",
|
||||
name: "Server-/Virtualisierungsbetrieb",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["SYSTEM", "APPLICATION", "IT_SERVICE"],
|
||||
suggestedRiskCodes: ["R-OPS-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-01-03",
|
||||
name: "Netzwerk-/Firewallbetrieb",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["SYSTEM", "IT_SERVICE"],
|
||||
suggestedRiskCodes: ["R-NET-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-01-04",
|
||||
name: "Patch-/Schwachstellenmanagement",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["SYSTEM", "APPLICATION", "SOFTWARE"],
|
||||
suggestedRiskCodes: ["R-OPS-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-01-05",
|
||||
name: "Monitoring & Alerting",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["SYSTEM", "IT_SERVICE", "APPLICATION"],
|
||||
suggestedRiskCodes: ["R-OPS-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-01-06",
|
||||
name: "Identity-/Access-Betrieb (IAM)",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["APPLICATION", "IT_SERVICE", "PERSON"],
|
||||
suggestedRiskCodes: ["R-IAM-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-01-07",
|
||||
name: "Endpoint-Management",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["SYSTEM", "SOFTWARE", "IT_SERVICE"],
|
||||
suggestedRiskCodes: ["R-OPS-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-01-08",
|
||||
name: "RZ-/Cloud-Betrieb",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-01",
|
||||
suggestedAssetTypes: ["LOCATION", "IT_SERVICE", "SUPPLIER", "SYSTEM"],
|
||||
suggestedRiskCodes: ["R-OPS-01", "R-PHY-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-02",
|
||||
name: "Personalwesen (HR)",
|
||||
category: "SUPPORT",
|
||||
suggestedAssetTypes: ["INFORMATION", "DATA", "PERSON", "APPLICATION"],
|
||||
suggestedRiskCodes: ["R-HR-01", "R-DSGVO-01"],
|
||||
suggestedInfoLabels: ["PERSONAL_DATA", "INFO_HIGH"],
|
||||
},
|
||||
// Teilprozesse von P-SUP-02 „Personalwesen (HR)" (parentCode).
|
||||
{
|
||||
code: "P-SUP-02-01",
|
||||
name: "Recruiting & Onboarding",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-02",
|
||||
suggestedAssetTypes: ["INFORMATION", "DATA", "PERSON", "APPLICATION"],
|
||||
suggestedRiskCodes: ["R-HR-01", "R-DSGVO-01"],
|
||||
suggestedInfoLabels: ["PERSONAL_DATA"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-02-02",
|
||||
name: "Offboarding",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-02",
|
||||
suggestedAssetTypes: ["INFORMATION", "PERSON", "APPLICATION"],
|
||||
suggestedRiskCodes: ["R-HR-01", "R-IAM-01"],
|
||||
suggestedInfoLabels: ["PERSONAL_DATA"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-02-03",
|
||||
name: "Awareness & Schulung",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-02",
|
||||
suggestedAssetTypes: ["INFORMATION", "PERSON"],
|
||||
suggestedRiskCodes: ["R-HR-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-03",
|
||||
name: "Einkauf & Lieferantensteuerung",
|
||||
category: "SUPPORT",
|
||||
suggestedAssetTypes: ["INFORMATION", "SUPPLIER", "IT_SERVICE"],
|
||||
suggestedRiskCodes: ["R-SUP-01", "R-ORG-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-04",
|
||||
name: "Finanzen & Buchhaltung",
|
||||
category: "SUPPORT",
|
||||
suggestedAssetTypes: ["INFORMATION", "DATA", "APPLICATION", "PERSON"],
|
||||
suggestedRiskCodes: ["R-DSGVO-01", "R-ORG-01"],
|
||||
suggestedInfoLabels: ["INFO_HIGH", "PERSONAL_DATA"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-05",
|
||||
name: "Facility Management & physische Sicherheit",
|
||||
category: "SUPPORT",
|
||||
suggestedAssetTypes: ["LOCATION", "SYSTEM", "PERSON"],
|
||||
suggestedRiskCodes: ["R-PHY-01"],
|
||||
suggestedInfoLabels: ["NONE"],
|
||||
},
|
||||
// Teilprozesse von P-SUP-05 „Facility Management & physische Sicherheit" (parentCode).
|
||||
{
|
||||
code: "P-SUP-05-01",
|
||||
name: "Zutritts-/Zonenkontrolle",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-05",
|
||||
suggestedAssetTypes: ["LOCATION", "SYSTEM", "PERSON"],
|
||||
suggestedRiskCodes: ["R-PHY-01"],
|
||||
suggestedInfoLabels: ["NONE"],
|
||||
},
|
||||
{
|
||||
code: "P-SUP-05-02",
|
||||
name: "Gebäude-/Versorgungstechnik",
|
||||
category: "SUPPORT",
|
||||
parentCode: "P-SUP-05",
|
||||
suggestedAssetTypes: ["LOCATION", "SYSTEM"],
|
||||
suggestedRiskCodes: ["R-PHY-01"],
|
||||
suggestedInfoLabels: ["NONE"],
|
||||
},
|
||||
];
|
||||
|
||||
/** Schreibt den Katalog (Upsert je code). Liefert die Anzahl. */
|
||||
export async function importProcessCatalog(prisma: PrismaClient): Promise<number> {
|
||||
let orderIdx = 0;
|
||||
for (const c of CATALOG) {
|
||||
// parentCode explizit setzen (null bei Hauptprozessen) → idempotente Updates.
|
||||
const payload = { ...c, parentCode: c.parentCode ?? null, orderIdx: orderIdx++ };
|
||||
await prisma.processCatalogEntry.upsert({
|
||||
where: { code: c.code },
|
||||
update: payload,
|
||||
create: payload,
|
||||
});
|
||||
}
|
||||
return CATALOG.length;
|
||||
}
|
||||
Reference in New Issue
Block a user