msolarczekandClaude Opus 5
c8e6f30a27
Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
380 lines
11 KiB
JSON
380 lines
11 KiB
JSON
{
|
||
"$schema": "http://json-schema.org/draft-07/schema#",
|
||
"title": "ISMS-Vorlagenpaket v2 – Wizard-Variablen (VDA ISA 2027 / Information Security)",
|
||
"description": "Single Source of Truth aller Wizard-Variablen. Konvention: UPPER_SNAKE_CASE, Platzhalter {{NAME}}. Feature-Flags steuern {{#if FLAG_X}}-Bloecke. Der Programmierer generiert die Wizard-Eingaben aus diesem Schema.",
|
||
"version": "2.0",
|
||
"type": "object",
|
||
"properties": {
|
||
"ORG_NAME": {
|
||
"type": "string",
|
||
"title": "Organisation (voller Name)",
|
||
"example": "Muster GmbH"
|
||
},
|
||
"ORG_SHORT": {
|
||
"type": "string",
|
||
"title": "Organisation (Kurzname)",
|
||
"example": "Muster"
|
||
},
|
||
"ISMS_SCOPE": {
|
||
"type": "string",
|
||
"title": "Geltungsbereich (Kurzlabel)",
|
||
"example": "IT & Entwicklung Werk Nord"
|
||
},
|
||
"ISMS_SCOPE_DESCRIPTION": {
|
||
"type": "string",
|
||
"title": "Geltungsbereich (Beschreibung)"
|
||
},
|
||
"ROLE_MANAGEMENT": {
|
||
"type": "string",
|
||
"title": "Oberste Leitung",
|
||
"default": "Geschäftsführung"
|
||
},
|
||
"ROLE_ISB": {
|
||
"type": "string",
|
||
"title": "Informationssicherheitsbeauftragte(r) / CISO",
|
||
"default": "Informationssicherheitsbeauftragte(r) (ISB)"
|
||
},
|
||
"ROLE_IT_LEAD": {
|
||
"type": "string",
|
||
"title": "IT-Leitung",
|
||
"default": "IT-Leitung"
|
||
},
|
||
"ROLE_HR_LEAD": {
|
||
"type": "string",
|
||
"title": "Personalleitung",
|
||
"default": "Personalleitung"
|
||
},
|
||
"ROLE_DPO": {
|
||
"type": "string",
|
||
"title": "Datenschutzbeauftragte(r)",
|
||
"default": "Datenschutzbeauftragte(r) (DSB)"
|
||
},
|
||
"DOC_VERSION": {
|
||
"type": "string",
|
||
"title": "Version",
|
||
"default": "1.0"
|
||
},
|
||
"DOC_DATE": {
|
||
"type": "string",
|
||
"title": "Datum",
|
||
"format": "date"
|
||
},
|
||
"DOC_STATUS": {
|
||
"type": "string",
|
||
"title": "Status",
|
||
"enum": [
|
||
"Entwurf",
|
||
"In Freigabe",
|
||
"Freigegeben"
|
||
],
|
||
"default": "Entwurf"
|
||
},
|
||
"TOOL_NAME": {
|
||
"type": "string",
|
||
"title": "Name des ISMS-Tools",
|
||
"default": "ISMS-Tool"
|
||
},
|
||
"REVIEW_CYCLE": {
|
||
"type": "string",
|
||
"title": "Revisionszyklus (Freitext)",
|
||
"default": "jährlich"
|
||
},
|
||
"TECH_MFA": {
|
||
"type": "string",
|
||
"title": "MFA-Lösung",
|
||
"default": "die eingesetzte MFA-Lösung"
|
||
},
|
||
"TECH_MALWARE": {
|
||
"type": "string",
|
||
"title": "Malware-Schutz-Lösung",
|
||
"default": "die eingesetzte Endpoint-Schutzlösung"
|
||
},
|
||
"TECH_BACKUP": {
|
||
"type": "string",
|
||
"title": "Backup-Lösung",
|
||
"default": "die eingesetzte Backup-Lösung"
|
||
},
|
||
"TECH_SIEM": {
|
||
"type": "string",
|
||
"title": "Logging/SIEM-Lösung",
|
||
"default": "die zentrale Protokollierung"
|
||
},
|
||
"TECH_MDM": {
|
||
"type": "string",
|
||
"title": "MDM-Lösung",
|
||
"default": "das eingesetzte MDM"
|
||
},
|
||
"TECH_VPN": {
|
||
"type": "string",
|
||
"title": "VPN/Remote-Access-Lösung",
|
||
"default": "VPN"
|
||
},
|
||
"TECH_CRYPTO": {
|
||
"type": "string",
|
||
"title": "Krypto-Vorgabe/Standard",
|
||
"default": "aktuelle BSI-/Branchenempfehlungen"
|
||
},
|
||
"TOOL_TICKET": {
|
||
"type": "string",
|
||
"title": "Ticket-/Workflow-System (Dokumentationsort)",
|
||
"default": "Ticketsystem"
|
||
},
|
||
"TOOL_IAM": {
|
||
"type": "string",
|
||
"title": "Verzeichnis-/IAM-System",
|
||
"default": "Entra ID / Active Directory"
|
||
},
|
||
"PW_MIN_LENGTH": {
|
||
"type": "string",
|
||
"title": "Passwort-Mindestlänge (BL-IAM-01)",
|
||
"default": "12"
|
||
},
|
||
"PW_COMPLEXITY": {
|
||
"type": "string",
|
||
"title": "Passwort-Komplexität (BL-IAM-01)",
|
||
"default": "Komplexität aus mind. 3 von 4 Zeichenkategorien"
|
||
},
|
||
"PW_ROTATION": {
|
||
"type": "string",
|
||
"title": "Passwort-Rotation (BL-IAM-01)",
|
||
"default": "keine feste Zwangsrotation, Wechsel anlassbezogen bei Verdacht"
|
||
},
|
||
"MFA_SCOPE": {
|
||
"type": "string",
|
||
"title": "MFA-Geltungsbereich (BL-IAM-02)",
|
||
"default": "alle Fernzugriffe, administrative Zugänge und Cloud-Dienste"
|
||
},
|
||
"SESSION_TIMEOUT": {
|
||
"type": "string",
|
||
"title": "Sitzungs-Timeout (BL-IAM-03)",
|
||
"default": "15 Min. Inaktivität (privilegiert), 8 Std. (Standard)"
|
||
},
|
||
"ACCOUNT_LOCKOUT": {
|
||
"type": "string",
|
||
"title": "Kontosperrung (BL-IAM-04)",
|
||
"default": "temporäre Sperre nach 10 Fehlversuchen"
|
||
},
|
||
"RECERT_FREQ": {
|
||
"type": "string",
|
||
"title": "Rezertifizierung (BL-IAM-05)",
|
||
"default": "halbjährlich"
|
||
},
|
||
"TLS_MIN": {
|
||
"type": "string",
|
||
"title": "Mindest-TLS (BL-CRY-01)",
|
||
"default": "TLS 1.2 (Empfehlung TLS 1.3)"
|
||
},
|
||
"CRYPTO_ALGO": {
|
||
"type": "string",
|
||
"title": "Zulässige Algorithmen (BL-CRY-02)",
|
||
"default": "AES-256, RSA ≥ 3072 / ECC ≥ 256, SHA-256 oder stärker"
|
||
},
|
||
"PATCH_SLA_CRIT": {
|
||
"type": "string",
|
||
"title": "Patch-SLA kritisch (BL-OPS-01)",
|
||
"default": "innerhalb von 72 Stunden"
|
||
},
|
||
"PATCH_SLA_HIGH": {
|
||
"type": "string",
|
||
"title": "Patch-SLA hoch (BL-OPS-01)",
|
||
"default": "innerhalb von 14 Tagen"
|
||
},
|
||
"PATCH_SLA_STD": {
|
||
"type": "string",
|
||
"title": "Patch-SLA standard (BL-OPS-01)",
|
||
"default": "im regulären monatlichen Patchzyklus"
|
||
},
|
||
"VULN_SCAN_FREQ": {
|
||
"type": "string",
|
||
"title": "Schwachstellenscan (BL-OPS-02)",
|
||
"default": "monatlich"
|
||
},
|
||
"MALWARE_UPDATE": {
|
||
"type": "string",
|
||
"title": "Malware-Update (BL-OPS-03)",
|
||
"default": "mehrmals täglich automatisch"
|
||
},
|
||
"LOG_RETENTION": {
|
||
"type": "string",
|
||
"title": "Log-Aufbewahrung (BL-OPS-04)",
|
||
"default": "90 Tage, risikoabhängig bis 12 Monate"
|
||
},
|
||
"BACKUP_SCHEME": {
|
||
"type": "string",
|
||
"title": "Backup-Schema (BL-OPS-05)",
|
||
"default": "3-2-1 (3 Kopien, 2 Medien, 1 offline/ausgelagert)"
|
||
},
|
||
"BACKUP_RETENTION": {
|
||
"type": "string",
|
||
"title": "Backup-Aufbewahrung (BL-OPS-05)",
|
||
"default": "täglich 30 Tage, monatlich 12 Monate"
|
||
},
|
||
"BACKUP_TEST_FREQ": {
|
||
"type": "string",
|
||
"title": "Wiederherstellungstest (BL-OPS-06)",
|
||
"default": "jährlich"
|
||
},
|
||
"PENTEST_FREQ": {
|
||
"type": "string",
|
||
"title": "Penetrationstest (BL-OPS-08)",
|
||
"default": "jährlich"
|
||
},
|
||
"FLAG_INCLUDE_SHOULD": {
|
||
"type": "boolean",
|
||
"title": "SOLL-Anforderungen einbeziehen (Reifegrad 3 = true)",
|
||
"default": true
|
||
},
|
||
"FLAG_HIGH_PROTECTION": {
|
||
"type": "boolean",
|
||
"title": "Zusatzanforderungen HOHER Schutzbedarf einbeziehen",
|
||
"default": false
|
||
},
|
||
"FLAG_VERY_HIGH_PROTECTION": {
|
||
"type": "boolean",
|
||
"title": "Zusatzanforderungen SEHR HOHER Schutzbedarf einbeziehen",
|
||
"default": false
|
||
},
|
||
"FLAG_ELEVATED_PROTECTION": {
|
||
"type": "boolean",
|
||
"title": "Abgeleitet: HIGH ODER VERY_HIGH aktiv (vom Wizard gesetzt = FLAG_HIGH_PROTECTION || FLAG_VERY_HIGH_PROTECTION)",
|
||
"default": false
|
||
},
|
||
"FLAG_CLOUD_USED": {
|
||
"type": "boolean",
|
||
"title": "Cloud-Dienste im Einsatz",
|
||
"default": true
|
||
},
|
||
"FLAG_AI_USED": {
|
||
"type": "boolean",
|
||
"title": "KI-/GenAI-Dienste im Einsatz",
|
||
"default": true
|
||
},
|
||
"FLAG_OT_USED": {
|
||
"type": "boolean",
|
||
"title": "Produktions-/OT-Umgebung vorhanden",
|
||
"default": false
|
||
},
|
||
"FLAG_DEV_INHOUSE": {
|
||
"type": "boolean",
|
||
"title": "Eigene Software-Entwicklung",
|
||
"default": false
|
||
},
|
||
"FLAG_MOBILE_WORK": {
|
||
"type": "boolean",
|
||
"title": "Mobiles Arbeiten / Homeoffice zugelassen",
|
||
"default": true
|
||
},
|
||
"FLAG_MOBILE_DEVICES": {
|
||
"type": "boolean",
|
||
"title": "Mobile Endgeräte / Datenträger im Einsatz",
|
||
"default": true
|
||
},
|
||
"FLAG_CRYPTO_PKI": {
|
||
"type": "boolean",
|
||
"title": "Eigene PKI / Zertifikatsverwaltung",
|
||
"default": false
|
||
},
|
||
"FLAG_EXTERNAL_IT": {
|
||
"type": "boolean",
|
||
"title": "Externe IT-Dienstleister genutzt",
|
||
"default": true
|
||
},
|
||
"FLAG_PERSONAL_DATA": {
|
||
"type": "boolean",
|
||
"title": "Verarbeitung personenbezogener Daten",
|
||
"default": true
|
||
},
|
||
"FLAG_CUSTOMER_SYSTEMS": {
|
||
"type": "boolean",
|
||
"title": "Zugriff auf Kundensysteme (z.B. OEM)",
|
||
"default": false
|
||
},
|
||
"FLAG_PROTOTYPE_PROTECTION": {
|
||
"type": "boolean",
|
||
"title": "Prüfziel Prototypenschutz aktiv (Kapitel 8.x)",
|
||
"default": false
|
||
},
|
||
"FLAG_ISB_INTERNAL": {
|
||
"type": "boolean",
|
||
"title": "ISB intern besetzt",
|
||
"default": true
|
||
},
|
||
"FLAG_ISB_EXTERNAL": {
|
||
"type": "boolean",
|
||
"title": "ISB extern besetzt (externer Dienstleister)",
|
||
"default": false
|
||
},
|
||
"FLAG_FW_TISAX": {
|
||
"type": "boolean",
|
||
"title": "Framework: TISAX / VDA ISA anwenden",
|
||
"default": true
|
||
},
|
||
"FLAG_FW_ISO27001": {
|
||
"type": "boolean",
|
||
"title": "Framework: ISO/IEC 27001 anwenden",
|
||
"default": false
|
||
},
|
||
"POLICY_REVIEW_CYCLE": {
|
||
"type": "string",
|
||
"title": "Prüfzyklus Leitlinie/Richtlinien",
|
||
"example": "jährlich",
|
||
"default": "jährlich"
|
||
},
|
||
"MGMT_REVIEW_CYCLE": {
|
||
"type": "string",
|
||
"title": "Turnus Managementbewertung",
|
||
"example": "jährlich",
|
||
"default": "jährlich"
|
||
},
|
||
"RISK_REVIEW_CYCLE": {
|
||
"type": "string",
|
||
"title": "Turnus Risikobeurteilung",
|
||
"example": "jährlich",
|
||
"default": "jährlich"
|
||
},
|
||
"RECORDS_RETENTION": {
|
||
"type": "string",
|
||
"title": "Aufbewahrung abgelöster Dokumentfassungen",
|
||
"example": "3 Jahre",
|
||
"default": "3 Jahre"
|
||
},
|
||
"AUTHORITY_CONTACTS": {
|
||
"type": "string",
|
||
"title": "Relevante Behörden/Meldestellen",
|
||
"example": "Datenschutz-Aufsichtsbehörde, Polizei (ZAC), BSI/CERT-Bund",
|
||
"default": "Datenschutz-Aufsichtsbehörde, Polizei (ZAC), BSI/CERT-Bund"
|
||
},
|
||
"THREAT_INTEL_SOURCES": {
|
||
"type": "string",
|
||
"title": "Quellen für Bedrohungsinformationen",
|
||
"example": "CERT-Bund-Warnmeldungen, Herstellerhinweise, CVE-Feeds",
|
||
"default": "CERT-Bund-Warnmeldungen, Herstellerhinweise, CVE-Feeds"
|
||
},
|
||
"CAPACITY_REVIEW_FREQ": {
|
||
"type": "string",
|
||
"title": "Turnus Kapazitätsüberwachung",
|
||
"example": "monatlich",
|
||
"default": "monatlich"
|
||
},
|
||
"NTP_SOURCES": {
|
||
"type": "string",
|
||
"title": "Zugelassene Zeitquellen",
|
||
"example": "zwei unabhängige, vertrauenswürdige NTP-Quellen",
|
||
"default": "zwei unabhängige, vertrauenswürdige NTP-Quellen"
|
||
},
|
||
"DLP_SCOPE": {
|
||
"type": "string",
|
||
"title": "Abgedeckte Kanäle gegen Datenabfluss",
|
||
"example": "E-Mail, Wechseldatenträger, Cloud-Speicher",
|
||
"default": "E-Mail, Wechseldatenträger, Cloud-Speicher"
|
||
}
|
||
},
|
||
"required": [
|
||
"ORG_NAME",
|
||
"ISMS_SCOPE",
|
||
"ISMS_SCOPE_DESCRIPTION",
|
||
"DOC_VERSION",
|
||
"DOC_DATE"
|
||
]
|
||
}
|