/**
 * SOC 2 Trust Services Criteria Controls
 *
 * SOC 2 Common Criteria (CC) controls mapped to security finding categories.
 * Based on AICPA Trust Services Criteria 2017.
 *
 * @module compliance/soc2
 */
/**
 * SOC 2 Common Criteria Controls relevant to code security
 */
export const SOC2_CONTROLS = [
    // CC6: Logical and Physical Access Controls
    {
        id: "CC6.1",
        framework: "SOC2",
        category: "Logical and Physical Access",
        title: "Logical Access Security Software",
        description: "The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events.",
        keywords: ["authentication", "authorization", "access control", "login", "session"],
        findingCategories: ["auth-bypass", "broken-access-control", "session-management"],
        cweIds: ["CWE-287", "CWE-862", "CWE-863", "CWE-384"],
        severityThreshold: "medium",
    },
    {
        id: "CC6.2",
        framework: "SOC2",
        category: "Logical and Physical Access",
        title: "User Authentication",
        description: "Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users.",
        keywords: ["registration", "credential", "password", "user management"],
        findingCategories: ["auth-bypass", "weak-password"],
        cweIds: ["CWE-521", "CWE-620", "CWE-640"],
        severityThreshold: "medium",
    },
    {
        id: "CC6.3",
        framework: "SOC2",
        category: "Logical and Physical Access",
        title: "Access Removal",
        description: "The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes.",
        keywords: ["deprovisioning", "access removal", "role-based access"],
        findingCategories: ["broken-access-control", "auth-bypass"],
        cweIds: ["CWE-269", "CWE-266"],
        severityThreshold: "medium",
    },
    {
        id: "CC6.6",
        framework: "SOC2",
        category: "Logical and Physical Access",
        title: "Security Boundaries",
        description: "The entity implements logical access security measures to protect against threats from sources outside its system boundaries.",
        keywords: ["firewall", "network security", "boundary", "external threat"],
        findingCategories: ["ssrf", "path-traversal", "command-injection"],
        cweIds: ["CWE-918", "CWE-22", "CWE-78"],
        severityThreshold: "high",
    },
    {
        id: "CC6.7",
        framework: "SOC2",
        category: "Logical and Physical Access",
        title: "Transmission Protection",
        description: "The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes.",
        keywords: ["encryption", "TLS", "data transmission", "data leakage"],
        findingCategories: ["insecure-transmission", "data-exposure"],
        cweIds: ["CWE-319", "CWE-523"],
        severityThreshold: "medium",
    },
    {
        id: "CC6.8",
        framework: "SOC2",
        category: "Logical and Physical Access",
        title: "Malicious Software Prevention",
        description: "The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software.",
        keywords: ["malware", "injection", "code execution", "xss"],
        findingCategories: ["xss", "sql-injection", "command-injection", "code-injection"],
        cweIds: ["CWE-79", "CWE-89", "CWE-78", "CWE-94"],
        severityThreshold: "high",
    },
    // CC7: System Operations
    {
        id: "CC7.1",
        framework: "SOC2",
        category: "System Operations",
        title: "Security Event Detection",
        description: "To meet its objectives, the entity uses detection and monitoring procedures to identify anomalies that could represent security events.",
        keywords: ["logging", "monitoring", "detection", "audit trail"],
        findingCategories: ["insufficient-logging", "security-misconfiguration"],
        cweIds: ["CWE-778", "CWE-223"],
        severityThreshold: "medium",
    },
    {
        id: "CC7.2",
        framework: "SOC2",
        category: "System Operations",
        title: "Security Incident Response",
        description: "The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts.",
        keywords: ["incident response", "anomaly detection", "security monitoring"],
        findingCategories: ["insufficient-logging"],
        cweIds: ["CWE-778"],
        severityThreshold: "medium",
    },
    {
        id: "CC7.3",
        framework: "SOC2",
        category: "System Operations",
        title: "Security Event Analysis",
        description: "The entity evaluates security events to determine whether they could or have resulted in a failure to meet objectives.",
        keywords: ["event analysis", "security assessment", "threat analysis"],
        findingCategories: ["security-misconfiguration"],
        severityThreshold: "low",
    },
    {
        id: "CC7.4",
        framework: "SOC2",
        category: "System Operations",
        title: "Security Event Response",
        description: "The entity responds to identified security incidents by executing a defined incident response program.",
        keywords: ["incident response", "remediation", "recovery"],
        findingCategories: [],
        severityThreshold: "medium",
    },
    // CC8: Change Management
    {
        id: "CC8.1",
        framework: "SOC2",
        category: "Change Management",
        title: "Change Authorization",
        description: "The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures.",
        keywords: ["change management", "code review", "testing", "deployment"],
        findingCategories: ["security-misconfiguration", "type-safety"],
        cweIds: ["CWE-1188"],
        severityThreshold: "medium",
    },
    // CC9: Risk Mitigation
    {
        id: "CC9.1",
        framework: "SOC2",
        category: "Risk Mitigation",
        title: "Risk Identification and Assessment",
        description: "The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.",
        keywords: ["risk assessment", "vulnerability", "threat modeling"],
        findingCategories: ["dependency-vuln"],
        cweIds: ["CWE-1035"],
        severityThreshold: "medium",
    },
    {
        id: "CC9.2",
        framework: "SOC2",
        category: "Risk Mitigation",
        title: "Vendor Risk Management",
        description: "The entity assesses and manages risks associated with vendors and business partners.",
        keywords: ["vendor", "third-party", "supply chain", "dependency"],
        findingCategories: ["dependency-vuln"],
        cweIds: ["CWE-1035", "CWE-829"],
        severityThreshold: "medium",
    },
    // Confidentiality Controls (C Series)
    {
        id: "C1.1",
        framework: "SOC2",
        category: "Confidentiality",
        title: "Confidential Information Identification",
        description: "The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality.",
        keywords: ["confidential", "sensitive data", "PII", "secrets"],
        findingCategories: ["secrets", "data-exposure"],
        cweIds: ["CWE-200", "CWE-359"],
        severityThreshold: "high",
    },
    {
        id: "C1.2",
        framework: "SOC2",
        category: "Confidentiality",
        title: "Confidential Information Disposal",
        description: "The entity disposes of confidential information to meet the entity's objectives related to confidentiality.",
        keywords: ["data disposal", "secure delete", "data retention"],
        findingCategories: ["data-exposure"],
        cweIds: ["CWE-226", "CWE-212"],
        severityThreshold: "medium",
    },
    // Availability Controls (A Series)
    {
        id: "A1.1",
        framework: "SOC2",
        category: "Availability",
        title: "Capacity Management",
        description: "The entity maintains, monitors, and evaluates current processing capacity and use of system components.",
        keywords: ["capacity", "performance", "resource exhaustion", "DoS"],
        findingCategories: ["resource-exhaustion", "denial-of-service"],
        cweIds: ["CWE-400", "CWE-770"],
        severityThreshold: "medium",
    },
    {
        id: "A1.2",
        framework: "SOC2",
        category: "Availability",
        title: "Recovery Planning",
        description: "The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data backup processes, and recovery infrastructure.",
        keywords: ["backup", "disaster recovery", "business continuity"],
        findingCategories: [],
        severityThreshold: "medium",
    },
    // Processing Integrity (PI Series)
    {
        id: "PI1.1",
        framework: "SOC2",
        category: "Processing Integrity",
        title: "Processing Accuracy",
        description: "The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives.",
        keywords: ["data validation", "input validation", "data integrity"],
        findingCategories: ["sql-injection", "xss", "insecure-deserialization"],
        cweIds: ["CWE-20", "CWE-89", "CWE-79", "CWE-502"],
        severityThreshold: "high",
    },
    {
        id: "PI1.2",
        framework: "SOC2",
        category: "Processing Integrity",
        title: "System Input Controls",
        description: "The entity implements policies and procedures over system inputs that result in products, services, and reporting to meet the entity's objectives.",
        keywords: ["input validation", "sanitization", "encoding"],
        findingCategories: ["sql-injection", "xss", "command-injection", "path-traversal"],
        cweIds: ["CWE-20", "CWE-89", "CWE-79", "CWE-78", "CWE-22"],
        severityThreshold: "high",
    },
    {
        id: "PI1.3",
        framework: "SOC2",
        category: "Processing Integrity",
        title: "System Processing Controls",
        description: "The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives.",
        keywords: ["data processing", "transaction integrity", "error handling"],
        findingCategories: ["type-safety", "error-handling"],
        cweIds: ["CWE-754", "CWE-755"],
        severityThreshold: "medium",
    },
];
/**
 * Get all SOC 2 controls
 */
export function getSOC2Controls() {
    return SOC2_CONTROLS;
}
/**
 * Get SOC 2 controls by category
 */
export function getSOC2ControlsByCategory(category) {
    return SOC2_CONTROLS.filter((c) => c.category === category);
}
/**
 * Get SOC 2 control by ID
 */
export function getSOC2ControlById(id) {
    return SOC2_CONTROLS.find((c) => c.id === id);
}
/**
 * Get SOC 2 categories
 */
export function getSOC2Categories() {
    return [...new Set(SOC2_CONTROLS.map((c) => c.category))];
}
//# sourceMappingURL=soc2.js.map