/**
 * ISO 27001:2022 Annex A Controls
 *
 * ISO 27001 controls mapped to security finding categories.
 * Based on ISO/IEC 27001:2022 Annex A.
 *
 * @module compliance/iso27001
 */
/**
 * ISO 27001 Annex A Controls relevant to code security
 */
export const ISO27001_CONTROLS = [
    // A.5 Organizational Controls
    {
        id: "A.5.1",
        framework: "ISO27001",
        category: "Organizational Controls",
        title: "Policies for Information Security",
        description: "Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to and acknowledged by relevant personnel.",
        keywords: ["policy", "security policy", "guidelines"],
        findingCategories: ["security-misconfiguration"],
        severityThreshold: "low",
    },
    {
        id: "A.5.7",
        framework: "ISO27001",
        category: "Organizational Controls",
        title: "Threat Intelligence",
        description: "Information relating to information security threats shall be collected and analyzed to produce threat intelligence.",
        keywords: ["threat intelligence", "vulnerability", "CVE", "security advisory"],
        findingCategories: ["dependency-vuln"],
        cweIds: ["CWE-1035"],
        severityThreshold: "medium",
    },
    // A.8 Technological Controls
    {
        id: "A.8.2",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Privileged Access Rights",
        description: "The allocation and use of privileged access rights shall be restricted and managed.",
        keywords: ["privileged access", "admin", "root", "sudo", "elevation"],
        findingCategories: ["auth-bypass", "broken-access-control"],
        cweIds: ["CWE-250", "CWE-269"],
        severityThreshold: "high",
    },
    {
        id: "A.8.3",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Information Access Restriction",
        description: "Access to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control.",
        keywords: ["access control", "authorization", "permissions"],
        findingCategories: ["broken-access-control", "auth-bypass", "rls-bypass"],
        cweIds: ["CWE-862", "CWE-863"],
        severityThreshold: "high",
    },
    {
        id: "A.8.4",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Access to Source Code",
        description: "Read and write access to source code, development tools and software libraries shall be appropriately managed.",
        keywords: ["source code", "repository", "git", "version control"],
        findingCategories: ["secrets"],
        cweIds: ["CWE-798"],
        severityThreshold: "high",
    },
    {
        id: "A.8.5",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Secure Authentication",
        description: "Secure authentication technologies and procedures shall be implemented based on information access restrictions and the topic-specific policy on access control.",
        keywords: ["authentication", "login", "password", "MFA", "2FA"],
        findingCategories: ["auth-bypass", "weak-password"],
        cweIds: ["CWE-287", "CWE-521"],
        severityThreshold: "high",
    },
    {
        id: "A.8.6",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Capacity Management",
        description: "The use of resources shall be monitored and adjusted in line with current and expected capacity requirements.",
        keywords: ["capacity", "resource", "performance", "DoS"],
        findingCategories: ["resource-exhaustion", "denial-of-service"],
        cweIds: ["CWE-400", "CWE-770"],
        severityThreshold: "medium",
    },
    {
        id: "A.8.7",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Protection Against Malware",
        description: "Protection against malware shall be implemented and supported by appropriate user awareness.",
        keywords: ["malware", "virus", "injection", "XSS"],
        findingCategories: ["xss", "sql-injection", "command-injection", "code-injection"],
        cweIds: ["CWE-79", "CWE-89", "CWE-78", "CWE-94"],
        severityThreshold: "high",
    },
    {
        id: "A.8.8",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Management of Technical Vulnerabilities",
        description: "Information about technical vulnerabilities of information systems in use shall be obtained, the organization's exposure to such vulnerabilities shall be evaluated and appropriate measures shall be taken.",
        keywords: ["vulnerability", "patch", "CVE", "security update"],
        findingCategories: ["dependency-vuln"],
        cweIds: ["CWE-1035"],
        severityThreshold: "medium",
    },
    {
        id: "A.8.9",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Configuration Management",
        description: "Configurations, including security configurations, of hardware, software, services and networks shall be established, documented, implemented, monitored and reviewed.",
        keywords: ["configuration", "hardening", "baseline", "settings"],
        findingCategories: ["security-misconfiguration"],
        cweIds: ["CWE-16", "CWE-1188"],
        severityThreshold: "medium",
    },
    {
        id: "A.8.10",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Information Deletion",
        description: "Information stored in information systems, devices or in any other storage media shall be deleted when no longer required.",
        keywords: ["data deletion", "secure delete", "data retention"],
        findingCategories: ["data-exposure"],
        cweIds: ["CWE-212", "CWE-226"],
        severityThreshold: "medium",
    },
    {
        id: "A.8.11",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Data Masking",
        description: "Data masking shall be used in accordance with the organization's topic-specific policy on access control and other related topic-specific policies, and business requirements, taking applicable legislation into consideration.",
        keywords: ["data masking", "anonymization", "PII", "sensitive data"],
        findingCategories: ["data-exposure", "secrets"],
        cweIds: ["CWE-200", "CWE-359"],
        severityThreshold: "medium",
    },
    {
        id: "A.8.12",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Data Leakage Prevention",
        description: "Data leakage prevention measures shall be applied to systems, networks and any other devices that process, store or transmit sensitive information.",
        keywords: ["DLP", "data leakage", "exfiltration", "sensitive data"],
        findingCategories: ["data-exposure", "secrets", "ssrf"],
        cweIds: ["CWE-200", "CWE-918"],
        severityThreshold: "high",
    },
    {
        id: "A.8.15",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Logging",
        description: "Logs that record activities, exceptions, faults and other relevant events shall be produced, stored, protected and analyzed.",
        keywords: ["logging", "audit", "monitoring", "events"],
        findingCategories: ["insufficient-logging"],
        cweIds: ["CWE-778", "CWE-223"],
        severityThreshold: "medium",
    },
    {
        id: "A.8.16",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Monitoring Activities",
        description: "Networks, systems and applications shall be monitored for anomalous behavior and appropriate actions taken to evaluate potential information security incidents.",
        keywords: ["monitoring", "anomaly detection", "alerting"],
        findingCategories: ["insufficient-logging"],
        cweIds: ["CWE-778"],
        severityThreshold: "medium",
    },
    {
        id: "A.8.20",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Networks Security",
        description: "Networks and network devices shall be secured, managed and controlled to protect information in systems and applications.",
        keywords: ["network security", "firewall", "segmentation"],
        findingCategories: ["ssrf", "security-misconfiguration"],
        cweIds: ["CWE-918"],
        severityThreshold: "medium",
    },
    {
        id: "A.8.21",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Security of Network Services",
        description: "Security mechanisms, service levels and service requirements of network services shall be identified, implemented and monitored.",
        keywords: ["network services", "API security", "service security"],
        findingCategories: ["ssrf", "auth-bypass"],
        cweIds: ["CWE-918", "CWE-287"],
        severityThreshold: "medium",
    },
    {
        id: "A.8.24",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Use of Cryptography",
        description: "Rules for the effective use of cryptography, including cryptographic key management, shall be defined and implemented.",
        keywords: ["cryptography", "encryption", "keys", "TLS", "SSL"],
        findingCategories: ["insecure-transmission", "weak-crypto"],
        cweIds: ["CWE-327", "CWE-328", "CWE-319"],
        severityThreshold: "high",
    },
    {
        id: "A.8.25",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Secure Development Life Cycle",
        description: "Rules for the secure development of software and systems shall be established and applied.",
        keywords: ["SDLC", "secure development", "security by design"],
        findingCategories: ["type-safety", "security-misconfiguration"],
        severityThreshold: "medium",
    },
    {
        id: "A.8.26",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Application Security Requirements",
        description: "Information security requirements shall be identified, specified and approved when developing or acquiring applications.",
        keywords: ["application security", "security requirements", "secure coding"],
        findingCategories: ["sql-injection", "xss", "auth-bypass"],
        cweIds: ["CWE-89", "CWE-79", "CWE-287"],
        severityThreshold: "high",
    },
    {
        id: "A.8.27",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Secure System Architecture and Engineering Principles",
        description: "Principles for engineering secure systems shall be established, documented, maintained and applied to any information system development activities.",
        keywords: ["architecture", "secure design", "engineering"],
        findingCategories: ["security-misconfiguration", "broken-access-control"],
        severityThreshold: "medium",
    },
    {
        id: "A.8.28",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Secure Coding",
        description: "Secure coding principles shall be applied to software development.",
        keywords: ["secure coding", "OWASP", "input validation", "output encoding"],
        findingCategories: ["sql-injection", "xss", "command-injection", "path-traversal"],
        cweIds: ["CWE-89", "CWE-79", "CWE-78", "CWE-22"],
        severityThreshold: "high",
    },
    {
        id: "A.8.29",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Security Testing in Development and Acceptance",
        description: "Security testing processes shall be defined and implemented in the development life cycle.",
        keywords: ["security testing", "SAST", "DAST", "penetration testing"],
        findingCategories: ["type-safety"],
        severityThreshold: "medium",
    },
    {
        id: "A.8.30",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Outsourced Development",
        description: "The organization shall direct, monitor and review the activities related to outsourced system development.",
        keywords: ["outsourcing", "third-party", "vendor", "contractor"],
        findingCategories: ["dependency-vuln"],
        cweIds: ["CWE-1035"],
        severityThreshold: "medium",
    },
    {
        id: "A.8.31",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Separation of Development, Test and Production Environments",
        description: "Development, testing and production environments shall be separated and secured.",
        keywords: ["environment separation", "dev", "test", "production"],
        findingCategories: ["secrets", "security-misconfiguration"],
        cweIds: ["CWE-798"],
        severityThreshold: "medium",
    },
    {
        id: "A.8.32",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Change Management",
        description: "Changes to information processing facilities and information systems shall be subject to change management procedures.",
        keywords: ["change management", "version control", "deployment"],
        findingCategories: ["security-misconfiguration"],
        severityThreshold: "low",
    },
    {
        id: "A.8.33",
        framework: "ISO27001",
        category: "Technological Controls",
        title: "Test Information",
        description: "Test information shall be appropriately selected, protected and managed.",
        keywords: ["test data", "test environment", "data protection"],
        findingCategories: ["secrets", "data-exposure"],
        cweIds: ["CWE-798"],
        severityThreshold: "medium",
    },
];
/**
 * Get all ISO 27001 controls
 */
export function getISO27001Controls() {
    return ISO27001_CONTROLS;
}
/**
 * Get ISO 27001 controls by category
 */
export function getISO27001ControlsByCategory(category) {
    return ISO27001_CONTROLS.filter((c) => c.category === category);
}
/**
 * Get ISO 27001 control by ID
 */
export function getISO27001ControlById(id) {
    return ISO27001_CONTROLS.find((c) => c.id === id);
}
/**
 * Get ISO 27001 categories
 */
export function getISO27001Categories() {
    return [...new Set(ISO27001_CONTROLS.map((c) => c.category))];
}
//# sourceMappingURL=iso27001.js.map