kitos
a238b05ca8
Implements the Digital Operational Resilience Act as a compliance framework
using the same pattern as CIS Controls v8 (hardcoded curated mappings,
no official STIX bundle exists for DORA).
22 controls across 5 chapters mapped to MITRE ATT&CK techniques:
Ch. II — ICT Risk Management (Art. 5–15): governance, identification,
protection, detection, response, backup, threat intel
Ch. III — Incident Management (Art. 17–19): classification, reporting
Ch. IV — Resilience Testing (Art. 24–27): general testing + TLPT
(Art. 26 explicitly based on TIBER-EU/ATT&CK threat-led testing)
Ch. V — Third-Party Risk (Art. 28, 30, 42): supply chain, trusted rels.
Ch. VI — Information Sharing (Art. 45)
Technique mappings derived from ENISA DORA guidelines and TIBER-EU framework.
Import is triggered via POST /api/v1/compliance/import/dora (admin only).
Frontend: new 'DORA' button in the Compliance page import section.
129 lines
3.8 KiB
TypeScript
129 lines
3.8 KiB
TypeScript
import client from "./client";
|
|
|
|
// ── Types ────────────────────────────────────────────────────────────
|
|
|
|
export interface ComplianceFrameworkSummary {
|
|
id: string;
|
|
name: string;
|
|
version: string | null;
|
|
description: string | null;
|
|
url: string | null;
|
|
is_active: boolean;
|
|
controls_count: number;
|
|
}
|
|
|
|
export interface ComplianceTechniqueInfo {
|
|
mitre_id: string;
|
|
name: string;
|
|
score: number;
|
|
status: string;
|
|
}
|
|
|
|
export interface ComplianceControlStatus {
|
|
control_id: string;
|
|
title: string;
|
|
category: string | null;
|
|
status: "covered" | "partially_covered" | "not_covered" | "not_evaluated";
|
|
score: number;
|
|
techniques_count: number;
|
|
techniques_covered: number;
|
|
techniques: ComplianceTechniqueInfo[];
|
|
}
|
|
|
|
export interface ComplianceSummary {
|
|
total_controls: number;
|
|
covered: number;
|
|
partially_covered: number;
|
|
not_covered: number;
|
|
not_evaluated: number;
|
|
compliance_percentage: number;
|
|
}
|
|
|
|
export interface ComplianceFrameworkStatus {
|
|
framework: { id: string; name: string };
|
|
summary: ComplianceSummary;
|
|
controls: ComplianceControlStatus[];
|
|
}
|
|
|
|
export interface ComplianceGapTechnique extends ComplianceTechniqueInfo {
|
|
templates_available: number;
|
|
threat_actors_using: number;
|
|
}
|
|
|
|
export interface ComplianceGap {
|
|
control_id: string;
|
|
title: string;
|
|
category: string | null;
|
|
status: string;
|
|
score: number;
|
|
uncovered_techniques: ComplianceGapTechnique[];
|
|
}
|
|
|
|
export interface ComplianceGapsResponse {
|
|
framework: { id: string; name: string };
|
|
total_gaps: number;
|
|
gaps: ComplianceGap[];
|
|
}
|
|
|
|
// ── API Functions ────────────────────────────────────────────────────
|
|
|
|
/** List all available compliance frameworks. */
|
|
export async function getComplianceFrameworks(): Promise<ComplianceFrameworkSummary[]> {
|
|
const { data } = await client.get<ComplianceFrameworkSummary[]>("/compliance/frameworks");
|
|
return data;
|
|
}
|
|
|
|
/** Get compliance status for a framework. */
|
|
export async function getFrameworkStatus(
|
|
frameworkId: string,
|
|
): Promise<ComplianceFrameworkStatus> {
|
|
const { data } = await client.get<ComplianceFrameworkStatus>(
|
|
`/compliance/frameworks/${frameworkId}/status`,
|
|
);
|
|
return data;
|
|
}
|
|
|
|
/** Get compliance gaps for a framework. */
|
|
export async function getFrameworkGaps(
|
|
frameworkId: string,
|
|
): Promise<ComplianceGapsResponse> {
|
|
const { data } = await client.get<ComplianceGapsResponse>(
|
|
`/compliance/frameworks/${frameworkId}/gaps`,
|
|
);
|
|
return data;
|
|
}
|
|
|
|
/** Download CSV report for a framework. */
|
|
export async function downloadComplianceCSV(frameworkId: string): Promise<void> {
|
|
const { data } = await client.get(`/compliance/frameworks/${frameworkId}/report/csv`, {
|
|
responseType: "blob",
|
|
});
|
|
const blob = new Blob([data], { type: "text/csv" });
|
|
const url = URL.createObjectURL(blob);
|
|
const a = document.createElement("a");
|
|
a.href = url;
|
|
a.download = "compliance_report.csv";
|
|
document.body.appendChild(a);
|
|
a.click();
|
|
document.body.removeChild(a);
|
|
URL.revokeObjectURL(url);
|
|
}
|
|
|
|
/** Import NIST 800-53 mappings (admin). */
|
|
export async function importNistMappings(): Promise<Record<string, unknown>> {
|
|
const { data } = await client.post("/compliance/import/nist-800-53");
|
|
return data;
|
|
}
|
|
|
|
/** Import CIS Controls v8 mappings (admin). */
|
|
export async function importCisMappings(): Promise<Record<string, unknown>> {
|
|
const { data } = await client.post("/compliance/import/cis-controls-v8");
|
|
return data;
|
|
}
|
|
|
|
/** Import DORA (EU 2022/2554) compliance mappings (admin). */
|
|
export async function importDoraMappings(): Promise<Record<string, unknown>> {
|
|
const { data } = await client.post("/compliance/import/dora");
|
|
return data;
|
|
}
|