{ "schema": "dsose.assessment.v1", "exportedAt": "2026-09-14T11:16:04.101Z", "application": { "name": "Payment Platform", "slug": "payment-platform" }, "metrics": { "coverage": 0.4726, "coverageBasis": { "covered": 198, "required": 419 }, "effectiveness": 0.6092, "effectivenessAssessed": 0.65, "maturity": 1, "maturityScale": 5 }, "capabilities": [ { "key": "API_SECURITY", "name": "API Security Testing", "coverage": 0, "maturity": 0, "gaps": 9 }, { "key": "FUZZING", "name": "Fuzzing", "coverage": 0, "maturity": 0, "gaps": 4 }, { "key": "KUBERNETES_SECURITY", "name": "Kubernetes Security", "coverage": 0, "maturity": 0, "gaps": 9 }, { "key": "RUNTIME_SECURITY", "name": "Runtime Security", "coverage": 0, "maturity": 0, "gaps": 12 }, { "key": "SECURITY_REQUIREMENTS", "name": "Security Requirements", "coverage": 0, "maturity": 0, "gaps": 1 }, { "key": "DAST", "name": "DAST", "coverage": 0.0667, "maturity": 0.1, "gaps": 8 }, { "key": "VULNERABILITY_SCANNING", "name": "Vulnerability Scanning", "coverage": 0.1667, "maturity": 0.3, "gaps": 25 }, { "key": "PENETRATION_TESTING", "name": "Penetration Testing", "coverage": 0.2857, "maturity": 0.3, "gaps": 7 }, { "key": "ADMISSION_CONTROL", "name": "Admission Control", "coverage": 0.3333, "maturity": 0.7, "gaps": 3 }, { "key": "NETWORK_SECURITY", "name": "Network Security", "coverage": 0.3333, "maturity": 0.7, "gaps": 12 }, { "key": "DRIFT_DETECTION", "name": "Drift Detection", "coverage": 0.5, "maturity": 1, "gaps": 12 }, { "key": "IAC_SECURITY", "name": "IaC Security", "coverage": 0.5, "maturity": 1, "gaps": 6 }, { "key": "THREAT_MODELING", "name": "Threat Modeling", "coverage": 0.5, "maturity": 0.5, "gaps": 1 }, { "key": "SECRETS_MANAGEMENT", "name": "Secrets Management", "coverage": 0.6, "maturity": 1.2, "gaps": 2 }, { "key": "CLOUD_CONFIGURATION_SECURITY", "name": "Cloud Configuration Security", "coverage": 0.6667, "maturity": 1.3, "gaps": 2 }, { "key": "CODE_REVIEW_SECURITY", "name": "Code Review Security", "coverage": 0.6667, "maturity": 0.7, "gaps": 1 }, { "key": "SECRET_SCANNING", "name": "Secret Scanning", "coverage": 0.6667, "maturity": 2.7, "gaps": 1 }, { "key": "SIEM", "name": "SIEM", "coverage": 0.6667, "maturity": 1.3, "gaps": 1 }, { "key": "WORKLOAD_IDENTITY", "name": "Workload Identity", "coverage": 0.6667, "maturity": 1.3, "gaps": 6 }, { "key": "SCA", "name": "SCA", "coverage": 0.7273, "maturity": 1.5, "gaps": 9 }, { "key": "CONTAINER_SECURITY", "name": "Container Security", "coverage": 1, "maturity": 4, "gaps": 0 }, { "key": "INCIDENT_RESPONSE", "name": "Incident Response", "coverage": 1, "maturity": 1, "gaps": 0 }, { "key": "SAST", "name": "SAST", "coverage": 1, "maturity": 3.2, "gaps": 0 }, { "key": "SECURE_ARCHITECTURE", "name": "Secure Architecture", "coverage": 1, "maturity": 1, "gaps": 0 }, { "key": "VULNERABILITY_MANAGEMENT", "name": "Vulnerability Management", "coverage": 1, "maturity": 2, "gaps": 0 } ], "scopes": [ { "capability": "Security Requirements", "control": "Security Requirements Defined", "environment": null, "technology": null, "phase": "Plan", "controlPoint": "Manual Review", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Threat Modeling", "control": "Threat Model Created", "environment": null, "technology": null, "phase": "Design", "controlPoint": "Manual Review", "weight": 1, "covered": true, "coveredBy": [ "STRIDE workshop held at design time" ] }, { "capability": "Threat Modeling", "control": "Threat Model Review on Architecture Change", "environment": null, "technology": null, "phase": "Design", "controlPoint": "Manual Review", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Secure Architecture", "control": "Security Architecture Review", "environment": null, "technology": null, "phase": "Design", "controlPoint": "Manual Review", "weight": 1, "covered": true, "coveredBy": [ "Architecture board sign-off on major changes" ] }, { "capability": "SAST", "control": "SAST Pipeline Scan", "environment": null, "technology": "Java", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "SonarQube analysis of the main branch" ] }, { "capability": "SAST", "control": "SAST Pipeline Scan", "environment": null, "technology": "Spring Boot", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "SonarQube analysis of the main branch" ] }, { "capability": "SAST", "control": "SAST Pipeline Scan", "environment": null, "technology": "React", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "SonarQube analysis of the main branch" ] }, { "capability": "SAST", "control": "SAST Pull Request Gate", "environment": null, "technology": "Java", "phase": "Code", "controlPoint": "Pull Request", "weight": 3, "covered": true, "coveredBy": [ "SonarQube pull request gate", "Semgrep rules on pull requests" ] }, { "capability": "SAST", "control": "SAST Pull Request Gate", "environment": null, "technology": "Spring Boot", "phase": "Code", "controlPoint": "Pull Request", "weight": 3, "covered": true, "coveredBy": [ "SonarQube pull request gate", "Semgrep rules on pull requests" ] }, { "capability": "SAST", "control": "SAST Pull Request Gate", "environment": null, "technology": "React", "phase": "Code", "controlPoint": "Pull Request", "weight": 3, "covered": true, "coveredBy": [ "SonarQube pull request gate", "Semgrep rules on pull requests" ] }, { "capability": "Secret Scanning", "control": "Pre-Commit Secret Detection", "environment": null, "technology": null, "phase": "Code", "controlPoint": "Pre-Commit", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Secret Scanning", "control": "Repository Secret Scanning", "environment": null, "technology": null, "phase": "Code", "controlPoint": "Repository", "weight": 2, "covered": true, "coveredBy": [ "Gitleaks over the repository and its history" ] }, { "capability": "Code Review Security", "control": "Mandatory Peer Review Before Merge", "environment": null, "technology": null, "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "covered": true, "coveredBy": [ "Branch protection requiring a second reviewer" ] }, { "capability": "Code Review Security", "control": "Security Review of Sensitive Changes", "environment": null, "technology": null, "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "covered": true, "coveredBy": [ "CODEOWNERS review on the payment paths" ] }, { "capability": "Code Review Security", "control": "Security Review of Sensitive Changes", "environment": null, "technology": null, "phase": "Code", "controlPoint": "Manual Review", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Development", "technology": "Java", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Development", "technology": "Java", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Development", "technology": "Spring Boot", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Development", "technology": "Spring Boot", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Development", "technology": "React", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Development", "technology": "React", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Test", "technology": "Java", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Test", "technology": "Java", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Test", "technology": "Spring Boot", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Test", "technology": "Spring Boot", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Test", "technology": "React", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Test", "technology": "React", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Production", "technology": "Java", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Production", "technology": "Java", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Production", "technology": "Spring Boot", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Production", "technology": "Spring Boot", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Production", "technology": "React", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Dependency Composition Scan", "environment": "Production", "technology": "React", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "Trivy dependency scan on pull requests and in CI" ] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Development", "technology": "Java", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "covered": true, "coveredBy": [ "Trivy gate on the container build" ] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Development", "technology": "Java", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Development", "technology": "Spring Boot", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "covered": true, "coveredBy": [ "Trivy gate on the container build" ] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Development", "technology": "Spring Boot", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Development", "technology": "React", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "covered": true, "coveredBy": [ "Trivy gate on the container build" ] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Development", "technology": "React", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Test", "technology": "Java", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "covered": true, "coveredBy": [ "Trivy gate on the container build" ] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Test", "technology": "Java", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Test", "technology": "Spring Boot", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "covered": true, "coveredBy": [ "Trivy gate on the container build" ] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Test", "technology": "Spring Boot", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Test", "technology": "React", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "covered": true, "coveredBy": [ "Trivy gate on the container build" ] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Test", "technology": "React", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Production", "technology": "Java", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "covered": true, "coveredBy": [ "Trivy gate on the container build" ] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Production", "technology": "Java", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Production", "technology": "Spring Boot", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "covered": true, "coveredBy": [ "Trivy gate on the container build" ] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Production", "technology": "Spring Boot", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Production", "technology": "React", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "covered": true, "coveredBy": [ "Trivy gate on the container build" ] }, { "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Production", "technology": "React", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Development", "technology": "Java", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "covered": true, "coveredBy": [ "Renovate dependency update pull requests" ] }, { "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Development", "technology": "Spring Boot", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "covered": true, "coveredBy": [ "Renovate dependency update pull requests" ] }, { "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Development", "technology": "React", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "covered": true, "coveredBy": [ "Renovate dependency update pull requests" ] }, { "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Test", "technology": "Java", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "covered": true, "coveredBy": [ "Renovate dependency update pull requests" ] }, { "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Test", "technology": "Spring Boot", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "covered": true, "coveredBy": [ "Renovate dependency update pull requests" ] }, { "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Test", "technology": "React", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "covered": true, "coveredBy": [ "Renovate dependency update pull requests" ] }, { "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Production", "technology": "Java", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "covered": true, "coveredBy": [ "Renovate dependency update pull requests" ] }, { "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Production", "technology": "Spring Boot", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "covered": true, "coveredBy": [ "Renovate dependency update pull requests" ] }, { "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Production", "technology": "React", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "covered": true, "coveredBy": [ "Renovate dependency update pull requests" ] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "Java", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "Java", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "Spring Boot", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "Spring Boot", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "React", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "React", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "PostgreSQL", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "PostgreSQL", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "Docker", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "Docker", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "Java", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "Java", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "Spring Boot", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "Spring Boot", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "React", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "React", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "PostgreSQL", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "PostgreSQL", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "Docker", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "Docker", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Production", "technology": "Java", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Production", "technology": "Java", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": true, "coveredBy": [ "Defender for Cloud vulnerability assessment in production" ] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Production", "technology": "Spring Boot", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Production", "technology": "Spring Boot", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": true, "coveredBy": [ "Defender for Cloud vulnerability assessment in production" ] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Production", "technology": "React", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Production", "technology": "React", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": true, "coveredBy": [ "Defender for Cloud vulnerability assessment in production" ] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Production", "technology": "PostgreSQL", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Production", "technology": "PostgreSQL", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": true, "coveredBy": [ "Defender for Cloud vulnerability assessment in production" ] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Production", "technology": "Docker", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Production", "technology": "Docker", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": true, "coveredBy": [ "Defender for Cloud vulnerability assessment in production" ] }, { "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Development", "technology": "Terraform", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "covered": true, "coveredBy": [ "Checkov Terraform scan on pull requests and in CI" ] }, { "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Development", "technology": "Terraform", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "Checkov Terraform scan on pull requests and in CI" ] }, { "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Development", "technology": "Helm", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Development", "technology": "Helm", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Test", "technology": "Terraform", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "covered": true, "coveredBy": [ "Checkov Terraform scan on pull requests and in CI" ] }, { "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Test", "technology": "Terraform", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "Checkov Terraform scan on pull requests and in CI" ] }, { "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Test", "technology": "Helm", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Test", "technology": "Helm", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Production", "technology": "Terraform", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "covered": true, "coveredBy": [ "Checkov Terraform scan on pull requests and in CI" ] }, { "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Production", "technology": "Terraform", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "Checkov Terraform scan on pull requests and in CI" ] }, { "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Production", "technology": "Helm", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Production", "technology": "Helm", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Container Security", "control": "Container Image Vulnerability Scan", "environment": "Development", "technology": "Docker", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "Trivy image scan in CI and registry" ] }, { "capability": "Container Security", "control": "Container Image Vulnerability Scan", "environment": "Development", "technology": "Docker", "phase": "Build", "controlPoint": "Registry", "weight": 2, "covered": true, "coveredBy": [ "Trivy image scan in CI and registry" ] }, { "capability": "Container Security", "control": "Container Image Vulnerability Scan", "environment": "Test", "technology": "Docker", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "Trivy image scan in CI and registry" ] }, { "capability": "Container Security", "control": "Container Image Vulnerability Scan", "environment": "Test", "technology": "Docker", "phase": "Build", "controlPoint": "Registry", "weight": 2, "covered": true, "coveredBy": [ "Trivy image scan in CI and registry" ] }, { "capability": "Container Security", "control": "Container Image Vulnerability Scan", "environment": "Production", "technology": "Docker", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "covered": true, "coveredBy": [ "Trivy image scan in CI and registry" ] }, { "capability": "Container Security", "control": "Container Image Vulnerability Scan", "environment": "Production", "technology": "Docker", "phase": "Build", "controlPoint": "Registry", "weight": 2, "covered": true, "coveredBy": [ "Trivy image scan in CI and registry" ] }, { "capability": "Kubernetes Security", "control": "Kubernetes Workload Configuration Scan", "environment": "Development", "technology": "Kubernetes", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Kubernetes Security", "control": "Kubernetes Workload Configuration Scan", "environment": "Development", "technology": "Kubernetes", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Kubernetes Security", "control": "Kubernetes Workload Configuration Scan", "environment": "Test", "technology": "Kubernetes", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Kubernetes Security", "control": "Kubernetes Workload Configuration Scan", "environment": "Test", "technology": "Kubernetes", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Kubernetes Security", "control": "Kubernetes Workload Configuration Scan", "environment": "Production", "technology": "Kubernetes", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Kubernetes Security", "control": "Kubernetes Workload Configuration Scan", "environment": "Production", "technology": "Kubernetes", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Kubernetes Security", "control": "Cluster Benchmark Assessment", "environment": "Development", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Kubernetes Security", "control": "Cluster Benchmark Assessment", "environment": "Test", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Kubernetes Security", "control": "Cluster Benchmark Assessment", "environment": "Production", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Cloud Configuration Security", "control": "Cloud Posture Continuous Assessment", "environment": "Development", "technology": "Azure", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Cloud Configuration Security", "control": "Cloud Posture Continuous Assessment", "environment": "Test", "technology": "Azure", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Cloud Configuration Security", "control": "Cloud Posture Continuous Assessment", "environment": "Production", "technology": "Azure", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "covered": true, "coveredBy": [ "Defender for Cloud posture on the production subscription" ] }, { "capability": "Cloud Configuration Security", "control": "Cloud Guardrail Enforcement", "environment": "Development", "technology": "Azure", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 1, "covered": true, "coveredBy": [ "Azure Policy deny assignments on resource deployments" ] }, { "capability": "Cloud Configuration Security", "control": "Cloud Guardrail Enforcement", "environment": "Test", "technology": "Azure", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 1, "covered": true, "coveredBy": [ "Azure Policy deny assignments on resource deployments" ] }, { "capability": "Cloud Configuration Security", "control": "Cloud Guardrail Enforcement", "environment": "Production", "technology": "Azure", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 1, "covered": true, "coveredBy": [ "Azure Policy deny assignments on resource deployments" ] }, { "capability": "Secrets Management", "control": "Central Secret Storage", "environment": null, "technology": null, "phase": "Build", "controlPoint": "CI Pipeline", "weight": 1, "covered": true, "coveredBy": [ "Azure Key Vault for application secrets" ] }, { "capability": "Secrets Management", "control": "Central Secret Storage", "environment": null, "technology": null, "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 1, "covered": true, "coveredBy": [ "Azure Key Vault for application secrets" ] }, { "capability": "Secrets Management", "control": "Central Secret Storage", "environment": null, "technology": null, "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": true, "coveredBy": [ "Azure Key Vault for application secrets" ] }, { "capability": "Secrets Management", "control": "Secret Rotation", "environment": null, "technology": null, "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Secrets Management", "control": "Secret Access Auditing", "environment": null, "technology": null, "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "DAST", "control": "Automated Dynamic Scan", "environment": "Development", "technology": null, "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "DAST", "control": "Automated Dynamic Scan", "environment": "Test", "technology": null, "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "covered": true, "coveredBy": [ "OWASP ZAP baseline scan against TEST" ] }, { "capability": "DAST", "control": "Automated Dynamic Scan", "environment": "Production", "technology": null, "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "DAST", "control": "Authenticated Dynamic Scan", "environment": "Development", "technology": null, "phase": "Test", "controlPoint": "CI Pipeline", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "DAST", "control": "Authenticated Dynamic Scan", "environment": "Test", "technology": null, "phase": "Test", "controlPoint": "CI Pipeline", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "DAST", "control": "Authenticated Dynamic Scan", "environment": "Production", "technology": null, "phase": "Test", "controlPoint": "CI Pipeline", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "DAST", "control": "Dynamic Findings Block the Release", "environment": "Development", "technology": null, "phase": "Release", "controlPoint": "Release Gate", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "DAST", "control": "Dynamic Findings Block the Release", "environment": "Test", "technology": null, "phase": "Release", "controlPoint": "Release Gate", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "DAST", "control": "Dynamic Findings Block the Release", "environment": "Production", "technology": null, "phase": "Release", "controlPoint": "Release Gate", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "API Security Testing", "control": "API Security Scan", "environment": "Development", "technology": "REST", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "API Security Testing", "control": "API Security Scan", "environment": "Development", "technology": "REST", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "API Security Testing", "control": "API Security Scan", "environment": "Test", "technology": "REST", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "API Security Testing", "control": "API Security Scan", "environment": "Test", "technology": "REST", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "API Security Testing", "control": "API Security Scan", "environment": "Production", "technology": "REST", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "API Security Testing", "control": "API Security Scan", "environment": "Production", "technology": "REST", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "API Security Testing", "control": "API Schema Conformance Test", "environment": "Development", "technology": "REST", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "API Security Testing", "control": "API Schema Conformance Test", "environment": "Test", "technology": "REST", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "API Security Testing", "control": "API Schema Conformance Test", "environment": "Production", "technology": "REST", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Fuzzing", "control": "Interface Fuzz Testing", "environment": null, "technology": "Java", "phase": "Code", "controlPoint": "Local CLI", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Fuzzing", "control": "Interface Fuzz Testing", "environment": null, "technology": "Java", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Fuzzing", "control": "Interface Fuzz Testing", "environment": null, "technology": "REST", "phase": "Code", "controlPoint": "Local CLI", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Fuzzing", "control": "Interface Fuzz Testing", "environment": null, "technology": "REST", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Penetration Testing", "control": "Periodic Penetration Test", "environment": "Development", "technology": null, "phase": "Test", "controlPoint": "Manual Review", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "Penetration Testing", "control": "Periodic Penetration Test", "environment": "Development", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "Penetration Testing", "control": "Periodic Penetration Test", "environment": "Test", "technology": null, "phase": "Test", "controlPoint": "Manual Review", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "Penetration Testing", "control": "Periodic Penetration Test", "environment": "Test", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 3, "covered": false, "coveredBy": [] }, { "capability": "Penetration Testing", "control": "Periodic Penetration Test", "environment": "Production", "technology": null, "phase": "Test", "controlPoint": "Manual Review", "weight": 3, "covered": true, "coveredBy": [ "Annual third-party penetration test" ] }, { "capability": "Penetration Testing", "control": "Periodic Penetration Test", "environment": "Production", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 3, "covered": true, "coveredBy": [ "Annual third-party penetration test" ] }, { "capability": "Penetration Testing", "control": "Penetration Test Remediation Tracking", "environment": "Development", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Penetration Testing", "control": "Penetration Test Remediation Tracking", "environment": "Test", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Penetration Testing", "control": "Penetration Test Remediation Tracking", "environment": "Production", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Admission Control", "control": "Admission Policy Enforcement", "environment": "Development", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Admission Control", "control": "Admission Policy Enforcement", "environment": "Test", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Admission Control", "control": "Admission Policy Enforcement", "environment": "Production", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Admission Control", "control": "Admission Policy Audit Mode", "environment": "Development", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "covered": true, "coveredBy": [ "Kyverno policies in audit mode" ] }, { "capability": "Admission Control", "control": "Admission Policy Audit Mode", "environment": "Test", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "covered": true, "coveredBy": [ "Kyverno policies in audit mode" ] }, { "capability": "Admission Control", "control": "Admission Policy Audit Mode", "environment": "Production", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "covered": true, "coveredBy": [ "Kyverno policies in audit mode" ] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": true, "coveredBy": [ "Argo CD reconciliation against Git" ] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": true, "coveredBy": [ "Argo CD reconciliation against Git" ] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Terraform", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Terraform", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Helm", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": true, "coveredBy": [ "Argo CD reconciliation against Git" ] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Helm", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": true, "coveredBy": [ "Argo CD reconciliation against Git" ] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Azure", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": true, "coveredBy": [ "Argo CD reconciliation against Git" ] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": true, "coveredBy": [ "Argo CD reconciliation against Git" ] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Terraform", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Terraform", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Helm", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": true, "coveredBy": [ "Argo CD reconciliation against Git" ] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Helm", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": true, "coveredBy": [ "Argo CD reconciliation against Git" ] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Azure", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": true, "coveredBy": [ "Argo CD reconciliation against Git" ] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": true, "coveredBy": [ "Argo CD reconciliation against Git" ] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Terraform", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Terraform", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Helm", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": true, "coveredBy": [ "Argo CD reconciliation against Git" ] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Helm", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": true, "coveredBy": [ "Argo CD reconciliation against Git" ] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Azure", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Development", "technology": "Docker", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Development", "technology": "Docker", "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Development", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Development", "technology": "Kubernetes", "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Test", "technology": "Docker", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Test", "technology": "Docker", "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Test", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Test", "technology": "Kubernetes", "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Production", "technology": "Docker", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Production", "technology": "Docker", "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Production", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Production", "technology": "Kubernetes", "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 2, "covered": false, "coveredBy": [] }, { "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Development", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "covered": true, "coveredBy": [ "Default-deny NetworkPolicies in the cluster" ] }, { "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Development", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": true, "coveredBy": [ "Default-deny NetworkPolicies in the cluster" ] }, { "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Development", "technology": "Azure", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Development", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Test", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "covered": true, "coveredBy": [ "Default-deny NetworkPolicies in the cluster" ] }, { "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Test", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": true, "coveredBy": [ "Default-deny NetworkPolicies in the cluster" ] }, { "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Test", "technology": "Azure", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Test", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Production", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "covered": true, "coveredBy": [ "Default-deny NetworkPolicies in the cluster" ] }, { "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Production", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": true, "coveredBy": [ "Default-deny NetworkPolicies in the cluster" ] }, { "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Production", "technology": "Azure", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Production", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Network Security", "control": "Egress Traffic Control", "environment": "Development", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Network Security", "control": "Egress Traffic Control", "environment": "Development", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Network Security", "control": "Egress Traffic Control", "environment": "Test", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Network Security", "control": "Egress Traffic Control", "environment": "Test", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Network Security", "control": "Egress Traffic Control", "environment": "Production", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Network Security", "control": "Egress Traffic Control", "environment": "Production", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Workload Identity", "control": "Short-Lived Workload Identity", "environment": "Development", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "covered": true, "coveredBy": [ "Entra Workload Identity on AKS" ] }, { "capability": "Workload Identity", "control": "Short-Lived Workload Identity", "environment": "Development", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": true, "coveredBy": [ "Entra Workload Identity on AKS" ] }, { "capability": "Workload Identity", "control": "Short-Lived Workload Identity", "environment": "Development", "technology": "Azure", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "covered": true, "coveredBy": [ "Entra Workload Identity on AKS" ] }, { "capability": "Workload Identity", "control": "Short-Lived Workload Identity", "environment": "Development", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": true, "coveredBy": [ "Entra Workload Identity on AKS" ] }, { "capability": "Workload Identity", "control": "Short-Lived Workload Identity", "environment": "Test", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "covered": true, "coveredBy": [ "Entra Workload Identity on AKS" ] }, { "capability": "Workload Identity", "control": "Short-Lived Workload Identity", "environment": "Test", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": true, "coveredBy": [ "Entra Workload Identity on AKS" ] }, { "capability": "Workload Identity", "control": "Short-Lived Workload Identity", "environment": "Test", "technology": "Azure", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "covered": true, "coveredBy": [ "Entra Workload Identity on AKS" ] }, { "capability": "Workload Identity", "control": "Short-Lived Workload Identity", "environment": "Test", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": true, "coveredBy": [ "Entra Workload Identity on AKS" ] }, { "capability": "Workload Identity", "control": "Short-Lived Workload Identity", "environment": "Production", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "covered": true, "coveredBy": [ "Entra Workload Identity on AKS" ] }, { "capability": "Workload Identity", "control": "Short-Lived Workload Identity", "environment": "Production", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": true, "coveredBy": [ "Entra Workload Identity on AKS" ] }, { "capability": "Workload Identity", "control": "Short-Lived Workload Identity", "environment": "Production", "technology": "Azure", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "covered": true, "coveredBy": [ "Entra Workload Identity on AKS" ] }, { "capability": "Workload Identity", "control": "Short-Lived Workload Identity", "environment": "Production", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": true, "coveredBy": [ "Entra Workload Identity on AKS" ] }, { "capability": "Workload Identity", "control": "Elimination of Static Machine Credentials", "environment": "Development", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Workload Identity", "control": "Elimination of Static Machine Credentials", "environment": "Development", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Workload Identity", "control": "Elimination of Static Machine Credentials", "environment": "Test", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Workload Identity", "control": "Elimination of Static Machine Credentials", "environment": "Test", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Workload Identity", "control": "Elimination of Static Machine Credentials", "environment": "Production", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Workload Identity", "control": "Elimination of Static Machine Credentials", "environment": "Production", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "Vulnerability Management", "control": "Central Finding Routing", "environment": "Development", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 1, "covered": true, "coveredBy": [ "DefectDojo as the finding destination" ] }, { "capability": "Vulnerability Management", "control": "Central Finding Routing", "environment": "Development", "technology": null, "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 1, "covered": true, "coveredBy": [ "DefectDojo as the finding destination" ] }, { "capability": "Vulnerability Management", "control": "Central Finding Routing", "environment": "Test", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 1, "covered": true, "coveredBy": [ "DefectDojo as the finding destination" ] }, { "capability": "Vulnerability Management", "control": "Central Finding Routing", "environment": "Test", "technology": null, "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 1, "covered": true, "coveredBy": [ "DefectDojo as the finding destination" ] }, { "capability": "Vulnerability Management", "control": "Central Finding Routing", "environment": "Production", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 1, "covered": true, "coveredBy": [ "DefectDojo as the finding destination" ] }, { "capability": "Vulnerability Management", "control": "Central Finding Routing", "environment": "Production", "technology": null, "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 1, "covered": true, "coveredBy": [ "DefectDojo as the finding destination" ] }, { "capability": "Vulnerability Management", "control": "Finding SLA Tracking", "environment": "Development", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 1, "covered": true, "coveredBy": [ "DefectDojo SLA policy per severity" ] }, { "capability": "Vulnerability Management", "control": "Finding SLA Tracking", "environment": "Test", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 1, "covered": true, "coveredBy": [ "DefectDojo SLA policy per severity" ] }, { "capability": "Vulnerability Management", "control": "Finding SLA Tracking", "environment": "Production", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 1, "covered": true, "coveredBy": [ "DefectDojo SLA policy per severity" ] }, { "capability": "SIEM", "control": "Security Log Centralization", "environment": "Development", "technology": null, "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 1, "covered": false, "coveredBy": [] }, { "capability": "SIEM", "control": "Security Log Centralization", "environment": "Test", "technology": null, "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 1, "covered": true, "coveredBy": [ "Azure Monitor log pipeline" ] }, { "capability": "SIEM", "control": "Security Log Centralization", "environment": "Production", "technology": null, "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 1, "covered": true, "coveredBy": [ "Azure Monitor log pipeline" ] }, { "capability": "Incident Response", "control": "Incident Response Plan", "environment": null, "technology": null, "phase": "Monitor / Respond", "controlPoint": "Manual Review", "weight": 1, "covered": true, "coveredBy": [ "Incident response runbook, rehearsed twice a year" ] } ], "gaps": [ { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "DAST", "control": "Authenticated Dynamic Scan", "environment": "Production", "technology": null, "phase": "Test", "controlPoint": "CI Pipeline", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "AUTOMATION_GAP", "severity": "CRITICAL", "capability": "Penetration Testing", "control": "Periodic Penetration Test", "environment": "Production", "technology": null, "phase": "Test", "controlPoint": "Manual Review", "weight": 3, "expected": "AUTOMATED", "actual": "MANUAL", "description": "expected runs automatically, actual run by hand" }, { "type": "AUTOMATION_GAP", "severity": "CRITICAL", "capability": "Penetration Testing", "control": "Periodic Penetration Test", "environment": "Production", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 3, "expected": "AUTOMATED", "actual": "MANUAL", "description": "expected runs automatically, actual run by hand" }, { "type": "ENFORCEMENT_GAP", "severity": "CRITICAL", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Production", "technology": "Java", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "expected": "BLOCKING", "actual": "WARNING", "description": "expected blocking, actual a warning" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Production", "technology": "Java", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENFORCEMENT_GAP", "severity": "CRITICAL", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Production", "technology": "Spring Boot", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "expected": "BLOCKING", "actual": "WARNING", "description": "expected blocking, actual a warning" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Production", "technology": "Spring Boot", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENFORCEMENT_GAP", "severity": "CRITICAL", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Production", "technology": "React", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "expected": "BLOCKING", "actual": "WARNING", "description": "expected blocking, actual a warning" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Production", "technology": "React", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Admission Control", "control": "Admission Policy Enforcement", "environment": "Production", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "TECHNOLOGY_GAP", "severity": "CRITICAL", "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Production", "technology": "Helm", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "CRITICAL", "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Production", "technology": "Helm", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "CRITICAL", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Terraform", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "CRITICAL", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Terraform", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "CRITICAL", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Azure", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "CRITICAL", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Production", "technology": "Docker", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Production", "technology": "Docker", "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Production", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Production", "technology": "Kubernetes", "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Production", "technology": "Java", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Production", "technology": "Spring Boot", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Production", "technology": "React", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Production", "technology": "PostgreSQL", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Production", "technology": "Docker", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "API Security Testing", "control": "API Schema Conformance Test", "environment": "Production", "technology": "REST", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "API Security Testing", "control": "API Security Scan", "environment": "Production", "technology": "REST", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "API Security Testing", "control": "API Security Scan", "environment": "Production", "technology": "REST", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENVIRONMENT_GAP", "severity": "CRITICAL", "capability": "DAST", "control": "Automated Dynamic Scan", "environment": "Production", "technology": null, "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "DAST", "control": "Dynamic Findings Block the Release", "environment": "Production", "technology": null, "phase": "Release", "controlPoint": "Release Gate", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Network Security", "control": "Egress Traffic Control", "environment": "Production", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Network Security", "control": "Egress Traffic Control", "environment": "Production", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Kubernetes Security", "control": "Cluster Benchmark Assessment", "environment": "Production", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Kubernetes Security", "control": "Kubernetes Workload Configuration Scan", "environment": "Production", "technology": "Kubernetes", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Kubernetes Security", "control": "Kubernetes Workload Configuration Scan", "environment": "Production", "technology": "Kubernetes", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "TECHNOLOGY_GAP", "severity": "CRITICAL", "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Production", "technology": "Azure", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "CRITICAL", "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Production", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Penetration Testing", "control": "Penetration Test Remediation Tracking", "environment": "Production", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Workload Identity", "control": "Elimination of Static Machine Credentials", "environment": "Production", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "CRITICAL", "capability": "Workload Identity", "control": "Elimination of Static Machine Credentials", "environment": "Production", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "DAST", "control": "Authenticated Dynamic Scan", "environment": "Test", "technology": null, "phase": "Test", "controlPoint": "CI Pipeline", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENVIRONMENT_GAP", "severity": "HIGH", "capability": "Penetration Testing", "control": "Periodic Penetration Test", "environment": "Test", "technology": null, "phase": "Test", "controlPoint": "Manual Review", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "ENVIRONMENT_GAP", "severity": "HIGH", "capability": "Penetration Testing", "control": "Periodic Penetration Test", "environment": "Test", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "ENFORCEMENT_GAP", "severity": "HIGH", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Test", "technology": "Java", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "expected": "BLOCKING", "actual": "WARNING", "description": "expected blocking, actual a warning" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Test", "technology": "Java", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENFORCEMENT_GAP", "severity": "HIGH", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Test", "technology": "Spring Boot", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "expected": "BLOCKING", "actual": "WARNING", "description": "expected blocking, actual a warning" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Test", "technology": "Spring Boot", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENFORCEMENT_GAP", "severity": "HIGH", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Test", "technology": "React", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "expected": "BLOCKING", "actual": "WARNING", "description": "expected blocking, actual a warning" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Test", "technology": "React", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Admission Control", "control": "Admission Policy Enforcement", "environment": "Test", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "TECHNOLOGY_GAP", "severity": "HIGH", "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Test", "technology": "Helm", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "HIGH", "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Test", "technology": "Helm", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "HIGH", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Terraform", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "HIGH", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Terraform", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "HIGH", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Azure", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "HIGH", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Test", "technology": "Docker", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Test", "technology": "Docker", "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Test", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Test", "technology": "Kubernetes", "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "Java", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENVIRONMENT_GAP", "severity": "HIGH", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "Java", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "Spring Boot", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENVIRONMENT_GAP", "severity": "HIGH", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "Spring Boot", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "React", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENVIRONMENT_GAP", "severity": "HIGH", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "React", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "PostgreSQL", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENVIRONMENT_GAP", "severity": "HIGH", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "PostgreSQL", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "Docker", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENVIRONMENT_GAP", "severity": "HIGH", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Test", "technology": "Docker", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "API Security Testing", "control": "API Schema Conformance Test", "environment": "Test", "technology": "REST", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "API Security Testing", "control": "API Security Scan", "environment": "Test", "technology": "REST", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "API Security Testing", "control": "API Security Scan", "environment": "Test", "technology": "REST", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENVIRONMENT_GAP", "severity": "HIGH", "capability": "Cloud Configuration Security", "control": "Cloud Posture Continuous Assessment", "environment": "Test", "technology": "Azure", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "CONTROL_POINT_GAP", "severity": "HIGH", "capability": "Code Review Security", "control": "Security Review of Sensitive Changes", "environment": null, "technology": null, "phase": "Code", "controlPoint": "Manual Review", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not at this control point" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "DAST", "control": "Dynamic Findings Block the Release", "environment": "Test", "technology": null, "phase": "Release", "controlPoint": "Release Gate", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Network Security", "control": "Egress Traffic Control", "environment": "Test", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Network Security", "control": "Egress Traffic Control", "environment": "Test", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Fuzzing", "control": "Interface Fuzz Testing", "environment": null, "technology": "Java", "phase": "Code", "controlPoint": "Local CLI", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Fuzzing", "control": "Interface Fuzz Testing", "environment": null, "technology": "Java", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Fuzzing", "control": "Interface Fuzz Testing", "environment": null, "technology": "REST", "phase": "Code", "controlPoint": "Local CLI", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Fuzzing", "control": "Interface Fuzz Testing", "environment": null, "technology": "REST", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Kubernetes Security", "control": "Cluster Benchmark Assessment", "environment": "Test", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Kubernetes Security", "control": "Kubernetes Workload Configuration Scan", "environment": "Test", "technology": "Kubernetes", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Kubernetes Security", "control": "Kubernetes Workload Configuration Scan", "environment": "Test", "technology": "Kubernetes", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "TECHNOLOGY_GAP", "severity": "HIGH", "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Test", "technology": "Azure", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "HIGH", "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Test", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Penetration Testing", "control": "Penetration Test Remediation Tracking", "environment": "Test", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Secrets Management", "control": "Secret Access Auditing", "environment": null, "technology": null, "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Secret Scanning", "control": "Pre-Commit Secret Detection", "environment": null, "technology": null, "phase": "Code", "controlPoint": "Pre-Commit", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Secrets Management", "control": "Secret Rotation", "environment": null, "technology": null, "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Security Requirements", "control": "Security Requirements Defined", "environment": null, "technology": null, "phase": "Plan", "controlPoint": "Manual Review", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Workload Identity", "control": "Elimination of Static Machine Credentials", "environment": "Test", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Workload Identity", "control": "Elimination of Static Machine Credentials", "environment": "Test", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "HIGH", "capability": "Threat Modeling", "control": "Threat Model Review on Architecture Change", "environment": null, "technology": null, "phase": "Design", "controlPoint": "Manual Review", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "SLA_GAP", "severity": "MEDIUM", "capability": "Penetration Testing", "control": "Periodic Penetration Test", "environment": "Production", "technology": null, "phase": "Test", "controlPoint": "Manual Review", "weight": 3, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "MEDIUM", "capability": "Penetration Testing", "control": "Periodic Penetration Test", "environment": "Production", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 3, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "MEDIUM", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "MEDIUM", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "MEDIUM", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Helm", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "MEDIUM", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Production", "technology": "Helm", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "MEDIUM", "capability": "Admission Control", "control": "Admission Policy Audit Mode", "environment": "Production", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "MEDIUM", "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Production", "technology": "Java", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "MEDIUM", "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Production", "technology": "Spring Boot", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "MEDIUM", "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Production", "technology": "React", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "MEDIUM", "capability": "SIEM", "control": "Security Log Centralization", "environment": "Production", "technology": null, "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 1, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "DAST", "control": "Authenticated Dynamic Scan", "environment": "Development", "technology": null, "phase": "Test", "controlPoint": "CI Pipeline", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENVIRONMENT_GAP", "severity": "LOW", "capability": "Penetration Testing", "control": "Periodic Penetration Test", "environment": "Development", "technology": null, "phase": "Test", "controlPoint": "Manual Review", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "ENVIRONMENT_GAP", "severity": "LOW", "capability": "Penetration Testing", "control": "Periodic Penetration Test", "environment": "Development", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "ENFORCEMENT_GAP", "severity": "LOW", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Development", "technology": "Java", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "expected": "BLOCKING", "actual": "WARNING", "description": "expected blocking, actual a warning" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Development", "technology": "Java", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENFORCEMENT_GAP", "severity": "LOW", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Development", "technology": "Spring Boot", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "expected": "BLOCKING", "actual": "WARNING", "description": "expected blocking, actual a warning" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Development", "technology": "Spring Boot", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENFORCEMENT_GAP", "severity": "LOW", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Development", "technology": "React", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 3, "expected": "BLOCKING", "actual": "WARNING", "description": "expected blocking, actual a warning" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "SCA", "control": "Vulnerable Dependency Gate", "environment": "Development", "technology": "React", "phase": "Release", "controlPoint": "Release Gate", "weight": 3, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Admission Control", "control": "Admission Policy Enforcement", "environment": "Development", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "TECHNOLOGY_GAP", "severity": "LOW", "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Development", "technology": "Helm", "phase": "Code", "controlPoint": "Pull Request", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "LOW", "capability": "IaC Security", "control": "IaC Misconfiguration Detection", "environment": "Development", "technology": "Helm", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "TECHNOLOGY_GAP", "severity": "LOW", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Terraform", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "LOW", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Terraform", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Helm", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Helm", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "TECHNOLOGY_GAP", "severity": "LOW", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Azure", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "LOW", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Development", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Helm", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "Drift Detection", "control": "Infrastructure Drift Detection", "environment": "Test", "technology": "Helm", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Development", "technology": "Docker", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Development", "technology": "Docker", "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Development", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Runtime Security", "control": "Runtime Threat Detection", "environment": "Development", "technology": "Kubernetes", "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "Java", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENVIRONMENT_GAP", "severity": "LOW", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "Java", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "Spring Boot", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENVIRONMENT_GAP", "severity": "LOW", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "Spring Boot", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "React", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENVIRONMENT_GAP", "severity": "LOW", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "React", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "PostgreSQL", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENVIRONMENT_GAP", "severity": "LOW", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "PostgreSQL", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "Docker", "phase": "Deploy", "controlPoint": "CD Pipeline", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENVIRONMENT_GAP", "severity": "LOW", "capability": "Vulnerability Scanning", "control": "Known Vulnerability Scan", "environment": "Development", "technology": "Docker", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 2, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "Admission Control", "control": "Admission Policy Audit Mode", "environment": "Development", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "Admission Control", "control": "Admission Policy Audit Mode", "environment": "Test", "technology": "Kubernetes", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "API Security Testing", "control": "API Schema Conformance Test", "environment": "Development", "technology": "REST", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "API Security Testing", "control": "API Security Scan", "environment": "Development", "technology": "REST", "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "API Security Testing", "control": "API Security Scan", "environment": "Development", "technology": "REST", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "ENVIRONMENT_GAP", "severity": "LOW", "capability": "Cloud Configuration Security", "control": "Cloud Posture Continuous Assessment", "environment": "Development", "technology": "Azure", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "ENVIRONMENT_GAP", "severity": "LOW", "capability": "DAST", "control": "Automated Dynamic Scan", "environment": "Development", "technology": null, "phase": "Test", "controlPoint": "CI Pipeline", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "DAST", "control": "Dynamic Findings Block the Release", "environment": "Development", "technology": null, "phase": "Release", "controlPoint": "Release Gate", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Network Security", "control": "Egress Traffic Control", "environment": "Development", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Network Security", "control": "Egress Traffic Control", "environment": "Development", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Kubernetes Security", "control": "Cluster Benchmark Assessment", "environment": "Development", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Continuous Scan", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Kubernetes Security", "control": "Kubernetes Workload Configuration Scan", "environment": "Development", "technology": "Kubernetes", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Kubernetes Security", "control": "Kubernetes Workload Configuration Scan", "environment": "Development", "technology": "Kubernetes", "phase": "Build", "controlPoint": "CI Pipeline", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "TECHNOLOGY_GAP", "severity": "LOW", "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Development", "technology": "Azure", "phase": "Deploy", "controlPoint": "Admission", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "TECHNOLOGY_GAP", "severity": "LOW", "capability": "Network Security", "control": "Network Segmentation Policy", "environment": "Development", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not for this technology" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Penetration Testing", "control": "Penetration Test Remediation Tracking", "environment": "Development", "technology": null, "phase": "Operate", "controlPoint": "Manual Review", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Development", "technology": "Java", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Development", "technology": "Spring Boot", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Development", "technology": "React", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Test", "technology": "Java", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Test", "technology": "Spring Boot", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "SCA", "control": "Automated Dependency Updates", "environment": "Test", "technology": "React", "phase": "Code", "controlPoint": "Pull Request", "weight": 1, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "ENVIRONMENT_GAP", "severity": "LOW", "capability": "SIEM", "control": "Security Log Centralization", "environment": "Development", "technology": null, "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "it runs elsewhere, but not in this environment" }, { "type": "SLA_GAP", "severity": "LOW", "capability": "SIEM", "control": "Security Log Centralization", "environment": "Test", "technology": null, "phase": "Monitor / Respond", "controlPoint": "SIEM", "weight": 1, "expected": "SLA", "actual": "NO_SLA", "description": "expected a remediation deadline, actual none" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Workload Identity", "control": "Elimination of Static Machine Credentials", "environment": "Development", "technology": "Kubernetes", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" }, { "type": "CONTROL_MISSING", "severity": "LOW", "capability": "Workload Identity", "control": "Elimination of Static Machine Credentials", "environment": "Development", "technology": "Azure", "phase": "Operate", "controlPoint": "Runtime", "weight": 1, "expected": "CONTROL", "actual": "NOTHING", "description": "nothing covers it" } ], "roadmap": [ { "priority": 1, "title": "Introduce Known Vulnerability Scan", "effort": "HIGH", "riskReduction": "CRITICAL", "coverageImpact": 0.0716, "scopeCount": 15 }, { "priority": 2, "title": "Introduce Vulnerable Dependency Gate", "effort": "HIGH", "riskReduction": "CRITICAL", "coverageImpact": 0.0644, "scopeCount": 9 }, { "priority": 3, "title": "Extend Infrastructure Drift Detection to the rest of your stack", "effort": "MEDIUM", "riskReduction": "CRITICAL", "coverageImpact": 0.0573, "scopeCount": 12 }, { "priority": 3, "title": "Introduce Runtime Threat Detection", "effort": "HIGH", "riskReduction": "CRITICAL", "coverageImpact": 0.0573, "scopeCount": 12 }, { "priority": 5, "title": "Extend Known Vulnerability Scan to every environment", "effort": "MEDIUM", "riskReduction": "HIGH", "coverageImpact": 0.0477, "scopeCount": 10 } ], "frameworks": [ { "key": "NIST_SSDF", "name": "NIST SSDF", "version": "1.1", "coverage": 0.575, "satisfied": 2, "partial": 6, "notSatisfied": 2, "notAddressedByCatalog": 2, "beyondBaseline": 7, "requirements": [ { "id": "PO.1", "title": "Define Security Requirements for Software Development", "status": "NOT_SATISFIED", "coverage": 0 }, { "id": "PO.2", "title": "Implement Roles and Responsibilities", "status": "NOT_REQUIRED", "coverage": null }, { "id": "PO.3", "title": "Implement Supporting Toolchains", "status": "NOT_REQUIRED", "coverage": null }, { "id": "PO.4", "title": "Define and Use Criteria for Software Security Checks", "status": "NOT_REQUIRED", "coverage": null }, { "id": "PO.5", "title": "Implement and Maintain Secure Environments for Software Development", "status": "PARTIAL", "coverage": 0.5 }, { "id": "PS.1", "title": "Protect All Forms of Code from Unauthorized Access and Tampering", "status": "NOT_REQUIRED", "coverage": null }, { "id": "PS.2", "title": "Provide a Mechanism for Verifying Software Release Integrity", "status": "NOT_REQUIRED", "coverage": null }, { "id": "PS.3", "title": "Archive and Protect Each Software Release", "status": "NOT_REQUIRED", "coverage": null }, { "id": "PW.1", "title": "Design Software to Meet Security Requirements and Mitigate Security Risks", "status": "PARTIAL", "coverage": 0.5 }, { "id": "PW.2", "title": "Review the Software Design to Verify Compliance with Security Requirements and Risk Information", "status": "SATISFIED", "coverage": 1 }, { "id": "PW.4", "title": "Reuse Existing, Well-Secured Software When Feasible Instead of Duplicating Functionality", "status": "PARTIAL", "coverage": 0.8333 }, { "id": "PW.5", "title": "Create Source Code by Adhering to Secure Coding Practices", "status": "NOT_SATISFIED", "coverage": 0 }, { "id": "PW.6", "title": "Configure the Compilation, Interpreter, and Build Processes to Improve Executable Security", "status": "NOT_ADDRESSED", "coverage": null }, { "id": "PW.7", "title": "Review and/or Analyze Human-Readable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements", "status": "PARTIAL", "coverage": 0.9167 }, { "id": "PW.8", "title": "Test Executable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements", "status": "PARTIAL", "coverage": 0.2778 }, { "id": "PW.9", "title": "Configure Software to Have Secure Settings by Default", "status": "NOT_ADDRESSED", "coverage": null }, { "id": "RV.1", "title": "Identify and Confirm Vulnerabilities on an Ongoing Basis", "status": "PARTIAL", "coverage": 0.7222 }, { "id": "RV.2", "title": "Assess, Prioritize, and Remediate Vulnerabilities", "status": "SATISFIED", "coverage": 1 }, { "id": "RV.3", "title": "Analyze Vulnerabilities to Identify Their Root Causes", "status": "NOT_REQUIRED", "coverage": null } ] }, { "key": "OWASP_SAMM", "name": "OWASP SAMM", "version": "2.0", "coverage": 0.5101, "satisfied": 2, "partial": 6, "notSatisfied": 2, "notAddressedByCatalog": 2, "beyondBaseline": 3, "requirements": [ { "id": "SM", "title": "Strategy and Metrics", "status": "NOT_ADDRESSED", "coverage": null }, { "id": "PC", "title": "Policy and Compliance", "status": "NOT_REQUIRED", "coverage": null }, { "id": "EG", "title": "Education and Guidance", "status": "NOT_REQUIRED", "coverage": null }, { "id": "TA", "title": "Threat Assessment", "status": "PARTIAL", "coverage": 0.5 }, { "id": "SR", "title": "Security Requirements", "status": "NOT_SATISFIED", "coverage": 0 }, { "id": "SA", "title": "Security Architecture", "status": "NOT_REQUIRED", "coverage": null }, { "id": "SB", "title": "Secure Build", "status": "PARTIAL", "coverage": 0.75 }, { "id": "SD", "title": "Secure Deployment", "status": "PARTIAL", "coverage": 0.3333 }, { "id": "DM", "title": "Defect Management", "status": "SATISFIED", "coverage": 1 }, { "id": "AA", "title": "Architecture Assessment", "status": "SATISFIED", "coverage": 1 }, { "id": "RT", "title": "Requirements-driven Testing", "status": "NOT_SATISFIED", "coverage": 0 }, { "id": "ST", "title": "Security Testing", "status": "PARTIAL", "coverage": 0.5333 }, { "id": "IM", "title": "Incident Management", "status": "PARTIAL", "coverage": 0.5556 }, { "id": "EM", "title": "Environment Management", "status": "PARTIAL", "coverage": 0.4286 }, { "id": "OM", "title": "Operational Management", "status": "NOT_ADDRESSED", "coverage": null } ] } ], "toolOverlaps": [ { "tools": [ "SEMGREP", "SONARQUBE" ], "capabilities": [ "SAST" ], "scopeCount": 3 } ] }