"""信息安全自评估 — ISMS report template (single source of truth). The semiannual 安全自评估报告 follows a fixed ISMS structure (the 10 control domains in the 2024 平凯星辰 report). Like ``compliance_catalog`` and the gamification badge catalog, the template lives in CODE — the section tree + which Helix data feeds each section's table is logic, not config a table can hold. A cycle instantiates one ``auditor_assessment_sections`` row per spec below; auto-fed sections get their numbers from :mod:`assessment_data`. Pure data — stdlib-only so a migration could import it if ever needed. Conclusion values (per section): ``compliant`` 符合 / ``partial`` 部分符合 / ``non_compliant`` 不符合 / ``not_assessed`` 未评估 (the default until a human or the AI drafter sets it). Narrative + table sections marked ``conclusion_applicable=False`` (引言 / 结论) carry prose only. """ from __future__ import annotations from typing import Any TEMPLATE_KEY = "isms_default" TEMPLATE_NAME = "信息安全自评估报告(ISMS 默认模板)" CONCLUSIONS: tuple[str, ...] = ( "compliant", "partial", "non_compliant", "not_assessed", ) MEASURE_STATUSES: tuple[str, ...] = ("pending", "in_progress", "done") # Each section spec: # key stable machine key (unique within template) # parent_key None for a top-level domain, else the domain key # title zh display title # sort_order ordering within its level # has_table whether the section renders a data table # table_columns [(key, label)] for the table header (display) # auto_source key into assessment_data.AGGREGATORS, or None # conclusion_applicable False for 引言/结论 (prose only) SECTIONS: list[dict[str, Any]] = [ # 1. 引言 ---------------------------------------------------------- { "key": "intro", "parent_key": None, "title": "引言", "sort_order": 10, "has_table": False, "table_columns": [], "auto_source": None, "conclusion_applicable": False, }, # 2. 管理层承诺 ---------------------------------------------------- { "key": "management_commitment", "parent_key": None, "title": "管理层承诺", "sort_order": 20, "has_table": False, "table_columns": [], "auto_source": None, "conclusion_applicable": True, }, # 3. 资产管理 ------------------------------------------------------ { "key": "asset_management", "parent_key": None, "title": "资产管理", "sort_order": 30, "has_table": True, "table_columns": [ ("asset_type", "资产类型"), ("count", "数量"), ("note", "说明"), ], "auto_source": "asset_inventory", "conclusion_applicable": True, }, # 4. 人力资源安全 -------------------------------------------------- { "key": "hr_security", "parent_key": None, "title": "人力资源安全", "sort_order": 40, "has_table": False, "table_columns": [], "auto_source": None, "conclusion_applicable": True, }, { "key": "hr_headcount", "parent_key": "hr_security", "title": "人员概况", "sort_order": 10, "has_table": True, "table_columns": [("metric", "指标"), ("value", "数值")], "auto_source": "headcount", "conclusion_applicable": False, }, { "key": "hr_offboarding", "parent_key": "hr_security", "title": "离职处理", "sort_order": 20, "has_table": True, "table_columns": [("metric", "指标"), ("value", "数值")], "auto_source": "offboarding_flow", "conclusion_applicable": True, }, # 5. 物理与环境安全 ------------------------------------------------ { "key": "physical_env", "parent_key": None, "title": "物理与环境安全", "sort_order": 50, "has_table": False, "table_columns": [], "auto_source": None, "conclusion_applicable": True, }, { "key": "device_security", "parent_key": "physical_env", "title": "设备安全", "sort_order": 10, "has_table": True, "table_columns": [("asset_type", "设备类型"), ("count", "数量"), ("note", "说明")], "auto_source": "device_inventory", "conclusion_applicable": True, }, # 6. 通信与运营管理 ------------------------------------------------ { "key": "comms_ops", "parent_key": None, "title": "通信与运营管理", "sort_order": 60, "has_table": False, "table_columns": [], "auto_source": None, "conclusion_applicable": True, }, { "key": "network_security", "parent_key": "comms_ops", "title": "网络与云安全", "sort_order": 10, "has_table": True, "table_columns": [("metric", "指标"), ("value", "数值")], "auto_source": "cloud_security", "conclusion_applicable": True, }, # 7. 访问控制 ------------------------------------------------------ { "key": "access_control", "parent_key": None, "title": "访问控制", "sort_order": 70, "has_table": True, "table_columns": [("level", "权限级别"), ("count", "用户数"), ("note", "说明")], "auto_source": "rbac_access", "conclusion_applicable": True, }, { "key": "authentication", "parent_key": "access_control", "title": "身份验证 (MFA)", "sort_order": 10, "has_table": True, "table_columns": [("metric", "指标"), ("value", "数值")], "auto_source": "mfa_coverage", "conclusion_applicable": True, }, { "key": "periodic_review", "parent_key": "access_control", "title": "定期访问复核", "sort_order": 20, "has_table": True, "table_columns": [("metric", "指标"), ("value", "数值")], "auto_source": "access_review", "conclusion_applicable": True, }, # 8. 信息系统采集、开发与维护 -------------------------------------- { "key": "sysdev", "parent_key": None, "title": "信息系统采集、开发与维护", "sort_order": 80, "has_table": False, "table_columns": [], "auto_source": None, "conclusion_applicable": True, }, { "key": "vuln_mgmt", "parent_key": "sysdev", "title": "漏洞与暴露管理", "sort_order": 10, "has_table": True, "table_columns": [("metric", "指标"), ("value", "数值")], "auto_source": "exposure_findings", "conclusion_applicable": True, }, { "key": "change_mgmt", "parent_key": "sysdev", "title": "变更管理", "sort_order": 20, "has_table": True, "table_columns": [("change_type", "变更类型"), ("count", "数量"), ("success_rate", "成功率")], "auto_source": "change_mgmt", "conclusion_applicable": True, }, { "key": "secret_mgmt", "parent_key": "sysdev", "title": "密钥与凭证管理", "sort_order": 30, "has_table": True, "table_columns": [("metric", "指标"), ("value", "数值")], "auto_source": "secret_rotation", "conclusion_applicable": True, }, # 9. 信息安全事件管理 ---------------------------------------------- { "key": "incident_mgmt", "parent_key": None, "title": "信息安全事件管理", "sort_order": 90, "has_table": True, "table_columns": [("metric", "指标"), ("value", "数值")], "auto_source": "incident_stats", "conclusion_applicable": True, }, # 10. 业务连续性管理 ----------------------------------------------- { "key": "business_continuity", "parent_key": None, "title": "业务连续性管理", "sort_order": 100, "has_table": False, "table_columns": [], "auto_source": None, "conclusion_applicable": True, }, # 周期性自我检查执行情况 (ties the two pillars together) ----------- { "key": "periodic_self_check", "parent_key": None, "title": "周期性自我检查执行情况", "sort_order": 110, "has_table": True, "table_columns": [("metric", "指标"), ("value", "数值")], "auto_source": "self_check_summary", "conclusion_applicable": True, }, # 结论 ------------------------------------------------------------- { "key": "conclusion", "parent_key": None, "title": "结论", "sort_order": 120, "has_table": False, "table_columns": [], "auto_source": None, "conclusion_applicable": False, }, ] def section_keys() -> set[str]: return {s["key"] for s in SECTIONS}