docs/vs-nfd/80-grundschutz-mapping.md against the Edition 2023 texts
of both building blocks (fetched from the BSI single PDFs, edition and
retrieval date stated; the dropped requirements of APP.3.1 are listed
as such, CON.11.1's 18 requirements are all Basis). Every requirement
classified as product / operator / n.a.: product rows point at code,
configuration and tests (auth+rate limits, upload controls, security
headers with the honest HSTS-at-the-proxy split, marking = the whole of
M26 under CON.11.1.A7 incl. the answered does-the-marking-carry-a-
security-function question); operator rows say what we hand over
(copy list, procedures, network plan, SBOMs); n.a. rows are argued via
the delimitation statement (no §52 security functions, no built-in
remote maintenance). Open requirements point at their closing issues
(M27/M28/M29/M32), so the document doubles as the gap list; the
never-scheduled external pentest is stated honestly.
Co-Authored-By: Claude Fable 5 (1M context) <noreply@anthropic.com>
