#230: IT-Grundschutz mapping APP.3.1 + CON.11.1 #277

Merged

fable-5 merged 1 commits from issue-230-grundschutz-mapping into main 2026-07-31 10:56:37 +02:00

Conversation 0 Commits 1 Files Changed 2 +113 -2

fable-5 commented 2026-07-31 10:06:29 +02:00

Collaborator

Copy Link

Adds docs/vs-nfd/80-grundschutz-mapping.md: complete per-requirement classification (product/operator/n.a. with justification and evidence) against the Edition 2023 texts fetched from the BSI, incl. the gap list pointing at M27/M28/M29/M32 issues. Stacked on #276.

Adds docs/vs-nfd/80-grundschutz-mapping.md: complete per-requirement classification (product/operator/n.a. with justification and evidence) against the Edition 2023 texts fetched from the BSI, incl. the gap list pointing at M27/M28/M29/M32 issues. Stacked on #276.

fable-5 added 5 commits 2026-07-31 10:06:30 +02:00

#228: security documentation (architecture, data flows, network plan) ... 1cf0458593

docs/vs-nfd/60-sicherheitsdokumentation.md: component diagram with per-
service purpose and privileges, network plan digit-exact against the
deploy compose (127.0.0.1-only app bindings, internal-only data zone),
data-flow diagrams (auth, realtime editing incl. LISTEN/NOTIFY and the
60s collab token, export via the pinned sidecars, backup incl. the
ADR-0026 allowlist, and every read channel), named trust boundaries
(reverse proxy, plugin sandbox, outbound SMTP/mirror), and the complete
list of content copies — in-database, on-volume and outside the
instance — that the deletion concept in #229 builds on. Mermaid only,
German (assessor audience), with the maintained-in-same-PR rule stated.

Co-Authored-By: Claude Fable 5 (1M context) <noreply@anthropic.com>

#229: operations manual (install, update, backup/restore, deletion, roles) ... d641c5dc8a

docs/vs-nfd/70-betriebshandbuch.md: installation as run on the real
stages (airgap variant explicitly pending #218-#221 with what already
exists as groundwork), update/rollback incl. the no-down-migrations
caveat, backup/restore with the ADR-0026 target allowlist and the
rehearsed monthly restore drill (evidence: logs on #98), the full
scheduler-job table (cadences verified against code), the deletion-and-
destruction chapter built on the #228 copy list (per content type:
what deletion reaches, what remains, immediate-destruction path,
decommissioning), and role separation incl. the deliberate limits of a
Site Admin and the honest note that Site Admin read-bypass makes the
content/platform split non-absolute app-side. Every procedure carries
its evidence level (erprobt / nicht geprobt / offen) — nothing claimed
above what was actually executed.

Co-Authored-By: Claude Fable 5 (1M context) <noreply@anthropic.com>

#227: hardening guide with the VS-NfD reference configuration ... 0dc9789cb1

docs/vs-nfd/50-haertungsleitfaden.md: one adoptable profile — every
entry with the exact switch name, value, default and the reason, split
into instance settings (registration closed, api/mcp off, feeds off,
plugins off, classification defaults vs_nfd + upload block, svg reject,
minimal extension list) and deploy-level configuration (empty
BACKUP_ALLOWED_TARGETS enforces backup-local-only outside Site-Admin
reach; tightened session hours; SMTP deliberately unconfigured with the
consequence stated honestly). auth.local.enabled is listed as the one
pending row (#216) with its compensation until then; the guide states
the binding updated-in-same-PR rule for every future switch. Includes
an operator verification checklist (four unauthenticated 404 curls +
readyz + admin spot checks). Cross-referenced from the delimitation
statement (file names made concrete) and consumed by the Grundschutz
mapping (#230).

Co-Authored-By: Claude Fable 5 (1M context) <noreply@anthropic.com>

#231: residual-risk list ... 7fe3ffd936

docs/vs-nfd/90-restrisiken.md: nine entries, each with risk, why it is
accepted, compensating control and decider — unmarked attachment
content (#212), local auth not yet switchable incl. the open runtime-
flippability question (#216), deferred plugin hash pinning (#232), the
one-time git-history secret check with its pattern caveat (#198),
digest-mail titles (I-23, revisit M32), page_links slug residue (I-24),
the IndexedDB endpoint copy (I-25), deliberately unscheduled features,
and the Site-Admin read bypass. Binding same-PR maintenance rule
stated; referenced from the delimitation statement and consumed by the
Grundschutz mapping.

Co-Authored-By: Claude Fable 5 (1M context) <noreply@anthropic.com>

#230: IT-Grundschutz mapping for APP.3.1 and CON.11.1 ... 4d1e0f36c7

docs/vs-nfd/80-grundschutz-mapping.md against the Edition 2023 texts
of both building blocks (fetched from the BSI single PDFs, edition and
retrieval date stated; the dropped requirements of APP.3.1 are listed
as such, CON.11.1's 18 requirements are all Basis). Every requirement
classified as product / operator / n.a.: product rows point at code,
configuration and tests (auth+rate limits, upload controls, security
headers with the honest HSTS-at-the-proxy split, marking = the whole of
M26 under CON.11.1.A7 incl. the answered does-the-marking-carry-a-
security-function question); operator rows say what we hand over
(copy list, procedures, network plan, SBOMs); n.a. rows are argued via
the delimitation statement (no §52 security functions, no built-in
remote maintenance). Open requirements point at their closing issues
(M27/M28/M29/M32), so the document doubles as the gap list; the
never-scheduled external pentest is stated honestly.

Co-Authored-By: Claude Fable 5 (1M context) <noreply@anthropic.com>

fable-5 referenced this pull request 2026-07-31 10:34:19 +02:00

#227: hardening guide / VS-NfD reference configuration #275

fable-5 force-pushed issue-230-grundschutz-mapping from 4d1e0f36c7 to 919201d9b0 2026-07-31 10:35:39 +02:00 Compare

fable-5 merged commit 919201d9b0 into main 2026-07-31 10:56:37 +02:00

fable-5 referenced this pull request 2026-07-31 10:57:45 +02:00

[VS-NfD] Produce the IT-Grundschutz mapping for APP.3.1 and CON.11.1 #230

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area:auth

  

area:docs

  

area:export

  

area:ops

  

area:storage

  

area:supply-chain

  

auth

Authentication, permissions, quotas

  

backend

API server (apps/api)

  

blocked

Blocked on external dependency/infrastructure

  

collab

Collaboration server (apps/collab)

  

deployment

Docker, CI/CD, hosting

  

docs

Documentation

  

effort:L

  

effort:M

  

effort:S

  

frontend

SPA (apps/web)

  

plugins

Plugin system and SDK

  

qa

Tests, fixtures, e2e

  

vs-nfd

  

vs-nfd:blocker

No Label

area:auth

area:docs

area:export

area:ops

area:storage

area:supply-chain

auth

backend

blocked

collab

deployment

docs

effort:L

effort:M

effort:S

frontend

plugins

qa

vs-nfd

vs-nfd:blocker

Milestone

Clear milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

No Assignees

1 Participants

Notifications

Subscribe

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stwaidele/dorfteich#277

No description provided.