Skip to content

feat: add enterprise governance and tenant controls #292

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TFT444 wants to merge 14 commits into
base: dev
Choose a base branch
from
Open

feat: add enterprise governance and tenant controls #292

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
4a06906
feat: add enterprise governance rule pack (#257)
TFT444 Aug 20, 2026
48e2f69
test(governance): cover secondary evidence guards and all UNKNOWN paths
TFT444 Aug 24, 2026
b8b3fee
ci: ignore chromadb CVE-2026-45830 and CVE-2026-45833 in pip-audit
TFT444 Aug 25, 2026
f44826d
fix(scanner): count inherited management-group Owners in AZ-GOV-006
TFT444 Aug 29, 2026
4a7223f
fix(scanner): validate ARM pagination URL origin before following con…
TFT444 Sep 19, 2026
7998a6b
style: collapse _is_valid_arm_continuation return to pass ruff format…
TFT444 Sep 19, 2026
732361e
style: reformat parametrize decorators in test file to pass ruff form…
TFT444 Sep 19, 2026
45a3c39
fix(governance): validate pagination URLs against exact ARM origin to…
TFT444 Oct 4, 2026
b7203c4
fix: rstrip trailing slash in _strings, add allow_redirects to _post_…
TFT444 Oct 4, 2026
1cca900
fix(governance): integrate current dev mapping contracts and rule cat…
TFT444 Oct 8, 2026
303ed7a
fix(governance): keep findings helpers out of the coverage evaluator …
TFT444 Oct 8, 2026
c56bd81
fix(deps): require patched Werkzeug and multidict releases
TFT444 Oct 8, 2026
339a718
fix(governance): key snapshot cache by subscription_id to prevent sta…
TFT444 Oct 17, 2026
50557a1
test(governance): cover load_context subscription-ID cache keying
TFT444 Oct 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,10 +74,10 @@ Findings map to NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA

| Feature | Description |
|---|---|
| **Misconfiguration Scanner** | Runs 144 Azure security rules across storage, network, identity, database, compute, Key Vault, AKS, Kubernetes workloads, post-quantum cryptography, backup, serverless, private endpoint, and supply chain posture |
| **Misconfiguration Scanner** | Runs 154 Azure security rules across storage, network, identity, database, compute, Key Vault, AKS, Kubernetes workloads, post-quantum cryptography, backup, serverless, private endpoint, supply chain, and governance posture |
| **Compliance Mapper** | Maps findings to CIS Benchmarks, NIST CSF, ISO 27001, and SOC 2 framework JSON files |
| **Scan History API** | Stores scans and findings in PostgreSQL and exposes findings, score, scan history, compliance posture, drift, and resource inventory over REST |
| **Remediation Playbooks** | Every documented rule ships with a matching review-gated remediation script (144 playbooks) |
| **Remediation Playbooks** | Every documented rule ships with a matching review-gated remediation script (154 playbooks) |
| **Security Dashboard** | Full React dashboard deployed on Vercel - live monitoring, findings, compliance, drift, prioritization, and AI-layer views |
| **Project Website** | Documentation and reference site at [owasp.github.io/openshield](https://owasp.github.io/openshield/) - blog, rules gallery, architecture, evidence guides, roadmap, and releases |
| **Sentinel Integration** | Normalises findings and pushes them into Microsoft Sentinel via a Log Analytics custom table and KQL analytics rules |
Expand Down Expand Up @@ -120,11 +120,11 @@ Project policies and assurance evidence:
flowchart TD
A["React Dashboard\nVercel · Live"]
B["Flask REST API\nJWT · CORS · Blueprints"]
C["Scanner Engine\n144 Python rules"]
C["Scanner Engine\n154 Python rules"]
D["Azure Subscription\nScanned via Azure SDK + Graph"]
E["Compliance Framework JSON\nCIS · NIST · ISO 27001 · SOC 2"]
F["PostgreSQL Database\nFindings · Scans"]
G["Azure CLI Playbooks\n144 remediation scripts"]
G["Azure CLI Playbooks\n154 remediation scripts"]
H["sentinel/ingest.py\nNormalise + HMAC upload"]
I["Microsoft Sentinel\nOpenShieldFindings_CL · KQL rules"]

Expand Down
120 changes: 120 additions & 0 deletions compliance/frameworks/cis_azure_benchmark.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1734,6 +1734,126 @@
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-001": {
"control_id": "N/A-GOV-001",
"control_name": "Subscription Outside Approved Management Group Hierarchy",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "not_applicable",
"evidence_type": "no_direct_mapping",
"primary_source": "OpenShield compliance mapping pack, authored against CIS Microsoft Azure Foundations Benchmark v2.0.0. Technical-evidence mapping only.",
"rationale": "No numbered control in this mapping pack directly maps to AZ-GOV-001. This rule is excluded from this framework score.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-002": {
"control_id": "N/A-GOV-002",
"control_name": "Required Security Policy Initiative Missing",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "not_applicable",
"evidence_type": "no_direct_mapping",
"primary_source": "OpenShield compliance mapping pack, authored against CIS Microsoft Azure Foundations Benchmark v2.0.0. Technical-evidence mapping only.",
"rationale": "No numbered control in this mapping pack directly maps to AZ-GOV-002. This rule is excluded from this framework score.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-003": {
"control_id": "N/A-GOV-003",
"control_name": "Preventive Policy Uses Non-Enforcing Effect",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "not_applicable",
"evidence_type": "no_direct_mapping",
"primary_source": "OpenShield compliance mapping pack, authored against CIS Microsoft Azure Foundations Benchmark v2.0.0. Technical-evidence mapping only.",
"rationale": "No numbered control in this mapping pack directly maps to AZ-GOV-003. This rule is excluded from this framework score.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-004": {
"control_id": "N/A-GOV-004",
"control_name": "Policy Exemption Missing Governance Metadata",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "not_applicable",
"evidence_type": "no_direct_mapping",
"primary_source": "OpenShield compliance mapping pack, authored against CIS Microsoft Azure Foundations Benchmark v2.0.0. Technical-evidence mapping only.",
"rationale": "No numbered control in this mapping pack directly maps to AZ-GOV-004. This rule is excluded from this framework score.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-005": {
"control_id": "N/A-GOV-005",
"control_name": "Critical Production Resource Missing Deletion Lock",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "not_applicable",
"evidence_type": "no_direct_mapping",
"primary_source": "OpenShield compliance mapping pack, authored against CIS Microsoft Azure Foundations Benchmark v2.0.0. Technical-evidence mapping only.",
"rationale": "No numbered control in this mapping pack directly maps to AZ-GOV-005. This rule is excluded from this framework score.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-006": {
"control_id": "N/A-GOV-006",
"control_name": "Excessive Subscription Owner Assignments",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "not_applicable",
"evidence_type": "no_direct_mapping",
"primary_source": "OpenShield compliance mapping pack, authored against CIS Microsoft Azure Foundations Benchmark v2.0.0. Technical-evidence mapping only.",
"rationale": "No numbered control in this mapping pack directly maps to AZ-GOV-006. This rule is excluded from this framework score.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-007": {
"control_id": "N/A-GOV-007",
"control_name": "Privileged Access Assigned at Broad Scope",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "not_applicable",
"evidence_type": "no_direct_mapping",
"primary_source": "OpenShield compliance mapping pack, authored against CIS Microsoft Azure Foundations Benchmark v2.0.0. Technical-evidence mapping only.",
"rationale": "No numbered control in this mapping pack directly maps to AZ-GOV-007. This rule is excluded from this framework score.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-008": {
"control_id": "N/A-GOV-008",
"control_name": "Undocumented Resource Provider Registered",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "not_applicable",
"evidence_type": "no_direct_mapping",
"primary_source": "OpenShield compliance mapping pack, authored against CIS Microsoft Azure Foundations Benchmark v2.0.0. Technical-evidence mapping only.",
"rationale": "No numbered control in this mapping pack directly maps to AZ-GOV-008. This rule is excluded from this framework score.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-009": {
"control_id": "N/A-GOV-009",
"control_name": "Production Resource Missing Ownership Metadata",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "not_applicable",
"evidence_type": "no_direct_mapping",
"primary_source": "OpenShield compliance mapping pack, authored against CIS Microsoft Azure Foundations Benchmark v2.0.0. Technical-evidence mapping only.",
"rationale": "No numbered control in this mapping pack directly maps to AZ-GOV-009. This rule is excluded from this framework score.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-010": {
"control_id": "N/A-GOV-010",
"control_name": "Security Configuration Drift Exceeds SLA",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "not_applicable",
"evidence_type": "no_direct_mapping",
"primary_source": "OpenShield compliance mapping pack, authored against CIS Microsoft Azure Foundations Benchmark v2.0.0. Technical-evidence mapping only.",
"rationale": "No numbered control in this mapping pack directly maps to AZ-GOV-010. This rule is excluded from this framework score.",
"owner": null,
"review_status": "pending_review",
"review_date": null
}
}
}
120 changes: 120 additions & 0 deletions compliance/frameworks/iso27001.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1734,6 +1734,126 @@
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-001": {
"control_id": "A.5.15",
"control_name": "Access control",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "supporting",
"evidence_type": "automated_configuration_scan",
"primary_source": "ISO/IEC 27001:2022, Annex A control A.5.15",
"rationale": "AZ-GOV-001 supplies Azure configuration evidence supporting A.5.15. It does not establish full organizational compliance; policy and process evidence require separate review.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-002": {
"control_id": "A.5.1",
"control_name": "Policies for information security",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "supporting",
"evidence_type": "automated_configuration_scan",
"primary_source": "ISO/IEC 27001:2022, Annex A control A.5.1",
"rationale": "AZ-GOV-002 supplies Azure configuration evidence supporting A.5.1. It does not establish full organizational compliance; policy and process evidence require separate review.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-003": {
"control_id": "A.5.1",
"control_name": "Policies for information security",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "supporting",
"evidence_type": "automated_configuration_scan",
"primary_source": "ISO/IEC 27001:2022, Annex A control A.5.1",
"rationale": "AZ-GOV-003 supplies Azure configuration evidence supporting A.5.1. It does not establish full organizational compliance; policy and process evidence require separate review.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-004": {
"control_id": "A.5.1",
"control_name": "Policies for information security",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "supporting",
"evidence_type": "automated_configuration_scan",
"primary_source": "ISO/IEC 27001:2022, Annex A control A.5.1",
"rationale": "AZ-GOV-004 supplies Azure configuration evidence supporting A.5.1. It does not establish full organizational compliance; policy and process evidence require separate review.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-005": {
"control_id": "A.8.9",
"control_name": "Configuration management",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "supporting",
"evidence_type": "automated_configuration_scan",
"primary_source": "ISO/IEC 27001:2022, Annex A control A.8.9",
"rationale": "AZ-GOV-005 supplies Azure configuration evidence supporting A.8.9. It does not establish full organizational compliance; policy and process evidence require separate review.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-006": {
"control_id": "A.5.18",
"control_name": "Access rights",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "supporting",
"evidence_type": "automated_configuration_scan",
"primary_source": "ISO/IEC 27001:2022, Annex A control A.5.18",
"rationale": "AZ-GOV-006 supplies Azure configuration evidence supporting A.5.18. It does not establish full organizational compliance; policy and process evidence require separate review.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-007": {
"control_id": "A.5.18",
"control_name": "Access rights",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "supporting",
"evidence_type": "automated_configuration_scan",
"primary_source": "ISO/IEC 27001:2022, Annex A control A.5.18",
"rationale": "AZ-GOV-007 supplies Azure configuration evidence supporting A.5.18. It does not establish full organizational compliance; policy and process evidence require separate review.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-008": {
"control_id": "A.5.9",
"control_name": "Inventory of information and other associated assets",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "supporting",
"evidence_type": "automated_configuration_scan",
"primary_source": "ISO/IEC 27001:2022, Annex A control A.5.9",
"rationale": "AZ-GOV-008 supplies Azure configuration evidence supporting A.5.9. It does not establish full organizational compliance; policy and process evidence require separate review.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-009": {
"control_id": "A.5.9",
"control_name": "Inventory of information and other associated assets",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "supporting",
"evidence_type": "automated_configuration_scan",
"primary_source": "ISO/IEC 27001:2022, Annex A control A.5.9",
"rationale": "AZ-GOV-009 supplies Azure configuration evidence supporting A.5.9. It does not establish full organizational compliance; policy and process evidence require separate review.",
"owner": null,
"review_status": "pending_review",
"review_date": null
},
"AZ-GOV-010": {
"control_id": "A.8.8",
"control_name": "Management of technical vulnerabilities",
"description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs.",
"mapping_type": "supporting",
"evidence_type": "automated_configuration_scan",
"primary_source": "ISO/IEC 27001:2022, Annex A control A.8.8",
"rationale": "AZ-GOV-010 supplies Azure configuration evidence supporting A.8.8. It does not establish full organizational compliance; policy and process evidence require separate review.",
"owner": null,
"review_status": "pending_review",
"review_date": null
}
}
}
Loading
Loading