feat: add enterprise governance and tenant controls

README.md

@@ -59,10 +59,10 @@ Findings map to NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA
 
 | Feature | Description |
 |---|---|
-| **Misconfiguration Scanner** | Runs 95 Azure security rules across storage, network, identity, database, compute, Key Vault, AKS, post-quantum cryptography, backup, serverless, private endpoint, and supply chain posture |
+| **Misconfiguration Scanner** | Runs 105 Azure security rules across storage, network, identity, database, compute, Key Vault, AKS, post-quantum cryptography, backup, serverless, private endpoint, supply chain, security operations, and governance posture |
 | **Compliance Mapper** | Maps findings to CIS Benchmarks, NIST CSF, ISO 27001, and SOC 2 framework JSON files |
 | **Scan History API** | Stores scans and findings in PostgreSQL and exposes findings, score, scan history, compliance posture, drift, and resource inventory over REST |
-| **Remediation Playbooks** | Every rule ships with a matching Azure CLI remediation script (95 playbooks) |
+| **Remediation Playbooks** | Every rule ships with a matching Azure CLI remediation script (105 playbooks) |
 | **Security Dashboard** | Full React dashboard deployed on Vercel - live monitoring, findings, compliance, drift, prioritization, and AI-layer views |
 | **Project Website** | Documentation and reference site at [openshield-website.vercel.app](https://openshield-website.vercel.app) - blog, rules gallery, docs, roadmap, releases, and interactive playground |
 | **Sentinel Integration** | Normalises findings and pushes them into Microsoft Sentinel via a Log Analytics custom table and KQL analytics rules |
@@ -104,7 +104,7 @@ Project policies and assurance evidence:
 flowchart TD
     A["React Dashboard\nVercel · Live"]
     B["Flask REST API\nJWT · CORS · Blueprints"]
-    C["Scanner Engine\n95 Python rules"]
+    C["Scanner Engine\n105 Python rules"]
     D["Azure Subscription\nScanned via Azure SDK + Graph"]
     E["Compliance Framework JSON\nCIS · NIST · ISO 27001 · SOC 2"]
     F["PostgreSQL Database\nFindings · Scans"]

compliance/frameworks/cis_azure_benchmark.json

@@ -422,6 +422,56 @@
       "control_id": "2.1.20",
       "control_name": "Ensure That 'Notify about alerts with the following severity' is Set to 'High'",
       "description": "No enabled Azure Monitor action group with a notification receiver exists, and no Sentinel automation rule routes incidents onward. CIS 2.1.20 requires Defender security alerts to notify a monitored destination; this rule generalizes that requirement to the concrete Azure notification primitive (action groups) and the Sentinel-native incident routing mechanism (automation rules)."
+    },
+    "AZ-GOV-001": {
+      "control_id": "N/A-GOV-001",
+      "control_name": "Subscription Outside Approved Management Group Hierarchy",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-002": {
+      "control_id": "N/A-GOV-002",
+      "control_name": "Required Security Policy Initiative Missing",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-003": {
+      "control_id": "N/A-GOV-003",
+      "control_name": "Preventive Policy Uses Non-Enforcing Effect",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-004": {
+      "control_id": "N/A-GOV-004",
+      "control_name": "Policy Exemption Missing Governance Metadata",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-005": {
+      "control_id": "N/A-GOV-005",
+      "control_name": "Critical Production Resource Missing Deletion Lock",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-006": {
+      "control_id": "N/A-GOV-006",
+      "control_name": "Excessive Subscription Owner Assignments",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-007": {
+      "control_id": "N/A-GOV-007",
+      "control_name": "Privileged Access Assigned at Broad Scope",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-008": {
+      "control_id": "N/A-GOV-008",
+      "control_name": "Undocumented Resource Provider Registered",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-009": {
+      "control_id": "N/A-GOV-009",
+      "control_name": "Production Resource Missing Ownership Metadata",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-010": {
+      "control_id": "N/A-GOV-010",
+      "control_name": "Security Configuration Drift Exceeds SLA",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
     }
   }
 }

compliance/frameworks/iso27001.json

@@ -482,6 +482,56 @@
       "control_id": "A.16.1.2",
       "control_name": "Reporting information security events",
       "description": "No monitored destination exists for security alerts or Sentinel incidents. A.16.1.2 requires information security events to be reported through appropriate management channels as quickly as possible; an alert with no notified recipient cannot be reported or acted on."
+    },
+    "AZ-GOV-001": {
+      "control_id": "A.5.15",
+      "control_name": "Subscription Outside Approved Management Group Hierarchy",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-002": {
+      "control_id": "A.5.1",
+      "control_name": "Required Security Policy Initiative Missing",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-003": {
+      "control_id": "A.5.1",
+      "control_name": "Preventive Policy Uses Non-Enforcing Effect",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-004": {
+      "control_id": "A.5.1",
+      "control_name": "Policy Exemption Missing Governance Metadata",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-005": {
+      "control_id": "A.8.9",
+      "control_name": "Critical Production Resource Missing Deletion Lock",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-006": {
+      "control_id": "A.5.18",
+      "control_name": "Excessive Subscription Owner Assignments",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-007": {
+      "control_id": "A.5.18",
+      "control_name": "Privileged Access Assigned at Broad Scope",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-008": {
+      "control_id": "A.5.9",
+      "control_name": "Undocumented Resource Provider Registered",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-009": {
+      "control_id": "A.5.9",
+      "control_name": "Production Resource Missing Ownership Metadata",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-010": {
+      "control_id": "A.8.8",
+      "control_name": "Security Configuration Drift Exceeds SLA",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
     }
   }
 }

compliance/frameworks/nist_csf.json

@@ -482,6 +482,56 @@
       "control_id": "RS.CO-2",
       "control_name": "Incidents are reported consistent with established criteria",
       "description": "No monitored destination exists for security alerts or Sentinel incidents. RS.CO-2 requires incidents to be reported consistent with established criteria; an alert with no notified recipient is never reported to anyone who can act on it."
+    },
+    "AZ-GOV-001": {
+      "control_id": "PR.AC-4",
+      "control_name": "Subscription Outside Approved Management Group Hierarchy",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-002": {
+      "control_id": "PR.IP-1",
+      "control_name": "Required Security Policy Initiative Missing",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-003": {
+      "control_id": "PR.IP-1",
+      "control_name": "Preventive Policy Uses Non-Enforcing Effect",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-004": {
+      "control_id": "PR.IP-1",
+      "control_name": "Policy Exemption Missing Governance Metadata",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-005": {
+      "control_id": "PR.IP-3",
+      "control_name": "Critical Production Resource Missing Deletion Lock",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-006": {
+      "control_id": "PR.AC-4",
+      "control_name": "Excessive Subscription Owner Assignments",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-007": {
+      "control_id": "PR.AC-4",
+      "control_name": "Privileged Access Assigned at Broad Scope",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-008": {
+      "control_id": "PR.IP-1",
+      "control_name": "Undocumented Resource Provider Registered",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-009": {
+      "control_id": "ID.AM-1",
+      "control_name": "Production Resource Missing Ownership Metadata",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-010": {
+      "control_id": "DE.CM-8",
+      "control_name": "Security Configuration Drift Exceeds SLA",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
     }
   }
 }

compliance/frameworks/soc2.json

@@ -482,6 +482,56 @@
       "control_id": "CC7.4",
       "control_name": "Incident Response",
       "description": "No monitored destination exists for security alerts or Sentinel incidents. CC7.4 requires the entity to respond to identified security incidents; an alert nobody is notified of cannot trigger the incident-response process CC7.4 requires."
+    },
+    "AZ-GOV-001": {
+      "control_id": "CC6.3",
+      "control_name": "Subscription Outside Approved Management Group Hierarchy",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-002": {
+      "control_id": "CC5.2",
+      "control_name": "Required Security Policy Initiative Missing",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-003": {
+      "control_id": "CC5.2",
+      "control_name": "Preventive Policy Uses Non-Enforcing Effect",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-004": {
+      "control_id": "CC5.3",
+      "control_name": "Policy Exemption Missing Governance Metadata",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-005": {
+      "control_id": "CC6.5",
+      "control_name": "Critical Production Resource Missing Deletion Lock",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-006": {
+      "control_id": "CC6.3",
+      "control_name": "Excessive Subscription Owner Assignments",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-007": {
+      "control_id": "CC6.3",
+      "control_name": "Privileged Access Assigned at Broad Scope",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-008": {
+      "control_id": "CC6.6",
+      "control_name": "Undocumented Resource Provider Registered",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-009": {
+      "control_id": "CC2.2",
+      "control_name": "Production Resource Missing Ownership Metadata",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
+    },
+    "AZ-GOV-010": {
+      "control_id": "CC7.2",
+      "control_name": "Security Configuration Drift Exceeds SLA",
+      "description": "OpenShield evaluates this governance control from read-only Azure control-plane evidence and organisation-approved policy inputs."
     }
   }
 }

config/governance-policy.example.json

@@ -0,0 +1,42 @@
+{
+  "approved_management_group_ids": [
+    "/providers/Microsoft.Management/managementGroups/production"
+  ],
+  "required_policy_initiatives": [
+    {
+      "definition_id": "/providers/Microsoft.Authorization/policySetDefinitions/security-baseline",
+      "scope": "/subscriptions/00000000-0000-0000-0000-000000000000"
+    }
+  ],
+  "preventive_policy_definition_ids": [
+    "/providers/Microsoft.Authorization/policyDefinitions/deny-public-resources"
+  ],
+  "allowed_preventive_effects": ["deny", "deployIfNotExists", "modify"],
+  "production_resource_types": [
+    "Microsoft.KeyVault/vaults",
+    "Microsoft.Sql/servers",
+    "Microsoft.Storage/storageAccounts"
+  ],
+  "production_tag": "environment",
+  "production_tag_values": ["production", "prod"],
+  "maximum_subscription_owners": 3,
+  "privileged_role_definition_ids": [
+    "8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
+    "b24988ac-6180-42a0-ab88-20f7382dd24c"
+  ],
+  "approved_privileged_scopes": [
+    "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/platform-security"
+  ],
+  "approved_provider_namespaces": [
+    "Microsoft.Authorization",
+    "Microsoft.Compute",
+    "Microsoft.KeyVault",
+    "Microsoft.Network",
+    "Microsoft.PolicyInsights",
+    "Microsoft.Resources",
+    "Microsoft.Storage"
+  ],
+  "ownership_tags": ["owner", "service-owner"],
+  "drift_sla_days": 30,
+  "excluded_resource_ids": []
+}

docs/architecture.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-OpenShield is a modular, open source Cloud Security Posture Management (CSPM) platform for Azure. It scans your Azure subscription against 80 security rules, maps findings to compliance frameworks (CIS, NIST CSF, ISO 27001, SOC 2), stores results in PostgreSQL, and exposes posture data through a Flask REST API consumed by a live React dashboard.
+OpenShield is a modular, open source Cloud Security Posture Management (CSPM) platform for Azure. It scans your Azure subscription against 105 security rules, maps findings to compliance frameworks (CIS, NIST CSF, ISO 27001, SOC 2), stores results in PostgreSQL, and exposes posture data through a Flask REST API consumed by a live React dashboard.
 
 ---
 
@@ -43,7 +43,7 @@ OpenShield is a modular, open source Cloud Security Posture Management (CSPM) pl
 ┌───────────▼──────────────────────────────────────────────────────┐
 │                   Rule Modules (scanner/rules/)                   │
 │                                                                   │
-│  80 rule files across Storage, Network, Identity, Database,       │
+│  105 rule files across Storage, Network, Identity, Database,      │
 │  Compute, Key Vault, AKS, post-quantum cryptography, Backup,      │
 │  Serverless, Private Endpoint posture, and Supply Chain           │
 └───────────┬───────────────────────────────────────────────────────┘
@@ -111,22 +111,25 @@ result = engine.run_scan()
 
 ### 4. Current Rule Modules
 
-There are 80 rule files in `scanner/rules/`. See `docs/rules-reference.md` for the full table.
+There are 105 rule files in `scanner/rules/`. See `docs/rules-reference.md` for the full table.
 
 | Category | Count | Rules |
 |---|---|---|
 | Storage | 5 | AZ-STOR-001 to 005 |
-| Network | 15 | AZ-NET-001 to 015 |
+| Network | 17 | AZ-NET-001 to 017 |
 | Identity | 15 | AZ-IDN-001 to 015 |
 | Database | 4 | AZ-DB-001 to 004 |
 | Compute | 4 | AZ-CMP-001 to 004 |
-| Key Vault | 5 | AZ-KV-001 to 005 |
+| Key Vault | 6 | AZ-KV-001 to 006 |
 | Kubernetes | 6 | AZ-AKS-001 to 006 |
 | Post-quantum | 3 | AZ-PQC-001 to 003 |
+| Governance | 10 | AZ-GOV-001 to 010 |
 | Backup | 4 | AZ-BAK-001, 002, 004, 006 |
 | Serverless | 5 | AZ-FUNC-001 to 005 |
 | Private Endpoint | 6 | AZ-PE-001 to 006 |
 | Supply Chain | 8 | AZ-SC-001 to 008 |
+| Security Operations | 10 | AZ-SECOPS-001 to 010 |
+| Data Link | 2 | AZ-DL-001 to 002 |
 
 Every rule has a matching Azure CLI playbook in `playbooks/cli/`.