Module

Compliance / GRC

Das Compliance/GRC-Modul deckt zwei eng verwandte Anwendungen ab: das Tracking von Compliance-Frameworks (ISO 27001, TISAX, BSI IT-Grundschutz, DSGVO) und das Governance/Risk/Compliance-Modell mit Policies, Risk-Registern und Control-Mappings.

Resources – Compliance

Resource	Pfad	Permission-Präfix	Sequenz
Frameworks	`/api/v1/compliance_frameworks`	`compliance_framework`	—
Anforderungen (Controls)	`/api/v1/compliance_requirements`	`compliance_requirement`	—
Reports	`/api/v1/compliance_reports`	`compliance_report`	—
Framework-Mappings	`/api/v1/framework_mappings`	`framework_mapping`	—

Resources – Audit-Modul

Resource	Pfad	Permission-Präfix	Sequenz
Audit-Kataloge	`/api/v1/audit_catalogs`	`audit_catalog`	—
Katalog-Versionen	`/api/v1/audit_catalog_versions`	`audit_catalog_version`	—
Assessments	`/api/v1/audit_assessments`	`audit_assessment`	`ASS-`
Antworten	`/api/v1/audit_answers`	`audit_answer`	—
Check-Ergebnisse	`/api/v1/audit_check_results`	`audit_check_result`	—

Resources – GRC

Resource	Pfad	Permission-Präfix
Policies	`/api/v1/policies`	`policy`
Policy-Type-Configs	`/api/v1/policy_type_configs`	`policy_type_config`
Risiken	`/api/v1/risks`	`risk`
AVV (Auftragsverarb.)	`/api/v1/avvs`	`avv`
TOMs	`/api/v1/toms`	`tom`
DPIAs	`/api/v1/dpias`	`dpia`

Befunde, Maßnahmenpläne und Nachweise (Evidence) liegen als typisierte Felder direkt am audit_assessment bzw. an der jeweiligen Anforderung; sie haben keine eigenen CRUD-Endpoints.

Schemas

Framework

compliance_frameworks4 Permissions

Schema for validating compliance framework entities

title string erforderlich

Framework title

1–500 Zeichen

shortName string erforderlich

Short machine-readable name (unique per tenant)

1–100 ZeichenPattern

description string optional

Framework description

nullable

frameworkVersion string optional

Framework version (e.g. "2022", "2023-Q4")

max 50 Zeichennullable

locale string optional

Primary locale of the framework content

Werte

deen

Default: "de"

category string optional

Framework category

Werte

INFORMATION_SECURITYDATA_PROTECTIONRISK_MANAGEMENTBUSINESS_CONTINUITYINDUSTRY_SPECIFICOPERATIONAL_RESILIENCEOTHER

nullable

publisher string optional

Publishing organization (e.g. "ISO", "BSI", "EU")

max 200 Zeichennullable

publicUrl string optional

Link to official source

nullable

status string erforderlich

Framework status

Werte

DRAFTACTIVEDEPRECATEDARCHIVED

isSystemTemplate boolean optional

True if platform-provided (read-only for tenants)

Default: false

importedFromTemplateId uuid optional

ID of the system template this was cloned from

nullable

requirementCount number optional

Denormalized count of requirements (protected)

Default: 0read-only

tags string[] optional

Framework tags

Default: []

Requirement

compliance_requirements4 Permissions

Schema for validating compliance requirement entities within a framework

frameworkId uuid erforderlich

Parent compliance framework UUID

parentId uuid optional

Parent requirement UUID (for tree structure)

nullable

referenceId string erforderlich

Official reference ID (e.g. "A.5.1", "ORP.1.A1", "Art. 21(2)(a)")

1–100 Zeichen

title string erforderlich

Requirement title

1–500 Zeichen

description string optional

Requirement description (own wording, not copied from standard)

nullable

guidance string optional

Implementation guidance (own wording)

nullable

level number optional

Depth in the tree (0 = root category)

0 – 10Default: 0

sortOrder number optional

Sort order among siblings

Default: 0

isCategory boolean optional

True = grouping node, not an assessable requirement

Default: false

priority string optional

Requirement priority level

Werte

CRITICALHIGHMEDIUMLOW

nullable

tags string[] optional

Requirement tags

Default: []

Report

compliance_reports4 Permissions

Schema for GoBD compliance reports and Verfahrensdokumentation

reportType string erforderlich

Type of compliance report

Werte

GOBD_STATUSVERFAHRENSDOKUMENTATIONHASH_CHAIN_VERIFICATIONRETENTION_ADHERENCEACCESS_AUDITSIGNATURE_STATUSTAX_AUDITOR_EXPORT

title string optional

max 500 Zeichennullable

status string erforderlich

Werte

PENDINGGENERATINGCOMPLETEDFAILED

Default: "PENDING"

dateFrom datetime optional

Report period start

nullable

dateTo datetime optional

Report period end

nullable

summary object optional

Report summary metrics

nullable

findings object[] optional

Default: []

severity string optional

Werte

INFOWARNINGCRITICAL

code string optional

Finding code (e.g. GOBD_001)

message string optional

documentId string optional

nullable

details object optional

nullable

documentCount number optional

Number of documents included in this report

nullable

hashChainValid boolean optional

Whether the hash chain is intact

read-onlynullable

lastVerifiedHash string optional

Last verified hash in the chain

read-onlynullable

brokenChainAt string optional

Document ID where chain broke (if any)

read-onlynullable

s3Key string optional

S3 key for exported report/archive

read-onlynullable

fileName string optional

nullable

fileSizeBytes number optional

nullable

startedAt datetime optional

nullable

completedAt datetime optional

nullable

errorMessage string optional

nullable

Framework-Mapping

framework_mappings4 Permissions

Schema for validating cross-framework requirement mappings

sourceRequirementId uuid erforderlich

Source compliance requirement UUID

sourceFrameworkId uuid erforderlich

Source compliance framework UUID (denormalized)

targetRequirementId uuid erforderlich

Target compliance requirement UUID

targetFrameworkId uuid erforderlich

Target compliance framework UUID (denormalized)

relationshipType string optional

Type of relationship between requirements

Werte

EQUALSUPERSETSUBSETINTERSECTRELATED

Default: "RELATED"

strength string optional

Strength of the mapping

Werte

FULLPARTIALWEAK

Default: "PARTIAL"

rationale string optional

Rationale for the mapping

nullable

isAiGenerated boolean optional

True if this mapping was generated by AI

Default: false

verifiedBy uuid optional

User UUID who verified this mapping

nullable

verifiedAt datetime optional

When the mapping was verified

nullable

Audit-Catalog

audit_catalogs4 Permissions

Schema for audit/compliance questionnaire definitions

title string erforderlich

Questionnaire title

1–200 Zeichen

description string optional

Questionnaire description

max 5000 Zeichennullable

framework string erforderlich

Compliance framework this catalog belongs to

Werte

ISADORANIS2ISO27001BSICUSTOM

category string optional

Category (e.g. IT-Sicherheit, Datenschutz, Onboarding)

max 100 Zeichennullable

activeVersionId uuid optional

UUID of the currently active version

nullable

promptTemplateSystem string optional

System prompt for AI report generation

max 10000 Zeichennullable

promptTemplateUser string optional

User prompt template with {{placeholders}} for AI report generation

max 10000 Zeichennullable

tags string[] optional

Tags for filtering and categorization

Default: []nullable

linkedCourseIds string[] optional

Linked Academy course IDs for training requirements

Default: []

Catalog-Version

audit_catalog_versions4 Permissions

Schema for immutable versioned snapshots of audit questionnaires

catalogId uuid erforderlich

FK to audit_catalog

versionLabel string erforderlich

Version label (e.g. "1.0", "2024-Q1")

1–50 Zeichen

status string erforderlich

Version lifecycle status

Werte

DRAFTACTIVEARCHIVED

questions object[] erforderlich

Default: []

questionId uuid erforderlich

Stable unique identifier for answer references

sortOrder integer erforderlich

Sort order within the questionnaire

≥ 0

category string erforderlich

Question grouping category (e.g. "Netzwerk", "Zugriffsschutz")

1–100 Zeichen

questionText string erforderlich

The question text

1–2000 Zeichen

hintText string optional

Help text for the auditor

max 2000 Zeichennullable

questionType string erforderlich

Determines how the question is rendered and answered

Werte

textyes_nosingle_choicemulti_choicenumberdate

options string[] optional

Answer options for single_choice / multi_choice questions

nullable

priority string erforderlich

Risk priority / severity indicator

Werte

CRITICALHIGHMEDIUMLOW

weight number optional

Scoring weight (1-10). Defaults to priority-based if not set.

1 – 10nullable

complianceRef string optional

Reference to compliance standard section (e.g. "NIS2 Art. 21(2)(a)")

max 200 Zeichennullable

required boolean optional

Whether this question must be answered before assessment completion

Default: falsenullable

questionCount integer optional

Denormalized count of questions in this version

≥ 0Default: 0

Assessment

audit_assessments4 Permissions

Schema for a conducted audit/assessment instance

catalogId uuid erforderlich

FK to audit_catalog

versionId uuid erforderlich

FK to audit_catalog_version (locked at creation)

partyId uuid optional

FK to party (customer being audited)

nullable

partyName string optional

Denormalized party name

max 200 Zeichennullable

assessorId uuid optional

FK to user conducting the audit

nullable

assessorName string optional

Denormalized assessor name

max 200 Zeichennullable

status string erforderlich

Assessment lifecycle status

Werte

DRAFTIN_PROGRESSCOMPLETEDARCHIVED

progress number optional

Completion percentage (0-100), computed from answers

0 – 100Default: 0read-only

score number optional

Weighted compliance score (0-100), computed on completion

0 – 100read-onlynullable

riskLevel string optional

Overall risk level derived from score

Werte

CRITICALHIGHMEDIUMLOW

read-onlynullable

reportText string optional

AI-generated markdown report

read-onlynullable

reportGeneratedAt datetime optional

Timestamp of last report generation

read-onlynullable

completedAt datetime optional

Timestamp when assessment was completed

read-onlynullable

tags string[] optional

Tags for filtering

Default: []nullable

linkedRiskIds string[] optional

Linked risk IDs

Default: []

assessmentPurpose string optional

Purpose of the assessment

Werte

INTERNALVENDOR_ASSESSMENTCUSTOMER_ONBOARDING

Default: "INTERNAL"

Answer

audit_answers4 Permissions

Schema for individual answers within an audit assessment

assessmentId uuid erforderlich

FK to audit_assessment

questionId uuid erforderlich

References a questionId in the linked audit_catalog_version

answer any optional

The answer value. Type depends on questionType: string for text/date, boolean for yes_no, string[] for multi_choice, number for number, string for single_choice.

nullable

note string optional

Auditor remark / additional notes

max 5000 Zeichennullable

status string erforderlich

Answer status

Werte

PENDINGANSWEREDSKIPPED

attachments string[] optional

File reference IDs for evidence/screenshots

Default: []nullable

Check-Result

audit_check_results4 Permissions

Schema for the result of an individual auto-check run within an audit assessment section

assessmentId uuid erforderlich

FK to audit_assessment

sectionId uuid erforderlich

Section this check belongs to

checkId uuid erforderlich

Check definition ID (from catalog version section)

checkType string erforderlich

Werte

nameddata_existence

checkName string erforderlich

Human-readable check name (e.g. "DPIA vorhanden", "Assets inventarisiert")

1–200 Zeichen

status string erforderlich

Check execution result

Werte

PASSFAILWARNINGSKIPPEDERROR

result object optional

Raw check result data (counts, matched records, etc.)

nullable

message string optional

Short result message shown in the UI

max 1000 Zeichennullable

details string optional

Extended explanation or remediation advice

max 5000 Zeichennullable

evidence object[] optional

Key-value evidence pairs (e.g. entity counts, last-review dates)

Default: []nullable

label string erforderlich

max 200 Zeichen

value string erforderlich

max 1000 Zeichen

runAt datetime erforderlich

When the check was executed

runBy string optional

User ID who triggered the run, or "system" for scheduled runs

nullable

Policy

policies4 Permissions

Schema for Konzepte & Richtlinien (all 47 policy types)

title string erforderlich

1–500 Zeichen

policyType string erforderlich

Werte

CODE_OF_CONDUCTCOMPLIANCE_POLICYQUALITY_POLICYRISK_MANAGEMENT_POLICYWHISTLEBLOWING_POLICYDOCUMENT_CONTROL_POLICYISMS_POLICYACCESS_CONTROL_POLICYPASSWORD_POLICYCRYPTOGRAPHY_POLICYNETWORK_SECURITY_POLICYVULNERABILITY_MANAGEMENTPATCH_MANAGEMENTLOGGING_MONITORINGSSDLC_POLICYCLOUD_SECURITY_POLICYDATA_CLASSIFICATIONAI_USAGE_POLICYDATA_PROTECTION_POLICYDELETION_CONCEPT

TOM_DOCUMENTATIONDATA_BREACH_POLICYPRIVACY_BY_DESIGNMEDIA_DESTRUCTION_POLICYBCM_POLICYDISASTER_RECOVERY_PLANINCIDENT_MANAGEMENTEMERGENCY_COMMUNICATIONBACKUP_CONCEPTGOBD_POLICYIKT_RISK_FRAMEWORKTHIRD_PARTY_RISK_MANAGEMENTOUTSOURCING_POLICYSUPPLY_CHAIN_SECURITYACCEPTABLE_USE_POLICYMDM_BYOD_POLICYHOME_OFFICE_POLICYREMOTE_MAINTENANCE_POLICYVPN_REMOTE_ACCESS_POLICYCLEAN_DESK_POLICYPHYSICAL_SECURITY_CONCEPTAWARENESS_TRAINING_CONCEPTEMAIL_COMMUNICATION_POLICYSOCIAL_MEDIA_POLICYCONFIDENTIALITY_NDA_POLICYITAM_POLICYLICENSE_MANAGEMENT_POLICY

policyVersion string erforderlich

Document version, semver-style (e.g. "1.0.0"). Distinct from the system `version` optimistic-concurrency counter.

1–50 Zeichen

status string erforderlich

Werte

DRAFTIN_REVIEWAPPROVEDACTIVEARCHIVEDSUPERSEDED

sections object[] erforderlich

Default: []

sectionKey string erforderlich

title string erforderlich

content string erforderlich

isComplete boolean erforderlich

order number erforderlich

typedFields object optional

nullable

authorId string optional

nullable

reviewerIds string[] optional

Default: []

approverId string optional

nullable

ownerDepartment string optional

nullable

approvalComment string optional

nullable

effectiveDate datetime optional

nullable

reviewDate datetime optional

nullable

expiryDate datetime optional

nullable

reviewCycleMonths number optional

Default: 12

targetCustomerTenantId string optional

nullable

dmsDocumentId string optional

nullable

dmsFolderPath string optional

nullable

frameworkMappings object[] optional

Default: []

framework string erforderlich

control string erforderlich

description string optional

applicableScopes string[] optional

Default: []

aiComplianceScore number optional

0 – 100nullable

aiLastChecked datetime optional

nullable

aiFindings object[] optional

Default: []

severity string erforderlich

Werte

HIGHMEDIUMLOWINFO

sectionKey string optional

code string erforderlich

message string erforderlich

suggestion string optional

supersededByPolicyId string optional

nullable

relatedPolicyIds string[] optional

Default: []

linkedRiskIds string[] optional

Default: []

linkedTomIds string[] optional

Default: []

linkedAssetIds string[] optional

Default: []

Policy-Type

policy_type_configs4 Permissions

policyType string erforderlich

min 1 Zeichen

customSections object[] optional

sectionKey string erforderlich

title string erforderlich

max 200 Zeichen

placeholder string optional

max 2000 Zeichen

isRequired boolean optional

defaultReviewCycleMonths number optional

1 – 120

defaultOwnerDepartment string optional

max 200 Zeichen

Risk

risks4 Permissions

Schema for validating risk entities

title string erforderlich

Risk title

1–500 Zeichen

description string optional

Risk description

nullable

category string optional

Risk category

Werte

STRATEGICOPERATIONALCOMPLIANCETECHNICALSECURITYDATA_PROTECTION

nullable

status string erforderlich

Risk status

Werte

IDENTIFIEDASSESSEDTREATINGACCEPTEDMITIGATEDCLOSED

inherentLikelihood number optional

Inherent likelihood (1-5)

1 – 5nullable

inherentImpact number optional

Inherent impact (1-5)

1 – 5nullable

inherentRiskScore number optional

Computed inherent risk score (protected)

read-onlynullable

residualLikelihood number optional

Residual likelihood (1-5)

1 – 5nullable

residualImpact number optional

Residual impact (1-5)

1 – 5nullable

residualRiskScore number optional

Computed residual risk score (protected)

read-onlynullable

treatmentStrategy string optional

Risk treatment strategy

Werte

AVOIDMITIGATETRANSFERACCEPT

nullable

ownerId uuid optional

Risk owner user UUID

nullable

linkedAssetIds string[] optional

Linked asset UUIDs

Default: []

linkedTicketIds string[] optional

Linked ticket UUIDs

Default: []

linkedProjectIds string[] optional

Linked project UUIDs

Default: []

linkedContractIds string[] optional

Linked contract UUIDs

Default: []

reviewDate datetime optional

Next review date

nullable

reviewCycleDays number optional

Review cycle in days

nullable

tags string[] optional

Risk tags

Default: []

AVV

avvs4 Permissions

Schema for validating AVV (Auftragsverarbeitungsvertrag) entities

partyId uuid erforderlich

Associated party UUID

status string erforderlich

AVV status

Werte

DRAFTACTIVEEXPIREDTERMINATED

signedAt datetime optional

Date when AVV was signed

nullable

effectiveDate datetime optional

Effective date of the AVV

nullable

expiryDate datetime optional

Expiry date of the AVV

nullable

dmsDocumentId uuid optional

Linked DMS document UUID

nullable

processingPurpose string optional

Purpose of data processing

nullable

dataCategories string[] optional

Categories of personal data

Default: []

dataSubjectCategories string[] optional

Categories of data subjects

Default: []

subProcessors object[] optional

List of sub-processors

Default: []

name string erforderlich

Sub-processor name

purpose string erforderlich

Processing purpose

country string erforderlich

Country of processing

adequacyBasis string erforderlich

Adequacy basis for transfer

tomReference string optional

Reference to TOM documentation

nullable

nextAuditDate datetime optional

Next audit date

nullable

linkedProcessingActivityIds string[] optional

Linked processing activity UUIDs

Default: []

TOM

toms4 Permissions

Schema for validating technical and organizational measure entities

title string erforderlich

TOM title

1–500 Zeichen

description string optional

TOM description (Markdown)

nullable

category string erforderlich

TOM category (GDPR Art. 32)

Werte

PSEUDONYMIZATIONENCRYPTIONCONFIDENTIALITYINTEGRITYAVAILABILITYRESILIENCERESTORATIONTESTINGACCESS_CONTROLTRANSMISSION_CONTROLINPUT_CONTROLORDER_CONTROLAVAILABILITY_CONTROLSEPARATION_CONTROL

status string erforderlich

Implementation status

Werte

IMPLEMENTEDPARTIALLY_IMPLEMENTEDPLANNEDNOT_APPLICABLE

linkedAssetIds string[] optional

Linked asset UUIDs

Default: []

linkedRiskIds string[] optional

Linked risk UUIDs

Default: []

linkedProcessingActivityIds string[] optional

Linked processing activity UUIDs

Default: []

complianceRefs string[] optional

Compliance framework references

Default: []

evidenceFileIds string[] optional

Evidence file UUIDs

Default: []

DPIA

dpias4 Permissions

Schema for validating Data Protection Impact Assessment entities (GDPR Art. 35)

title string erforderlich

DPIA title

1–500 Zeichen

processingActivityId uuid optional

Associated processing activity UUID

nullable

status string erforderlich

DPIA status

Werte

DRAFTIN_PROGRESSCOMPLETEDCONSULTATION_REQUIRED

necessity string optional

Assessment of necessity and proportionality

nullable

risks object[] optional

Identified risks with assessments

Default: []

description string erforderlich

Risk description

likelihood number erforderlich

Risk likelihood (1-5)

1 – 5

severity number erforderlich

Risk severity (1-5)

1 – 5

mitigations string erforderlich

Planned mitigations

dpoOpinion string optional

Data protection officer opinion

nullable

supervisoryConsultation boolean optional

Whether supervisory authority consultation is required

Default: false

assessorId uuid optional

Assessor user UUID

nullable

completedAt datetime optional

When the DPIA was completed

nullable

Workflows

Audit / Assessment

planned → in_progress → completed | cancelled

Pro Assessment hängen Findings und (über die Findings) Maßnahmenpläne. Nach Abschluss eines Maßnahmenplans wird das Finding auf closed gesetzt; bleibt es offen, ist es Teil des nächsten Audits.

Risk-Lifecycle

Ein Risiko bekommt eine Eintrittswahrscheinlichkeit (likelihood) und einen Schaden (impact). Daraus ergibt sich der Risiko-Score. Mitigations werden über Verlinkung mit Policies oder Controls dokumentiert.

Evidence

Compliance-Nachweise sind oft Datei-Anhänge (Screenshots, Protokolle, Zertifikate). Sie hängen typisiert an audit_answer oder compliance_requirement und referenzieren ein Dokument aus dem DMS mit validFrom / validUntil.

Verwandt

Konventionen
DMS — Evidence-Anhänge
Vault — Vault-Audit als ISO-27001-Evidence
Analytics — analytics_remediation_logs