Compliance Engine stage 1 for BSI Grundschutz++ (Kernel requirements only):
- Pinned snapshots of the BSI Kernel catalog and the official ISO 27001
Annex A -> Grundschutz++ mapping with source URL, SHA-256 and CC BY-SA
attribution, generated by server/compliance/update-bsi-assets.mjs.
- Requirements are derived from accepted ISO controls, never stored as
decisions; missing mapping targets are reported.
- Client Info Compliance tab: BSI Grundschutz++ tile and Results window.
- Finding Reader: collapsed BSI requirements section grouped by ISO control.
- Work: BSI requirement and BSI practice facets.
- Data Hub: BSI catalog tile with Update from BSI and Use bundled catalog;
new outbound target documented in SECURITY.md.
- Move AI overview and privacy-safe JSON export into Compliance Engine
- Add ISO control and theme facets to Work, including GPO settings
- Enrich ISO queries with baseline context, Windows code meanings and technical explanations
- Count GPO settings once and preserve editable decisions across mapping runs
- Fix GPO mapping version conflicts and backup domain identity resolution
- Add regression coverage and update architecture and reimport documentation
Binh