[OpenSpec] security-baseline-classification #1131

⚠️ OpenSpec-managed issue — this content is automatically synced
from the openspec/ directory. Manual edits will be overwritten on next sync.

Artifacts

• ✅ Metadata
• ✅ Proposal
• ✅ Specs
• ✅ Design
• ✅ Tasks
• 🔲 Plan
• 🔲 Review

Summary

A CISO wants to classify the applications in their own organisation's overview with a BIO baseline level, and share that knowledge with other municipalities. Stackiq has one BBN level per product, set in the catalogue, the same for every municipality and not split into availability, integrity and confidentiality. This change lets an organisation classify each application it uses on those three aspects, with a reason each, suggests the levels from GEMMA's reference components, derives the overall BBN level, and shows other municipalities how organisations classify an application, as counts that name no one.

Specs

• 📄 baseline-classification

Tasks

• Implement
• Test (PHPUnit tests/Unit/Settings/BaselineClassificationDeclarationTest.php)
• Implement
• Test (PHPUnit tests/Unit/EventListener/UsageClassificationSubscriberTest.php, constructing the real OpenRegister event classes)
• Implement
• Test (PHPUnit tests/Unit/Service/UsageClassificationServiceTest.php and tests/Unit/Controller/UsageClassificationControllerTest.php)
• Implement
• Test (vitest tests/vitest/usageClassificationPanel.spec.js and Playwright tests/e2e/spec-coverage/baseline-classification.spec.ts)
• Implement
• Test (Playwright tests/e2e/spec-coverage/baseline-classification.spec.ts against the demo data)

Design

See design.md for technical design details.

Synced from openspec/changes/security-baseline-classification by OpenSpec workflow
App: stackiq