[FEAT] Modello Organizzativo SGSI (ISO 27001/27017/27018) + SoA pre-popolato da NIS2
Nuovo modulo guidato in 6 step (cl. 4-10 + Statement of Applicability): - migration 037 (isms_models/roles/soa/documents) + 038 (dataset 111 controlli: 93 Annex A:2022 + 7 CLD/27017 + 11 PII/27018) + runner scripts/migrate-isms.php - IsmsModelController (16 endpoint) registrato in index.php - SoA pre-popolato dalle risposte Gap Analysis NIS2 (mapping iso27001_control) - estensioni cloud condizionali 27017/27018 via flag uses_public_cloud/ is_cloud_provider/processes_pii_in_cloud - AIService::generateIsmsDocument + fonti ISO in nis2_sources.php - frontend isms.html/isms.js + api client + sidebar + help + i18n IT/EN - ingest KB ISO (scope SYSTEM, solo titoli/sintesi: no testo coperto da copyright) - version.json 1.14.0; doc studio + deploy handoff Strumento di supporto/pre-audit (non certificazione). Migration DA APPLICARE su host. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
DevEnv nis2-agile
@@ -204,6 +204,26 @@ class NIS2API {
|
||||
acnReport(id) { return this._acn(this.get(`/acn-gap/${id}/report`)); }
|
||||
acnAiAnalyze(id) { return this._acn(this.post(`/acn-gap/${id}/aiAnalyze`, {})); }
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════
|
||||
// Modello Organizzativo SGSI (ISO 27001/27017/27018) — vedi IsmsModelController
|
||||
// Stesso contratto degli acn*: ritornano `data`, lanciano su success=false.
|
||||
// ═══════════════════════════════════════════════════════════════════
|
||||
ismsGetModel() { return this._acn(this.get('/isms/model')); }
|
||||
ismsSaveModel(data) { return this._acn(this.post('/isms/model', data || {})); }
|
||||
ismsAnnexControls() { return this._acn(this.get('/isms/annex-controls')); }
|
||||
ismsGetSoa() { return this._acn(this.get('/isms/soa')); }
|
||||
ismsDeriveSoa() { return this._acn(this.post('/isms/soa/derive', {})); }
|
||||
ismsUpdateSoa(data) { return this._acn(this.put('/isms/soa', data)); }
|
||||
ismsRoles() { return this._acn(this.get('/isms/roles')); }
|
||||
ismsSaveRole(data) { return this._acn(this.post('/isms/roles', data)); }
|
||||
ismsDeleteRole(id) { return this._acn(this.del(`/isms/roles/${id}`)); }
|
||||
ismsDocuments() { return this._acn(this.get('/isms/documents')); }
|
||||
ismsCreateDocument(data) { return this._acn(this.post('/isms/documents', data)); }
|
||||
ismsAiGenerateDocument(data) { return this._acn(this.post('/isms/documents/ai-generate', data)); }
|
||||
ismsUpdateDocument(id, data) { return this._acn(this.put(`/isms/documents/${id}`, data)); }
|
||||
ismsReadiness() { return this._acn(this.get('/isms/readiness')); }
|
||||
ismsExport() { return this._acn(this.get('/isms/export')); }
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════
|
||||
// Dashboard
|
||||
// ═══════════════════════════════════════════════════════════════════
|
||||
|
||||
@@ -189,6 +189,7 @@ function loadSidebar() {
|
||||
{ name: 'Compliance Journey', href: 'workflow.html', icon: `<svg viewBox="0 0 20 20" fill="currentColor"><path d="M10.707 2.293a1 1 0 00-1.414 0l-7 7a1 1 0 001.414 1.414L4 10.414V17a1 1 0 001 1h2a1 1 0 001-1v-2a1 1 0 011-1h2a1 1 0 011 1v2a1 1 0 001 1h2a1 1 0 001-1v-6.586l.293.293a1 1 0 001.414-1.414l-7-7z"/></svg>` },
|
||||
{ name: 'Gap Analysis', href: 'assessment.html', icon: iconClipboardCheck(), i18nKey: 'nav.gap_analysis' },
|
||||
{ name: 'Gap Analysis ACN', href: 'acn-gap.html', icon: iconClipboardCheck(), i18nKey: 'nav.acn_gap' },
|
||||
{ name: 'Modello SGSI (ISO 27001)', href: 'isms.html', icon: `<svg viewBox="0 0 20 20" fill="currentColor"><path fill-rule="evenodd" d="M2.166 4.999A11.954 11.954 0 0010 1.944 11.954 11.954 0 0017.834 5c.11.65.166 1.32.166 2.001 0 5.225-3.34 9.67-8 11.317C5.34 16.67 2 12.225 2 7c0-.682.057-1.35.166-2.001zm11.541 3.708a1 1 0 00-1.414-1.414L9 10.586 7.707 9.293a1 1 0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4z" clip-rule="evenodd"/></svg>`, i18nKey: 'nav.isms' },
|
||||
]
|
||||
},
|
||||
{
|
||||
|
||||
@@ -159,6 +159,48 @@ const HelpSystem = (function () {
|
||||
]
|
||||
},
|
||||
|
||||
'isms': {
|
||||
title: 'Guida - Modello Organizzativo SGSI (ISO 27001)',
|
||||
intro: 'Il modulo Modello Organizzativo ti guida nella costruzione di un Sistema di Gestione della Sicurezza delle Informazioni (SGSI / ISMS) secondo ISO/IEC 27001:2022 (clausole 4-10) + lo Statement of Applicability (SoA) sui controlli Annex A. E\' uno strumento di SUPPORTO e PRE-AUDIT: non sostituisce l\'auditor ne costituisce una certificazione.',
|
||||
sections: [
|
||||
{
|
||||
heading: 'Il wizard in 6 passi (clausole ISO 27001:2022)',
|
||||
items: [
|
||||
'<strong>1. Contesto e Ambito (cl. 4)</strong>: definisci lo scope del SGSI, contesto interno/esterno, parti interessate, confini ed esclusioni motivate. Qui attivi anche le estensioni cloud.',
|
||||
'<strong>2. Leadership (cl. 5)</strong>: ruoli e responsabilita del SGSI con matrice RACI (Responsible, Accountable, Consulted, Informed).',
|
||||
'<strong>3. Risk (cl. 6)</strong>: dichiari la metodologia di risk assessment (es. ISO 27005) e gli obiettivi. Il registro dei rischi resta nel modulo Rischi.',
|
||||
'<strong>4. Statement of Applicability</strong>: i 93 controlli Annex A con applicabilita, stato e motivazione.',
|
||||
'<strong>5. Documented Information (cl. 7-8)</strong>: policy e procedure, con bozze generabili dall\'AI (revisione umana obbligatoria).',
|
||||
'<strong>6. Monitoraggio e Miglioramento (cl. 9-10)</strong>: audit interni e non conformita si gestiscono nei moduli Audit & Report e NCR/CAPA. Una checklist mostra il completamento del SGSI.'
|
||||
]
|
||||
},
|
||||
{
|
||||
heading: 'SoA pre-popolato dal NIS2',
|
||||
items: [
|
||||
'Ogni domanda della Gap Analysis NIS2 Art.21 e gia collegata a un controllo ISO 27001 (es. A.5.1): lo Statement of Applicability viene quindi <strong>pre-compilato</strong> a partire dalle tue risposte NIS2 (badge "da NIS2").',
|
||||
'Lo stato derivato e una <strong>proposta da confermare</strong>: implemented=100%, partial=50%, not_implemented=0%; not_applicable esclude il controllo dalla derivazione.',
|
||||
'I controlli senza corrispondenza NIS2 (es. parte dei controlli fisici A.7) restano da compilare manualmente.',
|
||||
'Il pulsante "Ri-deriva dal NIS2" aggiunge solo i controlli mancanti: non sovrascrive le tue modifiche manuali.'
|
||||
]
|
||||
},
|
||||
{
|
||||
heading: 'Estensioni cloud ISO 27017 / 27018',
|
||||
items: [
|
||||
'Se usi servizi cloud pubblici o sei un fornitore cloud, attiva <strong>ISO/IEC 27017:2015</strong>: aggiunge 7 controlli cloud (CLD.*) al SoA.',
|
||||
'Se tratti dati personali (PII) in cloud pubblico come responsabile, attiva <strong>ISO/IEC 27018:2019</strong>: aggiunge i controlli privacy (PII.*) allineati ai principi ISO 29100, sinergici con il GDPR.',
|
||||
'Le sezioni cloud/PII compaiono nel SoA solo se attivi i relativi flag nel passo 1.'
|
||||
]
|
||||
}
|
||||
],
|
||||
references: [
|
||||
'ISO/IEC 27001:2022 - Requisiti del SGSI (clausole 4-10 + Annex A, 93 controlli)',
|
||||
'ISO/IEC 27002:2022 - Guida implementativa dei controlli Annex A',
|
||||
'ISO/IEC 27017:2015 - Controlli di sicurezza per i servizi cloud (CLD.*)',
|
||||
'ISO/IEC 27018:2019 - Protezione dei PII nel cloud pubblico (PII processor)',
|
||||
'NOTA: ISO e best practice non vincolante; gli obblighi italiani derivano da NIS2 / D.Lgs. 138/2024 / Determinazioni ACN.'
|
||||
]
|
||||
},
|
||||
|
||||
// ─── Risk Management ─────────────────────────────────────────
|
||||
'risks': {
|
||||
title: 'Guida - Gestione Rischi',
|
||||
@@ -911,6 +953,8 @@ const HelpSystem = (function () {
|
||||
'acn-gap.html': 'acn',
|
||||
'acn-gap': 'acn',
|
||||
'acn': 'acn',
|
||||
'isms.html': 'isms',
|
||||
'isms': 'isms',
|
||||
'risks.html': 'risks',
|
||||
'risks': 'risks',
|
||||
'incidents.html': 'incidents',
|
||||
|
||||
@@ -36,6 +36,47 @@ const I18n = (function () {
|
||||
'acn.results.ai': { it: 'Analisi AI dei gap', en: 'AI gap analysis' },
|
||||
'acn.results.gaps': { it: "Requisiti non conformi (piano d'azione)", en: 'Non-compliant requirements (action plan)' },
|
||||
'acn.backstart': { it: "Torna all'inizio", en: 'Back to start' },
|
||||
// ── Modello Organizzativo SGSI (ISO 27001) ──
|
||||
'nav.isms': { it: 'Modello SGSI (ISO 27001)', en: 'ISMS Model (ISO 27001)' },
|
||||
'isms.title': { it: 'Modello Organizzativo SGSI (ISO 27001)', en: 'ISMS Organizational Model (ISO 27001)' },
|
||||
'isms.export': { it: 'Esporta SGSI', en: 'Export ISMS' },
|
||||
'isms.intro.title': { it: 'Costruisci il tuo Sistema di Gestione della Sicurezza delle Informazioni.', en: 'Build your Information Security Management System.' },
|
||||
'isms.intro.body': { it: 'Procedura guidata ISO/IEC 27001:2022 (clausole 4-10 + Statement of Applicability). Lo Statement of Applicability viene pre-popolato dalle tue risposte alla Gap Analysis NIS2. Attiva le estensioni cloud ISO 27017/27018 dove pertinenti.', en: 'Guided ISO/IEC 27001:2022 procedure (clauses 4-10 + Statement of Applicability). The Statement of Applicability is pre-populated from your NIS2 Gap Analysis answers. Enable the ISO 27017/27018 cloud extensions where relevant.' },
|
||||
'isms.disclaimer': { it: 'Strumento di supporto e pre-audit: non costituisce una certificazione ISO 27001 né un parere professionale vincolante. Gli obblighi normativi in Italia derivano da NIS2 / D.Lgs. 138/2024 / Determinazioni ACN; ISO 27001/27017/27018 sono best practice.', en: 'Support and pre-audit tool: it is not an ISO 27001 certification nor binding professional advice. Regulatory obligations in Italy stem from NIS2 / Legislative Decree 138/2024 / ACN Determinations; ISO 27001/27017/27018 are best practices.' },
|
||||
'isms.step1': { it: 'Contesto', en: 'Context' },
|
||||
'isms.step2': { it: 'Leadership', en: 'Leadership' },
|
||||
'isms.step3': { it: 'Risk', en: 'Risk' },
|
||||
'isms.step4': { it: 'SoA', en: 'SoA' },
|
||||
'isms.step5': { it: 'Documenti', en: 'Documents' },
|
||||
'isms.step6': { it: 'Monitoraggio', en: 'Monitoring' },
|
||||
'isms.save_next': { it: 'Salva e continua', en: 'Save and continue' },
|
||||
'isms.next': { it: 'Continua', en: 'Continue' },
|
||||
'isms.s1.title': { it: '1. Contesto e Ambito (cl. 4)', en: '1. Context and Scope (cl. 4)' },
|
||||
'isms.s1.scope': { it: 'Ambito del SGSI (scope statement)', en: 'ISMS scope statement' },
|
||||
'isms.s1.ctx_int': { it: 'Contesto interno', en: 'Internal context' },
|
||||
'isms.s1.ctx_ext': { it: 'Contesto esterno', en: 'External context' },
|
||||
'isms.s1.parties': { it: 'Parti interessate (una per riga)', en: 'Interested parties (one per line)' },
|
||||
'isms.s1.boundaries': { it: 'Confini del SGSI', en: 'ISMS boundaries' },
|
||||
'isms.s1.exclusions': { it: 'Esclusioni motivate', en: 'Justified exclusions' },
|
||||
'isms.s1.cloud': { it: 'Estensioni cloud (attivano i controlli condizionali nel SoA)', en: 'Cloud extensions (enable conditional controls in the SoA)' },
|
||||
'isms.s1.uses_cloud': { it: 'Usiamo servizi cloud pubblici (Microsoft 365, AWS, Google...) → ISO 27017', en: 'We use public cloud services (Microsoft 365, AWS, Google...) → ISO 27017' },
|
||||
'isms.s1.cloud_provider': { it: 'Siamo fornitori di servizi cloud → ISO 27017 (lato provider)', en: 'We are cloud service providers → ISO 27017 (provider side)' },
|
||||
'isms.s1.pii_cloud': { it: 'Trattiamo dati personali (PII) in cloud pubblico come responsabili → ISO 27018', en: 'We process personal data (PII) in public cloud as processors → ISO 27018' },
|
||||
'isms.s2.title': { it: '2. Leadership: ruoli e responsabilità (cl. 5)', en: '2. Leadership: roles and responsibilities (cl. 5)' },
|
||||
'isms.s2.hint': { it: 'Definisci i ruoli del SGSI con la matrice RACI (Responsible, Accountable, Consulted, Informed).', en: 'Define the ISMS roles with the RACI matrix (Responsible, Accountable, Consulted, Informed).' },
|
||||
'isms.s2.add': { it: 'Aggiungi ruolo', en: 'Add role' },
|
||||
'isms.s3.title': { it: '3. Risk: metodologia e obiettivi (cl. 6)', en: '3. Risk: methodology and objectives (cl. 6)' },
|
||||
'isms.s3.method': { it: 'Metodologia di risk assessment', en: 'Risk assessment methodology' },
|
||||
'isms.s3.objectives': { it: 'Obiettivi del SGSI (uno per riga)', en: 'ISMS objectives (one per line)' },
|
||||
'isms.s3.link': { it: 'Il registro dei rischi vive nel modulo Rischi: questo passo ne dichiara la metodologia.', en: 'The risk register lives in the Risks module: this step declares its methodology.' },
|
||||
'isms.s4.title': { it: '4. Statement of Applicability', en: '4. Statement of Applicability' },
|
||||
'isms.s4.hint': { it: 'I controlli sono pre-popolati dalle risposte NIS2 dove esiste corrispondenza (badge "da NIS2"). Conferma applicabilità, stato e motivazione per ciascuno.', en: 'Controls are pre-populated from NIS2 answers where a mapping exists ("from NIS2" badge). Confirm applicability, status and justification for each.' },
|
||||
'isms.s4.derive': { it: 'Ri-deriva dal NIS2', en: 'Re-derive from NIS2' },
|
||||
'isms.s5.title': { it: '5. Documented Information (cl. 7-8)', en: '5. Documented Information (cl. 7-8)' },
|
||||
'isms.s5.aigen': { it: 'Genera bozza con AI', en: 'Generate draft with AI' },
|
||||
'isms.s6.title': { it: '6. Monitoraggio e Miglioramento (cl. 9-10)', en: '6. Monitoring and Improvement (cl. 9-10)' },
|
||||
'isms.s6.hint': { it: 'Gli audit interni e le non conformità si gestiscono nei moduli esistenti: Audit & Report e NCR/CAPA.', en: 'Internal audits and non-conformities are managed in the existing modules: Audit & Reports and NCR/CAPA.' },
|
||||
'isms.s6.readiness': { it: 'Completamento del SGSI', en: 'ISMS completion' },
|
||||
'nav.management': { it: 'Gestione', en: 'Management' },
|
||||
'nav.risks': { it: 'Rischi', en: 'Risks' },
|
||||
'nav.incidents': { it: 'Incidenti', en: 'Incidents' },
|
||||
|
||||
@@ -0,0 +1,288 @@
|
||||
/**
|
||||
* NIS2 Agile - Modello Organizzativo SGSI (ISO 27001/27017/27018)
|
||||
* Wizard 6 step: Contesto → Leadership → Risk → SoA → Documenti → Monitoraggio.
|
||||
* Pattern coerente con acn-gap.html: client api.* che ritorna `data` e lancia su errore.
|
||||
*/
|
||||
'use strict';
|
||||
|
||||
const STEP_KEYS = ['isms.step1','isms.step2','isms.step3','isms.step4','isms.step5','isms.step6'];
|
||||
const STEP_FALLBACK = ['Contesto','Leadership','Risk','SoA','Documenti','Monitoraggio'];
|
||||
const THEME_LABELS = {
|
||||
organizational: { it:'Organizzativi', en:'Organizational' },
|
||||
people: { it:'Persone', en:'People' },
|
||||
physical: { it:'Fisici', en:'Physical' },
|
||||
technological: { it:'Tecnologici', en:'Technological' },
|
||||
privacy: { it:'Privacy (PII)', en:'Privacy (PII)' }
|
||||
};
|
||||
|
||||
let ISMS = { model:null, step:0, soaLoaded:false };
|
||||
let soaSaveTimer = {};
|
||||
|
||||
function lang(){ try { return I18n.getLang ? I18n.getLang() : 'it'; } catch(e){ return 'it'; } }
|
||||
function el(id){ return document.getElementById(id); }
|
||||
function esc(s){ const d=document.createElement('div'); d.textContent=s==null?'':String(s); return d.innerHTML; }
|
||||
function hint(id, msg){ const e=el(id); if(e){ e.textContent=msg; } }
|
||||
|
||||
document.addEventListener('DOMContentLoaded', async function(){
|
||||
if (typeof checkAuth==='function' && !checkAuth()) return;
|
||||
if (window.I18n && I18n.init) I18n.init('it');
|
||||
if (typeof loadSidebar==='function') loadSidebar();
|
||||
if (window.HelpSystem && HelpSystem.init) HelpSystem.init();
|
||||
renderSteps();
|
||||
await loadModel();
|
||||
});
|
||||
|
||||
function renderSteps(){
|
||||
let html='';
|
||||
STEP_FALLBACK.forEach(function(lbl, i){
|
||||
const t = (window.I18n && I18n.t) ? I18n.t(STEP_KEYS[i]) : lbl;
|
||||
html += '<div class="isms-step" id="step-'+i+'" onclick="goStep('+i+')"><div class="num">'+(i+1)+'</div><div>'+esc(t&&t!==STEP_KEYS[i]?t:lbl)+'</div></div>';
|
||||
});
|
||||
el('isms-steps').innerHTML = html;
|
||||
}
|
||||
|
||||
function goStep(i){
|
||||
ISMS.step = i;
|
||||
document.querySelectorAll('.isms-panel').forEach(function(p){ p.classList.remove('active'); });
|
||||
const panel = el('panel-'+i); if (panel) panel.classList.add('active');
|
||||
document.querySelectorAll('.isms-step').forEach(function(s,idx){ s.classList.toggle('active', idx===i); });
|
||||
if (i===1) loadRoles();
|
||||
if (i===3) loadSoa();
|
||||
if (i===4) loadDocs();
|
||||
if (i===5) loadReadiness();
|
||||
window.scrollTo({top:0,behavior:'smooth'});
|
||||
}
|
||||
|
||||
async function loadModel(){
|
||||
try {
|
||||
const res = await api.ismsGetModel();
|
||||
ISMS.model = res.model;
|
||||
if (ISMS.model) fillStep1(ISMS.model);
|
||||
markDone();
|
||||
} catch(e){ /* tabella non ancora migrata o nessun modello: si parte da zero */ }
|
||||
goStep(0);
|
||||
}
|
||||
|
||||
function fillStep1(m){
|
||||
el('f-scope').value = m.scope_statement||'';
|
||||
el('f-ctx-int').value = m.context_internal||'';
|
||||
el('f-ctx-ext').value = m.context_external||'';
|
||||
el('f-parties').value = (m.interested_parties||[]).join('\n');
|
||||
el('f-boundaries').value = m.boundaries||'';
|
||||
el('f-exclusions').value = m.exclusions||'';
|
||||
el('f-uses-cloud').checked = !!m.uses_public_cloud;
|
||||
el('f-cloud-provider').checked = !!m.is_cloud_provider;
|
||||
el('f-pii-cloud').checked = !!m.processes_pii_in_cloud;
|
||||
if (m.risk_methodology!==undefined) el('f-method').value = m.risk_methodology||'';
|
||||
el('f-objectives').value = (m.isms_objectives||[]).join('\n');
|
||||
}
|
||||
|
||||
function linesToArr(v){ return (v||'').split('\n').map(function(s){return s.trim();}).filter(Boolean); }
|
||||
|
||||
async function saveStep1(){
|
||||
const data = {
|
||||
scope_statement: el('f-scope').value,
|
||||
context_internal: el('f-ctx-int').value,
|
||||
context_external: el('f-ctx-ext').value,
|
||||
interested_parties: linesToArr(el('f-parties').value),
|
||||
boundaries: el('f-boundaries').value,
|
||||
exclusions: el('f-exclusions').value,
|
||||
uses_public_cloud: el('f-uses-cloud').checked,
|
||||
is_cloud_provider: el('f-cloud-provider').checked,
|
||||
processes_pii_in_cloud: el('f-pii-cloud').checked
|
||||
};
|
||||
try {
|
||||
await api.ismsSaveModel(data);
|
||||
hint('isms-savehint', lang()==='en'?'Saved':'Salvato');
|
||||
ISMS.soaLoaded = false; // i flag cloud cambiano il perimetro SoA
|
||||
await loadModel();
|
||||
goStep(1);
|
||||
} catch(e){ alert((e&&e.message)||'Errore'); }
|
||||
}
|
||||
|
||||
async function saveStep3(){
|
||||
try {
|
||||
await api.ismsSaveModel({ risk_methodology: el('f-method').value, isms_objectives: linesToArr(el('f-objectives').value) });
|
||||
hint('isms-savehint', lang()==='en'?'Saved':'Salvato');
|
||||
await loadModel();
|
||||
goStep(3);
|
||||
} catch(e){ alert((e&&e.message)||'Errore'); }
|
||||
}
|
||||
|
||||
// ── Ruoli (cl.5) ──
|
||||
async function loadRoles(){
|
||||
try {
|
||||
const res = await api.ismsRoles();
|
||||
let html='';
|
||||
(res.roles||[]).forEach(function(r){
|
||||
html += '<div class="raci-row"><span class="soa-code">'+(r.raci||'-')+'</span>'+
|
||||
'<strong style="flex:1 1 140px;">'+esc(r.role_name)+'</strong>'+
|
||||
'<span style="flex:2 1 200px; color:var(--gray-500,#6b7280); font-size:.85rem;">'+esc(r.responsibility||'')+'</span>'+
|
||||
'<button class="btn btn-sm btn-outline" onclick="delRole('+r.id+')">×</button></div>';
|
||||
});
|
||||
el('roles-list').innerHTML = html || '<p class="text-muted">'+(lang()==='en'?'No roles yet.':'Nessun ruolo definito.')+'</p>';
|
||||
} catch(e){ el('roles-list').innerHTML='<p class="text-muted">'+esc((e&&e.message)||'')+'</p>'; }
|
||||
}
|
||||
async function addRole(){
|
||||
const name = el('r-name').value.trim();
|
||||
if(!name){ return; }
|
||||
try {
|
||||
await api.ismsSaveRole({ role_name:name, responsibility:el('r-resp').value, raci:el('r-raci').value });
|
||||
el('r-name').value=''; el('r-resp').value=''; el('r-raci').value='';
|
||||
loadRoles(); markDone();
|
||||
} catch(e){ alert((e&&e.message)||'Errore'); }
|
||||
}
|
||||
async function delRole(id){ try { await api.ismsDeleteRole(id); loadRoles(); } catch(e){} }
|
||||
|
||||
// ── SoA (cl.6.1.3) ──
|
||||
async function loadSoa(){
|
||||
if (ISMS.soaLoaded) return;
|
||||
el('soa-groups').innerHTML = '<p class="text-muted">'+(lang()==='en'?'Loading…':'Caricamento…')+'</p>';
|
||||
try {
|
||||
const res = await api.ismsGetSoa();
|
||||
renderSoa(res);
|
||||
ISMS.soaLoaded = true;
|
||||
markDone();
|
||||
} catch(e){
|
||||
el('soa-groups').innerHTML = '<p class="text-muted">'+esc((e&&e.message)||'')+'</p>';
|
||||
}
|
||||
}
|
||||
async function deriveSoa(){
|
||||
try { await api.ismsDeriveSoa(); ISMS.soaLoaded=false; await loadSoa(); }
|
||||
catch(e){ alert((e&&e.message)||'Errore'); }
|
||||
}
|
||||
function renderSoa(res){
|
||||
showSoaStats(res.stats);
|
||||
let html='';
|
||||
(res.groups||[]).forEach(function(g, gi){
|
||||
// raggruppa per tema
|
||||
const byTheme = {};
|
||||
(g.controls||[]).forEach(function(c){ (byTheme[c.theme]=byTheme[c.theme]||[]).push(c); });
|
||||
let inner='';
|
||||
Object.keys(byTheme).forEach(function(th){
|
||||
inner += '<div class="soa-theme">'+esc(THEME_LABELS[th]?THEME_LABELS[th][lang()]:th)+'</div>';
|
||||
byTheme[th].forEach(function(c){ inner += renderCtrl(c); });
|
||||
});
|
||||
html += '<div class="soa-std'+(gi===0?' open':'')+'"><div class="soa-std-head" onclick="this.parentNode.classList.toggle(\'open\')">'+
|
||||
'<strong>'+esc(g.label)+'</strong><span class="text-muted">'+(g.controls||[]).length+' '+(lang()==='en'?'controls':'controlli')+'</span></div>'+
|
||||
'<div class="soa-std-body">'+inner+'</div></div>';
|
||||
});
|
||||
el('soa-groups').innerHTML = html || '<p class="text-muted">'+(lang()==='en'?'No controls.':'Nessun controllo.')+'</p>';
|
||||
}
|
||||
function renderCtrl(c){
|
||||
const title = lang()==='en' ? (c.title_en||c.title_it) : (c.title_it||c.title_en);
|
||||
const derived = (+c.derived_from_nis2) ? '<span class="soa-derived" title="'+esc(c.source_ref||'')+'">'+(lang()==='en'?'from NIS2':'da NIS2')+'</span>' : '';
|
||||
const applicable = (+c.applicable)===1;
|
||||
const statuses = [
|
||||
['not_started', lang()==='en'?'Not started':'Da iniziare'],
|
||||
['in_progress', lang()==='en'?'In progress':'In corso'],
|
||||
['implemented', lang()==='en'?'Implemented':'Attuato'],
|
||||
['verified', lang()==='en'?'Verified':'Verificato']
|
||||
];
|
||||
let opts='';
|
||||
statuses.forEach(function(s){
|
||||
const sel = c.implementation_status===s[0] ? ('sel-'+s[0]) : '';
|
||||
opts += '<button type="button" class="soa-opt '+sel+'" onclick="setSoaStatus(this,\''+esc(c.control_code)+'\',\''+s[0]+'\')">'+s[1]+'</button>';
|
||||
});
|
||||
return '<div class="soa-ctrl" data-code="'+esc(c.control_code)+'">'+
|
||||
'<div class="soa-ctrl-head"><div><span class="soa-code">'+esc(c.control_code)+'</span>'+esc(title)+' '+derived+'</div>'+
|
||||
'<label style="font-size:.82rem; white-space:nowrap;"><input type="checkbox" '+(applicable?'checked':'')+' onchange="setSoaApplicable(\''+esc(c.control_code)+'\',this.checked)"> '+(lang()==='en'?'Applicable':'Applicabile')+'</label></div>'+
|
||||
'<div class="soa-opts" style="'+(applicable?'':'opacity:.4;pointer-events:none;')+'">'+opts+'</div>'+
|
||||
'<textarea class="soa-justif" placeholder="'+(lang()==='en'?'Justification (inclusion/exclusion)':'Motivazione (inclusione/esclusione)')+'" onchange="setSoaJustif(\''+esc(c.control_code)+'\',this.value,'+applicable+')">'+esc(applicable?(c.justification_inclusion||''):(c.justification_exclusion||''))+'</textarea>'+
|
||||
'</div>';
|
||||
}
|
||||
function setSoaStatus(btn, code, status){
|
||||
const wrap = btn.parentNode;
|
||||
Array.prototype.forEach.call(wrap.querySelectorAll('.soa-opt'), function(b){ b.className='soa-opt'; });
|
||||
btn.className='soa-opt sel-'+status;
|
||||
const pct = {not_started:0,in_progress:50,implemented:100,verified:100}[status];
|
||||
queueSoaSave(code, { control_code:code, implementation_status:status, implementation_pct:pct });
|
||||
}
|
||||
function setSoaApplicable(code, applicable){
|
||||
queueSoaSave(code, { control_code:code, applicable:applicable });
|
||||
ISMS.soaLoaded=false; setTimeout(loadSoa, 400);
|
||||
}
|
||||
function setSoaJustif(code, val, applicable){
|
||||
queueSoaSave(code, applicable ? { control_code:code, justification_inclusion:val } : { control_code:code, justification_exclusion:val });
|
||||
}
|
||||
function queueSoaSave(code, payload){
|
||||
hint('isms-savehint', lang()==='en'?'Saving…':'Salvataggio…');
|
||||
if (soaSaveTimer[code]) clearTimeout(soaSaveTimer[code]);
|
||||
soaSaveTimer[code] = setTimeout(async function(){
|
||||
try { const r = await api.ismsUpdateSoa(payload); showSoaStats(r.stats); hint('isms-savehint', lang()==='en'?'Saved':'Salvato'); }
|
||||
catch(e){ hint('isms-savehint', lang()==='en'?'Save pending':'Salvataggio in sospeso'); }
|
||||
}, 600);
|
||||
}
|
||||
function showSoaStats(s){
|
||||
if(!s){ return; }
|
||||
const e = el('soa-stats');
|
||||
if(e) e.textContent = (lang()==='en'?'Applicable: ':'Applicabili: ')+s.applicable+' · '+(lang()==='en'?'avg impl.: ':'impl. media: ')+s.avg_implementation_pct+'%';
|
||||
}
|
||||
|
||||
// ── Documenti (cl.7-8) ──
|
||||
async function loadDocs(){
|
||||
try {
|
||||
const res = await api.ismsDocuments();
|
||||
let html='';
|
||||
(res.documents||[]).forEach(function(d){
|
||||
const ai = (+d.ai_generated)?'<span class="soa-derived">AI</span>':'';
|
||||
html += '<div class="ck-item"><div><strong>'+esc(d.title)+'</strong> '+ai+' <span class="text-muted" style="font-size:.8rem;">('+esc(d.doc_type)+')</span></div>'+
|
||||
'<span class="badge badge-'+(d.status==='approved'?'success':'warning')+'">'+esc(d.status)+'</span></div>';
|
||||
});
|
||||
el('docs-list').innerHTML = html || '<p class="text-muted">'+(lang()==='en'?'No documents yet.':'Nessun documento.')+'</p>';
|
||||
} catch(e){ el('docs-list').innerHTML='<p class="text-muted">'+esc((e&&e.message)||'')+'</p>'; }
|
||||
}
|
||||
async function aiGenDoc(){
|
||||
const btn = el('btn-aigen'); btn.disabled=true;
|
||||
hint('aigen-hint', lang()==='en'?'Generating draft…':'Generazione bozza in corso…');
|
||||
try {
|
||||
await api.ismsAiGenerateDocument({ doc_type: el('d-type').value });
|
||||
hint('aigen-hint', lang()==='en'?'Draft created (review required).':'Bozza creata (revisione obbligatoria).');
|
||||
loadDocs(); markDone();
|
||||
} catch(e){ hint('aigen-hint',''); alert((e&&e.message)||(lang()==='en'?'AI unavailable':'AI non disponibile')); }
|
||||
finally { btn.disabled=false; }
|
||||
}
|
||||
|
||||
// ── Readiness (cl.9-10) ──
|
||||
async function loadReadiness(){
|
||||
try {
|
||||
const res = await api.ismsReadiness();
|
||||
el('readiness-pct').textContent = (res.overall_pct||0)+'%';
|
||||
let html='';
|
||||
(res.checklist||[]).forEach(function(c){
|
||||
html += '<div class="ck-item"><span><span class="soa-code">'+esc(c.clause)+'</span>'+esc(c.label)+'</span>'+
|
||||
'<span class="'+(c.done?'ck-yes':'ck-no')+'">'+(c.done?'✓':'—')+'</span></div>';
|
||||
});
|
||||
el('readiness-checklist').innerHTML = html;
|
||||
} catch(e){ el('readiness-checklist').innerHTML='<p class="text-muted">'+esc((e&&e.message)||'')+'</p>'; }
|
||||
}
|
||||
|
||||
function markDone(){
|
||||
// marca gli step "completati" in base allo stato del modello (best-effort).
|
||||
const m = ISMS.model;
|
||||
const done = [ m&&!!m.scope_statement, false, m&&!!m.risk_methodology, ISMS.soaLoaded, false, false ];
|
||||
done.forEach(function(d,i){ const s=el('step-'+i); if(s) s.classList.toggle('done', !!d); });
|
||||
}
|
||||
|
||||
async function ismsExportView(){
|
||||
try {
|
||||
const data = await api.ismsExport();
|
||||
const w = window.open('', '_blank');
|
||||
if(!w){ return; }
|
||||
const m = data.model||{};
|
||||
let soa='';
|
||||
(data.soa||[]).forEach(function(c){
|
||||
soa += '<tr><td>'+esc(c.control_code)+'</td><td>'+esc(c.title_it||'')+'</td><td>'+((+c.applicable)?'Sì':'No')+'</td><td>'+esc(c.implementation_status||'')+'</td><td>'+(c.implementation_pct||0)+'%</td></tr>';
|
||||
});
|
||||
w.document.write('<html><head><meta charset="utf-8"><title>SGSI - '+esc((data.organization&&data.organization.name)||'')+'</title>'+
|
||||
'<style>body{font-family:Arial,sans-serif;padding:30px;color:#111} h1,h2{color:#1e40af} table{width:100%;border-collapse:collapse;font-size:12px} td,th{border:1px solid #ccc;padding:5px;text-align:left} .disc{background:#fffbeb;border:1px solid #fde68a;padding:10px;font-size:12px;margin:16px 0}</style></head><body>'+
|
||||
'<h1>Modello Organizzativo SGSI (ISO/IEC 27001:2022)</h1>'+
|
||||
'<p><strong>'+esc((data.organization&&data.organization.name)||'')+'</strong> — generato il '+esc(data.generated_at||'')+'</p>'+
|
||||
'<div class="disc">'+esc(data.disclaimer||'')+'</div>'+
|
||||
'<h2>Ambito</h2><p>'+esc(m.scope_statement||'—')+'</p>'+
|
||||
'<h2>Metodologia di risk assessment</h2><p>'+esc(m.risk_methodology||'—')+'</p>'+
|
||||
'<h2>Statement of Applicability</h2><table><tr><th>Controllo</th><th>Titolo</th><th>Applicabile</th><th>Stato</th><th>%</th></tr>'+soa+'</table>'+
|
||||
'</body></html>');
|
||||
w.document.close();
|
||||
} catch(e){ alert((e&&e.message)||(lang()==='en'?'Start the SGSI first.':'Avvia prima il SGSI.')); }
|
||||
}
|
||||
Reference in New Issue
Block a user