{
  "schema": "compliance-crosswalk/v1",
  "tool": "inciclass",
  "frameworks": [
    {
      "id": "DORA",
      "name": "Digital Operational Resilience Act (Reg. 2022/2554)",
      "controls": [
        { "ref": "Art. 17", "name": "ICT-related incident management process", "how": "assess subcommand scores an incident against Art. 17 classification criteria.", "coverage": "evidences" },
        { "ref": "Art. 18", "name": "Classification & reporting of ICT-related incidents", "how": "Explicit mapping of RTS 2024/1772 seven criteria + Below/Met/Critical rationale.", "coverage": "evidences" },
        { "ref": "Art. 19", "name": "Reporting timeline",                                  "how": "clock subcommand tracks 4h initial / 72h intermediate / 1m final DORA deadlines.", "coverage": "evidences" }
      ]
    },
    {
      "id": "NIS2",
      "name": "NIS2 Directive (Dir. 2022/2555)",
      "controls": [
        { "ref": "Art. 23", "name": "Reporting obligations",  "how": "clock subcommand tracks 24h early-warning / 72h intermediate / 1m final NIS2 deadlines.", "coverage": "evidences" }
      ]
    },
    {
      "id": "RTS-2024-1772",
      "name": "Commission Delegated Regulation on ICT-incident classification",
      "controls": [
        { "ref": "Art. 1", "name": "Clients / financial-counterparties / transactions affected", "how": "assess criterion 1.",  "coverage": "evidences" },
        { "ref": "Art. 2", "name": "Reputational impact",                                        "how": "assess criterion 2.",  "coverage": "evidences" },
        { "ref": "Art. 3", "name": "Duration + service downtime",                                "how": "assess criterion 3.",  "coverage": "evidences" },
        { "ref": "Art. 4", "name": "Geographical spread",                                        "how": "assess criterion 4.",  "coverage": "evidences" },
        { "ref": "Art. 5", "name": "Data losses",                                                "how": "assess criterion 5.",  "coverage": "evidences" },
        { "ref": "Art. 6", "name": "Criticality of services affected",                           "how": "assess criterion 6.",  "coverage": "evidences" },
        { "ref": "Art. 7", "name": "Economic impact",                                            "how": "assess criterion 7.",  "coverage": "evidences" }
      ]
    }
  ]
}