{"id":"security-program","filename":"security-program.yaml","schema":"security-program","document":{"version":"1.0","program_id":"PROGRAM-DEMO-WEB","client_id":"client-demo","owner":"Bow Tie Kreative Security Operations","objectives":["Protect confidentiality and integrity of client website data.","Minimize public attack surface and privileged access.","Detect material control drift and compromise.","Restore the website and data from independently protected backups."],"assets":[{"asset_id":"demo-vps-01","kind":"vps","environment":"production","criticality":5,"owner":"platform-team","classification":"confidential","internet_exposed":true,"dependencies":["demo-domain","demo-database","demo-backup"]},{"asset_id":"demo-domain","kind":"website","environment":"production","criticality":5,"owner":"application-team","classification":"public-and-confidential","internet_exposed":true,"dependencies":["demo-vps-01"]},{"asset_id":"demo-backup","kind":"backup_repository","environment":"recovery","criticality":5,"owner":"recovery-team","classification":"confidential","internet_exposed":false,"dependencies":[]}],"profiles":[{"profile":"profiles/vps-web-baseline.yaml","applies_to":["demo-vps-01"],"target_level":"hardened"},{"profile":"profiles/website-passive-baseline.yaml","applies_to":["demo-domain"],"target_level":"verified"},{"profile":"profiles/drive-backup-baseline.yaml","applies_to":["demo-backup"],"target_level":"resilient"}],"rules":[{"rule_id":"RULE-PUBLIC-KEV","if":["vulnerability.known_exploited == true","vulnerability.affected == true","vulnerability.reachable == true"],"then":["priority = P0","open emergency mitigation workflow"],"else":["continue contextual prioritization"]},{"rule_id":"RULE-CHANGE-GATE","if":["action.mode in [change, containment, recovery]","backup.verified == true","rollback.verified == true","maintenance_window.confirmed == true","kill_switch.configured == true"],"then":["permit guarded runner"],"else":["plan only"]}],"feedback_loops":[{"trigger":"public exposure drift","action":["open urgent finding","verify provider and host firewall","propose containment"]},{"trigger":"backup restore test failed","action":["mark recovery control failed","raise affected asset priority","suspend destructive changes"]}]},"yaml":"version: \"1.0\"\nprogram_id: PROGRAM-DEMO-WEB\nclient_id: client-demo\nowner: Bow Tie Kreative Security Operations\nobjectives:\n  - Protect confidentiality and integrity of client website data.\n  - Minimize public attack surface and privileged access.\n  - Detect material control drift and compromise.\n  - Restore the website and data from independently protected backups.\nassets:\n  - asset_id: demo-vps-01\n    kind: vps\n    environment: production\n    criticality: 5\n    owner: platform-team\n    classification: confidential\n    internet_exposed: true\n    dependencies: [demo-domain, demo-database, demo-backup]\n  - asset_id: demo-domain\n    kind: website\n    environment: production\n    criticality: 5\n    owner: application-team\n    classification: public-and-confidential\n    internet_exposed: true\n    dependencies: [demo-vps-01]\n  - asset_id: demo-backup\n    kind: backup_repository\n    environment: recovery\n    criticality: 5\n    owner: recovery-team\n    classification: confidential\n    internet_exposed: false\n    dependencies: []\nprofiles:\n  - profile: profiles/vps-web-baseline.yaml\n    applies_to: [demo-vps-01]\n    target_level: hardened\n  - profile: profiles/website-passive-baseline.yaml\n    applies_to: [demo-domain]\n    target_level: verified\n  - profile: profiles/drive-backup-baseline.yaml\n    applies_to: [demo-backup]\n    target_level: resilient\nrules:\n  - rule_id: RULE-PUBLIC-KEV\n    if:\n      - vulnerability.known_exploited == true\n      - vulnerability.affected == true\n      - vulnerability.reachable == true\n    then:\n      - priority = P0\n      - open emergency mitigation workflow\n    else:\n      - continue contextual prioritization\n  - rule_id: RULE-CHANGE-GATE\n    if:\n      - action.mode in [change, containment, recovery]\n      - backup.verified == true\n      - rollback.verified == true\n      - maintenance_window.confirmed == true\n      - kill_switch.configured == true\n    then:\n      - permit guarded runner\n    else:\n      - plan only\nfeedback_loops:\n  - trigger: public exposure drift\n    action:\n      - open urgent finding\n      - verify provider and host firewall\n      - propose containment\n  - trigger: backup restore test failed\n    action:\n      - mark recovery control failed\n      - raise affected asset priority\n      - suspend destructive changes\n"}