Cybersecurity-Certification-Hub · anatheka · Feb 7, 2025 · Jun 24, 2025 · Jul 4, 2025 · Jan 2, 2026
diff --git a/metrics/Inventory/AutomaticDiscoveryEnabled/AutomaticDiscoveryEnabled.yml b/metrics/Inventory/AutomaticDiscoveryEnabled/AutomaticDiscoveryEnabled.yml
@@ -0,0 +1,9 @@
+--- # Metadata
+- id: ResourceInventoryEnabled
+- description: This rule evaluates whether an [AssetInventory] is [p1:enabled]
+- version: "1.0"
+- comments: An asset inventory is a tool to manage resources and their lifecycles which is essential for maintaining security and compliance.
+--- # Configuration data
+- p1:
+  - operator: ==
+  - targetValue: True
diff --git a/metrics/Inventory/AutomaticDiscoveryEnabled/data.json b/metrics/Inventory/AutomaticDiscoveryEnabled/data.json
@@ -0,0 +1,4 @@
+{
+    "operator" : "==",
+    "target_value" : true
+}
diff --git a/metrics/Inventory/AutomaticDiscoveryEnabled/metric.rego b/metrics/Inventory/AutomaticDiscoveryEnabled/metric.rego
@@ -0,0 +1,18 @@
+package cch.metrics.automatic_discovery_enabled
+
+import data.cch.compare
+import rego.v1
+
+default applicable = false
+
+default compliant = false
+
+enabled := input.resourceInventory.automaticDiscoveryEnabled
+
+applicable if {
+	input.type[_] == "ResourceInventory"
+}
+
+compliant if {
+	compare(data.operator, data.target_value, enabled)
+}
diff --git a/metrics/Inventory/ResourceInventoryEnabled/ResourceInventoryEnabled.yml b/metrics/Inventory/ResourceInventoryEnabled/ResourceInventoryEnabled.yml
@@ -0,0 +1,9 @@
+--- # Metadata
+- id: ResourceInventoryEnabled
+- description: This rule evaluates whether a [ResourceInventory] is [p1:enabled]
+- version: "1.0"
+- comments: An asset inventory is a tool to manage resources and their lifecycles which is essential for maintaining security and compliance.
+--- # Configuration data
+- p1:
+  - operator: ==
+  - targetValue: True
diff --git a/metrics/Inventory/ResourceInventoryEnabled/data.json b/metrics/Inventory/ResourceInventoryEnabled/data.json
@@ -0,0 +1,4 @@
+{
+    "operator" : "==",
+    "target_value" : true
+}
diff --git a/metrics/Inventory/ResourceInventoryEnabled/metric.rego b/metrics/Inventory/ResourceInventoryEnabled/metric.rego
@@ -0,0 +1,18 @@
+package cch.metrics.resource_inventory_enabled
+
+import data.cch.compare
+import rego.v1
+
+default applicable = false
+
+default compliant = false
+
+enabled := input.resourceInventory.enabled
+
+applicable if {
+	input.type[_] == "ResourceInventory"
+}
+
+compliant if {
+	compare(data.operator, data.target_value, enabled)
+}
diff --git a/ontology/1.0/ontology-merged.owx b/ontology/1.0/ontology-merged.owx
@@ -656,6 +656,9 @@
     <Declaration>
         <Class IRI="/classes/ResourceGroup"/>
     </Declaration>
+    <Declaration>
+        <Class IRI="/classes/ResourceInventoryService"/>
+    </Declaration>
     <Declaration>
         <Class IRI="/classes/ResourceLogging"/>
     </Declaration>
@@ -860,12 +863,21 @@
     <Declaration>
         <ObjectProperty IRI="/properties/to"/>
     </Declaration>
+    <Declaration>
+        <DataProperty IRI="/classes/OneQubitErrorRate"/>
+    </Declaration>
+    <Declaration>
+        <DataProperty IRI="/classes/SpamErrorRate"/>
+    </Declaration>
     <Declaration>
         <DataProperty IRI="/classes/T1CoherenceTime"/>
     </Declaration>
     <Declaration>
         <DataProperty IRI="/classes/T2CoherenceTime"/>
     </Declaration>
+    <Declaration>
+        <DataProperty IRI="/classes/TwoQubitErrorRate"/>
+    </Declaration>
     <Declaration>
         <DataProperty IRI="/classes/UniversalGateSetEnabled"/>
     </Declaration>
@@ -926,6 +938,9 @@
     <Declaration>
         <DataProperty IRI="/classes/enforceMFA"/>
     </Declaration>
+    <Declaration>
+        <DataProperty IRI="/classes/errorCorrectionEnabled"/>
+    </Declaration>
     <Declaration>
         <DataProperty IRI="/classes/expirationDate"/>
     </Declaration>
@@ -1388,12 +1403,6 @@
     <Declaration>
         <Datatype abbreviatedIRI="xsd:listString"/>
     </Declaration>
-    <Declaration>
-        <DataProperty IRI="/classes/OneQubitErrorRate"/>
-    </Declaration>
-    <Declaration>
-        <DataProperty IRI="/classes/SpamErrorRate"/>
-    </Declaration>
     <Declaration>
         <DataProperty IRI="/classes/privacyLabel"/>
     </Declaration>
@@ -1409,12 +1418,6 @@
     <Declaration>
         <DataProperty IRI="/classes/size"/>
     </Declaration>
-    <Declaration>
-        <DataProperty IRI="/classes/TwoQubitErrorRate"/>
-    </Declaration>
-    <Declaration>
-        <DataProperty IRI="/classes/errorCorrectionEnabled"/>
-    </Declaration>
     <Declaration>
         <DataProperty IRI="/classes/poisonLevel"/>
     </Declaration>
@@ -1424,9 +1427,15 @@
     <Declaration>
         <DataProperty IRI="/classes/type"/>
     </Declaration>
+    <Declaration>
+        <DataProperty IRI="/classes/enabled"/>
+    </Declaration>
     <Declaration>
         <NamedIndividual IRI="/classes/Implementation"/>
     </Declaration>
+    <Declaration>
+        <DataProperty IRI="/classes/automaticDiscoveryEnabled"/>
+    </Declaration>
     <Declaration>
         <DataProperty IRI="/classes/robustness"/>
     </Declaration>
@@ -4151,6 +4160,24 @@
         <Class IRI="/classes/ResourceGroup"/>
         <Class IRI="/classes/CloudResource"/>
     </SubClassOf>
+    <SubClassOf>
+        <Class IRI="/classes/ResourceInventoryService"/>
+        <Class IRI="/classes/NetworkService"/>
+    </SubClassOf>
+    <SubClassOf>
+        <Class IRI="/classes/ResourceInventoryService"/>
+        <DataSomeValuesFrom>
+            <DataProperty IRI="/classes/automaticDiscoveryEnabled"/>
+            <Datatype abbreviatedIRI="xsd:boolean"/>
+        </DataSomeValuesFrom>
+    </SubClassOf>
+    <SubClassOf>
+        <Class IRI="/classes/ResourceInventoryService"/>
+        <DataSomeValuesFrom>
+            <DataProperty IRI="/classes/enabled"/>
+            <Datatype abbreviatedIRI="xsd:boolean"/>
+        </DataSomeValuesFrom>
+    </SubClassOf>
     <SubClassOf>
         <Class IRI="/classes/ResourceLogging"/>
         <Class IRI="/classes/Logging"/>
@@ -6512,6 +6539,16 @@ name = metadata.name</Literal>
         <IRI>/classes/ResourceGroup</IRI>
         <Literal>ResourceGroup</Literal>
     </AnnotationAssertion>
+    <AnnotationAssertion>
+        <AnnotationProperty abbreviatedIRI="rdfs:comment"/>
+        <IRI>/classes/ResourceInventoryService</IRI>
+        <Literal>A resource inventory service that may automatically discover resources to enable their management.</Literal>
+    </AnnotationAssertion>
+    <AnnotationAssertion>
+        <AnnotationProperty abbreviatedIRI="rdfs:label"/>
+        <IRI>/classes/ResourceInventoryService</IRI>
+        <Literal>ResourceInventoryService</Literal>
+    </AnnotationAssertion>
     <AnnotationAssertion>
         <AnnotationProperty abbreviatedIRI="rdfs:label"/>
         <IRI>/classes/ResourceLogging</IRI>

diff --git a/ontology/1.0/ontology.proto b/ontology/1.0/ontology.proto
@@ -556,6 +556,7 @@ message Infrastructure {
 		LoadBalancer load_balancer = 4201;
 		LoggingService logging_service = 14131;
 		MachineLearningService machine_learning_service = 16966;
+		ResourceInventoryService resource_inventory_service = 3821;
 		SecurityAdvisoryService security_advisory_service = 173;
 		DocumentDatabaseService document_database_service = 17950;
 		KeyValueDatabaseService key_value_database_service = 1004;
@@ -2740,6 +2741,7 @@ message NetworkService {
 		LoadBalancer load_balancer = 4201;
 		LoggingService logging_service = 14131;
 		MachineLearningService machine_learning_service = 16966;
+		ResourceInventoryService resource_inventory_service = 3821;
 		SecurityAdvisoryService security_advisory_service = 173;
 		DocumentDatabaseService document_database_service = 17950;
 		KeyValueDatabaseService key_value_database_service = 1004;
@@ -2761,6 +2763,7 @@ message Networking {
 		LoadBalancer load_balancer = 4201;
 		LoggingService logging_service = 14131;
 		MachineLearningService machine_learning_service = 16966;
+		ResourceInventoryService resource_inventory_service = 3821;
 		SecurityAdvisoryService security_advisory_service = 173;
 		DocumentDatabaseService document_database_service = 17950;
 		KeyValueDatabaseService key_value_database_service = 1004;
@@ -3431,6 +3434,7 @@ message Resource {
 		LoadBalancer load_balancer = 4201;
 		LoggingService logging_service = 14131;
 		MachineLearningService machine_learning_service = 16966;
+		ResourceInventoryService resource_inventory_service = 3821;
 		SecurityAdvisoryService security_advisory_service = 173;
 		DocumentDatabaseService document_database_service = 17950;
 		KeyValueDatabaseService key_value_database_service = 1004;
@@ -3503,6 +3507,38 @@ message ResourceGroup {
 	UsageStatistics usage_statistics = 2564;
 }
 
+// ResourceInventoryService is an entity class in our ontology. It can be instantiated and contains all of its properties as well of its implemented interfaces.
+// A resource inventory service that may automatically discover resources to enable their management.
+message ResourceInventoryService {
+	option (resource_type_names) = "ResourceInventoryService";
+	option (resource_type_names) = "NetworkService";
+	option (resource_type_names) = "Networking";
+	option (resource_type_names) = "Infrastructure";
+	option (resource_type_names) = "Resource";
+
+	bool automatic_discovery_enabled = 12229;
+	google.protobuf.Timestamp creation_time = 920;
+	string description = 12086;
+	bool enabled = 9833;
+	string id = 9382 [ (buf.validate.field).required = true ];
+	bool internet_accessible_endpoint = 14221;
+	repeated string ips = 3324;
+	map<string, string> labels = 10962;
+	string name = 4569 [ (buf.validate.field).required = true ];
+	repeated uint32 ports = 5032;
+	// The raw field contains the raw information that is used to fill in the fields of the ontology.
+	string raw = 13845;
+	Authenticity authenticity = 9116;
+	repeated string compute_ids  = 16091;
+	GeoLocation geo_location = 853;
+	repeated Logging loggings  = 9823;
+	repeated Redundancy redundancies  = 8507;
+	optional string parent_id = 13496;
+	optional string service_metadata_document_id = 17502;
+	TransportEncryption transport_encryption = 16285;
+	UsageStatistics usage_statistics = 13273;
+}
+
 // ResourceLogging is an entity class in our ontology. It can be instantiated and contains all of its properties as well of its implemented interfaces.
 message ResourceLogging {
 	option (resource_type_names) = "ResourceLogging";

diff --git a/ontology/1.0/resource/catalog-v001.xml b/ontology/1.0/resource/catalog-v001.xml
@@ -1,21 +1,11 @@
 <?xml version="1.0" encoding="UTF-8" standalone="no"?>
 <catalog prefer="public" xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog">
     <group id="Folder Repository, directory=, recursive=true, Auto-Update=true, version=2" prefer="public" xml:base="">
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="duplicate:https://ontology.cybersecuritycertcluster.eu" uri="ontology.owx"/>
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="duplicate:https://ontology.cybersecuritycertcluster.eu" uri="ontology-merged.owx"/>
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="https://ontology.cybersecuritycertcluster.eu/core" uri="core.owx"/>
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="https://ontology.cybersecuritycertcluster.eu/core/evidence" uri="core/evidence.owx"/>
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="https://ontology.cybersecuritycertcluster.eu/core/framework" uri="core/framework.owx"/>
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="https://ontology.cybersecuritycertcluster.eu/core/functionality" uri="core/functionality.owx"/>
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="https://ontology.cybersecuritycertcluster.eu/core/properties" uri="core/properties.owx"/>
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="https://ontology.cybersecuritycertcluster.eu/core/resource" uri="core/resource.owx"/>
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="https://ontology.cybersecuritycertcluster.eu/core/security" uri="core/security.owx"/>
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="https://ontology.cybersecuritycertcluster.eu/data" uri="data.owx"/>
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="https://ontology.cybersecuritycertcluster.eu/resource" uri="resource.owx"/>
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="https://ontology.cybersecuritycertcluster.eu/resource/application" uri="resource/application.owx"/>
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="https://ontology.cybersecuritycertcluster.eu/resource/document" uri="resource/document.owx"/>
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="https://ontology.cybersecuritycertcluster.eu/resource/human_resources" uri="resource/human_resources.owx"/>
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="https://ontology.cybersecuritycertcluster.eu/resource/infrastructure" uri="resource/infrastructure.owx"/>
-        <uri id="Automatically generated entry, Timestamp=1757501533068" name="https://ontology.cybersecuritycertcluster.eu/resource/ml" uri="resource/ml.owx"/>
+        <uri id="Automatically generated entry, Timestamp=1767343274459" name="https://ontology.cybersecuritycertcluster.eu/resource/application" uri="application.owx"/>
+        <uri id="Automatically generated entry, Timestamp=1767343274459" name="https://ontology.cybersecuritycertcluster.eu/resource/document" uri="document.owx"/>
+        <uri id="Automatically generated entry, Timestamp=1767343274459" name="https://ontology.cybersecuritycertcluster.eu/resource/hardware" uri="hardware.owx"/>
+        <uri id="Automatically generated entry, Timestamp=1767343274459" name="https://ontology.cybersecuritycertcluster.eu/resource/human_resources" uri="human_resources.owx"/>
+        <uri id="Automatically generated entry, Timestamp=1767343274459" name="https://ontology.cybersecuritycertcluster.eu/resource/infrastructure" uri="infrastructure.owx"/>
+        <uri id="Automatically generated entry, Timestamp=1767343274459" name="https://ontology.cybersecuritycertcluster.eu/resource/ml" uri="ml.owx"/>
     </group>
 </catalog>