Spaces:
Sleeping
Sleeping
| import streamlit as st | |
| import pandas as pd | |
| from docx import Document | |
| import io | |
| import json | |
| # Page configuration | |
| st.set_page_config( | |
| page_title="Cybersecurity Compliance Checklist Creator", | |
| page_icon="🔒", | |
| layout="wide" | |
| ) | |
| # Sample compliance frameworks data | |
| COMPLIANCE_FRAMEWORKS = { | |
| "ISO27001": { | |
| "name": "ISO/IEC 27001:2022", | |
| "controls": [ | |
| {"id": "A.5.1", "description": "Information security policies", "category": "Organizational"}, | |
| {"id": "A.5.2", "description": "Information security roles and responsibilities", "category": "Organizational"}, | |
| {"id": "A.5.3", "description": "Segregation of duties", "category": "Organizational"}, | |
| {"id": "A.5.4", "description": "Management responsibilities", "category": "Organizational"}, | |
| {"id": "A.6.1", "description": "Information security in project management", "category": "Organizational"}, | |
| {"id": "A.7.1", "description": "Personnel screening", "category": "Human Resources"}, | |
| {"id": "A.7.2", "description": "Terms and conditions of employment", "category": "Human Resources"}, | |
| {"id": "A.8.1", "description": "Inventory of assets", "category": "Asset Management"}, | |
| {"id": "A.8.2", "description": "Ownership of assets", "category": "Asset Management"}, | |
| {"id": "A.9.1", "description": "Access control policy", "category": "Access Control"}, | |
| {"id": "A.9.2", "description": "User access management", "category": "Access Control"}, | |
| {"id": "A.9.3", "description": "User responsibilities", "category": "Access Control"}, | |
| {"id": "A.9.4", "description": "System and application access control", "category": "Access Control"}, | |
| {"id": "A.10.1", "description": "Cryptographic controls", "category": "Cryptography"}, | |
| {"id": "A.11.1", "description": "Physical security perimeters", "category": "Physical Security"}, | |
| {"id": "A.11.2", "description": "Physical entry controls", "category": "Physical Security"}, | |
| {"id": "A.12.1", "description": "Operational procedures", "category": "Operations Security"}, | |
| {"id": "A.12.2", "description": "Protection from malware", "category": "Operations Security"}, | |
| {"id": "A.12.3", "description": "Backup", "category": "Operations Security"}, | |
| {"id": "A.12.4", "description": "Logging and monitoring", "category": "Operations Security"}, | |
| {"id": "A.12.5", "description": "Control of operational software", "category": "Operations Security"}, | |
| {"id": "A.12.6", "description": "Technical vulnerability management", "category": "Operations Security"}, | |
| {"id": "A.12.7", "description": "Information systems audit considerations", "category": "Operations Security"}, | |
| {"id": "A.13.1", "description": "Network security management", "category": "Communications Security"}, | |
| {"id": "A.13.2", "description": "Information transfer", "category": "Communications Security"}, | |
| {"id": "A.14.1", "description": "Security requirements of information systems", "category": "System Development"}, | |
| {"id": "A.14.2", "description": "Security in development and support processes", "category": "System Development"}, | |
| {"id": "A.14.3", "description": "Test data", "category": "System Development"}, | |
| {"id": "A.15.1", "description": "Information security in supplier relationships", "category": "Supplier Relationships"}, | |
| {"id": "A.15.2", "description": "Supplier service delivery management", "category": "Supplier Relationships"}, | |
| {"id": "A.16.1", "description": "Management of information security incidents and improvements", "category": "Incident Management"}, | |
| {"id": "A.17.1", "description": "Information security continuity", "category": "Business Continuity"}, | |
| {"id": "A.17.2", "description": "Redundancies", "category": "Business Continuity"}, | |
| {"id": "A.18.1", "description": "Compliance with legal and contractual requirements", "category": "Compliance"} | |
| ] | |
| }, | |
| "NIST": { | |
| "name": "NIST Cybersecurity Framework", | |
| "controls": [ | |
| {"id": "ID.AM-1", "description": "Physical devices and systems within the organization are inventoried", "category": "Identify"}, | |
| {"id": "ID.AM-2", "description": "Software platforms and applications within the organization are inventoried", "category": "Identify"}, | |
| {"id": "ID.AM-3", "description": "Organizational communication and data flows are mapped", "category": "Identify"}, | |
| {"id": "ID.AM-4", "description": "External information systems are catalogued", "category": "Identify"}, | |
| {"id": "ID.AM-5", "description": "Resources (e.g., hardware, devices, data, and software) are prioritized based on their classification, criticality, and business value", "category": "Identify"}, | |
| {"id": "ID.AM-6", "description": "Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders are established", "category": "Identify"}, | |
| {"id": "PR.AC-1", "description": "Identities and credentials are managed for authorized devices and users", "category": "Protect"}, | |
| {"id": "PR.AC-2", "description": "Physical access to assets is managed and protected", "category": "Protect"}, | |
| {"id": "PR.AC-3", "description": "Remote access is managed", "category": "Protect"}, | |
| {"id": "PR.AC-4", "description": "Access permissions are managed, incorporating the principles of least privilege and separation of duties", "category": "Protect"}, | |
| {"id": "PR.AC-5", "description": "Network integrity is protected, incorporating network segregation where appropriate", "category": "Protect"}, | |
| {"id": "PR.AT-1", "description": "All users are informed and trained", "category": "Protect"}, | |
| {"id": "PR.AT-2", "description": "Privileged users understand their roles and responsibilities", "category": "Protect"}, | |
| {"id": "PR.AT-3", "description": "Third-party stakeholders understand their roles and responsibilities", "category": "Protect"}, | |
| {"id": "PR.AT-4", "description": "Senior executives understand their roles and responsibilities", "category": "Protect"}, | |
| {"id": "PR.AT-5", "description": "Physical and cybersecurity personnel understand their roles and responsibilities", "category": "Protect"}, | |
| {"id": "PR.DS-1", "description": "Data-at-rest is protected", "category": "Protect"}, | |
| {"id": "PR.DS-2", "description": "Data-in-transit is protected", "category": "Protect"}, | |
| {"id": "PR.DS-3", "description": "Assets are formally managed throughout removal, transfers, and disposition", "category": "Protect"}, | |
| {"id": "PR.DS-4", "description": "Adequate capacity to ensure availability is maintained", "category": "Protect"}, | |
| {"id": "PR.DS-5", "description": "Protections against data leaks are implemented", "category": "Protect"}, | |
| {"id": "PR.DS-6", "description": "Integrity checking mechanisms are used to verify software, firmware, and information integrity", "category": "Protect"}, | |
| {"id": "PR.DS-7", "description": "The development and testing environment(s) are separate from the production environment", "category": "Protect"}, | |
| {"id": "PR.IP-1", "description": "A baseline configuration of information technology/industrial control systems is created and maintained", "category": "Protect"}, | |
| {"id": "PR.IP-2", "description": "A System Development Life Cycle to manage systems is implemented", "category": "Protect"}, | |
| {"id": "PR.IP-3", "description": "Configuration change control processes are in place", "category": "Protect"}, | |
| {"id": "PR.IP-4", "description": "Backups of information are conducted, maintained, and tested periodically", "category": "Protect"}, | |
| {"id": "PR.IP-5", "description": "Policy and regulations regarding the physical operating environment for organizational assets are met", "category": "Protect"}, | |
| {"id": "PR.IP-6", "description": "Data is destroyed according to policy", "category": "Protect"}, | |
| {"id": "PR.IP-7", "description": "Protection processes are continuously improved", "category": "Protect"}, | |
| {"id": "PR.IP-8", "description": "Effectiveness of protection technologies is shared with appropriate parties", "category": "Protect"}, | |
| {"id": "PR.IP-9", "description": "Response plans (Incident Response and Business Continuity) and recovery plans (Disaster Recovery) are in place and managed", "category": "Protect"}, | |
| {"id": "PR.IP-10", "description": "Response and recovery plans are tested", "category": "Protect"}, | |
| {"id": "PR.IP-11", "description": "Cybersecurity is included in human resources practices", "category": "Protect"}, | |
| {"id": "PR.IP-12", "description": "A vulnerability management plan is developed and implemented", "category": "Protect"}, | |
| {"id": "PR.PT-1", "description": "Audit/log records are determined, documented, implemented, and reviewed in accordance with policy", "category": "Protect"}, | |
| {"id": "PR.PT-2", "description": "Removable media is protected and its use restricted according to policy", "category": "Protect"}, | |
| {"id": "PR.PT-3", "description": "Access to systems and assets is controlled, incorporating the principle of least functionality", "category": "Protect"}, | |
| {"id": "PR.PT-4", "description": "Communications and control networks are protected", "category": "Protect"}, | |
| {"id": "PR.PT-5", "description": "Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations", "category": "Protect"}, | |
| {"id": "DE.AE-1", "description": "A baseline of network operations and expected data flows for users and systems is established and managed", "category": "Detect"}, | |
| {"id": "DE.AE-2", "description": "Detected events are analyzed to understand attack targets and methods", "category": "Detect"}, | |
| {"id": "DE.AE-3", "description": "Event data are aggregated and correlated from multiple sources and sensors", "category": "Detect"}, | |
| {"id": "DE.AE-4", "description": "Impact of events is determined", "category": "Detect"}, | |
| {"id": "DE.AE-5", "description": "Incident alert thresholds are established", "category": "Detect"}, | |
| {"id": "DE.CM-1", "description": "The network is monitored to detect potential cybersecurity events", "category": "Detect"}, | |
| {"id": "DE.CM-2", "description": "The physical environment is monitored to detect potential cybersecurity events", "category": "Detect"}, | |
| {"id": "DE.CM-3", "description": "Personnel activity is monitored to detect potential cybersecurity events", "category": "Detect"}, | |
| {"id": "DE.CM-4", "description": "Malicious code is detected", "category": "Detect"}, | |
| {"id": "DE.CM-5", "description": "Unauthorized mobile code is detected", "category": "Detect"}, | |
| {"id": "DE.CM-6", "description": "External service provider activity is monitored to detect potential cybersecurity events", "category": "Detect"}, | |
| {"id": "DE.CM-7", "description": "Monitoring for unauthorized personnel, connections, devices, and software is performed", "category": "Detect"}, | |
| {"id": "DE.CM-8", "description": "Vulnerability scans are performed", "category": "Detect"}, | |
| {"id": "DE.DP-1", "description": "Roles and responsibilities for detection are well defined to ensure accountability", "category": "Detect"}, | |
| {"id": "DE.DP-2", "description": "Detection activities comply with all applicable requirements", "category": "Detect"}, | |
| {"id": "DE.DP-3", "description": "Detection processes are tested", "category": "Detect"}, | |
| {"id": "DE.DP-4", "description": "Event detection information is communicated to appropriate parties", "category": "Detect"}, | |
| {"id": "DE.DP-5", "description": "Detection processes are continuously improved", "category": "Detect"}, | |
| {"id": "RS.RP-1", "description": "Response plan is executed during or after an event", "category": "Respond"}, | |
| {"id": "RS.CO-1", "description": "Personnel know their roles and order of operations when a response is needed", "category": "Respond"}, | |
| {"id": "RS.CO-2", "description": "Events are reported consistent with established criteria", "category": "Respond"}, | |
| {"id": "RS.CO-3", "description": "Information is shared consistent with response plans", "category": "Respond"}, | |
| {"id": "RS.CO-4", "description": "Coordination with stakeholders occurs consistent with response plans", "category": "Respond"}, | |
| {"id": "RS.CO-5", "description": "Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness", "category": "Respond"}, | |
| {"id": "RS.AN-1", "description": "Notifications from detection systems are investigated", "category": "Respond"}, | |
| {"id": "RS.AN-2", "description": "The impact of the incident is understood", "category": "Respond"}, | |
| {"id": "RS.AN-3", "description": "Forensics are performed", "category": "Respond"}, | |
| {"id": "RS.AN-4", "description": "Incidents are categorized consistent with response plans", "category": "Respond"}, | |
| {"id": "RS.MI-1", "description": "Incidents are contained", "category": "Respond"}, | |
| {"id": "RS.MI-2", "description": "Incidents are mitigated", "category": "Respond"}, | |
| {"id": "RS.MI-3", "description": "Newly identified vulnerabilities are mitigated or documented as accepted risks", "category": "Respond"}, | |
| {"id": "RS.IM-1", "description": "Response plans incorporate lessons learned", "category": "Respond"}, | |
| {"id": "RS.IM-2", "description": "Response strategies are updated", "category": "Respond"}, | |
| {"id": "RC.RP-1", "description": "Recovery plan is executed during or after an event", "category": "Recover"}, | |
| {"id": "RC.IM-1", "description": "Recovery plans incorporate lessons learned", "category": "Recover"}, | |
| {"id": "RC.IM-2", "description": "Recovery strategies are updated", "category": "Recover"}, | |
| {"id": "RC.CO-1", "description": "Public relations are managed", "category": "Recover"}, | |
| {"id": "RC.CO-2", "description": "Reputation is repaired after an incident", "category": "Recover"}, | |
| {"id": "RC.CO-3", "description": "Recovery activities are communicated to internal stakeholders and executive and management teams", "category": "Recover"} | |
| ] | |
| }, | |
| "PCIDSS": { | |
| "name": "PCI DSS v4.0", | |
| "controls": [ | |
| {"id": "1.1.1", "description": "Establish and implement firewall and router configuration standards", "category": "Network Security"}, | |
| {"id": "1.2.1", "description": "Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment", "category": "Network Security"}, | |
| {"id": "1.3.1", "description": "Implement DMZ to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports", "category": "Network Security"}, | |
| {"id": "1.4.1", "description": "Do not allow unauthorized outbound traffic from the cardholder data environment to the internet", "category": "Network Security"}, | |
| {"id": "2.1.1", "description": "Change vendor-supplied defaults before installing a system on the network", "category": "Vendor Defaults"}, | |
| {"id": "2.2.1", "description": "Develop configuration standards for all system components", "category": "System Configuration"}, | |
| {"id": "3.1.1", "description": "Keep cardholder data storage to a minimum", "category": "Data Protection"}, | |
| {"id": "3.2.1", "description": "Do not store sensitive authentication data after authorization", "category": "Data Protection"}, | |
| {"id": "4.1.1", "description": "Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks", "category": "Encryption"}, | |
| {"id": "5.1.1", "description": "Deploy anti-virus software on all systems commonly affected by malicious software", "category": "Malware Protection"}, | |
| {"id": "6.1.1", "description": "Establish a process to identify security vulnerabilities", "category": "Vulnerability Management"}, | |
| {"id": "7.1.1", "description": "Limit access to system components and cardholder data to only those individuals whose job requires such access", "category": "Access Control"}, | |
| {"id": "8.1.1", "description": "Assign all users a unique ID before allowing them to access system components or cardholder data", "category": "Access Control"}, | |
| {"id": "9.1.1", "description": "Use appropriate facility entry controls to limit and monitor physical access to systems in the cardholder data environment", "category": "Physical Security"}, | |
| {"id": "10.1.1", "description": "Implement audit trails to link all access to system components to each individual user", "category": "Monitoring"}, | |
| {"id": "11.1.1", "description": "Test for the presence of wireless access points and detect and identify all authorized and unauthorized wireless access points", "category": "Testing"}, | |
| {"id": "12.1.1", "description": "Establish, publish, maintain, and disseminate a security policy", "category": "Policy"} | |
| ] | |
| } | |
| } | |
| def main(): | |
| st.title("🔒 Cybersecurity Compliance Checklist Creator") | |
| st.markdown("Create customized checklists for various cybersecurity compliance frameworks") | |
| # Sidebar for framework selection | |
| st.sidebar.header("Framework Selection") | |
| selected_frameworks = st.sidebar.multiselect( | |
| "Select Compliance Frameworks:", | |
| list(COMPLIANCE_FRAMEWORKS.keys()), | |
| default=["ISO27001"] | |
| ) | |
| # Main content area | |
| if not selected_frameworks: | |
| st.warning("Please select at least one compliance framework from the sidebar.") | |
| return | |
| # Display selected frameworks | |
| st.header("Selected Frameworks") | |
| cols = st.columns(len(selected_frameworks)) | |
| for i, framework in enumerate(selected_frameworks): | |
| with cols[i]: | |
| st.info(f"**{COMPLIANCE_FRAMEWORKS[framework]['name']}**") | |
| # Checklist creation section | |
| st.header("📋 Checklist Items") | |
| all_controls = [] | |
| for framework in selected_frameworks: | |
| framework_controls = COMPLIANCE_FRAMEWORKS[framework]['controls'] | |
| for control in framework_controls: | |
| control['framework'] = framework | |
| all_controls.append(control) | |
| # Create a DataFrame for better display | |
| df_controls = pd.DataFrame(all_controls) | |
| # Add selection checkboxes | |
| selected_controls = [] | |
| # Group by category for better organization | |
| categories = df_controls['category'].unique() | |
| for category in sorted(categories): | |
| st.subheader(f"Category: {category}") | |
| category_controls = df_controls[df_controls['category'] == category] | |
| for _, control in category_controls.iterrows(): | |
| col1, col2 = st.columns([1, 4]) | |
| with col1: | |
| selected = st.checkbox( | |
| f"Select {control['id']}", | |
| key=f"{control['framework']}_{control['id']}" | |
| ) | |
| with col2: | |
| st.write(f"**{control['id']}** - {control['description']}") | |
| st.caption(f"Framework: {control['framework']}") | |
| if selected: | |
| selected_controls.append(control.to_dict()) | |
| # Export options | |
| if selected_controls: | |
| st.header("📤 Export Checklist") | |
| col1, col2, col3 = st.columns(3) | |
| with col1: | |
| if st.button("📄 Export to Word Document"): | |
| export_to_word(selected_controls) | |
| with col2: | |
| if st.button("📊 Export to Excel"): | |
| export_to_excel(selected_controls) | |
| with col3: | |
| if st.button("📋 Export to CSV"): | |
| export_to_csv(selected_controls) | |
| # Display selected items | |
| st.subheader("Selected Items Summary") | |
| df_selected = pd.DataFrame(selected_controls) | |
| st.dataframe(df_selected[['framework', 'id', 'description', 'category']]) | |
| st.success(f"✅ Selected {len(selected_controls)} controls for your checklist") | |
| def export_to_word(controls): | |
| doc = Document() | |
| doc.add_heading('Cybersecurity Compliance Checklist', 0) | |
| # Group by framework | |
| frameworks = {} | |
| for control in controls: | |
| framework = control['framework'] | |
| if framework not in frameworks: | |
| frameworks[framework] = [] | |
| frameworks[framework].append(control) | |
| for framework, framework_controls in frameworks.items(): | |
| doc.add_heading(f'Framework: {COMPLIANCE_FRAMEWORKS[framework]["name"]}', level=1) | |
| # Group by category within framework | |
| categories = {} | |
| for control in framework_controls: | |
| category = control['category'] | |
| if category not in categories: | |
| categories[category] = [] | |
| categories[category].append(control) | |
| for category, category_controls in categories.items(): | |
| doc.add_heading(f'Category: {category}', level=2) | |
| table = doc.add_table(rows=1, cols=3) | |
| table.style = 'Table Grid' | |
| hdr_cells = table.rows[0].cells | |
| hdr_cells[0].text = 'Control ID' | |
| hdr_cells[1].text = 'Description' | |
| hdr_cells[2].text = 'Status' | |
| for control in category_controls: | |
| row_cells = table.add_row().cells | |
| row_cells[0].text = control['id'] | |
| row_cells[1].text = control['description'] | |
| row_cells[2].text = '□ Not Implemented □ In Progress □ Implemented' | |
| # Save to bytes buffer | |
| buffer = io.BytesIO() | |
| doc.save(buffer) | |
| buffer.seek(0) | |
| st.download_button( | |
| label="⬇️ Download Word Document", | |
| data=buffer, | |
| file_name="compliance_checklist.docx", | |
| mime="application/vnd.openxmlformats-officedocument.wordprocessingml.document" | |
| ) | |
| def export_to_excel(controls): | |
| df = pd.DataFrame(controls) | |
| df['Status'] = 'Not Started' | |
| df['Notes'] = '' | |
| df['Implementation Date'] = '' | |
| df['Responsible Person'] = '' | |
| # Reorder columns for better readability | |
| df = df[['framework', 'category', 'id', 'description', 'Status', 'Implementation Date', 'Responsible Person', 'Notes']] | |
| buffer = io.BytesIO() | |
| with pd.ExcelWriter(buffer, engine='openpyxl') as writer: | |
| df.to_excel(writer, sheet_name='Compliance Checklist', index=False) | |
| # Auto-adjust columns' width | |
| worksheet = writer.sheets['Compliance Checklist'] | |
| for column in worksheet.columns: | |
| max_length = 0 | |
| column_letter = column[0].column_letter | |
| for cell in column: | |
| try: | |
| if len(str(cell.value)) > max_length: | |
| max_length = len(str(cell.value)) | |
| except: | |
| pass | |
| adjusted_width = min(max_length + 2, 50) | |
| worksheet.column_dimensions[column_letter].width = adjusted_width | |
| buffer.seek(0) | |
| st.download_button( | |
| label="⬇️ Download Excel Spreadsheet", | |
| data=buffer, | |
| file_name="compliance_checklist.xlsx", | |
| mime="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" | |
| ) | |
| def export_to_csv(controls): | |
| df = pd.DataFrame(controls) | |
| df['Status'] = 'Not Started' | |
| df['Notes'] = '' | |
| df['Implementation Date'] = '' | |
| df['Responsible Person'] = '' | |
| csv = df.to_csv(index=False) | |
| st.download_button( | |
| label="⬇️ Download CSV File", | |
| data=csv, | |
| file_name="compliance_checklist.csv", | |
| mime="text/csv" | |
| ) | |
| if __name__ == "__main__": | |
| main() |