--
-- Host: localhost    Database: bgrc
-- ------------------------------------------------------


--
-- Table structure for table `audit_findings`
--

CREATE TABLE `audit_findings` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `audit_id` char(36) NOT NULL,
  `finding_id` varchar(100) NOT NULL,
  `title` varchar(500) NOT NULL,
  `description` text DEFAULT NULL,
  `severity` enum('critical','high','medium','low','informational') NOT NULL DEFAULT 'medium',
  `status` enum('open','in_remediation','remediated','accepted','closed') NOT NULL DEFAULT 'open',
  `control_id` char(36) DEFAULT NULL,
  `requirement_id` char(36) DEFAULT NULL,
  `recommendation` text DEFAULT NULL,
  `management_response` text DEFAULT NULL,
  `owner_id` char(36) DEFAULT NULL,
  `due_date` date DEFAULT NULL,
  `closed_at` datetime DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_tenant_severity` (`tenant_id`,`severity`),
  KEY `idx_tenant_status` (`tenant_id`,`status`),
  KEY `idx_audit` (`audit_id`),
  FULLTEXT KEY `ft_findings` (`title`,`description`),
  CONSTRAINT `fk_af_audit` FOREIGN KEY (`audit_id`) REFERENCES `audits` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_af_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `audit_findings`
--


--
-- Table structure for table `audit_logs`
--

CREATE TABLE `audit_logs` (
  `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
  `tenant_id` char(36) NOT NULL,
  `user_id` char(36) DEFAULT NULL,
  `action` varchar(100) NOT NULL,
  `resource_type` varchar(100) DEFAULT NULL,
  `resource_id` char(36) DEFAULT NULL,
  `old_values` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `new_values` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `ip_address` varchar(45) DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_tenant_created` (`tenant_id`,`created_at`),
  KEY `idx_resource` (`resource_type`,`resource_id`),
  KEY `idx_user` (`user_id`)
) ENGINE=InnoDB AUTO_INCREMENT=43 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `audit_logs`
--

INSERT INTO `audit_logs` VALUES (1,'2b5beb87-5e23-40c1-baaa-182279c173a0','e831ee4d-5086-47ad-bb3e-02c9388fbc08','register','user','e831ee4d-5086-47ad-bb3e-02c9388fbc08',NULL,NULL,'75.172.84.31','2026-04-24 18:47:44'),(2,'2b5beb87-5e23-40c1-baaa-182279c173a0','e831ee4d-5086-47ad-bb3e-02c9388fbc08','logout','session',NULL,NULL,NULL,'75.172.84.31','2026-04-24 18:49:24'),(3,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','register','user','931dcf93-d429-4358-913c-28b47b722e44',NULL,NULL,'75.172.84.31','2026-04-24 18:49:47'),(4,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','activate_framework','framework','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,NULL,'75.172.84.31','2026-04-24 18:52:57'),(5,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','activate_framework','framework','375b1394-c9fa-449f-b9d0-d58b9769e5aa',NULL,NULL,'75.172.84.31','2026-04-24 18:53:04'),(6,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','activate_framework','framework','eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,NULL,'75.172.84.31','2026-04-24 18:53:17'),(7,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','activate_framework','framework','666252f0-47b7-440a-82d9-cca6878f6b60',NULL,NULL,'75.172.84.31','2026-04-24 18:53:22'),(8,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','activate_framework','framework','e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b',NULL,NULL,'75.172.84.31','2026-04-24 18:53:32'),(9,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-24 21:28:44'),(10,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-25 04:48:45'),(11,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-25 05:17:12'),(12,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-25 17:53:49'),(13,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-25 23:41:25'),(14,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-26 00:01:20'),(15,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','create','integration','e00f0062-78d1-4b02-a3a9-485b64c0eeaf',NULL,'{\"type\":\"github\",\"name\":\"moophi@gmail.com\"}','75.172.84.31','2026-04-26 00:02:47'),(16,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','create','integration','8fb7ef87-7670-4926-97b3-6373d87583b4',NULL,'{\"type\":\"okta\",\"name\":\"thien.pham@f9networks.com\"}','75.172.84.31','2026-04-26 00:04:01'),(17,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-26 04:54:34'),(18,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.31','2026-04-26 05:40:09'),(19,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','logout','session',NULL,NULL,NULL,'75.172.84.31','2026-04-26 05:41:20'),(20,'a307de4a-b884-4459-acce-bb68d1dc59e0','b26548e8-6e6c-4a8b-88cd-fd9f49388253','register','user','b26548e8-6e6c-4a8b-88cd-fd9f49388253',NULL,NULL,'75.172.84.63','2026-05-07 18:45:10'),(21,'a307de4a-b884-4459-acce-bb68d1dc59e0','b26548e8-6e6c-4a8b-88cd-fd9f49388253','invite_user','user','636b0a52-8882-48b9-be33-7f95ff206553',NULL,'{\"email\":\"gghantarchian@gscxgroup.com\",\"role\":\"admin\"}','75.172.84.63','2026-05-07 18:46:15'),(22,'a307de4a-b884-4459-acce-bb68d1dc59e0','b26548e8-6e6c-4a8b-88cd-fd9f49388253','logout','session',NULL,NULL,NULL,'75.172.84.63','2026-05-07 18:47:30'),(23,'2b5beb87-5e23-40c1-baaa-182279c173a0','e831ee4d-5086-47ad-bb3e-02c9388fbc08','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 04:32:31'),(24,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 05:00:25'),(25,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','delete','integration','e00f0062-78d1-4b02-a3a9-485b64c0eeaf','{\"type\":\"github\",\"name\":\"moophi@gmail.com\"}',NULL,'75.172.84.63','2026-05-08 05:01:26'),(26,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','delete','integration','8fb7ef87-7670-4926-97b3-6373d87583b4','{\"type\":\"okta\",\"name\":\"thien.pham@f9networks.com\"}',NULL,'75.172.84.63','2026-05-08 05:01:29'),(27,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 05:23:22'),(28,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','logout','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 05:23:25'),(29,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 05:25:20'),(30,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 05:40:39'),(31,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','create','audit','7f1464a9-5cf9-403a-876f-62d4b403f796',NULL,'{\"title\":\"Everything\",\"type\":\"regulatory\",\"status\":\"planned\",\"planned_start\":\"2026-05-07\",\"planned_end\":\"2026-05-14\",\"scope\":\"Audit all access and framework\"}','75.172.84.63','2026-05-08 05:41:09'),(32,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','upload','evidence','c7c97aff-7d07-40cb-9e44-6a741d0127c6',NULL,'{\"title\":\"abc\",\"type\":\"document\"}','75.172.84.63','2026-05-08 05:42:18'),(33,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 05:56:00'),(34,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 06:20:11'),(35,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','logout','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 06:32:31'),(36,'36a24342-f58f-41fd-ae01-2b42cb7ea234','25cc5b96-08dd-4a3a-b4ad-796eefcd136a','register','user','25cc5b96-08dd-4a3a-b4ad-796eefcd136a',NULL,NULL,'75.172.84.63','2026-05-08 06:33:17'),(37,'36a24342-f58f-41fd-ae01-2b42cb7ea234','25cc5b96-08dd-4a3a-b4ad-796eefcd136a','logout','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 06:35:44'),(38,'a307de4a-b884-4459-acce-bb68d1dc59e0','b26548e8-6e6c-4a8b-88cd-fd9f49388253','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-08 06:35:57'),(39,'2b5beb87-5e23-40c1-baaa-182279c173a0','e831ee4d-5086-47ad-bb3e-02c9388fbc08','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-09 23:50:25'),(40,'2b5beb87-5e23-40c1-baaa-182279c173a0','e831ee4d-5086-47ad-bb3e-02c9388fbc08','logout','session',NULL,NULL,NULL,'75.172.84.63','2026-05-09 23:50:59'),(41,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','login','session',NULL,NULL,NULL,'75.172.84.63','2026-05-10 21:34:23'),(42,'9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','logout','session',NULL,NULL,NULL,'75.172.84.63','2026-05-10 21:44:29');

--
-- Table structure for table `audits`
--

CREATE TABLE `audits` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `audit_id` varchar(100) NOT NULL,
  `title` varchar(500) NOT NULL,
  `type` enum('internal','external','regulatory','certification') NOT NULL DEFAULT 'internal',
  `framework_id` char(36) DEFAULT NULL,
  `lead_auditor_id` char(36) DEFAULT NULL,
  `status` enum('planned','in_progress','review','completed','cancelled') NOT NULL DEFAULT 'planned',
  `scope` text DEFAULT NULL,
  `objectives` text DEFAULT NULL,
  `planned_start` date DEFAULT NULL,
  `planned_end` date DEFAULT NULL,
  `actual_start` date DEFAULT NULL,
  `actual_end` date DEFAULT NULL,
  `opinion` enum('clean','qualified','adverse','disclaimer') DEFAULT NULL,
  `summary` text DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_tenant_status` (`tenant_id`,`status`),
  KEY `fk_audits_framework` (`framework_id`),
  CONSTRAINT `fk_audits_framework` FOREIGN KEY (`framework_id`) REFERENCES `regulatory_frameworks` (`id`) ON DELETE SET NULL,
  CONSTRAINT `fk_audits_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `audits`
--

INSERT INTO `audits` VALUES ('7f1464a9-5cf9-403a-876f-62d4b403f796','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','AUD-1778218869562','Everything','regulatory',NULL,NULL,'planned','Audit all access and framework',NULL,'2026-05-07','2026-05-14',NULL,NULL,NULL,NULL,'2026-05-08 05:41:09','2026-05-08 05:41:09');

--
-- Table structure for table `billing_payments`
--

CREATE TABLE `billing_payments` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `user_id` char(36) DEFAULT NULL,
  `stripe_payment_intent_id` varchar(255) NOT NULL,
  `stripe_charge_id` varchar(255) DEFAULT NULL,
  `amount_cents` int(10) unsigned NOT NULL,
  `currency` char(3) NOT NULL DEFAULT 'usd',
  `months_purchased` smallint(5) unsigned NOT NULL,
  `status` enum('requires_payment_method','requires_confirmation','requires_action','processing','succeeded','canceled','failed') NOT NULL,
  `failure_reason` text DEFAULT NULL,
  `receipt_url` text DEFAULT NULL,
  `paid_until_before` datetime DEFAULT NULL,
  `paid_until_after` datetime DEFAULT NULL,
  `paid_at` datetime DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  UNIQUE KEY `uq_billing_payment_intent` (`stripe_payment_intent_id`),
  KEY `idx_billing_tenant_created` (`tenant_id`,`created_at`),
  KEY `fk_billing_payments_user` (`user_id`),
  CONSTRAINT `fk_billing_payments_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_billing_payments_user` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE SET NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `billing_payments`
--

INSERT INTO `billing_payments` VALUES ('113f97ea-4066-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPyawDQM89JQeuW1WwZ327n','py_3TPyawDQM89JQeuW1o0YC279',150000,'usd',3,'succeeded',NULL,'https://pay.stripe.com/receipts/payment/CAcaFwoVYWNjdF8xSTUwdjhEUU04OUpRZXVXKLudsc8GMgbYIAW9pRc6LBZ2J_NsgnlcXZ72ME7erRZ9OQl4ib6NSJtDyoEKYSh6Mc-VqA3bwZy03FU6',NULL,'2026-07-25 05:18:51','2026-04-25 05:18:51','2026-04-25 05:17:34','2026-04-25 05:18:51'),('1ff01f71-4067-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPyiGDQM89JQeuW0zrDba3B','py_3TPyiGDQM89JQeuW0YMC05w7',150000,'usd',3,'succeeded',NULL,'https://pay.stripe.com/receipts/payment/CAcaFwoVYWNjdF8xSTUwdjhEUU04OUpRZXVXKNSgsc8GMgaw53lv-ec6LBb7K0W6jqd38eHlC73QAZL0XzxXb5IdtqVjN9lfCULqS6uqgZIl7FtxiJ4k','2027-01-25 05:18:51','2027-04-25 05:18:51','2026-04-25 05:25:40','2026-04-25 05:25:08','2026-04-25 05:25:40'),('6da16fa7-4025-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPrNADQM89JQeuW16pk0TAf',NULL,150000,'usd',3,'requires_payment_method',NULL,NULL,NULL,NULL,NULL,'2026-04-24 21:34:52','2026-04-24 21:34:52'),('704f1c23-4025-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPrNEDQM89JQeuW0DRQ0pSG',NULL,150000,'usd',3,'requires_payment_method',NULL,NULL,NULL,NULL,NULL,'2026-04-24 21:34:56','2026-04-24 21:34:56'),('9b61afa7-4024-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPrHTDQM89JQeuW1rgRxUBD',NULL,150000,'usd',3,'requires_payment_method',NULL,NULL,NULL,NULL,NULL,'2026-04-24 21:28:59','2026-04-24 21:28:59'),('b0f78d5b-4066-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPyfGDQM89JQeuW2mFYa9Yr','py_3TPyfGDQM89JQeuW2ajGzal9',300000,'usd',6,'succeeded',NULL,'https://pay.stripe.com/receipts/payment/CAcaFwoVYWNjdF8xSTUwdjhEUU04OUpRZXVXKJ-fsc8GMgblKi2mcfc6LBYCnvOXi6P6xwNTXcERLVbpQ4J_BIrkMOv1Cc-BJC_EP_n-HYZv6Ilbd3Oy','2026-07-25 05:18:51','2027-01-25 05:18:51','2026-04-25 05:22:39','2026-04-25 05:22:02','2026-04-25 05:22:39'),('ee453cfd-4025-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPrQdDQM89JQeuW1TcF5V9y',NULL,150000,'usd',3,'requires_payment_method',NULL,NULL,NULL,NULL,NULL,'2026-04-24 21:38:28','2026-04-24 21:38:28'),('ff00af7f-4025-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','931dcf93-d429-4358-913c-28b47b722e44','pi_3TPrR6DQM89JQeuW1OGirtJ5',NULL,300000,'usd',6,'requires_payment_method',NULL,NULL,NULL,NULL,NULL,'2026-04-24 21:38:56','2026-04-24 21:38:56');

--
-- Table structure for table `control_evidence`
--

CREATE TABLE `control_evidence` (
  `control_id` char(36) NOT NULL,
  `evidence_id` char(36) NOT NULL,
  `tenant_id` char(36) NOT NULL,
  `mapped_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`control_id`,`evidence_id`),
  KEY `fk_ce_evidence` (`evidence_id`),
  CONSTRAINT `fk_ce_control` FOREIGN KEY (`control_id`) REFERENCES `controls` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_ce_evidence` FOREIGN KEY (`evidence_id`) REFERENCES `evidence` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `control_evidence`
--


--
-- Table structure for table `control_framework_mappings`
--

CREATE TABLE `control_framework_mappings` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `control_id` char(36) NOT NULL,
  `requirement_id` char(36) NOT NULL,
  `coverage` enum('full','partial','none') NOT NULL DEFAULT 'partial',
  `notes` text DEFAULT NULL,
  `mapped_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`id`),
  UNIQUE KEY `uq_control_req` (`control_id`,`requirement_id`),
  KEY `idx_tenant` (`tenant_id`),
  KEY `fk_cfm_req` (`requirement_id`),
  CONSTRAINT `fk_cfm_control` FOREIGN KEY (`control_id`) REFERENCES `controls` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_cfm_req` FOREIGN KEY (`requirement_id`) REFERENCES `framework_requirements` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `control_framework_mappings`
--


--
-- Table structure for table `controls`
--

CREATE TABLE `controls` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `control_id` varchar(100) NOT NULL,
  `title` varchar(500) NOT NULL,
  `description` text DEFAULT NULL,
  `type` enum('preventive','detective','corrective','deterrent','compensating') NOT NULL DEFAULT 'preventive',
  `category` varchar(255) DEFAULT NULL,
  `frequency` enum('continuous','daily','weekly','monthly','quarterly','annually','ad_hoc') DEFAULT NULL,
  `owner_id` char(36) DEFAULT NULL,
  `status` enum('active','inactive','under_review') NOT NULL DEFAULT 'active',
  `effectiveness` enum('effective','partially_effective','ineffective','not_tested') NOT NULL DEFAULT 'not_tested',
  `automation_level` enum('manual','semi_automated','automated') NOT NULL DEFAULT 'manual',
  `last_tested_at` datetime DEFAULT NULL,
  `tags` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_tenant_status` (`tenant_id`,`status`),
  KEY `idx_tenant_control_id` (`tenant_id`,`control_id`),
  FULLTEXT KEY `ft_controls` (`title`,`description`),
  CONSTRAINT `fk_controls_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `controls`
--


--
-- Table structure for table `evidence`
--

CREATE TABLE `evidence` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `title` varchar(500) NOT NULL,
  `description` text DEFAULT NULL,
  `type` varchar(50) NOT NULL DEFAULT 'document',
  `file_name` varchar(500) DEFAULT NULL,
  `file_path` text DEFAULT NULL,
  `file_size` bigint(20) unsigned DEFAULT NULL,
  `mime_type` varchar(100) DEFAULT NULL,
  `hash_sha256` varchar(64) DEFAULT NULL,
  `uploaded_by` char(36) DEFAULT NULL,
  `valid_from` date DEFAULT NULL,
  `valid_until` date DEFAULT NULL,
  `tags` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `source` enum('manual','integration') NOT NULL DEFAULT 'manual',
  `source_integration_id` char(36) DEFAULT NULL,
  `source_ref` varchar(500) DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_tenant_valid_until` (`tenant_id`,`valid_until`),
  KEY `fk_evidence_integration` (`source_integration_id`),
  CONSTRAINT `fk_evidence_integration` FOREIGN KEY (`source_integration_id`) REFERENCES `integrations` (`id`) ON DELETE SET NULL,
  CONSTRAINT `fk_evidence_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `evidence`
--

INSERT INTO `evidence` VALUES ('c7c97aff-7d07-40cb-9e44-6a741d0127c6','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','abc','sfsdfs','document','logo.png','uploads/9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c/2026/05/1778218938276_logo.png',118403,'image/png','8b2620b03a52ebbb741a0f1dce8ac8b017d4f463a30dd7f388eb893922905d79','931dcf93-d429-4358-913c-28b47b722e44','2026-05-08','2026-05-21',NULL,'manual',NULL,NULL,'2026-05-08 05:42:18');

--
-- Table structure for table `express_sessions`
--

CREATE TABLE `express_sessions` (
  `sid` varchar(128) NOT NULL,
  `data` text NOT NULL,
  `expires` datetime NOT NULL,
  PRIMARY KEY (`sid`),
  KEY `idx_expires` (`expires`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `express_sessions`
--


--
-- Table structure for table `framework_requirements`
--

CREATE TABLE `framework_requirements` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `framework_id` char(36) NOT NULL,
  `parent_id` char(36) DEFAULT NULL,
  `reference_code` varchar(100) NOT NULL,
  `title` varchar(500) NOT NULL,
  `description` text DEFAULT NULL,
  `guidance` text DEFAULT NULL,
  `requirement_type` enum('mandatory','recommended','optional') NOT NULL DEFAULT 'mandatory',
  `category` varchar(255) DEFAULT NULL,
  `tags` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `sort_order` int(11) NOT NULL DEFAULT 0,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_framework` (`framework_id`),
  KEY `idx_parent` (`parent_id`),
  CONSTRAINT `fk_req_framework` FOREIGN KEY (`framework_id`) REFERENCES `regulatory_frameworks` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_req_parent` FOREIGN KEY (`parent_id`) REFERENCES `framework_requirements` (`id`) ON DELETE SET NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `framework_requirements`
--



--
-- Table structure for table `incidents`
--

CREATE TABLE `incidents` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `incident_id` varchar(100) NOT NULL,
  `title` varchar(500) NOT NULL,
  `description` text DEFAULT NULL,
  `type` enum('data_breach','system_failure','policy_violation','fraud','physical','other') NOT NULL DEFAULT 'other',
  `severity` enum('critical','high','medium','low') NOT NULL DEFAULT 'medium',
  `status` enum('reported','investigating','contained','resolved','closed') NOT NULL DEFAULT 'reported',
  `reporter_id` char(36) DEFAULT NULL,
  `owner_id` char(36) DEFAULT NULL,
  `detected_at` datetime DEFAULT NULL,
  `reported_at` datetime NOT NULL DEFAULT current_timestamp(),
  `contained_at` datetime DEFAULT NULL,
  `resolved_at` datetime DEFAULT NULL,
  `regulatory_notification_required` tinyint(1) NOT NULL DEFAULT 0,
  `notified_at` datetime DEFAULT NULL,
  `root_cause` text DEFAULT NULL,
  `remediation_steps` text DEFAULT NULL,
  `lessons_learned` text DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_tenant_status` (`tenant_id`,`status`),
  KEY `idx_tenant_severity` (`tenant_id`,`severity`),
  CONSTRAINT `fk_incidents_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `incidents`
--


--
-- Table structure for table `ingestion_jobs`
--

CREATE TABLE `ingestion_jobs` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `source_id` char(36) DEFAULT NULL,
  `tenant_id` char(36) DEFAULT NULL,
  `status` enum('pending','running','completed','failed') NOT NULL DEFAULT 'pending',
  `records_processed` int(10) unsigned NOT NULL DEFAULT 0,
  `records_failed` int(10) unsigned NOT NULL DEFAULT 0,
  `error_message` text DEFAULT NULL,
  `started_at` datetime DEFAULT NULL,
  `completed_at` datetime DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_status` (`status`),
  KEY `fk_ij_source` (`source_id`),
  CONSTRAINT `fk_ij_source` FOREIGN KEY (`source_id`) REFERENCES `ingestion_sources` (`id`) ON DELETE SET NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `ingestion_jobs`
--

INSERT INTO `ingestion_jobs` VALUES ('0260ff90-895f-4f7b-b0a7-15edde89d781',NULL,NULL,'running',0,0,NULL,'2026-05-03 02:00:00',NULL,'2026-05-03 02:00:00'),('240e92d2-1b4c-452e-aae7-d5f973a2c1d4',NULL,NULL,'running',0,0,NULL,'2026-05-10 02:00:00',NULL,'2026-05-10 02:00:00'),('f7216f88-96bd-4004-a6de-8b3fa4c2fbc8',NULL,NULL,'running',0,0,NULL,'2026-04-26 02:00:00',NULL,'2026-04-26 02:00:00');

--
-- Table structure for table `ingestion_sources`
--

CREATE TABLE `ingestion_sources` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `name` varchar(255) NOT NULL,
  `type` enum('json','csv','xml','api','manual') NOT NULL DEFAULT 'json',
  `url` text DEFAULT NULL,
  `schema_version` varchar(50) DEFAULT NULL,
  `last_ingested` datetime DEFAULT NULL,
  `is_active` tinyint(1) NOT NULL DEFAULT 1,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `ingestion_sources`
--


--
-- Table structure for table `integration_runs`
--

CREATE TABLE `integration_runs` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `integration_id` char(36) NOT NULL,
  `tenant_id` char(36) NOT NULL,
  `status` enum('running','completed','failed') NOT NULL DEFAULT 'running',
  `records_collected` int(10) unsigned NOT NULL DEFAULT 0,
  `error_log` text DEFAULT NULL,
  `started_at` datetime NOT NULL DEFAULT current_timestamp(),
  `completed_at` datetime DEFAULT NULL,
  PRIMARY KEY (`id`),
  KEY `idx_ir_integration` (`integration_id`,`started_at`),
  CONSTRAINT `fk_ir_integration` FOREIGN KEY (`integration_id`) REFERENCES `integrations` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `integration_runs`
--


--
-- Table structure for table `integrations`
--

CREATE TABLE `integrations` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `type` varchar(50) NOT NULL,
  `name` varchar(255) NOT NULL,
  `credentials` text NOT NULL,
  `config` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `webhook_token_hash` varchar(64) DEFAULT NULL,
  `status` enum('active','inactive','error') NOT NULL DEFAULT 'active',
  `last_sync_at` datetime DEFAULT NULL,
  `last_error` text DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  UNIQUE KEY `webhook_token_hash` (`webhook_token_hash`),
  KEY `idx_integrations_tenant` (`tenant_id`,`type`),
  KEY `idx_webhook_token` (`webhook_token_hash`),
  CONSTRAINT `fk_integrations_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `integrations`
--


--
-- Table structure for table `password_reset_tokens`
--

CREATE TABLE `password_reset_tokens` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `user_id` char(36) NOT NULL,
  `tenant_id` char(36) NOT NULL,
  `token_hash` varchar(128) NOT NULL,
  `expires_at` datetime NOT NULL,
  `consumed_at` datetime DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`id`),
  UNIQUE KEY `uq_password_reset_token_hash` (`token_hash`),
  KEY `idx_password_reset_user` (`user_id`),
  KEY `idx_password_reset_expires` (`expires_at`),
  KEY `fk_password_reset_tenant` (`tenant_id`),
  CONSTRAINT `fk_password_reset_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_password_reset_user` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `password_reset_tokens`
--


--
-- Table structure for table `policies`
--

CREATE TABLE `policies` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `title` varchar(500) NOT NULL,
  `content` longtext DEFAULT NULL,
  `version` varchar(50) NOT NULL DEFAULT '1.0',
  `status` enum('draft','under_review','approved','published','retired') NOT NULL DEFAULT 'draft',
  `category` varchar(255) DEFAULT NULL,
  `owner_id` char(36) DEFAULT NULL,
  `approver_id` char(36) DEFAULT NULL,
  `approved_at` datetime DEFAULT NULL,
  `effective_date` date DEFAULT NULL,
  `review_date` date DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_tenant_status` (`tenant_id`,`status`),
  FULLTEXT KEY `ft_policies` (`title`),
  CONSTRAINT `fk_policies_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `policies`
--


--
-- Table structure for table `promo_code_redemptions`
--

CREATE TABLE `promo_code_redemptions` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `promo_code_id` char(36) NOT NULL,
  `tenant_id` char(36) NOT NULL,
  `user_id` char(36) DEFAULT NULL,
  `code` varchar(64) NOT NULL,
  `months_granted` smallint(5) unsigned NOT NULL,
  `paid_until_before` datetime DEFAULT NULL,
  `paid_until_after` datetime DEFAULT NULL,
  `redeemed_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_promo_redemptions_tenant` (`tenant_id`,`redeemed_at`),
  KEY `idx_promo_redemptions_code` (`promo_code_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `promo_code_redemptions`
--


--
-- Table structure for table `promo_codes`
--

CREATE TABLE `promo_codes` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `code` varchar(64) NOT NULL,
  `months_granted` smallint(5) unsigned NOT NULL,
  `max_redemptions` int(10) unsigned NOT NULL DEFAULT 1,
  `redemption_count` int(10) unsigned NOT NULL DEFAULT 0,
  `expires_at` datetime DEFAULT NULL,
  `is_active` tinyint(1) NOT NULL DEFAULT 1,
  `notes` text DEFAULT NULL,
  `created_by` char(36) DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  UNIQUE KEY `uq_promo_code` (`code`),
  KEY `idx_promo_active` (`is_active`,`expires_at`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `promo_codes`
--


--
-- Table structure for table `regulatory_frameworks`
--

CREATE TABLE `regulatory_frameworks` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` varchar(36) DEFAULT NULL,
  `code` varchar(50) NOT NULL,
  `name` varchar(255) NOT NULL,
  `description` text DEFAULT NULL,
  `version` varchar(50) DEFAULT NULL,
  `issuing_body` varchar(255) DEFAULT NULL,
  `regions` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `industries` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `effective_date` date DEFAULT NULL,
  `is_global` tinyint(1) NOT NULL DEFAULT 0,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  UNIQUE KEY `uq_code` (`code`),
  KEY `idx_rf_tenant` (`tenant_id`),
  CONSTRAINT `fk_rf_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `regulatory_frameworks`
--

INSERT INTO `regulatory_frameworks` VALUES ('06b057d3-fe17-42e1-92e3-5e3292cf8880',NULL,'HITRUST CSF','HITRUST Common Security Framework','Healthcare industry framework combining HIPAA, ISO 27001, NIST, PCI DSS and other standards.','v11','HITRUST Alliance',NULL,NULL,'2023-01-01',0,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('0872b646-3c71-4b1d-96fd-c577f5e02943',NULL,'NIS2','EU Network and Information Security Directive 2','EU directive on measures for a high common level of cybersecurity across the Union.','2022','European Parliament',NULL,NULL,'2024-10-17',0,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('0b2dd67e-d51c-4158-8a54-e8a7df801f33',NULL,'NIST 800-53','NIST SP 800-53 Rev 5 — Security and Privacy Controls','Comprehensive catalog of security and privacy controls for federal information systems.','Rev 5','NIST',NULL,NULL,'2020-09-23',1,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('161ca661-dcfc-41d6-ae04-4d515194f119',NULL,'GDPR','EU General Data Protection Regulation (GDPR)','Regulation on the protection of natural persons with regard to the processing of personal data','2018','European Parliament and Council','[\"eu\"]','[\"all\"]','2018-05-25',0,'2026-04-24 18:52:20','2026-05-10 02:00:00'),('375b1394-c9fa-449f-b9d0-d58b9769e5aa',NULL,'CCPA/CPRA','California Consumer Privacy Act / California Privacy Rights Act','California state law giving consumers rights over their personal information.','2023','State of California',NULL,NULL,'2023-01-01',0,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('3d1d4686-65fe-4478-8dcd-38f250e9c757',NULL,'CSA CCM','Cloud Security Alliance Cloud Controls Matrix v4','17 security domains covering key cloud security principles for cloud vendors and enterprises.','v4.0','Cloud Security Alliance',NULL,NULL,'2021-03-01',1,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('50db3692-94cc-48b4-91a5-a7adde83bf85',NULL,'SOX ITGC','Sarbanes-Oxley IT General Controls','IT controls required for SOX compliance covering financial reporting systems and data integrity.','2002','US Congress / PCAOB',NULL,NULL,'2002-07-30',0,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('666252f0-47b7-440a-82d9-cca6878f6b60',NULL,'ISO 22301','ISO 22301:2019 — Business Continuity Management','International standard for business continuity management systems (BCMS).','2019','ISO',NULL,NULL,'2019-10-31',1,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('873f7da5-f3c7-4c43-8888-ed277d15a204',NULL,'COBIT 2019','COBIT 2019','Framework for IT governance and management, providing principles, practices and analytical tools.','2019','ISACA',NULL,NULL,'2018-11-01',1,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('88665a55-9ddc-4c83-b223-b5314fc3d39c',NULL,'CMMC 2.0','Cybersecurity Maturity Model Certification 2.0','DoD framework for protecting the defense industrial base supply chain across 3 maturity levels.','2.0','US Department of Defense',NULL,NULL,'2021-11-04',0,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('906a1b55-4849-4909-a7ab-5a4c70f730f8',NULL,'FISMA','Federal Information Security Modernization Act','US federal law requiring federal agencies to develop, implement and maintain information security programs.','2014','US Congress / OMB',NULL,NULL,'2014-12-18',0,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('98ee5a53-635c-42eb-b435-8b2fa846ef2e',NULL,'ISO 27701','ISO/IEC 27701:2019 — Privacy Information Management','Extension to ISO 27001/27002 for privacy information management, aligned with GDPR.','2019','ISO/IEC',NULL,NULL,'2019-08-06',1,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('a1b2c3d4-0014-0001-0001-000000000001',NULL,'NIST SP 800-37','NIST SP 800-37 Rev 2 — Risk Management Framework (RMF)','Provides guidelines for applying the Risk Management Framework to federal information systems, covering seven steps from preparation through continuous monitoring.','Rev 2','NIST',NULL,NULL,'2018-12-20',1,'2026-05-08 04:31:17','2026-05-08 04:31:17'),('a1b2c3d4-0014-0002-0001-000000000001',NULL,'NIST SP 800-30','NIST SP 800-30 Rev 1 — Guide for Conducting Risk Assessments','Provides guidance for conducting risk assessments of federal information systems and organizations, covering all four steps of the risk assessment process.','Rev 1','NIST',NULL,NULL,'2012-09-01',1,'2026-05-08 04:31:17','2026-05-08 04:31:17'),('a1b2c3d4-0014-0003-0001-000000000001',NULL,'NIST SP 800-34','NIST SP 800-34 Rev 1 — Contingency Planning Guide for Federal Information Systems','Provides instructions, recommendations, and considerations for federal information system contingency planning, including business impact analysis and recovery strategies.','Rev 1','NIST',NULL,NULL,'2010-05-01',1,'2026-05-08 04:31:17','2026-05-08 04:31:17'),('a1b2c3d4-0014-0004-0001-000000000001',NULL,'NIST SP 800-61','NIST SP 800-61 Rev 2 — Computer Security Incident Handling Guide','Assists organizations in establishing computer security incident response capabilities and handling incidents efficiently and effectively.','Rev 2','NIST',NULL,NULL,'2012-08-01',1,'2026-05-08 04:31:17','2026-05-08 04:31:17'),('a1b2c3d4-0014-0005-0001-000000000001',NULL,'NIST SP 800-63','NIST SP 800-63-3 — Digital Identity Guidelines','Provides technical requirements for federal agencies implementing digital identity services, covering identity proofing, authentication, and federation across three volumes.','Rev 3','NIST',NULL,NULL,'2017-06-22',1,'2026-05-08 04:31:17','2026-05-08 04:31:17'),('a1b2c3d4-0014-0006-0001-000000000001',NULL,'NIST SP 800-115','NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment','Provides guidance on planning, conducting, and reporting on security testing and assessment activities for federal systems.','2008','NIST',NULL,NULL,'2008-09-01',1,'2026-05-08 04:31:17','2026-05-08 04:31:17'),('a1b2c3d4-0014-0007-0001-000000000001',NULL,'NIST SP 800-137','NIST SP 800-137 — Information Security Continuous Monitoring (ISCM)','Defines a six-step process for establishing an information security continuous monitoring program for federal information systems and organizations.','2011','NIST',NULL,NULL,'2011-09-01',1,'2026-05-08 04:31:17','2026-05-08 04:31:17'),('a1b2c3d4-0014-0008-0001-000000000001',NULL,'NIST SP 800-172','NIST SP 800-172 — Enhanced Security Requirements for Protecting CUI','Provides enhanced security requirements for protecting Controlled Unclassified Information in nonfederal systems against advanced persistent threats.','2021','NIST',NULL,NULL,'2021-02-02',1,'2026-05-08 04:31:17','2026-05-08 04:31:17'),('a1b2c3d4-0014-0009-0001-000000000001',NULL,'NIST Privacy Framework','NIST Privacy Framework 1.0 — A Tool for Improving Privacy Through Enterprise Risk Management','Voluntary framework that enables organizations to better identify and manage privacy risk to build innovative products and services while protecting individuals\' privacy.','1.0','NIST',NULL,NULL,'2020-01-16',1,'2026-05-08 04:31:17','2026-05-08 04:31:17'),('a1b2c3d4-0014-0010-0001-000000000001',NULL,'NIST SP 800-218','NIST SP 800-218 — Secure Software Development Framework (SSDF)','Provides a core set of high-level secure software development practices to integrate security into each SDLC implementation, grouped into four practice groups.','1.1','NIST',NULL,NULL,'2022-02-03',1,'2026-05-08 04:31:17','2026-05-08 04:31:17'),('a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d',NULL,'SOC 2','SOC 2 Type II','Service Organization Control 2 — security, availability, processing integrity, confidentiality, and privacy of customer data.','2017','AICPA',NULL,NULL,'2017-05-01',1,'2026-04-24 18:52:03','2026-04-24 18:52:03'),('a23072ef-4113-11f1-8bc3-00155d012902',NULL,'CCPA','California Consumer Privacy Act (CCPA)','California law that provides consumers with more control over the personal information that businesses collect about them','2020','State of California','[\"us\"]','[\"all\"]','2020-01-01',0,'2026-04-26 02:00:00','2026-05-10 02:00:00'),('a23897c7-4113-11f1-8bc3-00155d012902',NULL,'FCA-SYSC','FCA Senior Management Arrangements, Systems and Controls (SYSC)','FCA requirements for senior management arrangements, systems and controls for UK financial firms','2023','Financial Conduct Authority','[\"uk\"]','[\"Financial Services\"]','2023-07-31',0,'2026-04-26 02:00:00','2026-05-10 02:00:00'),('a25c0c03-4113-11f1-8bc3-00155d012902',NULL,'ISO27001-2022','ISO/IEC 27001:2022','Information security management systems — Requirements','2022','ISO/IEC','[\"global\"]','[\"all\"]','2022-10-25',1,'2026-04-26 02:00:00','2026-05-10 02:00:00'),('a271e304-4113-11f1-8bc3-00155d012902',NULL,'MAS-TRM','MAS Technology Risk Management Guidelines','Guidelines on Technology Risk Management for financial institutions in Singapore','2021','Monetary Authority of Singapore','[\"sg\"]','[\"Financial Services\"]','2021-01-18',0,'2026-04-26 02:00:01','2026-05-10 02:00:00'),('a27eef01-4113-11f1-8bc3-00155d012902',NULL,'NIST-CSF-2','NIST Cybersecurity Framework 2.0','Framework for Improving Critical Infrastructure Cybersecurity','2.0','National Institute of Standards and Technology','[\"us\",\"global\"]','[\"all\"]','2024-02-26',1,'2026-04-26 02:00:01','2026-05-10 02:00:00'),('a28c08f1-4113-11f1-8bc3-00155d012902',NULL,'PCIDSS-4','PCI Data Security Standard v4.0','Technical and operational requirements to protect payment data','4.0','PCI Security Standards Council','[\"global\"]','[\"Financial Services\",\"Retail\",\"Technology\"]','2022-03-31',1,'2026-04-26 02:00:01','2026-05-10 02:00:00'),('a29cdc11-4113-11f1-8bc3-00155d012902',NULL,'PDPA-TH','Personal Data Protection Act B.E. 2562 (Thailand)','Thailand\'s Personal Data Protection Act establishing rights for data subjects and obligations for data controllers and processors','2019','Personal Data Protection Committee, Thailand','[\"th\"]','[\"all\"]','2022-06-01',0,'2026-04-26 02:00:01','2026-05-10 02:00:00'),('a2a4e62d-4113-11f1-8bc3-00155d012902',NULL,'SOC2-2017','SOC 2 Type II — Trust Services Criteria (2017)','Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy','2017','AICPA','[\"us\"]','[\"Technology\",\"Financial Services\",\"Healthcare\"]','2017-12-15',0,'2026-04-26 02:00:01','2026-05-10 02:00:00'),('a2b3c4d5-e6f7-4a2b-9c3d-4e5f6a7b8c9d',NULL,'ISO 27018','ISO/IEC 27018:2019 — Privacy in Public Cloud (PII)','Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors.','2019','ISO/IEC',NULL,NULL,'2019-01-15',1,'2026-04-25 17:53:37','2026-04-25 17:53:37'),('a7b8c9d0-0020-0001-0001-000000000001',NULL,'FDA 21 CFR Part 11','FDA 21 CFR Part 11 — Electronic Records; Electronic Signatures','US FDA regulation establishing criteria under which electronic records and electronic signatures are considered trustworthy and equivalent to paper records.','2003 Guidance','US FDA',NULL,NULL,'1997-08-20',0,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('a7b8c9d0-0020-0002-0001-000000000001',NULL,'GxP','Good Practice (GxP) Guidelines — Pharmaceutical and Life Sciences','A collection of quality guidelines and regulations for pharmaceutical, medical device, and food industries covering manufacturing, laboratory, clinical, and distribution practices.','2023','WHO / EMA / FDA',NULL,NULL,'1990-01-01',1,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('a7b8c9d0-0020-0003-0001-000000000001',NULL,'EU MDR','EU Medical Device Regulation (2017/745)','EU regulation establishing requirements for the placing on the market and putting into service of medical devices and accessories for human use.','2017/745','European Parliament',NULL,NULL,'2021-05-26',0,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('a7b8c9d0-0020-0005-0001-000000000001',NULL,'TISAX','Trusted Information Security Assessment Exchange (TISAX)','Automotive industry information security assessment and exchange mechanism based on VDA ISA, enabling OEMs and suppliers to share security assessment results.','6.0','ENX Association / VDA',NULL,NULL,'2017-04-01',1,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('a7b8c9d0-0020-0006-0001-000000000001',NULL,'GSMA NESAS','GSMA Network Equipment Security Assurance Scheme (NESAS)','Industry-wide security assurance framework for mobile network equipment, covering vendor development and product lifecycle management and network product security.','3.0','GSMA',NULL,NULL,'2020-09-01',1,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('a7b8c9d0-0020-0007-0001-000000000001',NULL,'C2M2','Cybersecurity Capability Maturity Model (C2M2)','Voluntary program helping energy sector and other critical infrastructure organizations evaluate and improve their cybersecurity capabilities across 10 domains.','2.1','US DOE',NULL,NULL,'2012-01-01',0,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('a7b8c9d0-0020-0008-0001-000000000001',NULL,'PCI PIN Security','PCI PIN Security Requirements','PCI SSC standard establishing requirements for the secure management, processing, and transmission of personal identification numbers (PINs) in the payment card industry.','v3.1','PCI SSC',NULL,NULL,'2018-06-01',1,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('a7b8c9d0-0020-0009-0001-000000000001',NULL,'PCI P2PE','PCI Point-to-Point Encryption (P2PE) Standard','PCI SSC standard for point-to-point encryption solutions protecting account data from the point of interaction through decryption in a secure environment.','v3.0','PCI SSC',NULL,NULL,'2019-08-01',1,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('a7b8c9d0-0020-0010-0001-000000000001',NULL,'PCI SSF','PCI Software Security Framework (SSF)','Replaces PA-DSS with two standards: Secure SLC for software lifecycle security and Secure Software for payment software security requirements.','v1.2','PCI SSC',NULL,NULL,'2022-01-01',1,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('a7b8c9d0-0020-0011-0001-000000000001',NULL,'IMO Cyber Risk Guidelines','IMO Maritime Cyber Risk Management Guidelines (MSC-FAL.1/Circ.3)','IMO guidelines providing high-level recommendations on maritime cyber risk management to safeguard shipping from current and emerging cyber threats.','2017','International Maritime Organization',NULL,NULL,'2017-07-05',1,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('a7b8c9d0-0020-0012-0001-000000000001',NULL,'DO-326A','DO-326A — Airworthiness Security Process Specification (Aviation Cybersecurity)','RTCA/EUROCAE standard defining processes for cybersecurity of aircraft systems and airborne electronic hardware/software to achieve airworthiness certification.','DO-326A/ED-202A','RTCA / EUROCAE',NULL,NULL,'2014-09-01',1,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('a7b8c9d0-0020-0013-0001-000000000001',NULL,'NIST ICS Framework','NIST Cybersecurity Framework Applied to Industrial Control Systems (ICS/SCADA)','Application of the NIST CSF five core functions to industrial control systems, operational technology, and SCADA environments with sector-specific guidance.','1.1','NIST / ICS-CERT',NULL,NULL,'2018-04-16',1,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('a7b8c9d0-0020-0014-0001-000000000001',NULL,'CIS Kubernetes Benchmark','CIS Kubernetes Benchmark','Prescriptive configuration guidance for hardening Kubernetes clusters, covering control plane components, worker nodes, policies, and networking.','v1.8.0','Center for Internet Security',NULL,NULL,'2023-07-01',1,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('a7b8c9d0-0020-0015-0001-000000000001',NULL,'AWS Well-Architected Security','AWS Well-Architected Framework — Security Pillar','AWS guidance for applying security best practices across identity and access management, detection, infrastructure protection, data protection, and incident response.','2023','Amazon Web Services',NULL,NULL,'2015-11-01',0,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('a7b8c9d0-0020-0016-0001-000000000001',NULL,'Azure Security Benchmark v3','Microsoft Cloud Security Benchmark v3 (Azure Security Benchmark)','Microsoft\'s security best practices and recommendations for Azure, covering 12 control domains mapped to industry standards including CIS Controls and NIST.','v3.0','Microsoft',NULL,NULL,'2022-10-01',0,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('a7b8c9d0-0020-0017-0001-000000000001',NULL,'GCP Security Foundations','Google Cloud Security Foundations Blueprint','Google Cloud\'s prescriptive security guidance covering organization policy, IAM, networking, monitoring, data security, and incident response best practices.','2023','Google Cloud',NULL,NULL,'2022-01-01',0,'2026-05-08 04:45:12','2026-05-08 04:45:12'),('affe804b-ffcb-4957-a6f8-d013bf745160',NULL,'FedRAMP','Federal Risk and Authorization Management Program','US government program providing standardized approach to security assessment for cloud services.','2023','GSA / FedRAMP PMO',NULL,NULL,'2012-06-06',0,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('b2c3d4e5-0015-0001-0001-000000000001',NULL,'ISO 27002:2022','ISO/IEC 27002:2022 — Information Security Controls','Provides reference information security controls organized into four themes covering organizational, people, physical, and technological controls for implementing ISO 27001.','2022','ISO/IEC',NULL,NULL,'2022-02-15',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0002-0001-000000000001',NULL,'ISO 27005:2022','ISO/IEC 27005:2022 — Information Security Risk Management','Provides guidelines for managing information security risks, supporting general concepts in ISO 27001, and aligned with ISO 31000 risk management principles.','2022','ISO/IEC',NULL,NULL,'2022-10-24',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0003-0001-000000000001',NULL,'ISO 27031','ISO/IEC 27031:2011 — ICT Readiness for Business Continuity','Describes the concepts and principles of ICT readiness for business continuity and provides a framework for implementing and testing ICT readiness as part of a BCMS.','2011','ISO/IEC',NULL,NULL,'2011-03-01',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0004-0001-000000000001',NULL,'ISO 27032:2023','ISO/IEC 27032:2023 — Cybersecurity — Guidelines for Internet Security','Provides guidance for improving the state of cybersecurity, covering cybersecurity in the Internet ecosystem with a focus on collaboration among stakeholders.','2023','ISO/IEC',NULL,NULL,'2023-06-01',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0005-0001-000000000001',NULL,'ISO 27035:2023','ISO/IEC 27035:2023 — Information Security Incident Management','Provides structured guidance on information security incident management covering planning, detection, reporting, assessment, response, and lessons learned.','2023','ISO/IEC',NULL,NULL,'2023-02-01',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0006-0001-000000000001',NULL,'ISO 27036:2023','ISO/IEC 27036 — Information Security for Supplier Relationships','Provides guidance on assessing and treating information security risks associated with the acquisition of products and services from suppliers across the supply chain.','2023','ISO/IEC',NULL,NULL,'2023-01-01',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0007-0001-000000000001',NULL,'ISO 15408','ISO/IEC 15408 — Common Criteria for IT Security Evaluation','Defines a framework for expressing security requirements and for evaluating the security properties of IT products and systems through internationally recognized evaluation assurance levels.','2022','ISO/IEC',NULL,NULL,'2022-08-01',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0008-0001-000000000001',NULL,'ISO 31000:2018','ISO 31000:2018 — Risk Management Guidelines','Provides principles and guidelines on managing risk applicable to any type of organization, supporting decision-making and accountability across all levels of an organization.','2018','ISO',NULL,NULL,'2018-02-15',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0009-0001-000000000001',NULL,'ISO 22313:2020','ISO 22313:2020 — Business Continuity Management — Guidance','Provides guidance and recommendations for implementing a business continuity management system conformant with ISO 22301, with explanatory notes and worked examples.','2020','ISO',NULL,NULL,'2020-11-01',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0010-0001-000000000001',NULL,'ISO 22316:2017','ISO 22316:2017 — Security and Resilience — Organizational Resilience Principles and Attributes','Provides guidance to enhance organizational resilience by identifying key attributes and principles that enable organizations to withstand, adapt to, and recover from disruptions.','2017','ISO',NULL,NULL,'2017-03-01',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0011-0001-000000000001',NULL,'ISO 20000-1:2018','ISO/IEC 20000-1:2018 — Information Technology Service Management','Specifies requirements for an organization to establish, implement, maintain, and continually improve a service management system (SMS).','2018','ISO/IEC',NULL,NULL,'2018-09-01',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0012-0001-000000000001',NULL,'ISO 38500:2015','ISO/IEC 38500:2015 — Governance of IT for the Organization','Provides a framework of principles for directors of organizations for the effective, efficient, and acceptable use of information technology.','2015','ISO/IEC',NULL,NULL,'2015-02-15',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0013-0001-000000000001',NULL,'ISO 37301:2021','ISO 37301:2021 — Compliance Management Systems','Specifies requirements and provides guidelines for establishing, developing, implementing, evaluating, maintaining, and improving an effective compliance management system.','2021','ISO',NULL,NULL,'2021-04-13',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0014-0001-000000000001',NULL,'ISO 37001:2016','ISO 37001:2016 — Anti-Bribery Management Systems','Specifies requirements and provides guidance for establishing, implementing, maintaining, reviewing, and improving an anti-bribery management system to prevent, detect, and respond to bribery.','2016','ISO',NULL,NULL,'2016-10-15',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0015-0001-000000000001',NULL,'ISO 13485:2016','ISO 13485:2016 — Medical Devices Quality Management Systems','Specifies requirements for a quality management system where an organization needs to demonstrate its ability to provide medical devices and related services that meet customer and regulatory requirements.','2016','ISO',NULL,NULL,'2016-03-01',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0016-0001-000000000001',NULL,'ISO/SAE 21434:2021','ISO/SAE 21434:2021 — Road Vehicles Cybersecurity Engineering','Specifies engineering requirements for cybersecurity risk management regarding concept, product development, production, operation, maintenance, and decommissioning of road vehicle electrical systems.','2021','ISO/SAE',NULL,NULL,'2021-08-31',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0017-0001-000000000001',NULL,'IEC 62304:2006','IEC 62304:2006 — Medical Device Software Lifecycle Processes','Defines the lifecycle requirements for the development and maintenance of medical device software, covering safety classification and processes proportionate to risk.','2006/AMD1:2015','IEC',NULL,NULL,'2006-05-01',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-0015-0018-0001-000000000001',NULL,'IEC 62443','IEC 62443 — Industrial Automation and Control Systems (IACS) Security','Multi-part standard addressing cybersecurity of Industrial Automation and Control Systems, covering requirements for operators, integrators, and component suppliers.','2018','IEC',NULL,NULL,'2018-01-01',1,'2026-05-08 04:31:35','2026-05-08 04:31:35'),('b2c3d4e5-f6a1-4b2c-8d4e-5f6a1b2c3d4e',NULL,'ISO 27001','ISO/IEC 27001:2022','International standard for information security management systems (ISMS).','2022','ISO/IEC',NULL,NULL,'2022-10-25',1,'2026-04-24 18:52:03','2026-04-24 18:52:03'),('b3c4d5e6-f7a8-4b3c-9d4e-5f6a7b8c9d0e',NULL,'ISO 42001','ISO/IEC 42001:2023 — AI Management System','International standard specifying requirements for establishing, implementing, maintaining, and continually improving an AI management system (AIMS) within organizations.','2023','ISO/IEC',NULL,NULL,'2023-12-18',1,'2026-04-25 17:53:37','2026-04-25 17:53:37'),('b8c9d0e1-0021-0001-0001-000000000001',NULL,'GRI Standards 2021','GRI Universal Standards 2021 — Global Reporting Initiative','The world\'s most widely used sustainability reporting standards, enabling organizations to publicly report on their economic, environmental, and social impacts.','2021','Global Reporting Initiative',NULL,NULL,'2023-01-01',1,'2026-05-08 04:45:30','2026-05-08 04:45:30'),('b8c9d0e1-0021-0002-0001-000000000001',NULL,'SASB Standards','SASB Industry-Specific Sustainability Accounting Standards','Industry-specific sustainability accounting standards helping businesses identify, manage, and report on financially material sustainability topics for investors.','2023 (IFRS/ISSB alignment)','SASB / IFRS Foundation',NULL,NULL,'2018-11-01',1,'2026-05-08 04:45:30','2026-05-08 04:45:30'),('b8c9d0e1-0021-0003-0001-000000000001',NULL,'TCFD','Task Force on Climate-related Financial Disclosures (TCFD)','Framework for voluntary climate-related financial disclosures across four pillars to help companies provide better information to investors and other stakeholders.','2023 (Final)','Financial Stability Board',NULL,NULL,'2017-06-29',1,'2026-05-08 04:45:30','2026-05-08 04:45:30'),('b8c9d0e1-0021-0004-0001-000000000001',NULL,'CSRD','EU Corporate Sustainability Reporting Directive (CSRD)','EU directive requiring large companies to report on sustainability topics using European Sustainability Reporting Standards (ESRS) covering environmental, social, and governance matters.','2022/2464','European Parliament',NULL,NULL,'2024-01-01',0,'2026-05-08 04:45:30','2026-05-08 04:45:30'),('b8c9d0e1-0021-0005-0001-000000000001',NULL,'SLSA','Supply-chain Levels for Software Artifacts (SLSA)','Security framework providing a checklist of standards and controls to prevent software tampering, improve artifact integrity, and secure the software supply chain.','v1.0','OpenSSF',NULL,NULL,'2023-04-01',1,'2026-05-08 04:45:30','2026-05-08 04:45:30'),('b8c9d0e1-0021-0006-0001-000000000001',NULL,'EO 14028','Executive Order 14028 — Improving the Nation\'s Cybersecurity','US Executive Order directing federal agencies and contractors to improve cybersecurity through SBOM requirements, zero trust architecture, and secure software development practices.','2021','White House / NIST / CISA',NULL,NULL,'2021-05-12',0,'2026-05-08 04:45:30','2026-05-08 04:45:30'),('b8c9d0e1-0021-0007-0001-000000000001',NULL,'SBOM Standards','Software Bill of Materials Standards (SPDX and CycloneDX)','Open standards for creating, sharing, and consuming software bills of materials to enable vulnerability management, license compliance, and supply chain transparency.','SPDX 2.3 / CycloneDX 1.5','Linux Foundation / OWASP',NULL,NULL,'2021-01-01',1,'2026-05-08 04:45:30','2026-05-08 04:45:30'),('b8c9d0e1-0021-0008-0001-000000000001',NULL,'SAFECode','SAFECode Fundamental Practices for Secure Software Development','Industry-led guidance on fundamental secure software development practices for organizations to implement throughout the software development lifecycle.','3rd Edition','SAFECode',NULL,NULL,'2018-03-01',1,'2026-05-08 04:45:30','2026-05-08 04:45:30'),('b8c9d0e1-0021-0009-0001-000000000001',NULL,'OSCAL','Open Security Controls Assessment Language (OSCAL)','NIST-developed machine-readable language for expressing security controls, assessments, plans, and results to automate and standardize compliance activities.','1.1.2','NIST',NULL,NULL,'2023-06-01',1,'2026-05-08 04:45:30','2026-05-08 04:45:30'),('b8c9d0e1-0021-0010-0001-000000000001',NULL,'DevSecOps Framework','DevSecOps Framework — Integrating Security into DevOps','A set of practices for integrating security tools and processes throughout the CI/CD pipeline to identify and remediate security issues earlier in development.','2023','NIST / DoD / Industry',NULL,NULL,'2022-01-01',1,'2026-05-08 04:45:30','2026-05-08 04:45:30'),('b8c9d0e1-0021-0011-0001-000000000001',NULL,'FIDO2 / WebAuthn','FIDO2 — Web Authentication Standard','Open authentication standard enabling password-less authentication using public key cryptography, hardware security keys, and platform authenticators.','Level 3 (2023)','FIDO Alliance / W3C',NULL,NULL,'2019-03-04',1,'2026-05-08 04:45:30','2026-05-08 04:45:30'),('b8c9d0e1-0021-0012-0001-000000000001',NULL,'OAuth 2.0 / OIDC','OAuth 2.0 Authorization Framework and OpenID Connect 1.0','Industry-standard protocols for authorization (OAuth 2.0) and identity (OIDC) enabling secure delegated access and federated identity for web and mobile applications.','RFC 6749 / OIDC Core 1.0','IETF / OpenID Foundation',NULL,NULL,'2012-10-01',1,'2026-05-08 04:45:30','2026-05-08 04:45:30'),('b8c9d0e1-0021-0013-0001-000000000001',NULL,'SAML 2.0','Security Assertion Markup Language (SAML) 2.0','XML-based open standard for exchanging authentication and authorization data between identity providers and service providers for enterprise single sign-on.','2.0','OASIS',NULL,NULL,'2005-03-15',1,'2026-05-08 04:45:30','2026-05-08 04:45:30'),('b8c9d0e1-0021-0014-0001-000000000001',NULL,'SCIM 2.0','System for Cross-domain Identity Management (SCIM) 2.0','Open standard for automating the exchange of user identity information between identity domains and IT systems, simplifying provisioning and deprovisioning.','2.0 (RFC 7642-7644)','IETF',NULL,NULL,'2015-09-01',1,'2026-05-08 04:45:30','2026-05-08 04:45:30'),('b8c9d0e1-0021-0015-0001-000000000001',NULL,'NFPA 1600','NFPA 1600 — Standard on Continuity, Emergency, and Crisis Management','Comprehensive standard establishing a common set of criteria for all-hazards emergency management, business continuity, and crisis management programs.','2022','NFPA',NULL,NULL,'1995-01-01',1,'2026-05-08 04:45:30','2026-05-08 04:45:30'),('c3d4e5f6-0016-0001-0001-000000000001',NULL,'COSO IC','COSO Internal Control — Integrated Framework (2013)','Provides a comprehensive framework for designing, implementing, and evaluating internal controls using five interrelated components.','2013','COSO',NULL,NULL,'2013-05-14',1,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0002-0001-000000000001',NULL,'COSO ERM','COSO Enterprise Risk Management Framework (2017)','Integrates enterprise risk management into strategy setting and performance management through five interrelated components.','2017','COSO',NULL,NULL,'2017-09-01',1,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0003-0001-000000000001',NULL,'COBIT 5','COBIT 5 — A Business Framework for the Governance and Management of Enterprise IT','Provides an IT governance and management framework covering five domains with 37 processes for effective enterprise IT governance.','5.0','ISACA',NULL,NULL,'2012-04-01',1,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0004-0001-000000000001',NULL,'FAIR','Factor Analysis of Information Risk (FAIR) Framework','A quantitative risk analysis model providing a taxonomy of risk factors and a method for measuring and managing information security risk in financial terms.','2020','FAIR Institute',NULL,NULL,'2005-01-01',1,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0005-0001-000000000001',NULL,'OCTAVE','OCTAVE — Operationally Critical Threat, Asset, and Vulnerability Evaluation','A risk-based strategic assessment and planning technique for security, developed at Carnegie Mellon University for self-directed risk assessment.','Allegro','CERT/CC (CMU)',NULL,NULL,'2003-01-01',1,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0006-0001-000000000001',NULL,'SABSA','SABSA — Sherwood Applied Business Security Architecture','A framework and methodology for enterprise security architecture and service management providing a six-layer architecture model aligned with business requirements.','2009','SABSA Institute',NULL,NULL,'1995-01-01',1,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0007-0001-000000000001',NULL,'TOGAF Security','TOGAF Security Architecture','Security architecture component of The Open Group Architecture Framework, addressing security across all TOGAF architecture domains.','TOGAF 9.2','The Open Group',NULL,NULL,'2018-04-01',1,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0008-0001-000000000001',NULL,'ITIL v4','ITIL 4 — IT Infrastructure Library','A framework of best practices for IT service management providing guidance on service value system, service value chain, and management practices.','v4','AXELOS',NULL,NULL,'2019-02-01',1,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0009-0001-000000000001',NULL,'ISF SoGP','ISF Standard of Good Practice for Information Security','A comprehensive framework covering information security good practice organized into topical areas for enterprises and practitioners.','2022','Information Security Forum',NULL,NULL,'2022-01-01',1,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0010-0001-000000000001',NULL,'SOC 1','SOC 1 — Service Organization Control Report (SSAE 18)','An audit report on controls at a service organization relevant to user entities\' internal control over financial reporting.','SSAE 18','AICPA',NULL,NULL,'2017-05-01',0,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0011-0001-000000000001',NULL,'SOC 3','SOC 3 — General Use Report on Service Organization Controls','A public-use report based on SOC 2 criteria, suitable for general distribution to demonstrate security and availability commitments.','2022','AICPA',NULL,NULL,'2017-01-01',0,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0012-0001-000000000001',NULL,'SSAE 18','SSAE 18 — Statements on Standards for Attestation Engagements No. 18','The AICPA standard for attestation engagements performed by CPAs, replacing SSAE 16 and covering system and organization control examinations.','2017','AICPA',NULL,NULL,'2017-05-01',0,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0013-0001-000000000001',NULL,'ISAE 3000','ISAE 3000 — International Standard on Assurance Engagements (Revised)','International standard for assurance engagements other than audits or reviews of historical financial information, issued by the IAASB.','2013 Revised','IAASB/IFAC',NULL,NULL,'2015-01-01',1,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0014-0001-000000000001',NULL,'ISAE 3402','ISAE 3402 — Assurance Reports on Controls at a Service Organization','International standard for service organization control reports covering the description, design (Type I), and operating effectiveness (Type II) of controls.','2011','IAASB/IFAC',NULL,NULL,'2011-06-15',1,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0015-0001-000000000001',NULL,'TSC','AICPA Trust Services Criteria (TSC)','Criteria used to evaluate controls relevant to security, availability, processing integrity, confidentiality, and privacy in SOC 2 examinations.','2017 (Updated 2022)','AICPA',NULL,NULL,'2018-03-01',0,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0016-0001-000000000001',NULL,'IIA Standards','IIA International Professional Practices Framework (IPPF) Standards','Mandatory guidance for the internal audit profession covering attribute and performance standards for planning, executing, and communicating internal audit work.','2017 (2024 Update)','Institute of Internal Auditors',NULL,NULL,'2017-01-01',1,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0017-0001-000000000001',NULL,'PCAOB Standards','PCAOB Auditing Standards','Standards established by the Public Company Accounting Oversight Board governing audits of public company financial statements and internal controls.','2023','PCAOB',NULL,NULL,'2004-01-01',0,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0018-0001-000000000001',NULL,'Cyber Essentials','Cyber Essentials (UK)','UK government-backed certification scheme helping organizations guard against common cyber threats through five fundamental security controls.','2023','NCSC UK / IASME',NULL,NULL,'2014-06-01',0,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-0016-0019-0001-000000000001',NULL,'Cyber Essentials Plus','Cyber Essentials Plus (UK)','Enhanced version of Cyber Essentials that includes independent technical verification of the five security controls through hands-on testing.','2023','NCSC UK / IASME',NULL,NULL,'2014-06-01',0,'2026-05-08 04:34:02','2026-05-08 04:34:02'),('c3d4e5f6-a1b2-4c3d-8e5f-6a1b2c3d4e5f',NULL,'NIST CSF','NIST Cybersecurity Framework','Voluntary framework for managing and reducing cybersecurity risk, organized around five core functions.','2.0','NIST',NULL,NULL,'2024-02-26',1,'2026-04-24 18:52:03','2026-04-24 18:52:03'),('c4d5e6f7-a8b9-4c4d-9e5f-6a7b8c9d0e1f',NULL,'NIST AI RMF','NIST AI Risk Management Framework 1.0','Voluntary framework to improve the ability of organizations to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products and services.','1.0','NIST',NULL,NULL,'2023-01-26',1,'2026-04-25 17:53:37','2026-04-25 17:53:37'),('c504c77f-bddc-4dea-8403-aa2ea3dcf9df',NULL,'DORA','EU Digital Operational Resilience Act','EU regulation on digital operational resilience for the financial sector.','2022','European Parliament',NULL,NULL,'2025-01-17',0,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('d4a9ebef-b1ab-489b-baa4-274cc840171e',NULL,'CIS Controls','CIS Critical Security Controls v8','18 prioritized safeguards that mitigate the most prevalent cyber attacks against systems and networks.','v8','Center for Internet Security',NULL,NULL,'2021-05-18',1,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('d4e5f6a1-b2c3-4d4e-8f6a-1b2c3d4e5f6a',NULL,'HIPAA','Health Insurance Portability and Accountability Act (HIPAA)','Federal law that required the creation of national standards to protect sensitive patient health information','2013','U.S. Department of Health & Human Services','[\"us\"]','[\"Healthcare\"]','2013-03-26',0,'2026-04-24 18:52:03','2026-05-10 02:00:00'),('d4e5f6a7-0017-0001-0001-000000000001',NULL,'UK GDPR','UK General Data Protection Regulation','The UK\'s retained version of the EU GDPR following Brexit, providing the same data protection framework with UK-specific adaptations for domestic law.','2021','UK Parliament / ICO',NULL,NULL,'2021-01-01',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0002-0001-000000000001',NULL,'HITECH Act','Health Information Technology for Economic and Clinical Health Act','US federal law extending HIPAA requirements to business associates, strengthening enforcement, and creating breach notification obligations for health information.','2009','US Congress / HHS',NULL,NULL,'2009-02-17',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0003-0001-000000000001',NULL,'GLBA','Gramm-Leach-Bliley Act','US federal law requiring financial institutions to explain information-sharing practices to customers and protect sensitive data through the Financial Privacy and Safeguards Rules.','2023 Safeguards Rule','FTC / Federal Regulators',NULL,NULL,'1999-11-12',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0004-0001-000000000001',NULL,'FERPA','Family Educational Rights and Privacy Act','US federal law protecting the privacy of student education records, giving parents and eligible students rights to access, correct, and control disclosure of records.','2011','US Department of Education',NULL,NULL,'1974-08-21',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0005-0001-000000000001',NULL,'COPPA','Children\'s Online Privacy Protection Act','US federal law restricting online collection of personal information from children under 13, requiring parental consent and providing parents with rights over their children\'s data.','2013 Rule','FTC',NULL,NULL,'2000-04-21',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0006-0001-000000000001',NULL,'PIPEDA','Personal Information Protection and Electronic Documents Act (Canada)','Canadian federal privacy law governing how private-sector organizations collect, use, and disclose personal information in the course of commercial activities.','2019','Government of Canada / OPC',NULL,NULL,'2001-01-01',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0007-0001-000000000001',NULL,'LGPD','Lei Geral de Proteção de Dados (Brazil)','Brazil\'s comprehensive data protection law governing the processing of personal data by public and private entities, modeled in part on the EU GDPR.','2020','Brazilian Government / ANPD',NULL,NULL,'2020-09-18',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0008-0001-000000000001',NULL,'POPIA','Protection of Personal Information Act (South Africa)','South African data protection law establishing conditions for lawful processing of personal information to protect the right to privacy.','2021','South African Government / Information Regulator',NULL,NULL,'2021-07-01',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0009-0001-000000000001',NULL,'PDPA Singapore','Personal Data Protection Act (Singapore)','Singapore\'s data protection law governing collection, use, disclosure, and care of personal data, with mandatory data breach notification requirements.','2021 Amendment','PDPC Singapore',NULL,NULL,'2014-07-02',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0010-0001-000000000001',NULL,'PDPA Thailand','Personal Data Protection Act (Thailand)','Thailand\'s data protection law providing rights to data subjects and imposing obligations on data controllers and processors for the protection of personal data.','2022','PDPC Thailand',NULL,NULL,'2022-06-01',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0011-0001-000000000001',NULL,'DPDP Act 2023','Digital Personal Data Protection Act (India)','India\'s data protection law governing processing of digital personal data, establishing rights for data principals and obligations for data fiduciaries.','2023','Government of India / Ministry of Electronics',NULL,NULL,'2023-08-11',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0012-0001-000000000001',NULL,'Australian Privacy Act','Privacy Act 1988 (Australia) — Australian Privacy Principles','Australian federal law governing the handling of personal information by Australian government agencies and private sector organizations with 13 Australian Privacy Principles.','2022 Amendment','Australian Government / OAIC',NULL,NULL,'1988-12-21',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0013-0001-000000000001',NULL,'NZ Privacy Act 2020','Privacy Act 2020 (New Zealand)','New Zealand\'s privacy law establishing 13 Information Privacy Principles governing collection, use, disclosure, storage, and security of personal information.','2020','New Zealand Government / Privacy Commissioner',NULL,NULL,'2020-12-01',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0014-0001-000000000001',NULL,'FADP (nFADP)','Federal Act on Data Protection (Switzerland) — revised nFADP','Switzerland\'s revised data protection law modernizing privacy requirements for processing personal data of individuals in Switzerland, with GDPR-aligned concepts.','2023','Swiss Federal Council / FDPIC',NULL,NULL,'2023-09-01',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0015-0001-000000000001',NULL,'EU Data Act','EU Data Act (Regulation 2023/2854)','EU regulation establishing rules on fair access to and use of data generated by connected products and related services across all economic sectors.','2023','European Parliament',NULL,NULL,'2024-09-12',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0016-0001-000000000001',NULL,'EU Data Governance Act','EU Data Governance Act (Regulation 2022/868)','EU regulation creating a framework for data sharing intermediaries, data altruism organizations, and reuse of public sector data to build a European data space.','2022','European Parliament',NULL,NULL,'2023-09-24',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0017-0001-000000000001',NULL,'ePrivacy Directive','EU ePrivacy Directive (2002/58/EC as amended)','EU directive governing electronic communications privacy including rules on cookies, spam, location data, traffic data, and confidentiality of communications.','2009 Amendment','European Parliament',NULL,NULL,'2003-07-31',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d4e5f6a7-0017-0018-0001-000000000001',NULL,'APEC CBPR','APEC Cross-Border Privacy Rules System','Voluntary accountability-based system enabling businesses to certify their personal information handling practices against APEC Privacy Framework principles for cross-border data transfers.','2022','APEC / CBPR Joint Oversight Panel',NULL,NULL,'2011-11-01',0,'2026-05-08 04:39:30','2026-05-08 04:39:30'),('d5e6f7a8-b9c0-4d5e-9f6a-7b8c9d0e1f2a',NULL,'EU AI Act','EU Artificial Intelligence Act','EU regulation establishing a harmonized legal framework for AI systems, classifying AI by risk level and imposing requirements proportional to that risk.','2024','European Parliament',NULL,NULL,'2024-08-01',0,'2026-04-25 17:53:37','2026-04-25 17:53:37'),('e23cdd62-bdad-439b-9a8d-92c7312d3864',NULL,'NERC CIP','NERC Critical Infrastructure Protection Standards','Reliability standards for protecting the North American bulk electric system from cyber threats.','CIP-013-2','NERC',NULL,NULL,'2020-07-01',0,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b',NULL,'PCI DSS','Payment Card Industry Data Security Standard','Security standard for organizations that handle branded credit cards from major card schemes.','4.0','PCI SSC',NULL,NULL,'2022-03-31',1,'2026-04-24 18:52:03','2026-04-24 18:52:03'),('e5f6a7b8-0018-0001-0001-000000000001',NULL,'SOX','Sarbanes-Oxley Act (SOX)','US federal law establishing audit and financial regulations for public companies, with key provisions for CEO/CFO certification, internal controls over financial reporting, and whistleblower protections.','2002','US Congress / SEC / PCAOB',NULL,NULL,'2002-07-30',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0002-0001-000000000001',NULL,'Basel III','Basel III — International Regulatory Framework for Banks','International banking regulation framework developed by the Basel Committee on Banking Supervision, establishing capital adequacy, stress testing, and liquidity requirements.','2010/2023','Basel Committee on Banking Supervision',NULL,NULL,'2013-01-01',1,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0003-0001-000000000001',NULL,'FFIEC CAT','FFIEC Cybersecurity Assessment Tool','A voluntary tool developed by the FFIEC to help financial institutions identify cybersecurity risks and determine their cybersecurity preparedness across five domains.','2015','FFIEC',NULL,NULL,'2015-06-01',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0004-0001-000000000001',NULL,'NYDFS 23 NYCRR 500','NYDFS Cybersecurity Regulation (23 NYCRR Part 500)','New York State regulation requiring covered financial entities to establish and maintain a cybersecurity program, submit annual certifications, and report material cybersecurity events.','2023 Amendment','NYDFS',NULL,NULL,'2017-03-01',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0006-0001-000000000001',NULL,'SR 11-7','SR 11-7 — Guidance on Model Risk Management','Federal Reserve and OCC guidance establishing supervisory expectations for sound model risk management practices at banking organizations.','2011','Federal Reserve / OCC',NULL,NULL,'2011-04-04',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0007-0001-000000000001',NULL,'MiFID II','Markets in Financial Instruments Directive II (MiFID II/MiFIR)','EU directive and regulation governing financial markets, establishing requirements for investment firms on product governance, client categorization, and transaction reporting.','2018','European Parliament / ESMA',NULL,NULL,'2018-01-03',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0008-0001-000000000001',NULL,'PSD2','Payment Services Directive 2 (PSD2)','EU directive regulating payment services and payment service providers, introducing strong customer authentication, open banking, and third-party provider access.','2018','European Parliament / EBA',NULL,NULL,'2018-01-13',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0009-0001-000000000001',NULL,'SEC Cybersecurity Rules 2023','SEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure Rules (2023)','SEC rules requiring public companies to disclose material cybersecurity incidents within 4 business days and provide annual disclosures on risk management, strategy, and governance.','2023','US Securities and Exchange Commission',NULL,NULL,'2023-12-18',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0010-0001-000000000001',NULL,'FINRA Rules','FINRA Cybersecurity and Business Continuity Rules','FINRA rules governing business continuity planning, books and records retention, incident reporting, and supervisory controls for broker-dealers.','2023','FINRA',NULL,NULL,'2004-01-01',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0011-0001-000000000001',NULL,'NACHA Rules','NACHA ACH Network Rules — ACH Security Framework','Operating rules governing the ACH payment network, including security requirements for protecting account numbers, conducting risk assessments, and originator obligations.','2023','NACHA',NULL,NULL,'2019-06-01',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0012-0001-000000000001',NULL,'OCC Heightened Standards','OCC Guidelines Establishing Heightened Standards (12 CFR Part 30 Appendix D)','Guidelines establishing heightened standards for governance, risk appetite, risk management, and talent management at large insured national banks.','2014','OCC',NULL,NULL,'2014-09-02',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0014-0001-000000000001',NULL,'CMMC 1.0','Cybersecurity Maturity Model Certification 1.0','Original DoD framework for protecting the defense industrial base across five maturity levels, superseded by CMMC 2.0 but referenced for legacy contracts.','1.02','US Department of Defense',NULL,NULL,'2020-01-31',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0015-0001-000000000001',NULL,'DFARS 252.204-7012','DFARS 252.204-7012 — Safeguarding Covered Defense Information','DoD contract clause requiring contractors to implement NIST SP 800-171 security controls, report cyber incidents within 72 hours, and preserve data for 90 days.','2016','US Department of Defense',NULL,NULL,'2016-12-30',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0016-0001-000000000001',NULL,'DFARS 252.204-7020','DFARS 252.204-7020 — NIST SP 800-171 DoD Assessment','DoD contract clause requiring contractors to conduct assessments of NIST SP 800-171 implementation and submit summary scores to the Supplier Performance Risk System (SPRS).','2020','US Department of Defense',NULL,NULL,'2020-11-30',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0017-0001-000000000001',NULL,'ITAR','International Traffic in Arms Regulations (ITAR)','US regulations administered by the State Department controlling the export and import of defense-related articles and services on the United States Munitions List.','2023','US Department of State / DDTC',NULL,NULL,'1976-01-01',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0018-0001-000000000001',NULL,'EAR','Export Administration Regulations (EAR)','US regulations administered by the Commerce Department controlling the export, re-export, and transfer of commercial and dual-use items on the Commerce Control List.','2023','US Department of Commerce / BIS',NULL,NULL,'1979-01-01',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0019-0001-000000000001',NULL,'CJIS Security Policy','FBI CJIS Security Policy','Minimum security requirements for agencies accessing FBI Criminal Justice Information Services data, covering physical, personnel, technical, and administrative security controls.','v5.9.3','FBI CJIS Division',NULL,NULL,'1992-01-01',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0020-0001-000000000001',NULL,'DISA STIGs','DISA Security Technical Implementation Guides (STIGs)','Cybersecurity configuration standards for DoD IT systems covering operating systems, applications, network devices, and databases with vulnerability severity categorizations.','2023','DISA',NULL,NULL,'1998-01-01',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0021-0001-000000000001',NULL,'DoD SRG','DoD Cloud Computing Security Requirements Guide','Provides cloud security requirements and authorization guidance for cloud services used by DoD, organized by impact levels based on data sensitivity.','v1r4','DISA',NULL,NULL,'2017-03-07',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0022-0001-000000000001',NULL,'TIC 3.0','Trusted Internet Connection 3.0 (TIC 3.0)','CISA/OMB program establishing security capabilities and telemetry requirements for federal agency network connections, updated to support cloud and remote work use cases.','3.0','CISA / OMB',NULL,NULL,'2019-09-12',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0023-0001-000000000001',NULL,'GovRAMP','GovRAMP — Government Risk and Authorization Management Program','Multi-state program providing state and local governments a standardized approach to security assessment and authorization for cloud service providers, mirroring FedRAMP.','2023','GovRAMP PMO',NULL,NULL,'2021-01-01',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0024-0001-000000000001',NULL,'IRAP','Information Security Registered Assessors Program (IRAP) — Australia','Australian Signals Directorate program for assessing cloud and ICT systems that hold Australian government data against the ISM controls at different classification levels.','2023','ASD (Australian Signals Directorate)',NULL,NULL,'2014-01-01',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e5f6a7b8-0018-0025-0001-000000000001',NULL,'ENS','Esquema Nacional de Seguridad (ENS) — Spain','Spanish national security framework establishing the principles and requirements that information systems must meet to support the secure electronic exchange of data by public administrations.','2022 (RD 311/2022)','Spanish Government / CCN',NULL,NULL,'2022-05-03',0,'2026-05-08 04:40:40','2026-05-08 04:40:40'),('e6f7a8b9-c0d1-4e6f-9a7b-8c9d0e1f2a3b',NULL,'StateRAMP','StateRAMP — State Risk and Authorization Management Program','Program providing state and local governments a standardized approach to security assessment, authorization, and continuous monitoring for cloud service providers.','2023','StateRAMP PMO',NULL,NULL,'2021-03-01',0,'2026-04-25 17:53:37','2026-04-25 17:53:37'),('e89f5ae1-655d-4355-853f-d70e68259598',NULL,'NIST 800-171','NIST SP 800-171 Rev 2 — Protecting CUI','110 security requirements for protecting Controlled Unclassified Information in nonfederal systems.','Rev 2','NIST',NULL,NULL,'2021-02-02',1,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('eec44c85-6639-4f22-bdea-7f33976d22ab',NULL,'SWIFT CSP','SWIFT Customer Security Programme','Security controls framework for SWIFT member institutions to protect the financial messaging network.','2023','SWIFT',NULL,NULL,'2023-01-01',1,'2026-04-24 18:52:20','2026-04-24 18:52:20'),('f1a2b3c4-d5e6-4f1a-9b2c-3d4e5f6a7b8c',NULL,'ISO 27017','ISO/IEC 27017:2015 — Cloud Security Controls','Code of practice for information security controls based on ISO/IEC 27002 for cloud services, providing additional guidance for cloud providers and cloud customers.','2015','ISO/IEC',NULL,NULL,'2015-12-15',1,'2026-04-25 17:53:37','2026-04-25 17:53:37'),('f6a7b8c9-0019-0001-0001-000000000001',NULL,'OWASP Top 10','OWASP Top 10 Web Application Security Risks (2021)','The most critical web application security risks compiled by OWASP, representing a broad consensus about the most critical security risks to web applications.','2021','OWASP Foundation',NULL,NULL,'2021-09-24',1,'2026-05-08 04:44:16','2026-05-08 04:44:16'),('f6a7b8c9-0019-0002-0001-000000000001',NULL,'OWASP ASVS','OWASP Application Security Verification Standard v4.0','Defines security requirements for designing, developing, and testing secure web applications and web services across three levels of verification depth.','v4.0.3','OWASP Foundation',NULL,NULL,'2021-10-01',1,'2026-05-08 04:44:16','2026-05-08 04:44:16'),('f6a7b8c9-0019-0003-0001-000000000001',NULL,'OWASP SAMM','OWASP Software Assurance Maturity Model v2','A prescriptive model for software assurance enabling organizations to assess and improve their secure software development practices across five business functions.','v2.0','OWASP Foundation',NULL,NULL,'2020-01-01',1,'2026-05-08 04:44:16','2026-05-08 04:44:16'),('f6a7b8c9-0019-0004-0001-000000000001',NULL,'OWASP MASVS','OWASP Mobile Application Security Verification Standard v2','A standard for mobile application security establishing security requirements for iOS and Android applications across eight security control categories.','v2.1.0','OWASP Foundation',NULL,NULL,'2023-05-01',1,'2026-05-08 04:44:16','2026-05-08 04:44:16'),('f6a7b8c9-0019-0005-0001-000000000001',NULL,'MITRE ATT&CK','MITRE ATT&CK Enterprise Framework','A globally accessible knowledge base of adversary tactics and techniques based on real-world observations, used for threat modeling and detection development.','v15.0','MITRE Corporation',NULL,NULL,'2018-01-01',1,'2026-05-08 04:44:16','2026-05-08 04:44:16'),('f6a7b8c9-0019-0006-0001-000000000001',NULL,'MITRE D3FEND','MITRE D3FEND — Defensive Cyber Countermeasures Knowledge Graph','A knowledge graph of cybersecurity countermeasure techniques aligned to ATT&CK offensive techniques to guide defensive capability development.','1.0','MITRE Corporation / NSA',NULL,NULL,'2021-06-22',1,'2026-05-08 04:44:16','2026-05-08 04:44:16'),('f6a7b8c9-0019-0007-0001-000000000001',NULL,'BSIMM','Building Security In Maturity Model (BSIMM)','A measuring tool for software security initiatives based on observations across hundreds of software security programs, organized into four domains and twelve practices.','BSIMM14','Synopsys',NULL,NULL,'2009-01-01',1,'2026-05-08 04:44:16','2026-05-08 04:44:16'),('f6a7b8c9-0019-0008-0001-000000000001',NULL,'CIS Benchmarks','CIS Benchmarks — Configuration Hardening Guidelines','Prescriptive configuration recommendations for hundreds of technologies to safeguard systems against cyber threats, developed through community consensus.','2023','Center for Internet Security',NULL,NULL,'2001-01-01',1,'2026-05-08 04:44:16','2026-05-08 04:44:16'),('f6a7b8c9-0019-0009-0001-000000000001',NULL,'CSA STAR','CSA Security Trust Assurance and Risk (STAR) Program','Cloud security assurance program built on the CSA Cloud Controls Matrix (CCM), providing three levels of assurance for cloud service providers.','v2023','Cloud Security Alliance',NULL,NULL,'2013-09-01',1,'2026-05-08 04:44:16','2026-05-08 04:44:16'),('f6a7b8c9-0019-0010-0001-000000000001',NULL,'CISA ZT Maturity Model','CISA Zero Trust Maturity Model v2.0','Provides guidance on the journey toward zero trust architecture across five pillars with three cross-cutting capabilities and four maturity stages.','v2.0','CISA',NULL,NULL,'2023-04-01',0,'2026-05-08 04:44:16','2026-05-08 04:44:16'),('f6a7b8c9-0019-0011-0001-000000000001',NULL,'NSA Zero Trust Framework','NSA Embracing a Zero Trust Security Model','NSA guidance on implementing zero trust principles organized across seven pillars of the NSA zero trust framework for DoD and national security systems.','2021','National Security Agency',NULL,NULL,'2021-02-01',1,'2026-05-08 04:44:16','2026-05-08 04:44:16'),('f6a7b8c9-0019-0012-0001-000000000001',NULL,'NIST SP 800-207','NIST SP 800-207 — Zero Trust Architecture','Provides abstract definition and conceptual model of zero trust architecture with deployment scenarios and use cases for federal agencies.','2020','NIST',NULL,NULL,'2020-08-10',1,'2026-05-08 04:44:16','2026-05-08 04:44:16'),('f6a7b8c9-0019-0013-0001-000000000001',NULL,'SCF','Secure Controls Framework (SCF)','A comprehensive, vendor-neutral, meta-framework of cybersecurity and privacy controls covering all 31 SCF domains to harmonize multiple regulatory requirements.','2023.4','SCF Council',NULL,NULL,'2019-01-01',1,'2026-05-08 04:44:16','2026-05-08 04:44:16'),('f6a7b8c9-0019-0014-0001-000000000001',NULL,'UCF','Unified Compliance Framework (UCF)','A harmonization approach that maps hundreds of authority documents to a common set of controls, enabling organizations to address multiple compliance mandates efficiently.','2023','Network Frontiers',NULL,NULL,'2007-01-01',1,'2026-05-08 04:44:16','2026-05-08 04:44:16');

--
-- Table structure for table `risk_categories`
--

CREATE TABLE `risk_categories` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `name` varchar(255) NOT NULL,
  `description` text DEFAULT NULL,
  `color` varchar(7) DEFAULT NULL,
  `parent_id` char(36) DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `fk_rcat_tenant` (`tenant_id`),
  KEY `fk_rcat_parent` (`parent_id`),
  CONSTRAINT `fk_rcat_parent` FOREIGN KEY (`parent_id`) REFERENCES `risk_categories` (`id`) ON DELETE SET NULL,
  CONSTRAINT `fk_rcat_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `risk_categories`
--


--
-- Table structure for table `risk_control_mappings`
--

CREATE TABLE `risk_control_mappings` (
  `risk_id` char(36) NOT NULL,
  `control_id` char(36) NOT NULL,
  `tenant_id` char(36) NOT NULL,
  PRIMARY KEY (`risk_id`,`control_id`),
  KEY `fk_rcm_control` (`control_id`),
  CONSTRAINT `fk_rcm_control` FOREIGN KEY (`control_id`) REFERENCES `controls` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_rcm_risk` FOREIGN KEY (`risk_id`) REFERENCES `risks` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `risk_control_mappings`
--


--
-- Table structure for table `risk_treatments`
--

CREATE TABLE `risk_treatments` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `risk_id` char(36) NOT NULL,
  `title` varchar(500) NOT NULL,
  `description` text DEFAULT NULL,
  `type` enum('control','action','acceptance','transfer') DEFAULT NULL,
  `control_id` char(36) DEFAULT NULL,
  `owner_id` char(36) DEFAULT NULL,
  `status` enum('planned','in_progress','completed','cancelled') NOT NULL DEFAULT 'planned',
  `due_date` date DEFAULT NULL,
  `cost_estimate` decimal(15,2) DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `fk_rt_tenant` (`tenant_id`),
  KEY `fk_rt_risk` (`risk_id`),
  CONSTRAINT `fk_rt_risk` FOREIGN KEY (`risk_id`) REFERENCES `risks` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_rt_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `risk_treatments`
--


--
-- Table structure for table `risks`
--

CREATE TABLE `risks` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `risk_id` varchar(100) NOT NULL,
  `title` varchar(500) NOT NULL,
  `description` text DEFAULT NULL,
  `category_id` char(36) DEFAULT NULL,
  `owner_id` char(36) DEFAULT NULL,
  `status` enum('open','mitigated','accepted','transferred','closed') NOT NULL DEFAULT 'open',
  `likelihood` tinyint(3) unsigned NOT NULL CHECK (`likelihood` between 1 and 5),
  `impact` tinyint(3) unsigned NOT NULL CHECK (`impact` between 1 and 5),
  `inherent_score` tinyint(3) unsigned GENERATED ALWAYS AS (`likelihood` * `impact`) STORED,
  `residual_likelihood` tinyint(3) unsigned DEFAULT NULL CHECK (`residual_likelihood` between 1 and 5),
  `residual_impact` tinyint(3) unsigned DEFAULT NULL CHECK (`residual_impact` between 1 and 5),
  `residual_score` tinyint(3) unsigned GENERATED ALWAYS AS (case when `residual_likelihood` is not null and `residual_impact` is not null then `residual_likelihood` * `residual_impact` else NULL end) STORED,
  `target_date` date DEFAULT NULL,
  `treatment` enum('mitigate','accept','transfer','avoid') DEFAULT NULL,
  `tags` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `review_date` date DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_tenant_status` (`tenant_id`,`status`),
  KEY `idx_tenant_score` (`tenant_id`,`inherent_score`),
  KEY `idx_tenant_risk_id` (`tenant_id`,`risk_id`),
  KEY `fk_risks_category` (`category_id`),
  FULLTEXT KEY `ft_risks` (`title`,`description`),
  CONSTRAINT `fk_risks_category` FOREIGN KEY (`category_id`) REFERENCES `risk_categories` (`id`) ON DELETE SET NULL,
  CONSTRAINT `fk_risks_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `risks`
--


--
-- Table structure for table `saml_configs`
--

CREATE TABLE `saml_configs` (
  `id` varchar(36) NOT NULL DEFAULT uuid(),
  `tenant_id` varchar(36) NOT NULL,
  `entity_id` varchar(500) NOT NULL COMMENT 'IdP Entity ID / Issuer',
  `sso_url` varchar(500) NOT NULL COMMENT 'IdP SSO redirect URL',
  `slo_url` varchar(500) DEFAULT NULL COMMENT 'IdP SLO URL (optional)',
  `certificate` text NOT NULL COMMENT 'IdP X.509 signing certificate (PEM, no headers)',
  `name_id_format` varchar(200) NOT NULL DEFAULT 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
  `attribute_mapping` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL COMMENT 'Map IdP attrs to user fields e.g. {"email":"email","firstName":"firstName"}',
  `enabled` tinyint(1) NOT NULL DEFAULT 1,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  UNIQUE KEY `tenant_id` (`tenant_id`),
  CONSTRAINT `fk_saml_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `saml_configs`
--


--
-- Table structure for table `tenant_frameworks`
--

CREATE TABLE `tenant_frameworks` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `framework_id` char(36) NOT NULL,
  `status` enum('active','inactive','in_review') NOT NULL DEFAULT 'active',
  `target_date` date DEFAULT NULL,
  `owner_id` char(36) DEFAULT NULL,
  `notes` text DEFAULT NULL,
  `activated_at` datetime NOT NULL DEFAULT current_timestamp(),
  PRIMARY KEY (`id`),
  UNIQUE KEY `uq_tenant_framework` (`tenant_id`,`framework_id`),
  KEY `fk_tf_framework` (`framework_id`),
  CONSTRAINT `fk_tf_framework` FOREIGN KEY (`framework_id`) REFERENCES `regulatory_frameworks` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_tf_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `tenant_frameworks`
--

INSERT INTO `tenant_frameworks` VALUES ('cf58c7c6-400e-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','a1b2c3d4-e5f6-4a1b-8c3d-4e5f6a1b2c3d','active',NULL,'931dcf93-d429-4358-913c-28b47b722e44',NULL,'2026-04-24 18:52:57'),('d3289f7d-400e-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','375b1394-c9fa-449f-b9d0-d58b9769e5aa','active',NULL,'931dcf93-d429-4358-913c-28b47b722e44',NULL,'2026-04-24 18:53:04'),('daf318c0-400e-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','eec44c85-6639-4f22-bdea-7f33976d22ab','active',NULL,'931dcf93-d429-4358-913c-28b47b722e44',NULL,'2026-04-24 18:53:17'),('ddefeed1-400e-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','666252f0-47b7-440a-82d9-cca6878f6b60','active',NULL,'931dcf93-d429-4358-913c-28b47b722e44',NULL,'2026-04-24 18:53:22'),('e450973b-400e-11f1-8bc3-00155d012902','9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','e5f6a1b2-c3d4-4e5f-8a1b-2c3d4e5f6a1b','active',NULL,'931dcf93-d429-4358-913c-28b47b722e44',NULL,'2026-04-24 18:53:32');

--
-- Table structure for table `tenants`
--

CREATE TABLE `tenants` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `name` varchar(255) NOT NULL,
  `slug` varchar(100) NOT NULL,
  `plan` enum('starter','growth','business','enterprise') NOT NULL DEFAULT 'starter',
  `region` varchar(100) DEFAULT NULL,
  `industry` varchar(100) DEFAULT NULL,
  `employee_count` int(10) unsigned NOT NULL DEFAULT 1,
  `logo_url` text DEFAULT NULL,
  `settings` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `status` enum('active','suspended','trial') NOT NULL DEFAULT 'trial',
  `is_active` tinyint(1) NOT NULL DEFAULT 1,
  `trial_ends_at` datetime DEFAULT NULL,
  `billing_paid_until` datetime DEFAULT NULL,
  `stripe_customer_id` varchar(255) DEFAULT NULL,
  `stripe_default_payment_method` varchar(255) DEFAULT NULL,
  `billing_currency` char(3) NOT NULL DEFAULT 'usd',
  `billing_price_per_month_cents` int(10) unsigned NOT NULL DEFAULT 50000,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  UNIQUE KEY `uq_slug` (`slug`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `tenants`
--

INSERT INTO `tenants` VALUES ('2b5beb87-5e23-40c1-baaa-182279c173a0','Pham Holdings','pham-holdings','starter','us','Technology',1,NULL,NULL,'trial',1,'2026-07-23 18:47:44',NULL,NULL,NULL,'usd',50000,'2026-04-24 18:47:44','2026-04-24 18:47:44'),('36a24342-f58f-41fd-ae01-2b42cb7ea234','Jozie AI','jozie-ai','starter','us','Technology',50,NULL,NULL,'trial',1,'2026-06-07 06:33:17',NULL,NULL,NULL,'usd',50000,'2026-05-08 06:33:17','2026-05-08 06:33:17'),('9b0fb5bc-e3b5-47fe-9e2e-db3687759d0c','F9 Networks','f9-networks','starter','us','Technology',10,NULL,NULL,'active',1,'2026-05-24 18:49:47','2027-04-25 05:18:51','cus_UOeaH2sCruTyWE','pm_1TPyiPDQM89JQeuWmQsoVzoQ','usd',50000,'2026-04-24 18:49:47','2026-05-08 06:31:09'),('a307de4a-b884-4459-acce-bb68d1dc59e0','GSCX Group','gscx-group','starter','us','Financial Services',1,NULL,NULL,'trial',1,'2026-06-06 18:45:10',NULL,NULL,NULL,'usd',50000,'2026-05-07 18:45:10','2026-05-07 18:45:10');

--
-- Table structure for table `vendors`
--

CREATE TABLE `vendors` (
  `id` char(36) NOT NULL DEFAULT uuid(),
  `tenant_id` char(36) NOT NULL,
  `name` varchar(255) NOT NULL,
  `category` varchar(100) DEFAULT NULL,
  `criticality` enum('critical','high','medium','low') NOT NULL DEFAULT 'medium',
  `status` enum('active','inactive','under_review','offboarded') NOT NULL DEFAULT 'active',
  `primary_contact` varchar(255) DEFAULT NULL,
  `contact_email` varchar(255) DEFAULT NULL,
  `website` varchar(500) DEFAULT NULL,
  `services_provided` text DEFAULT NULL,
  `data_shared` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `risk_score` tinyint(3) unsigned DEFAULT NULL,
  `last_assessed` date DEFAULT NULL,
  `next_assessment` date DEFAULT NULL,
  `notes` text DEFAULT NULL,
  `created_at` datetime NOT NULL DEFAULT current_timestamp(),
  `updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`),
  KEY `idx_tenant_status` (`tenant_id`,`status`),
  CONSTRAINT `fk_vendors_tenant` FOREIGN KEY (`tenant_id`) REFERENCES `tenants` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `vendors`
--



