dpv/diagrams/techorgmeasures-2.dot at dev · w3c/dpv · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249

# Overview

digraph G {
    rankdir=BT;
    node [shape=rect,style=filled,fillcolor=yellow];
Thing [fillcolor=none];
N1 [label="TechnicalOrganisationalMeasure"];
N2 [label="TechincalMeasure",style=filled,fillcolor=yellow];
N3 [label="OrganistionalMeasure",style=filled,fillcolor=yellow];
RiskMitigationMeasure, N2,N3 -> N1 [arrowhead=onormal,label="isSubTypeOf"];

Risk -> RiskMitigationMeasure [label="isMitigatedByMeasure"];
RiskMitigationMeasure -> Risk [label="mitigatesRisk"];

Thing -> N1 [label="hasTechnicalOrganisationalMeasure"];
Thing -> N2 [label="hasTechnicalMeasure"];
Thing -> N3 [label="hasOrganisationalMeasure"];
Thing -> Risk [label="hasRisk"];

Thing -> Notice [label="hasNotice"];
Notice -> N3 [arrowhead=onormal,label="isSubTypeOf"];


Policy -> Thing [label="isPolicyFor"];
Thing -> Policy [label="hasPolicy"];
Policy -> N3 [arrowhead=onormal,label="isSubTypeOf"];
}

# Technical

digraph G {
    rankdir=LR;


    compound=true;
    node [shape=rect,style=filled,fillcolor=yellow];

subgraph cluster_0 {
    style=dotted;
    DataAnonymisationTechnique -> Anonymisation [dir=both,arrowhead=none,arrowtail=onormal];
    DataSanitisationTechnique -> DataAnonymisationTechnique [dir=both,arrowhead=none,arrowtail=onormal];
    DataAnonymisationTechnique -> Pseudonymisation [dir=both,arrowhead=none,arrowtail=onormal];
    DataAnonymisationTechnique -> Deidentification [dir=both,arrowhead=none,arrowtail=onormal];

    Pseudonymisation -> DeterministicPseudonymisation [dir=both,arrowhead=none,arrowtail=onormal];
    Pseudonymisation -> DocumentRandomisedPseudonymisation [dir=both,arrowhead=none,arrowtail=onormal];
    Pseudonymisation -> MonotonicCounterPseudonymisation [dir=both,arrowhead=none,arrowtail=onormal];
    Pseudonymisation -> FullyRandomisedPseudonymisation [dir=both,arrowhead=none,arrowtail=onormal];
    Pseudonymisation -> RNGPseudonymisation [dir=both,arrowhead=none,arrowtail=onormal];
}

subgraph cluster_1 {
    style=dotted;
    SecurityMethod -> DistributedSystemSecurity [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityMethod -> DocumentSecurity [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityMethod -> FileSystemSecurity [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityMethod -> HardwareSecurityProtocols [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityMethod -> NetworkProxyRouting [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityMethod -> NetworkSecurityProtocols [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityMethod -> OperatingSystemSecurity  [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityMethod -> IntrusionDetectionSystem [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityMethod -> UseSyntheticData [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityMethod -> VirtualisationSecurity [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityMethod -> PenetrationTestingMethods [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityMethod -> MobilePlatformSecurity [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityMethod -> VulnerabilityTestingMethods [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityMethod -> WebBrowserSecurity [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityMethod -> WebSecurityProtocols  [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityMethod -> WirelessSecurityProtocols [dir=both,arrowhead=none,arrowtail=onormal];
}
subgraph cluster_2 {
    style=dotted;
    CryptographicMethods -> AsymmetricCryptography [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicMethods -> CryptographicAuthentication [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicMethods -> CryptographicKeyManagement [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicMethods -> DifferentialPrivacy [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicMethods -> DigitalSignatures [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicMethods -> HashFunctions [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicMethods -> HomomorphicEncryption [dir=both,arrowhead=none,arrowtail=onormal];

    CryptographicMethods -> PostQuantumCryptography [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicMethods -> PrivacyPreservingProtocol [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicMethods -> PrivateInformationRetrieval [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicMethods -> QuantumCryptography [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicMethods -> SecretSharingSchemes [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicMethods -> SecureMultiPartyComputation [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicMethods -> SymmetricCryptography [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicMethods -> TrustedComputing [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicMethods -> TrustedExecutionEnvironments [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicAuthentication -> AuthenticationABC [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicAuthentication -> AuthenticationPABC [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicMethods -> ZeroKnowledgeAuthentication [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicAuthentication -> HashMessageAuthenticationCode [dir=both,arrowhead=none,arrowtail=onormal];
    CryptographicAuthentication -> MessageAuthenticationCodes [dir=both,arrowhead=none,arrowtail=onormal];

}
subgraph cluster_3 {
    style=dotted;

    Encryption -> AsymmetricEncryption [dir=both,arrowhead=none,arrowtail=onormal];
    Encryption -> EncryptionAtRest [dir=both,arrowhead=none,arrowtail=onormal];
    Encryption -> EncryptionInTransfer [dir=both,arrowhead=none,arrowtail=onormal];
    Encryption -> EncryptionInUse [dir=both,arrowhead=none,arrowtail=onormal];
    Encryption -> EndToEndEncryption [dir=both,arrowhead=none,arrowtail=onormal];
    Encryption -> SymmetricEncryption [dir=both,arrowhead=none,arrowtail=onormal];

}

subgraph cluster_4 {
    style=dotted;
    AccessControlMethod -> PhysicalAccessControlMethod [dir=both,arrowhead=none,arrowtail=onormal];
   AccessControlMethod -> UsageControl  [dir=both,arrowhead=none,arrowtail=onormal];

}

subgraph cluster_5 {
    style=dotted;

    ActivityMonitoring, BiometricAuthentication, InformationFlowControl, DataBackupProtocols, DigitalRightsManagement ;


}

subgraph cluster_6 {
    style=dotted;
    AuthenticationProtocols -> CryptographicAuthentication [dir=both,arrowhead=none,arrowtail=onormal];
    AuthenticationProtocols -> MultiFactorAuthentication [dir=both,arrowhead=none,arrowtail=onormal];
    AuthenticationProtocols -> PasswordAuthentication [dir=both,arrowhead=none,arrowtail=onormal];
    AuthenticationProtocols -> SingleSignOn [dir=both,arrowhead=none,arrowtail=onormal];

}


//TechnicalMeasure -> ActivityMonitoring [arrowhead=onormal,ltail=cluster_4] ;

TechnicalMeasure -> AccessControlMethod [dir=both,arrowhead=none,arrowtail=onormal];
//TechnicalMeasure ->	ActivityMonitoring [dir=both,arrowhead=none,arrowtail=onormal];
TechnicalMeasure -> DataSanitisationTechnique [dir=both,arrowhead=none,arrowtail=onormal];
//TechnicalMeasure -> SecurityMethod [dir=both,arrowhead=none,arrowtail=onormal];
SecurityMethod -> TechnicalMeasure [arrowhead=onormal];
//TechnicalMeasure -> AuthenticationProtocols [dir=both,arrowhead=none,arrowtail=onormal];
AuthenticationProtocols -> TechnicalMeasure [arrowhead=onormal];
//TechnicalMeasure -> BiometricAuthentication [dir=both,arrowhead=none,arrowtail=onormal];
//TechnicalMeasure -> CryptographicMethods [dir=both,arrowhead=none,arrowtail=onormal];
CryptographicMethods -> TechnicalMeasure [arrowhead=onormal];
//TechnicalMeasure -> DataBackupProtocols [dir=both,arrowhead=none,arrowtail=onormal];
//TechnicalMeasure -> DigitalRightsManagement [dir=both,arrowhead=none,arrowtail=onormal];
TechnicalMeasure -> Encryption [dir=both,arrowhead=none,arrowtail=onormal];
//TechnicalMeasure -> InformationFlowControl [dir=both,arrowhead=none,arrowtail=onormal];

//TechnicalMeasure -> ActivityMonitoring [arrowhead=none,arrowtail=onormal,dir=both,lhead=cluster_5] ;
ActivityMonitoring -> TechnicalMeasure [arrowhead=onormal, ltail=cluster_5];

}


# Organisational Measure

digraph G {
   rankdir=LR;
    compound=true;
    node [shape=rect,style=filled,fillcolor=yellow];

    subgraph cluster_0 {
        style=dotted;
     AuthorisationProcedure, CertificationSeal, Consultation, GuidelinesPrinciple, LegalAgreement, Notice, Safeguard ;
    }

    subgraph cluster_1 {
        style=dotted;
        Assessment, Policy, PrivacyByDesign, RecordsOfActivities, RegularityOfRecertification,  SecurityProcedure, ReviewProcedure ;
    }

    subgraph cluster_2 {
        style=dotted;
       StaffTraining, GovernanceProcedures ;
    }


    AuthorisationProcedure -> OrganisationalMeasure [arrowhead=onormal,ltail=cluster_0] ;
    OrganisationalMeasure -> RecordsOfActivities [arrowhead=none,arrowtail=onormal,dir=both,lhead=cluster_1] ;
    OrganisationalMeasure -> GovernanceProcedures [arrowhead=none,arrowtail=onormal,dir=both,lhead=cluster_2] ;

    GovernanceProcedures -> AssetManagementProcedures [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityProcedure -> BackgroundChecks [dir=both,arrowhead=none,arrowtail=onormal];
    Certification -> CertificationSeal [arrowhead=onormal];
    CodeOfConduct -> GuidelinesPrinciple [arrowhead=onormal];
    GovernanceProcedures -> ComplianceMonitoring [dir=both,arrowhead=none,arrowtail=onormal];
    ConsentNotice -> PrivacyNotice [arrowhead=onormal];
    PrivacyNotice -> Notice [arrowhead=onormal];
    DataProcessingRecord -> ConsentRecord [dir=both,arrowhead=none,arrowtail=onormal];
    RecordsOfActivities -> DataProcessingRecord  [dir=both,arrowhead=none,arrowtail=onormal];
    ConsultationWithAuthority -> Consultation [arrowhead=onormal];
    ConsultationWithDataSubject -> Consultation [arrowhead=onormal];
    ConsultationWithDataSubjectRepresentative ->  ConsultationWithDataSubject [arrowhead=onormal];
    ConsultationWithDPO -> Consultation [arrowhead=onormal];
    ContractualTerms -> LegalAgreement [arrowhead=onormal];
    DataProcessingAgreement  -> LegalAgreement [arrowhead=onormal];
    ControllerProcessorAgreement ->  DataProcessingAgreement [arrowhead=onormal];
    CredentialManagement -> AuthorisationProcedure [arrowhead=onormal];
    Assessment -> CybersecurityAssessment [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityAssessment -> CybersecurityAssessment [dir=both,arrowhead=none,arrowtail=onormal];
    StaffTraining -> CybersecurityTraining [dir=both,arrowhead=none,arrowtail=onormal];
    StaffTraining -> DataProtectionTraining [dir=both,arrowhead=none,arrowtail=onormal];
     ImpactAssessment -> DataTransferImpactAssessment  [dir=both,arrowhead=none,arrowtail=onormal];

    Assessment -> ImpactAssessment [dir=both,arrowhead=none,arrowtail=onormal];
    GovernanceProcedures -> IncidentManagementProcedures [dir=both,arrowhead=none,arrowtail=onormal];
    DesignStandard -> GuidelinesPrinciple [arrowhead=onormal];
    GovernanceProcedures -> DisasterRecoveryProcedures [dir=both,arrowhead=none,arrowtail=onormal];
   ImpactAssessment ->DPIA [dir=both,arrowhead=none,arrowtail=onormal];
    StaffTraining -> EducationalTraining [dir=both,arrowhead=none,arrowtail=onormal];
    Assessment ->   EffectivenessDeterminationProcedures [dir=both,arrowhead=none,arrowtail=onormal];

    IdentityManagementMethod -> AuthorisationProcedure [arrowhead=onormal];
    GovernanceProcedures -> IncidentManagementProcedures [dir=both,arrowhead=none,arrowtail=onormal];
    GovernanceProcedures -> IncidentReportingCommunication [dir=both,arrowhead=none,arrowtail=onormal];
    Policy ->  InformationSecurityPolicy [dir=both,arrowhead=none,arrowtail=onormal];
    JointDataControllersAgreement ->  DataProcessingAgreement [arrowhead=onormal];
    Assessment ->   LegitimateInterestAssessment [dir=both,arrowhead=none,arrowtail=onormal];
    GovernanceProcedures -> LoggingPolicies [dir=both,arrowhead=none,arrowtail=onormal];
    GovernanceProcedures -> MonitoringPolicies [dir=both,arrowhead=none,arrowtail=onormal];
    NDA -> LegalAgreement [arrowhead=onormal];

    ImpactAssessment -> PIA [dir=both,arrowhead=none,arrowtail=onormal];
    PrivacyByDefault -> GuidelinesPrinciple  [arrowhead=onormal];
    PrivacyNotice -> Notice [arrowhead=onormal];
    StaffTraining -> ProfessionalTraining [dir=both,arrowhead=none,arrowtail=onormal];
    DataProcessingRecord -> RegisterOfProcessingActivities [dir=both,arrowhead=none,arrowtail=onormal];
    ImpactAssessment  -> ReviewImpactAssessment [dir=both,arrowhead=none,arrowtail=onormal];

    ReviewImpactAssessment -> ReviewProcedure [arrowhead=onormal];
    SecurityProcedure -> RiskManagementPlan [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityProcedure -> RiskManagementPolicy [dir=both,arrowhead=none,arrowtail=onormal];
    Policy -> RiskManagementPolicy [dir=both,arrowhead=none,arrowtail=onormal];
    SafeguardForDataTransfer  -> Safeguard [arrowhead=onormal];
    Seal -> CertificationSeal [arrowhead=onormal];

    Assessment -> SecurityAssessment [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityAssessment -> SecurityProcedureAssessment [arrowhead=onormal];
    StaffTraining -> SecurityKnowledgeTraining [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityProcedure -> SecurityRoleProcedures [dir=both,arrowhead=none,arrowtail=onormal];
    SubProcessorAgreement -> DataProcessingAgreement [arrowhead=onormal];
    ThirdPartyAgreement  -> DataProcessingAgreement [arrowhead=onormal];
    SecurityProcedure -> ThirdPartySecurityProcedures [dir=both,arrowhead=none,arrowtail=onormal];
    SecurityProcedure -> TrustedThirdPartyUtilisation [dir=both,arrowhead=none,arrowtail=onormal];

}