GOST R 56939-2024 Compliance Report

Overview¶

CodeGraph generates a comprehensive compliance report for GOST R 56939-2024 (“Software Development Security Requirements”), evaluating all 25 processes defined in the standard. The report aggregates artifacts from CPG analysis, SARIF reports, configuration files, test results, git history, and threat models into a single structured document suitable for FSTEK audits.

Key capabilities:

• Automatic artifact collection from 11 CodeGraph subsystems
• Evaluation of all 25 GOST processes with FULL/PARTIAL/GAP/N/A status
• Traceability matrix linking requirements to code, tests, findings, and fixes
• Three output formats: Markdown, JSON, GOST auditor template
• Bilingual output (Russian and English)
• History tracking with delta comparison between assessments
• SQLite-based compliance store for trend analysis

Architecture¶

ArtifactCollector ──> ProcessEvaluator ──> ReportRenderer
       │                     │                    │
  CPG, SARIF, git,    25 process evals     Markdown / JSON / GOST
  config, tests,      (specialized or
  threat model        default scoring)
       │                     │
TraceabilityMatrix    ComplianceStore
  CWE -> code ->       SQLite history
  test -> finding       delta tracking

Components¶

GOST Processes¶

All 25 processes from Section 5 of GOST R 56939-2024:

Process Types¶

• automated — fully evaluated by CodeGraph artifact analysis
• organizational — requires manual assessment (marked N/A by default)
• mixed — partially automated, some manual input needed
• external — requires external tooling integration

CLI Usage¶

Generate Full Report¶

# Markdown report (default)
python -m src.cli compliance gost-56939

# JSON output
python -m src.cli compliance gost-56939 --format json

# GOST auditor template
python -m src.cli compliance gost-56939 --format gost --language ru

# With traceability matrix
python -m src.cli compliance gost-56939 --include-traceability

# Save to file and history
python -m src.cli compliance gost-56939 --output report.md --save-history

# English output
python -m src.cli compliance gost-56939 --language en

Artifact Checklist¶

# All processes
python -m src.cli compliance checklist

# Specific processes
python -m src.cli compliance checklist --process 5.7,5.10

# JSON format
python -m src.cli compliance checklist --format json

History and Delta¶

# View assessment history
python -m src.cli compliance history --project myproject

# Compare two assessments
python -m src.cli compliance delta --old abc123 --new def456

Traceability Matrix¶

# Markdown format
python -m src.cli compliance traceability

# JSON format
python -m src.cli compliance traceability --format json --output trace.json

API Endpoints¶

All endpoints are under /api/v1/compliance/gost-56939/.

Example: Get Report¶

curl http://localhost:8000/api/v1/compliance/gost-56939/myproject

Response:

{
  "project_name": "myproject",
  "compliance_score": 52.4,
  "gost_standard": "GOST R 56939-2024",
  "summary": {"full": 8, "partial": 5, "gap": 8, "n_a": 4},
  "processes": [...]
}

MCP Tool¶

codegraph_compliance_gost(
  action="evaluate",     # evaluate | checklist | traceability | history | delta
  format="markdown",     # markdown | json | gost
  language="ru",         # ru | en
  process_filter="",     # comma-separated process IDs
  include_traceability=false,
  report_id_old="",      # for delta action
  report_id_new=""       # for delta action
)

Configuration¶

# config.yaml
compliance:
  gost_56939:
    enabled: true
    auto_evaluate_on_audit: true
    store_history: true
    history_db_path: "data/compliance_history.sqlite"
    organizational_processes_status: "n_a"
    sarif_search_paths: ["data/", "reports/"]
    manual_overrides: {}     # e.g., "5.1": "partial"

Manual Overrides¶

For organizational processes that require manual assessment, set overrides:

compliance:
  gost_56939:
    manual_overrides:
      "5.1": "partial"   # Planning documented
      "5.2": "full"      # Training completed
      "5.22": "partial"  # Support processes defined

Compliance Score¶

The compliance score is calculated as:

• FULL = 1.0 point
• PARTIAL = 0.5 points
• GAP = 0 points
• N/A = excluded from calculation

Formula: score = sum(points) / count(applicable) * 100%

Traceability Matrix¶

The traceability matrix links:

1. CWE requirements to code locations (from SARIF and CPG pattern findings)
2. Code locations to test files (by naming convention, e.g., test_sql_injection.py links to CWE-89)
3. Findings to fix references (git commit hashes)

Each entry has a status: covered (code + tests), partial (code or tests only), uncovered.

Specialized Evaluators¶

CodeGraph includes 25 specialized evaluators — one for each GOST process:

Automated Evaluators (10)¶

These evaluators assess compliance programmatically by examining CPG data, SARIF reports, configuration files, and project structure:

Organizational/Mixed/External Evaluators (15)¶

These evaluators handle processes requiring manual assessment or external tooling. They support manual_overrides from configuration:

Evaluator Registry¶

All evaluators are auto-loaded via build_evaluator_registry():

from src.compliance.gost_56939.evaluators import build_evaluator_registry

registry = build_evaluator_registry(manual_overrides={"5.1": "partial"})
# Returns Dict[str, BaseProcessEvaluator] with all 25 evaluators

Output Formats¶

Integration with Audit Composite¶

When auto_evaluate_on_audit: true, the compliance report is automatically generated during audit composite execution and included in audit metrics under compliance_gost_summary.

Delta Tracking¶

The compliance store tracks assessment history in SQLite. Delta reports compare two assessments:

• improved — process status upgraded (e.g., GAP → PARTIAL)
• degraded — process status downgraded
• unchanged — no change in status

# Compare two reports
python -m src.cli compliance delta --old <report_id_1> --new <report_id_2>

The delta helps track compliance progress over time and identify regressions before audits.