C03 — Tuân thủ bảo mật thông tin

# NIST CSF v2.0 Self-Assessment Tool
# Score: 1=Initial, 2=Developing, 3=Defined, 4=Quantitatively Managed, 5=Optimizing

$csfAssessment = @(
    # GOVERN Function
    [PSCustomObject]@{ Function="GV"; Category="GV.OC"; Subcategory="GV.OC-01"; Description="Organizational mission understood"; Score=3; Target=4; Evidence="Mission statement published, security strategy aligned" },
    [PSCustomObject]@{ Function="GV"; Category="GV.RM"; Subcategory="GV.RM-01"; Description="Risk management objectives established"; Score=2; Target=4; Evidence="Risk appetite statement: draft, not approved" },
    [PSCustomObject]@{ Function="GV"; Category="GV.PO"; Subcategory="GV.PO-01"; Description="Security policy established"; Score=3; Target=4; Evidence="ISP v2.1 approved 2025-01, annual review scheduled" },

    # IDENTIFY Function
    [PSCustomObject]@{ Function="ID"; Category="ID.AM"; Subcategory="ID.AM-01"; Description="Asset inventory maintained"; Score=2; Target=4; Evidence="Manual spreadsheet, not auto-discovered, 60% coverage" },
    [PSCustomObject]@{ Function="ID"; Category="ID.RA"; Subcategory="ID.RA-01"; Description="Vulnerabilities identified"; Score=3; Target=4; Evidence="Nessus scan monthly, critical patched in 15 days avg" },
    [PSCustomObject]@{ Function="ID"; Category="ID.SC"; Subcategory="ID.SC-01"; Description="Supply chain risk managed"; Score=1; Target=3; Evidence="No formal vendor risk assessment process" },

    # PROTECT Function
    [PSCustomObject]@{ Function="PR"; Category="PR.AA"; Subcategory="PR.AA-01"; Description="Identities authenticated"; Score=3; Target=5; Evidence="MFA enabled for 85% users; 100% target" },
    [PSCustomObject]@{ Function="PR"; Category="PR.DS"; Subcategory="PR.DS-01"; Description="Data-at-rest protected"; Score=4; Target=4; Evidence="AES-256 on all databases, KMS managed" },
    [PSCustomObject]@{ Function="PR"; Category="PR.AT"; Subcategory="PR.AT-01"; Description="Security awareness conducted"; Score=3; Target=4; Evidence="Annual training, phishing sim quarterly, 83% completion" },

    # DETECT Function
    [PSCustomObject]@{ Function="DE"; Category="DE.CM"; Subcategory="DE.CM-01"; Description="Networks monitored"; Score=3; Target=4; Evidence="SIEM deployed, 90% log sources connected" },
    [PSCustomObject]@{ Function="DE"; Category="DE.AE"; Subcategory="DE.AE-01"; Description="Anomalies detected"; Score=2; Target=4; Evidence="Basic SIEM rules, no ML-based detection" },

    # RESPOND Function
    [PSCustomObject]@{ Function="RS"; Category="RS.MA"; Subcategory="RS.MA-01"; Description="Incident response plan tested"; Score=3; Target=4; Evidence="IRP tested via tabletop Q4 2025, gaps documented" },

    # RECOVER Function
    [PSCustomObject]@{ Function="RC"; Category="RC.RP"; Subcategory="RC.RP-01"; Description="Recovery plan tested"; Score=2; Target=4; Evidence="BCP exists, last DR test 2024-02, RTO not validated" }
)

# Tính toán gaps và scores
$results = $csfAssessment | ForEach-Object {
    $_ | Add-Member -NotePropertyName Gap   -NotePropertyValue ($_.Target - $_.Score) -PassThru |
        Add-Member -NotePropertyName Status -NotePropertyValue (if ($_.Score -ge $_.Target) { "MET" } elseif ($_.Gap -le 1) { "MINOR GAP" } else { "GAP" }) -PassThru
}

$results | Export-Csv "C:\GRC\csf-assessment.csv" -NoTypeInformation -Encoding UTF8

# Summary by Function
$results | Group-Object Function | ForEach-Object {
    $avgScore  = ($_.Group | Measure-Object Score -Average).Average
    $avgTarget = ($_.Group | Measure-Object Target -Average).Average
    [PSCustomObject]@{ Function=$_.Name; AvgScore=[math]::Round($avgScore,1); AvgTarget=[math]::Round($avgTarget,1); Gaps=($_.Group | Where-Object Status -ne "MET").Count }
} | Format-Table -AutoSize