Added RDX risk alignment. Add safety. Minor refactor

schema/2.0/modules/cyclonedx-blueprint-2.0.schema.json

@@ -1941,6 +1941,24 @@
         "criticality": {
           "$ref": "cyclonedx-risk-2.0.schema.json#/$defs/criticality"
         },
+        "safetyIntegrityLevels": {
+          "type": "array",
+          "title": "Safety Integrity Levels",
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/safetyIntegrityLevel"
+          },
+          "description": "The safety integrity classifications of this asset in the context of the blueprint. An asset may carry classifications from more than one scheme, for example where an element classified under IEC 61508 is also mapped to an automotive ASIL. The classification identifies the safety significance of the context so that the impact of a change on it can be assessed."
+        },
+        "riskAttributes": {
+          "type": "array",
+          "title": "Risk Attributes",
+          "uniqueItems": true,
+          "items": {
+            "$ref": "cyclonedx-risk-2.0.schema.json#/$defs/riskAttribute"
+          },
+          "description": "The security and privacy attributes of this asset that are worth protecting, such as integrity or availability, whose compromise leads to damage. Corresponds to the cybersecurity properties of an asset in ISO/SAE 21434 and to the security objectives of FIPS 199."
+        },
         "classification": {
           "$ref": "cyclonedx-data-2.0.schema.json#/$defs/dataClassification"
         },
@@ -1960,6 +1978,74 @@
         }
       }
     },
+    "safetyIntegrityLevel": {
+      "type": "object",
+      "title": "Safety Integrity Level",
+      "description": "A safety integrity classification drawn from a functional safety scheme, such as an Automotive Safety Integrity Level, a Safety Integrity Level, a Design Assurance Level, or a software safety class. The classification describes the safety significance of the context; a level that an authority has attested the subject achieved is recorded as a certification.",
+      "required": [
+        "scheme",
+        "level"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "scheme": {
+          "title": "Scheme",
+          "description": "The functional safety scheme from which the level is drawn. Use the custom option for schemes not covered by the enumeration.",
+          "oneOf": [
+            {
+              "title": "Predefined Safety Scheme",
+              "enum": [
+                "ISO-26262",
+                "IEC-61508",
+                "DO-178C",
+                "IEC-62304",
+                "EN-50128"
+              ],
+              "meta:enum": {
+                "ISO-26262": "Road vehicles functional safety. Levels are Automotive Safety Integrity Levels, from QM to ASIL D.",
+                "IEC-61508": "Functional safety of electrical, electronic, and programmable electronic safety-related systems. Levels are Safety Integrity Levels 1 to 4.",
+                "DO-178C": "Software considerations in airborne systems and equipment certification. Levels are Design Assurance Levels A to E.",
+                "IEC-62304": "Medical device software life cycle processes. Levels are software safety classes A to C.",
+                "EN-50128": "Railway applications software for railway control and protection systems. Levels are Software Safety Integrity Levels 0 to 4."
+              }
+            },
+            {
+              "type": "object",
+              "title": "Custom Safety Scheme",
+              "required": [
+                "name"
+              ],
+              "additionalProperties": false,
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "minLength": 1,
+                  "title": "Name",
+                  "description": "The name of the custom scheme."
+                },
+                "description": {
+                  "type": "string",
+                  "title": "Description",
+                  "description": "A description of the custom scheme."
+                }
+              }
+            }
+          ]
+        },
+        "level": {
+          "type": "string",
+          "minLength": 1,
+          "title": "Integrity Level",
+          "description": "The level within the scheme, using the designation the scheme defines. Lowercase kebab-case tokens are recommended so that levels compare reliably across documents.",
+          "examples": [
+            "asil-d",
+            "sil-3",
+            "dal-a",
+            "class-c"
+          ]
+        }
+      }
+    },
     "ownership": {
       "type": "array",
       "title": "Ownership",

schema/2.0/modules/cyclonedx-common-2.0.schema.json

@@ -219,12 +219,16 @@
             "threat-model",
             "adversary-model",
             "risk-assessment",
+            "hazard-analysis",
+            "safety-case",
             "vulnerability-assertion",
             "exploitability-statement",
             "pentest-report",
             "static-analysis-report",
             "dynamic-analysis-report",
             "runtime-analysis-report",
+            "test-report",
+            "incident-report",
             "component-analysis-report",
             "maturity-report",
             "certification-report",
@@ -271,12 +275,16 @@
             "threat-model": "An enumeration of identified weaknesses, threats, and countermeasures, dataflow diagram (DFD), attack tree, and other supporting documentation in human-readable or machine-readable format.",
             "adversary-model": "The defined assumptions, goals, and capabilities of an adversary.",
             "risk-assessment": "Identifies and analyzes the potential of future events that may negatively impact individuals, assets, and/or the environment. Risk assessments may also include judgments on the tolerability of each risk.",
+            "hazard-analysis": "A hazard analysis, such as a hazard analysis and risk assessment (HARA), a failure mode and effects analysis (FMEA), or a fault tree analysis (FTA).",
+            "safety-case": "A structured argument, supported by a body of evidence, that a system is acceptably safe for a given application in a given environment.",
             "vulnerability-assertion": "A Vulnerability Disclosure Report (VDR) which asserts the known and previously unknown vulnerabilities that affect a component, service, or product including the analysis and findings describing the impact (or lack of impact) that the reported vulnerability has on a component, service, or product.",
             "exploitability-statement": "A Vulnerability Exploitability eXchange (VEX) which asserts the known vulnerabilities that do not affect a product, product family, or organization, and optionally the ones that do. The VEX should include the analysis and findings describing the impact (or lack of impact) that the reported vulnerability has on the product, product family, or organization.",
             "pentest-report": "Results from an authorized simulated cyberattack on a component or service, otherwise known as a penetration test.",
             "static-analysis-report": "SARIF or proprietary machine or human-readable report for which static analysis has identified code quality, security, and other potential issues with the source code.",
             "dynamic-analysis-report": "Dynamic analysis report that has identified issues such as vulnerabilities and misconfigurations.",
             "runtime-analysis-report": "Report generated by analyzing the call stack of a running application.",
+            "test-report": "Results of testing, such as a laboratory test, a verification test, or a validation test, of a component, service, or system.",
+            "incident-report": "A report of an incident, such as a safety incident, a security incident, or an operational failure, and its investigation.",
             "component-analysis-report": "Report generated by Software Composition Analysis (SCA), container analysis, or other forms of component analysis.",
             "maturity-report": "Report containing a formal assessment of an organization, business unit, or team against a maturity model.",
             "certification-report": "Industry, regulatory, or other certification from an accredited (if applicable) certification body.",

schema/2.0/modules/cyclonedx-requirement-2.0.schema.json

@@ -164,6 +164,7 @@
         "privacy",
         "regulatory",
         "reliability",
+        "safety",
         "scalability",
         "security",
         "system",
@@ -190,6 +191,7 @@
         "privacy": "Requirements specifically addressing the handling and protection of personal and sensitive data.",
         "regulatory": "Requirements necessary for legal compliance, dictated by laws, regulations, or standards.",
         "reliability": "Requirements ensuring the system consistently performs under specified conditions and duration.",
+        "safety": "Requirements that address the prevention of harm to people, property, or the environment, such as functional safety requirements.",
         "scalability": "Requirements focused on the ability of the system to grow and manage increased demand effectively.",
         "security": "Requirements intended to protect systems, data, and users from malicious actions or threats.",
         "system": "Technical requirements defining infrastructure, architecture, or underlying technologies.",