{"schema":"https://ver.cy/schemas/card/1.0.0","id":"EM-TEC-07","code":"em-tec-07","url":"https://ver.cy/models/em-tec-07/","name":"Vulnerability, affectedness and remediation","alternateNames":[],"kind":"enterprise-contour","status":"research-draft","version":"research-checkpoint","language":"en","classifiers":{"family":"Enterprise profiles","category":"Enterprise subject","entryKind":"subject","plane":"","domain":["Enterprise","TEC"],"industry":["Cross-industry"],"navPath":"","tags":["EM-TEC-07","W2","subject","Vulnerability","AffectednessAssessment","Remediation","ExploitEvidence"],"facets":{}},"whatItIs":"Vulnerability description, affectedness assessment, priority and remediation confirmation. A discovered weakness is not identical to its exploitation.","purpose":"Vulnerability description, affectedness assessment, priority and remediation confirmation. A discovered weakness is not identical to its exploitation.","scope":{"in":[],"out":[],"boundaries":[]},"distinguishingFeatures":["CVE is not the only admissible ID","An assessment specifies a version and a context","A closed ticket is not proof of remediation"],"structure":{"bundles":[]},"agentConduct":{"may":[],"mustNot":["Negative case: The presence of a CVE in a transitive dependency automatically means a confirmed incident."],"requiresHuman":[]},"ethics":{"considerations":[],"affectedParties":[]},"owners":{"steward":"CTO / CIO / владелец сервиса","roles":[],"masterSystems":["Каталог ПО","Git","CI/CD","CMDB","observability"]},"relations":[{"target":"EM-TEC-01","type":"neighbor"},{"target":"WM-SFT-006","type":"references","note":"conceptual-candidate"}],"interaction":{"identity":{"applicability":"required","items":["Vulnerability","AffectednessAssessment","Remediation","ExploitEvidence"]},"properties":{"applicability":"not-applicable","items":[]},"recognition":{"applicability":"required","items":[]},"capabilities":{"applicability":"required","items":[]},"hazards":{"applicability":"required","items":[]},"interfaces":{"applicability":"required","items":[]},"context":{"applicability":"required","items":[]}},"sources":[{"title":"AISMM/WM-SFT and ArchiMate: product, system and architecture"},{"title":"CSDM: business application, service and runtime instance"},{"title":"SPDX/OpenTelemetry/Google SRE: delivery, observation and reliability; choose by boundary"}],"openQuestions":["When is a component version actually affected?","How to distinguish generic severity from contextual risk?","How to prove a fix in production?","Установить границу и решение reuse/extend/new по действующим спецификациям.","Подтвердить semantic crosswalk, права и source mastership.","Выбрать immutable refs; провести проверки fixtures до заявления о публикационной готовности."],"resources":{"source":"https://ver.cy/enterprise/models/em-tec-07/"},"provenance":{"origin":"enterprise research programme","builtFrom":["enterprise/models/em-tec-07/brief.json"],"providers":[],"researchStatus":"published-partial","generatedAt":"","builder":"tools/build_cards.py@1.0.0"},"completeness":{"sections":{"classifiers":"filled","whatItIs":"filled","purpose":"filled","distinguishingFeatures":"derived","structure":"missing","agentConduct":"derived","ethics":"missing","owners":"filled","relations":"filled","interaction.identity":"derived","interaction.properties":"not-applicable","interaction.recognition":"missing","interaction.capabilities":"missing","interaction.hazards":"missing","interaction.interfaces":"missing","interaction.context":"missing","sources":"filled"},"notes":{"agentConduct":"Negative case of the research brief, not yet a rule for agents.","interaction.properties":"Enterprise record contour: physical properties belong to referenced world models.","structure":"Research contour: bundles not designed yet; questions are listed as open questions.","language":"Still in Russian: suggested owner, blocking decisions, vercy candidates. Translate in research/enterprise/i18n/units.en.json."},"score":0.469}}