← Catalogue
World Models · legacy example

Cyber Integrity & System Security

This meta-model describes the technical health of the systems the catalogue depends on: known vulnerabilities, which live systems are exposed and how far patched, the threats and indicators observed against them, the incidents that actually occurred, and the control baselines and posture assessments that say how well defended each system is. It is its own model because system security has its own registries, actors and cadence (disclosure, patching, incident response) that are orthogonal to who owns data and who may read it, yet every access guarantee in this cluster silently assumes it.

AI YAMLAGENTS.mdSource
IDworld.s8-cyber-integrity-and-system-security
Version history0.2.0-legacy
CategoryReference example
IndustryCross-industry
Domainsecurity-ownership-access
Tagscyber, integrity, system, security
Data structure

Bundles and layers

Bundle

weakness

What could be exploited

Layers

vulnerabilities`: known weaknesses in software and components · `exposures`: which concrete systems carry them and their patch state

Bundle

threat

Who and what attacks

Layers

actorsAndCampaigns`: actors, campaigns and techniques posing risk · `indicators`: observable signs of compromise and their attribution

Bundle

incident

What actually happened

Layers

detection`: declared incidents, triage and impact scoping · `response`: containment, recovery and closure

Bundle

assurance

How well defended

Layers

controls`: each owner's declared control baseline · `posture`: periodic assessments against that baseline

Findings

Catalogue-native findings must describe the information grouped by each layer. This legacy version does not declare them separately.

Questions & artifacts

Questions, artifact requirements and serial naming rules are required by Vercy vNext; they remain unassigned in this reference version.

Service layers

How this specification operates

Dimension & namespace

  • REFERENCE `world.informationSystem` (M8): the software systems whose weaknesses, incidents and baselines this model tracks.
  • REFERENCE `world.network` (N4): network infrastructure appears as the other class of protected, registered asset.
  • REFERENCE `world.ownership` (S1): system ownership determines who patches, who declares baselines and who is notified.
  • REFERENCE `world.accessAudit` (S4): access-log anomalies feed detection, and incident timelines cite log entries as evidence.
  • REFERENCE `world.accessEnforcement` (S7): an incident that is also a violation of access contracts escalates into that model's cases.
  • imports: cve (REFERENCE): the public identifier scheme for vulnerabilities.
  • imports: cwe (REFERENCE): the weakness classification scheme behind vulnerability classes.
  • imports: cvss (REFERENCE): the severity scoring vocabulary carried on vulnerabilities.
  • imports: iso-27001 (ALIGN): the control catalogue that declared baselines map to.
  • imports: oasis-stix (ALIGN): the exchange shape for threats and indicators under threat-sharing contracts.

Canon, patches & standards

  • REFERENCE `world.informationSystem` (M8): the software systems whose weaknesses, incidents and baselines this model tracks.
  • REFERENCE `world.network` (N4): network infrastructure appears as the other class of protected, registered asset.
  • REFERENCE `world.ownership` (S1): system ownership determines who patches, who declares baselines and who is notified.
  • REFERENCE `world.accessAudit` (S4): access-log anomalies feed detection, and incident timelines cite log entries as evidence.
  • REFERENCE `world.accessEnforcement` (S7): an incident that is also a violation of access contracts escalates into that model's cases.
  • imports: cve (REFERENCE): the public identifier scheme for vulnerabilities.
  • imports: cwe (REFERENCE): the weakness classification scheme behind vulnerability classes.
  • imports: cvss (REFERENCE): the severity scoring vocabulary carried on vulnerabilities.
  • imports: iso-27001 (ALIGN): the control catalogue that declared baselines map to.
  • imports: oasis-stix (ALIGN): the exchange shape for threats and indicators under threat-sharing contracts.

Artifact formats & serial data

Format-independent core. Concrete artifact formats and naming prefixes are not declared in this legacy version.

Policies & accepted processes

  • `coordinatedDisclosure`: a finder, the system owner and the CERT steward agree on an embargo and publication timeline for a new vulnerability.
  • `threatSharing`: system owners exchange indicators and threat context under attribution and confidentiality terms.
  • `incidentNotification`: the CERT steward, and the owners of data held on a struck system, are notified within agreed timeframes when an incident has a data-exposure flag.

Read / add / edit / delete

CRUD procedures and interface bindings are not declared in this legacy version.

Ownership, roles & access

Each system owner stewards the records of their own systems: exposures, patch states, baselines and assessments. A CERT steward archetype coordinates across owners, runs disclosure embargoes and keeps the situation board; access to any owner's detail remains a grant from that owner under S1/S2, logged in S4.

Existing assembly

Objects, relationships, events and projections

Objects

  • `vulnerability`: a known weakness in software or a component; key attributes: CVE reference, CWE class, CVSS severity, affected versions.
  • `exposure`: the presence of a vulnerability in one concrete system; key attributes: system reference, discovery time, mitigations in place.
  • `patchState`: the remediation status of an exposure; key attributes: state (open, mitigated, patched, accepted), target date, verified time.
  • `threat`: an actor, campaign or technique posing risk; key attributes: capability, intent, technique references.
  • `indicator`: an observable sign of compromise; key attributes: observable, confidence, first and last seen.
  • `cyberIncident`: a realized security event; key attributes: systems struck, impact, timeline, data-exposure flag.
  • `controlBaseline`: the control set a system owner declares; key attributes: control catalogue reference, scope, declared time.
  • `postureAssessment`: one evaluation of a system against its baseline; key attributes: method, findings, score, assessed time.

Relationships

  • `exposure` -> instantiates -> `vulnerability` (*..1): one published weakness fans out into many concrete exposures.
  • `exposure` -> affects -> `registeredSystem` (*..1): exposures attach to systems and network nodes registered in M8 and N4.
  • `patchState` -> remediates -> `exposure` (1..1): every exposure carries exactly one live remediation status.
  • `indicator` -> signals -> `threat` (*..1): indicators are attributed, with stated confidence, to threats.
  • `cyberIncident` -> exploited -> `vulnerability` (0..*): incidents cite the weaknesses used when known.
  • `cyberIncident` -> struck -> `registeredSystem` (1..*): every incident names the systems affected.
  • `postureAssessment` -> evaluates -> `controlBaseline` (1..1): assessments measure a system against its own declared baseline.

Events

  • `vulnerabilityDisclosed`: a weakness became known, with or without a coordinated embargo.
  • `exposureIdentified`: a concrete system was found to carry a known vulnerability.
  • `patchApplied`: a remediation was applied and its verification recorded.
  • `threatObserved`: a threat actor, campaign or technique was observed in scope.
  • `incidentDeclared`: a security event was declared an incident and triage began.
  • `incidentContained`: the spread of an incident was stopped; recovery began.
  • `incidentClosed`: recovery finished and lessons were recorded.
  • `assessmentCompleted`: a posture assessment concluded with findings.

Projections

  • `publicAdvisory`: vulnerability, affected versions and fixed versions; omits which live systems remain unpatched.
  • `ownerRiskDashboard`: exposures, patch states and posture for one owner's systems only; omits everyone else's estate.
  • `certSituationBoard`: cross-system aggregate of exposures, threats and incidents at cohort grain; omits identifiable unpatched systems.