Arx 0.5.6: password/lockout fixes on Mac, Linux, Windows; Fix problems on Windows (fix.ps1); Linux pwquality read order

HANDOVER.md

@@ -15,8 +15,8 @@ Last updated: **2026-10-14** (app 0.5.5, catalog 0.4).
 - A small **fine-tuned AI model** (Qwen2.5-0.5B + LoRA) runs **on the computer** (WebLLM, WebGPU) and writes the report:
   findings, risk, fix steps, summary, AI-tool classification. Every AI answer is checked against the evidence; if it
   fails, a fixed template is used instead.
-- **Fix problems:** on Mac and Linux, Arx can change unsafe settings for you (one click, password prompt, re-check,
-  **Undo**). The AI never writes or runs commands; fixes are tested scripts.
+- **Fix problems:** on Mac, Linux and Windows, Arx can change unsafe settings for you (one click, password/UAC prompt,
+  re-check, **Undo**). The AI never writes or runs commands; fixes are tested scripts.
 - **Nothing is uploaded.** Reports stay on the computer.
 
 The design rule from day one: **code decides pass/fail; the model only explains, prioritises and writes.**
@@ -62,7 +62,7 @@ Licences: code **Apache-2.0** (+ `NOTICE`), data **CC BY 4.0**, `CITATION.cff`.
 | **Website** | Computers only. Detects the OS and shows **one install command** with Copy; lists all 70 checks; shows a report from the app ("Open report with fixes") or an opened `…-evidence.json`. Hero label "Arx - Fine-tuned AI Model". |
 | **Install** | `curl -fsSL https://devseis-arx.static.hf.space/install.sh \| bash` (macOS, Linux) · `irm https://devseis-arx.static.hf.space/install.ps1 \| iex` (Windows). Checks SHA-256 against `SHA256SUMS`; no "Open Anyway", no SmartScreen. |
 | **App** | **0.5.5**. macOS: tested on a real Intel Mac. Linux: tested in Ubuntu containers (app headless + fixes). Windows: **built, never run on a real PC**. |
-| **Fix problems** | Mac: 9 one-click fixes + Settings pages. Linux: 8 one-click fixes. Windows: not built. |
+| **Fix problems** | Mac: 17 one-click fixes + Settings pages. Linux: 17 one-click fixes. Windows: 29 one-click fixes + Settings pages (`fix.ps1`; logic tested with mocked OS calls, **never run on a real PC**). Password/lockout values come from `baseline.conf`. |
 | **AI** | `app/model-version.json`: `version` **v0.3** (full-precision `q0f16`, chips with 16-bit maths), `version_4bit` **v0.6** (4-bit builds). Both 24/24 on the catalog-0.4 checks without retraining. |
 | **Vulnerability data** | Built **2026-10-08**; reports flag it as old after 14 days → **refresh before 2026-10-22**. |
 
@@ -139,6 +139,18 @@ Licences: code **Apache-2.0** (+ `NOTICE`), data **CC BY 4.0**, `CITATION.cff`.
 - **App 0.5.4:** clearer "Ready to audit" screen (two rows of check groups with descriptions and counts).
 - **App 0.5.5:** **All results** after the audit: every check with its status and filters; a click shows why (found vs
   required, finding, why it matters, risk, how to fix, how to check, references, detected or self-reported).
+- **Fix problems: passwords, lockout and Windows (2026-10-15, not released yet):** the password-length check reads the
+  *policy* (shortest password the system accepts), not your password, so a long password does not change it — the macOS
+  default policy is 4. New one-click fixes on all systems for password length, complexity, history, expiry (and minimum
+  age on Linux/Windows) and account lockout, with values from `baseline.conf` (`--baseline` / `-Baseline`).
+  macOS: Arx's own `pwpolicy` entries (`com.devseis.arx.*`) at the top of the global policy; undo removes only those
+  (original kept in `<state>.pwpolicy`); automatic login off (no undo: the saved password is deleted). Linux:
+  pwquality.conf (libpam-pwquality installed if missing), pam-auth-update profiles `arx-pwhistory`/`arx-faillock*` on
+  Ubuntu/Debian, authselect features on Red Hat-type; login.defs + chage; tested apply → re-audit → login/lockout/
+  password-change → undo in Ubuntu 24.04 and Fedora 40 containers. Windows: `collectors/windows/fix.ps1` (secedit,
+  firewall profiles, Defender real-time + signatures, screen lock, telemetry, updates, time, guest, auto sign-in,
+  audit policy, USB write, Recall) wired into the app. Shared fixes (lockout ×3, screen lock ×3) show as one item.
+  Linux audit fix: `pwquality.conf` is read after `pwquality.conf.d/`, so its values win.
 - **Hugging Face clean-up:** only what is used remains (model tags v0.3 + v0.6, data tags v0.3 + v0.5, latest release).
 
 ## 5. Hurdles and lessons (quick reference)
@@ -198,8 +210,9 @@ Docker). Windows scripts: parse/logic-test in `mcr.microsoft.com/powershell`.
 
 ## 8. Open items / next steps
 1. **Refresh the vulnerability data before 2026-10-22**, then automate a weekly refresh.
-2. **Windows:** first real test on a Windows 10/11 PC or VM (app, audit, `install.ps1` silent install), then
-   **Fix problems for Windows** (firewall profiles, Defender, updates, guest account, automatic sign-in…).
+2. **Windows:** first real test on a Windows 10/11 PC or VM (app, audit, `install.ps1` silent install, and every
+   fix in `fix.ps1`: apply → re-audit → undo).
+   **macOS:** run the password/lockout fixes once for real (`pwpolicy -setaccountpolicies` was only tested with a stand-in).
 3. **Linux:** test on a real desktop (pkexec prompt) and on Red Hat/Fedora (firewalld, dnf-automatic).
 4. **Apple notarisation** ($99/yr Developer ID) and a **Windows code-signing certificate**, so direct file downloads
    also open without warnings.

app/main.cjs

@@ -147,7 +147,7 @@ function autoFixIds(ids) {
   const fixes = readJson('library', 'fixes.json').fixes;
   return [...new Set(ids)].filter(id => typeof id === 'string' && fixes[id] && fixes[id][OS_FAMILY] && fixes[id][OS_FAMILY].kind === 'auto');
 }
-const FIX_SCRIPT = { macos: 'fix.sh', linux: 'fix.sh' };
+const FIX_SCRIPT = { macos: 'fix.sh', linux: 'fix.sh', windows: 'fix.ps1' };
 // Test only (smoke test): the fix script prints what it would change and changes nothing; no administrator prompt.
 const FIX_DRY = !!(process.env.DEVSEIS_SMOKE && process.env.DEVSEIS_FIX_DRY);
 const fixHistoryFile = () => path.join(app.getPath('userData'), 'fix-history.json');
@@ -155,7 +155,7 @@ function fixHistory() { try { return JSON.parse(fs.readFileSync(fixHistoryFile()
 ipcMain.handle('fix:history', () => fixHistory().slice(-20));
 ipcMain.handle('fix:settings', (event, checkId) => {
   const fix = (readJson('library', 'fixes.json').fixes[checkId] || {})[OS_FAMILY];
-  if (fix && fix.kind === 'settings' && /^x-apple\.systempreferences:|^ms-settings:/.test(fix.url)) return shell.openExternal(fix.url);
+  if (fix && fix.kind === 'settings' && /^x-apple\.systempreferences:|^ms-settings:|^windowsdefender:/.test(fix.url)) return shell.openExternal(fix.url);
   return false;
 });
 
@@ -166,7 +166,9 @@ function collectorCommand(workDir, progressFile, elevated, fix = null) {
   if (OS_FAMILY === 'windows') {
     const q = s => `'${s.replace(/'/g, "''")}'`;
     const runner = path.join(workDir, 'run.ps1');
-    fs.writeFileSync(runner, `& ${q(path.join(AUDIT_ROOT, 'collectors', 'windows', 'audit.ps1'))} -Baseline ${q(base)} -Organisational ${q(org)} -Output ${q(workDir)} -Progress ${q(progressFile)} *> ${q(path.join(workDir, 'collector.log'))}\n`);
+    // A fix run: apply or undo first (old values saved in the fix state file), then audit again to show the result.
+    const fixStep = fix ? `& ${q(path.join(AUDIT_ROOT, 'collectors', 'windows', FIX_SCRIPT.windows))} -Action ${fix.action} -State ${q(path.join(app.getPath('userData'), 'fix-state.tsv'))} -Results ${q(path.join(workDir, 'fix-results.tsv'))} -Baseline ${q(base)}${FIX_DRY ? ' -DryRun' : ''} -Ids @(${fix.ids.map(q).join(', ')}) *> ${q(path.join(workDir, 'fix.log'))}\n` : '';
+    fs.writeFileSync(runner, `${fixStep}& ${q(path.join(AUDIT_ROOT, 'collectors', 'windows', 'audit.ps1'))} -Baseline ${q(base)} -Organisational ${q(org)} -Output ${q(workDir)} -Progress ${q(progressFile)} *> ${q(path.join(workDir, 'collector.log'))}\n`);
     const inner = `-NoProfile -ExecutionPolicy Bypass -File "${runner}"`;
     if (!elevated) return ['powershell.exe', ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', runner]];
     // UAC prompt; -Wait keeps this process alive until the elevated audit finishes.
@@ -185,7 +187,7 @@ function collectorCommand(workDir, progressFile, elevated, fix = null) {
   }
   const collector = path.join(scripts, 'audit.sh');
   // A fix run: apply or undo first (old values saved in the fix state file), then audit again to show the result.
-  const fixStep = fix ? `/bin/bash ${q(path.join(scripts, FIX_SCRIPT[OS_FAMILY]))} ${fix.action}${FIX_DRY ? ' --dry-run' : ''} --state ${q(path.join(app.getPath('userData'), 'fix-state.tsv'))} ${fix.ids.map(q).join(' ')} > ${q(path.join(workDir, 'fix-results.tsv'))} 2>&1\n` : '';
+  const fixStep = fix ? `/bin/bash ${q(path.join(scripts, FIX_SCRIPT[OS_FAMILY]))} ${fix.action}${FIX_DRY ? ' --dry-run' : ''} --state ${q(path.join(app.getPath('userData'), 'fix-state.tsv'))} --baseline ${q(base)} ${fix.ids.map(q).join(' ')} > ${q(path.join(workDir, 'fix-results.tsv'))} 2>&1\n` : '';
   fs.writeFileSync(runner, `#!/bin/bash\n${fixStep}/bin/bash ${q(collector)} --baseline ${q(base)} --org ${q(org)} --output ${q(workDir)} --progress ${q(progressFile)} > ${q(path.join(workDir, 'collector.log'))} 2>&1\nchmod -R a+rX ${q(workDir)}\n`, { mode: 0o755 });
   if (!elevated) return ['/bin/bash', [runner]];
   if (OS_FAMILY === 'macos') {

app/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devseis-endpoint-auditor",
   "productName": "Arx",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "Read-only endpoint audit for ISO 27001, GDPR and the EU AI Act, with a local AI auditor.",
   "author": {
     "name": "Devseis",

app/renderer/app.js

@@ -202,6 +202,12 @@ async function renderFixes(evidence, fixResults) {
   const usable = f => !f.requires || ((evidence.results.find(x => x.id === f.requires.check) || {}).actual || '').toLowerCase().includes(f.requires.contains.toLowerCase());
   const gaps = evidence.results.filter(r => r.status === 'Non-Compliant' && fixes[r.id] && fixes[r.id][os] && usable(fixes[r.id][os]));
   const auto = gaps.filter(r => fixes[r.id][os].kind === 'auto');
+  // Several checks can share one fix (lockout threshold, duration and observation): show it once, fixing all of them.
+  const autoGroups = [];
+  for (const r of auto) {
+    const f = fixes[r.id][os], g = autoGroups.find(x => x.f.title === f.title && x.f.changes === f.changes);
+    if (g) g.ids.push(r.id); else autoGroups.push({ f, ids: [r.id] });
+  }
   // Several checks can share one settings page and the same steps (screen lock): show them once.
   const seen = new Set();
   const guided = gaps.filter(r => fixes[r.id][os].kind === 'settings')
@@ -212,20 +218,20 @@ async function renderFixes(evidence, fixResults) {
   if (!auto.length && !guided.length && !undoable.length) { $('fixes').classList.add('hidden'); return; }
 
   $('fixes').innerHTML = `<h2>🛠 Fix problems</h2>
-    ${auto.length ? `<p class="muted">Arx can fix these for you. Each change can be undone.</p>
-      <div class="fix-auto">${auto.map(r => { const f = fixes[r.id][os]; return `<label class="fix-item"><input type="checkbox" data-fix="${r.id}" checked>
-        <span><b>${escapeHtml(f.title)}</b><br><span class="muted">${escapeHtml(f.changes)}${f.note ? ` ${escapeHtml(f.note)}` : ''}</span></span></label>`; }).join('')}</div>
-      <div class="actions"><button class="primary" id="fix-selected">Fix selected (${auto.length})</button></div>` : ''}
+    ${auto.length ? `<p class="muted">Arx can fix these for you. Most changes can be undone.</p>
+      <div class="fix-auto">${autoGroups.map(({ f, ids }) => `<label class="fix-item"><input type="checkbox" data-fix="${ids.join(',')}" checked>
+        <span><b>${escapeHtml(f.title)}</b><br><span class="muted">${escapeHtml(f.changes)}${f.note ? ` ${escapeHtml(f.note)}` : ''}</span></span></label>`).join('')}</div>
+      <div class="actions"><button class="primary" id="fix-selected">Fix selected (${autoGroups.length})</button></div>` : ''}
     ${guided.length ? `<h3>${os === 'macos' ? 'Fix in System Settings' : 'Fix in Settings'}</h3><p class="muted">These need your password, a recovery key or a restart, so you make the change. Arx opens the right page.</p>
       <div class="fix-guided">${guided.map(r => { const f = fixes[r.id][os]; return `<div class="fix-item"><span><b>${escapeHtml(f.title)}</b>
         <ol>${f.steps.map(x => `<li>${escapeHtml(x)}</li>`).join('')}</ol></span>${f.url ? `<button class="secondary" data-settings="${r.id}">Open Settings</button>` : ''}</div>`; }).join('')}</div>
       <p class="muted">When you are done, choose <b>Run another audit</b> to check again.</p>` : ''}
-    ${undoable.length ? `<div class="undo-row"><span class="muted">Last fixes (${new Date(last.at).toLocaleString()}): ${undoable.map(id => escapeHtml(fixes[id][os].title)).join(', ')}</span>
+    ${undoable.length ? `<div class="undo-row"><span class="muted">Last fixes (${new Date(last.at).toLocaleString()}): ${[...new Set(undoable.map(id => fixes[id][os].title))].map(escapeHtml).join(', ')}</span>
       <button class="secondary" id="fix-undo">Undo last fixes</button></div>` : ''}`;
   $('fixes').classList.remove('hidden');
 
-  const selected = () => [...$('fixes').querySelectorAll('input[data-fix]:checked')].map(i => i.dataset.fix);
-  const updateCount = () => { const b = $('fix-selected'); if (b) { const n = selected().length; b.textContent = `Fix selected (${n})`; b.disabled = !n; } };
+  const selected = () => [...$('fixes').querySelectorAll('input[data-fix]:checked')].flatMap(i => i.dataset.fix.split(','));
+  const updateCount = () => { const b = $('fix-selected'); if (b) { const n = $('fixes').querySelectorAll('input[data-fix]:checked').length; b.textContent = `Fix selected (${n})`; b.disabled = !n; } };
   $('fixes').querySelectorAll('input[data-fix]').forEach(i => i.addEventListener('change', updateCount));
   $('fixes').querySelectorAll('[data-settings]').forEach(b => b.addEventListener('click', () => window.devseis.openFixSettings(b.dataset.settings)));
   if ($('fix-selected')) $('fix-selected').addEventListener('click', () => confirmFix('apply', selected()));
@@ -236,11 +242,12 @@ function confirmFix(action, ids) {
   if (!ids.length) return;
   const os = plan.os;
   pendingFix = { action, ids };
-  $('fix-title').textContent = action === 'undo' ? 'Undo these fixes?' : `Fix ${ids.length} problem${ids.length > 1 ? 's' : ''}?`;
+  const shown = [...new Map(ids.map(id => [fixes[id][os].title, fixes[id][os]])).values()];   // shared fixes listed once
+  $('fix-title').textContent = action === 'undo' ? 'Undo these fixes?' : `Fix ${shown.length} problem${shown.length > 1 ? 's' : ''}?`;
   $('fix-intro').textContent = action === 'undo' ? 'Arx will put these settings back as they were before, then check this computer again.'
-    : 'Arx will change these settings, then check this computer again. You can undo each fix afterwards.';
-  $('fix-confirm-list').innerHTML = ids.map(id => { const f = fixes[id][os]; return `<li><b>${escapeHtml(f.title)}</b><br><span class="muted">${escapeHtml(action === 'undo' ? 'Back to the previous setting.' : f.changes)}</span></li>`; }).join('');
-  $('fix-password-note').textContent = { macos: 'macOS will ask for your administrator password.', linux: 'Your system will ask for your password (administrator rights).' }[os] || 'Your computer will ask for your administrator password.';
+    : 'Arx will change these settings, then check this computer again. You can undo most fixes afterwards.';
+  $('fix-confirm-list').innerHTML = shown.map(f => { return `<li><b>${escapeHtml(f.title)}</b><br><span class="muted">${escapeHtml(action === 'undo' ? 'Back to the previous setting.' : f.changes)}</span></li>`; }).join('');
+  $('fix-password-note').textContent = { macos: 'macOS will ask for your administrator password.', linux: 'Your system will ask for your password (administrator rights).', windows: 'Windows will ask you to allow the change (User Account Control).' }[os] || 'Your computer will ask for your administrator password.';
   $('fix-modal').classList.remove('hidden');
 }
 $('fix-cancel').addEventListener('click', () => { pendingFix = null; $('fix-modal').classList.add('hidden'); });

collectors/linux/audit.sh

@@ -161,7 +161,8 @@ conf_value() { # key files... -> last "key = value" in the files
 }
 
 PWQ_LINE=$(pam_line pam_pwquality.so $PAM_PASSWORD)
-PWQ_CONF="/etc/security/pwquality.conf $(ls /etc/security/pwquality.conf.d/*.conf 2>/dev/null | tr '\n' ' ')"
+# libpwquality reads pwquality.conf.d/ first and pwquality.conf last, so the main file's values win.
+PWQ_CONF="$(ls /etc/security/pwquality.conf.d/*.conf 2>/dev/null | tr '\n' ' ') /etc/security/pwquality.conf"
 pwq() { # key default -> value from the PAM arguments, else pwquality.conf, else default
     local v
     v=$(pam_arg "$PWQ_LINE" "$1")

collectors/linux/fix.sh

@@ -2,19 +2,21 @@
 # Arx fixer for Linux: applies or undoes the one-click fixes in library/fixes.json, one tested function per fix.
 # The AI never writes these commands; the app only passes fix ids, and this script accepts only the ids below.
 #
-#   fix.sh apply --state FILE [--dry-run] ID [ID ...]   save the current values to FILE, then fix
-#   fix.sh undo  --state FILE [--dry-run] ID [ID ...]   put back what was saved in FILE
+#   fix.sh apply --state FILE [--baseline FILE] [--dry-run] ID [ID ...]   save the current values to FILE, then fix
+#   fix.sh undo  --state FILE [--baseline FILE] [--dry-run] ID [ID ...]   put back what was saved in FILE
 #
+# --baseline: baseline.conf, read for the password and lockout numbers only (digits only; never executed).
 # Needs root (the app asks with the desktop's password prompt, pkexec). Prints one line per fix:
 #   RESULT <tab> id <tab> applied|undone|unchanged|skipped|failed <tab> message
 # State lines: id <tab> key <tab> previous value. Config files Arx edits are copied first to <state>.files/ and copied
 # back on undo; where possible Arx adds its own drop-in file instead (undo = delete it).
 set -u
 ACTION=${1:-}; shift || true
-STATE=""; DRY=0; IDS=()
+STATE=""; BASELINE=""; DRY=0; IDS=()
 while [ $# -gt 0 ]; do
     case "$1" in
         --state) STATE=$2; shift 2 ;;
+        --baseline) BASELINE=$2; shift 2 ;;
         --dry-run) DRY=1; shift ;;
         *) IDS+=("$1"); shift ;;
     esac
@@ -33,6 +35,7 @@ saved() { # id key -> the value saved at apply time (last one wins), only if it
     local v
     v=$(awk -F'\t' -v id="$1" -v key="$2" '$1 == id && $2 == key { v = $3 } END { print v }' "$STATE" 2>/dev/null)
     case "$v" in on|off|yes|no|1|0|unset|created|none|allow|deny|reject) printf '%s' "$v" ;;
+        -1|[0-9]|[0-9][0-9]|[0-9][0-9][0-9]|[0-9][0-9][0-9][0-9]|[0-9][0-9][0-9][0-9][0-9]) printf '%s' "$v" ;;
         /*) [[ "$v" =~ ^/[A-Za-z0-9/_.-]+$ ]] && printf '%s' "$v" ;;
         *) printf '' ;; esac
 }
@@ -50,6 +53,10 @@ restore() { # id file
         *) return 1 ;;
     esac
 }
+base_int() { # KEY default -> a whole number from baseline.conf, else the default
+    local v=""; [ -f "$BASELINE" ] && v=$(awk -F= -v k="$1" '$1 == k { v = $2 } END { print v }' "$BASELINE" 2>/dev/null | tr -d '[:space:]')
+    [[ "$v" =~ ^[0-9]{1,6}$ ]] && printf '%s' "$v" || printf '%s' "$2"
+}
 svc_active() { systemctl is-active --quiet "$1" 2>/dev/null; }
 svc_enabled() { systemctl is-enabled --quiet "$1" 2>/dev/null; }
 pkg_install() { # quietly install a package with the system's package manager
@@ -240,11 +247,203 @@ fix_malware_signature_updates() {
     fi
 }
 
+# --- password rules and lockout (PAM) -------------------------------------------------------------------------
+# Debian/Ubuntu: pam_pwquality comes from the libpam-pwquality package; password history and lockout are added as
+# pam-auth-update profiles (arx-*), the standard way to change the PAM stack there. Red Hat-type systems: authselect
+# features. Any other PAM setup is left alone: a wrong PAM change can stop everyone from logging in.
+OS_ID=$(. /etc/os-release 2>/dev/null; echo "${ID:-linux}"); OS_LIKE=$(. /etc/os-release 2>/dev/null; echo "${ID_LIKE:-}")
+case " $OS_ID $OS_LIKE " in
+    *" debian "*|*" ubuntu "*) PAM_PW=/etc/pam.d/common-password; PAM_AU=/etc/pam.d/common-auth ;;
+    *) PAM_PW="/etc/pam.d/system-auth /etc/pam.d/password-auth"; PAM_AU="/etc/pam.d/system-auth /etc/pam.d/password-auth" ;;
+esac
+PAM_CONFIGS=/usr/share/pam-configs
+pam_has() { # module files...: the module is in the PAM stack (non-comment line)
+    local m=$1; shift
+    # shellcheck disable=SC2068
+    grep -qsE "^[[:space:]]*[a-z-]+[[:space:]].*$m" $@
+}
+uses_authselect() { have authselect && authselect current >/dev/null 2>&1; }
+uses_pam_auth_update() { have pam-auth-update && [ -d "$PAM_CONFIGS" ]; }
+set_conf() { # file key value: set "key = value" on its active lines, else append it (comments are left alone)
+    local f=$1 k=$2 v=$3
+    if [ "$DRY" -eq 1 ]; then echo "DRY: set $k = $v in $f" >&2; return 0; fi
+    [ -e "$f" ] || { mkdir -p "$(dirname "$f")"; : > "$f"; }
+    if grep -qE "^[[:space:]]*$k[[:space:]]*=" "$f"; then
+        sed -i -E "s/^[[:space:]]*$k[[:space:]]*=.*/$k = $v/" "$f"
+    else printf '%s = %s\n' "$k" "$v" >> "$f"; fi
+}
+conf_get() { # file key -> the value of "key = value" (last one), empty if not set
+    awk -v k="$2" '/^[[:space:]]*#/ { next } { line = $0; gsub(/[[:space:]]/, "", line) } index(line, k "=") == 1 { v = substr(line, length(k) + 2) } END { print v }' "$1" 2>/dev/null
+}
+conf_change() { # id file key value: save the key's current value, then set it (several fixes can share one file)
+    local was; was=$(conf_get "$2" "$3"); [[ "$was" =~ ^-?[0-9]{1,6}$ ]] || was=unset
+    save "$1" "conf:$2:$3" "$was"; set_conf "$2" "$3" "$4"
+}
+conf_undo() { # id: put back each key this fix changed; returns 1 if there was nothing to put back
+    local key f k was any=1
+    while IFS= read -r key; do
+        f=${key#conf:}; k=${f##*:}; f=${f%:*}
+        case "$f" in /etc/security/*.conf) ;; *) continue ;; esac
+        [[ "$k" =~ ^[a-z_]+$ ]] || continue
+        [ -e "$f" ] || continue   # the file went away with the package Arx installed
+        was=$(saved "$1" "$key"); [ -n "$was" ] || continue
+        if [ "$was" = unset ]; then run sed -i -E "/^[[:space:]]*$k[[:space:]]*=/d" "$f"; else set_conf "$f" "$k" "$was"; fi
+        any=0
+    done < <(awk -F'\t' -v id="$1" '$1 == id && $2 ~ /^conf:/ { print $2 }' "$STATE" 2>/dev/null | sort -u)
+    return $any
+}
+
+PWQ_FILE=/etc/security/pwquality.conf   # read after pwquality.conf.d/, so its values win
+pwquality_fix() { # id key value message
+    local id=$1 k=$2 v=$3
+    if [ "$ACTION" = apply ]; then
+        if ! pam_has pam_pwquality.so $PAM_PW; then
+            if have apt-get; then
+                save "$id" pwq_package no
+                dpkg-query -W -f='${Status}' libpwquality-common 2>/dev/null | grep -q "install ok installed" || save "$id" pwq_common no
+                [ "$DRY" -eq 1 ] || { pkg_install libpam-pwquality && pam_has pam_pwquality.so $PAM_PW; } \
+                    || { result "$id" failed "Could not install and turn on libpam-pwquality."; return; }
+            else
+                result "$id" skipped "pam_pwquality is not in the PAM setup; Arx only changes the standard setups (Ubuntu/Debian, authselect)."; return
+            fi
+        fi
+        local pamv; pamv=$(grep -hsE "^[[:space:]]*password.*pam_pwquality" $PAM_PW | grep -oE "(^|[[:space:]])$k=[^[:space:]]+" | head -1 | cut -d= -f2)
+        [ -n "$pamv" ] && { result "$id" skipped "$k=$pamv is set on the pam_pwquality line in ${PAM_PW%% *}; change it there."; return; }
+        conf_change "$id" "$PWQ_FILE" "$k" "$v" && result "$id" applied "$4" || result "$id" failed "Could not change $PWQ_FILE."
+    else
+        local any=0
+        conf_undo "$id" && any=1
+        if [ "$(saved "$id" pwq_package)" = no ]; then
+            run apt-get purge -y -qq libpam-pwquality >/dev/null 2>&1; any=1
+            [ "$(saved "$id" pwq_common)" = no ] && run apt-get purge -y -qq libpwquality-common libpwquality1 >/dev/null 2>&1
+        fi
+        [ $any -eq 1 ] && result "$id" undone "Password rules put back as they were." || result "$id" skipped "Nothing saved to undo."
+    fi
+}
+fix_password_min_length() { local n; n=$(base_int PASSWORD_MIN_LENGTH 14); pwquality_fix password.min_length minlen "$n" "New passwords must have at least $n characters. Current passwords keep working until they are changed."; }
+fix_password_complexity() { pwquality_fix password.complexity minclass 3 "New passwords must use at least 3 kinds of characters (lower case, upper case, digits, symbols)."; }
+
+# A pam-auth-update profile written by Arx (Debian/Ubuntu); undo disables and deletes it.
+pam_profile() { # name: write the profile from stdin and enable it
+    if [ "$DRY" -eq 1 ]; then echo "DRY: pam-auth-update --enable $1" >&2; cat > /dev/null; return 0; fi
+    cat > "$PAM_CONFIGS/$1" && pam-auth-update --enable "$1"
+}
+pam_profile_remove() { run pam-auth-update --remove "$@" && for p in "$@"; do run rm -f "$PAM_CONFIGS/$p"; done; }
+
+fix_password_history() {
+    local id=password.history n; n=$(base_int PASSWORD_HISTORY 24)
+    if [ "$ACTION" = apply ]; then
+        if pam_has pam_pwhistory.so $PAM_PW && ! [ -e "$PAM_CONFIGS/arx-pwhistory" ]; then
+            result $id skipped "pam_pwhistory is already set up by someone else; set remember=$n there."; return
+        fi
+        if uses_authselect; then
+            authselect current 2>/dev/null | grep -q with-pwhistory || save $id feature off
+            run authselect enable-feature with-pwhistory >/dev/null 2>&1 && conf_change $id /etc/security/pwhistory.conf remember "$n" \
+                && result $id applied "A new password cannot be one of the last $n passwords." || result $id failed "Could not turn on password history (authselect)."
+        elif uses_pam_auth_update; then
+            [ -e "$PAM_CONFIGS/arx-pwhistory" ] || save $id profile off
+            printf '%s\n' "Name: Arx: remember old passwords (pam_pwhistory)" "Default: yes" "Priority: 1024" "Password-Type: Primary" "Password:" \
+                "	requisite	pam_pwhistory.so remember=$n enforce_for_root try_first_pass use_authtok" | pam_profile arx-pwhistory \
+                && result $id applied "A new password cannot be one of the last $n passwords." || result $id failed "Could not turn on password history (pam-auth-update)."
+        else
+            result $id skipped "Arx only changes the standard PAM setups (Ubuntu/Debian pam-auth-update, Red Hat authselect)."
+        fi
+    else
+        local any=0
+        if [ "$(saved $id feature)" = off ]; then run authselect disable-feature with-pwhistory >/dev/null 2>&1; any=1; fi
+        conf_undo $id && any=1
+        if [ "$(saved $id profile)" = off ]; then pam_profile_remove arx-pwhistory; any=1; fi
+        [ $any -eq 1 ] && result $id undone "Password history put back as it was." || result $id skipped "Nothing saved to undo."
+    fi
+}
+
+LOCK_DONE=""   # threshold, duration and observation are one pam_faillock setup (state saved as "lockout"): change it once per run
+fix_lockout() { # id
+    local id=$1 t d o; t=$(base_int LOCKOUT_THRESHOLD_MAX 5); d=$(base_int LOCKOUT_DURATION_MIN_MINUTES 15); o=$(base_int LOCKOUT_OBSERVATION_MIN_MINUTES 15)
+    [ "$t" -ge 1 ] || t=5
+    local msg="After $t wrong passwords within $o minutes the account is locked for $d minutes."
+    if [ "$ACTION" = apply ]; then
+        [ -n "$LOCK_DONE" ] && { result "$id" "$LOCK_DONE" "$msg"; return; }
+        if pam_has pam_faillock.so $PAM_AU && ! [ -e "$PAM_CONFIGS/arx-faillock" ]; then
+            if [ -n "$(grep -hsE '^[[:space:]]*auth.*pam_faillock' $PAM_AU | grep -oE '(deny|unlock_time|fail_interval)=')" ]; then
+                LOCK_DONE=skipped; result "$id" skipped "pam_faillock is set up with its own values in ${PAM_AU%% *}; change them there."; return
+            fi
+            conf_change lockout /etc/security/faillock.conf deny "$t" && conf_change lockout /etc/security/faillock.conf unlock_time $(( d * 60 )) && conf_change lockout /etc/security/faillock.conf fail_interval $(( o * 60 )) \
+                && { LOCK_DONE=applied; result "$id" applied "$msg"; } || { LOCK_DONE=failed; result "$id" failed "Could not change /etc/security/faillock.conf."; }
+        elif uses_authselect; then
+            save lockout feature off
+            run authselect enable-feature with-faillock >/dev/null 2>&1 && conf_change lockout /etc/security/faillock.conf deny "$t" \
+                && conf_change lockout /etc/security/faillock.conf unlock_time $(( d * 60 )) && conf_change lockout /etc/security/faillock.conf fail_interval $(( o * 60 )) \
+                && { LOCK_DONE=applied; result "$id" applied "$msg"; } || { LOCK_DONE=failed; result "$id" failed "Could not turn on account lockout (authselect)."; }
+        elif uses_pam_auth_update; then
+            [ -e "$PAM_CONFIGS/arx-faillock" ] || save lockout profile off
+            local args="deny=$t unlock_time=$(( d * 60 )) fail_interval=$(( o * 60 ))"
+            printf '%s\n' "Name: Arx: lock accounts after failed logins (pam_faillock)" "Default: yes" "Priority: 0" "Auth-Type: Primary" "Auth:" \
+                "	[default=die]	pam_faillock.so authfail $args" | pam_profile arx-faillock \
+            && printf '%s\n' "Name: Arx: check and reset the failed login count (pam_faillock)" "Default: yes" "Priority: 1024" "Auth-Type: Primary" "Auth:" \
+                "	requisite	pam_faillock.so preauth $args" "Account-Type: Primary" "Account:" "	required	pam_faillock.so" | pam_profile arx-faillock-notify \
+                && { LOCK_DONE=applied; result "$id" applied "$msg"; } || { LOCK_DONE=failed; result "$id" failed "Could not turn on account lockout (pam-auth-update)."; }
+        else
+            LOCK_DONE=skipped; result "$id" skipped "Arx only changes the standard PAM setups (Ubuntu/Debian pam-auth-update, Red Hat authselect)."
+        fi
+    else
+        [ -n "$LOCK_DONE" ] && { result "$id" "$LOCK_DONE" "Account lockout put back as it was."; return; }
+        local any=0
+        if [ "$(saved lockout feature)" = off ]; then run authselect disable-feature with-faillock >/dev/null 2>&1; any=1; fi
+        conf_undo lockout && any=1
+        if [ "$(saved lockout profile)" = off ] && [ -e "$PAM_CONFIGS/arx-faillock" ]; then pam_profile_remove arx-faillock arx-faillock-notify; any=1; fi
+        [ $any -eq 1 ] && LOCK_DONE=undone || LOCK_DONE=skipped
+        result "$id" "$LOCK_DONE" "$( [ $any -eq 1 ] && echo "Account lockout put back as it was." || echo "Nothing saved to undo.")"
+    fi
+}
+fix_lockout_threshold() { fix_lockout lockout.threshold; }
+fix_lockout_duration() { fix_lockout lockout.duration; }
+fix_lockout_observation() { fix_lockout lockout.observation; }
+
+# Password age: /etc/login.defs for new accounts, chage for existing accounts with a password.
+age_fix() { # id login.defs-key chage-flag shadow-field days message
+    local id=$1 key=$2 flag=$3 field=$4 n=$5
+    if [ "$ACTION" = apply ]; then
+        local was; was=$(awk -v k="$key" '$1 == k { v = $2 } END { print v }' /etc/login.defs 2>/dev/null); [[ "$was" =~ ^[0-9]{1,6}$ ]] || was=unset
+        save "$id" defs "$was"
+        if grep -qE "^[[:space:]]*$key[[:space:]]" /etc/login.defs; then
+            run sed -i -E "s/^[[:space:]]*$key[[:space:]].*\$/$key\t$n/" /etc/login.defs
+        else [ "$DRY" -eq 1 ] || printf '%s\t%s\n' "$key" "$n" >> /etc/login.defs; fi
+        local uid_min u line hash cur users=""
+        uid_min=$(awk '$1 == "UID_MIN" { print $2 }' /etc/login.defs 2>/dev/null); uid_min=${uid_min:-1000}
+        for u in $(awk -F: -v min="$uid_min" '$3 >= min && $3 < 60000 && $7 !~ /(nologin|false)$/ { print $1 }' /etc/passwd); do
+            line=$(grep "^$u:" /etc/shadow); hash=$(echo "$line" | cut -d: -f2); cur=$(echo "$line" | cut -d: -f"$field")
+            case "$hash" in '!'*|'*'*|'') continue ;; esac
+            if [ "$key" = PASS_MAX_DAYS ]; then [[ "$cur" =~ ^[0-9]+$ ]] && [ "$cur" -ge 1 ] && [ "$cur" -le "$n" ] && continue
+            else [[ "$cur" =~ ^[0-9]+$ ]] && [ "$cur" -ge "$n" ] && continue; fi
+            save "$id" "user:$u" "${cur:--1}"; run chage "$flag" "$n" "$u" && users="${users:+$users, }$u"
+        done
+        result "$id" applied "$6${users:+ Accounts updated: $users.}"
+    else
+        local any=0 u was
+        was=$(saved "$id" defs)
+        if [ "$was" = unset ]; then run sed -i -E "/^$key[[:space:]]/d" /etc/login.defs; any=1
+        elif [ -n "$was" ]; then run sed -i -E "s/^$key[[:space:]].*\$/$key\t$was/" /etc/login.defs; any=1; fi
+        for u in $(awk -F'\t' -v id="$id" '$1 == id && $2 ~ /^user:/ { print substr($2, 6) }' "$STATE" 2>/dev/null | sort -u); do
+            [[ "$u" =~ ^[a-z_][a-z0-9_.-]*\$?$ ]] || continue
+            was=$(saved "$id" "user:$u"); [ -n "$was" ] && { run chage "$flag" "$was" "$u"; any=1; }
+        done
+        [ $any -eq 1 ] && result "$id" undone "Password age settings put back as they were." || result "$id" skipped "Nothing saved to undo."
+    fi
+}
+fix_password_expiration() {
+    local n; n=$(base_int PASSWORD_MAX_AGE_DAYS 365)
+    [ "$n" -ge 1 ] || { result password.expiration skipped "The baseline does not require passwords to expire."; return; }
+    age_fix password.expiration PASS_MAX_DAYS -M 5 "$n" "Passwords now expire after $n days; a new one is asked for at login."
+}
+fix_password_min_age() { local n; n=$(base_int PASSWORD_MIN_AGE_DAYS 1); age_fix password.min_age PASS_MIN_DAYS -m 4 "$n" "A password can be changed again only after $n day(s)."; }
+
 # --- main ---------------------------------------------------------------------------------------------------
 [ "$DRY" -eq 1 ] || { touch "$STATE"; chmod 600 "$STATE"; }
 for id in "${IDS[@]}"; do
     case "$id" in
-        firewall.enabled|firewall.inbound|gdpr.auto_updates|gdpr.time_sync|gdpr.guest_account|gdpr.telemetry|account.unique_login|malware.signatures|malware.signature_updates)
+        firewall.enabled|firewall.inbound|gdpr.auto_updates|gdpr.time_sync|gdpr.guest_account|gdpr.telemetry|account.unique_login|malware.signatures|malware.signature_updates|\
+        password.min_length|password.complexity|password.history|password.expiration|password.min_age|lockout.threshold|lockout.duration|lockout.observation)
             "fix_${id//./_}" ;;
         *) result "$id" skipped "Arx has no automatic fix for this check." ;;
     esac

collectors/macos/fix.sh

@@ -2,19 +2,21 @@
 # Arx fixer for macOS: applies or undoes the one-click fixes in library/fixes.json, one tested function per fix.
 # The AI never writes these commands; the app only passes fix ids, and this script accepts only the ids below.
 #
-#   fix.sh apply --state FILE [--dry-run] ID [ID ...]   save the current values to FILE, then fix
-#   fix.sh undo  --state FILE [--dry-run] ID [ID ...]   put back the values saved in FILE
+#   fix.sh apply --state FILE [--baseline FILE] [--dry-run] ID [ID ...]   save the current values to FILE, then fix
+#   fix.sh undo  --state FILE [--baseline FILE] [--dry-run] ID [ID ...]   put back the values saved in FILE
 #
+# --baseline: baseline.conf, read for the password and lockout numbers only (digits only; never executed).
 # Needs root (the app asks with the macOS administrator prompt). Prints one line per fix:
 #   RESULT <tab> id <tab> applied|undone|unchanged|skipped|failed <tab> message
 # State lines: id <tab> key <tab> previous value (only on, off, 1, 0 or unset are ever written or read back).
 # Settings set by a configuration profile (MDM) are left alone: the profile would put them back.
 set -u
 ACTION=${1:-}; shift || true
-STATE=""; DRY=0; IDS=()
+STATE=""; BASELINE=""; DRY=0; IDS=()
 while [ $# -gt 0 ]; do
     case "$1" in
         --state) STATE=$2; shift 2 ;;
+        --baseline) BASELINE=$2; shift 2 ;;
         --dry-run) DRY=1; shift ;;
         *) IDS+=("$1"); shift ;;
     esac
@@ -22,6 +24,10 @@ done
 case "$ACTION" in apply|undo) ;; *) echo "usage: fix.sh apply|undo --state FILE [--dry-run] ID..." >&2; exit 2 ;; esac
 [ -n "$STATE" ] || { echo "--state is required" >&2; exit 2; }
 [ "$DRY" -eq 1 ] || [ "$(id -u)" -eq 0 ] || { echo "fix.sh must run as root" >&2; exit 3; }
+base_int() { # KEY default -> a whole number from baseline.conf, else the default
+    local v=""; [ -f "$BASELINE" ] && v=$(awk -F= -v k="$1" '$1 == k { v = $2 } END { print v }' "$BASELINE" 2>/dev/null | tr -d '[:space:]')
+    [[ "$v" =~ ^[0-9]{1,6}$ ]] && printf '%s' "$v" || printf '%s' "$2"
+}
 
 FW=/usr/libexec/ApplicationFirewall/socketfilterfw
 SU=/Library/Preferences/com.apple.SoftwareUpdate
@@ -163,11 +169,121 @@ fix_gdpr_time_sync() {
     fi
 }
 
+# --- account policy (pwpolicy): password rules and lockout ----------------------------------------------------
+# Arx adds its own policy entries (identifier com.devseis.arx.<id>) at the top of the global account policy, so the
+# rules already there stay in place (all rules apply together) and undo removes only Arx's entries. A copy of the
+# policy as it was before Arx first changed it is kept in <state>.pwpolicy (root only).
+PWP=""
+PWP_PROFILE="$MANAGED/com.apple.mobiledevice.passwordpolicy.plist"
+pwp_load() {
+    PWP=$(mktemp -t arx-pwpolicy) || return 1
+    pwpolicy -getaccountpolicies 2>/dev/null | sed '1{/^Getting/d;}' > "$PWP"
+    plutil -lint -s "$PWP" >/dev/null 2>&1 \
+        || printf '<?xml version="1.0" encoding="UTF-8"?>\n<plist version="1.0">\n<dict/>\n</plist>\n' > "$PWP"
+    if [ "$DRY" -eq 0 ] && [ ! -e "$STATE.pwpolicy" ]; then cp "$PWP" "$STATE.pwpolicy"; chmod 600 "$STATE.pwpolicy"; fi
+}
+pwp_remove() { # category identifier-prefix: remove Arx's entries
+    local n i id
+    n=$(plutil -extract "$1" raw -o - "$PWP" 2>/dev/null) || return 0
+    [[ "$n" =~ ^[0-9]+$ ]] || return 0
+    for (( i = n - 1; i >= 0; i-- )); do
+        id=$(plutil -extract "$1.$i.policyIdentifier" raw -o - "$PWP" 2>/dev/null)
+        case "$id" in "$2"*) plutil -remove "$1.$i" "$PWP" ;; esac
+    done
+    [ "$(plutil -extract "$1" raw -o - "$PWP" 2>/dev/null)" = 0 ] && plutil -remove "$1" "$PWP"   # no empty category left behind
+    return 0
+}
+pwp_add() { # category identifier content parameters-xml: add an entry at the top of the category
+    local content=${3//&/&amp;}; content=${content//</&lt;}; content=${content//>/&gt;}
+    plutil -extract "$1" raw -o - "$PWP" >/dev/null 2>&1 || plutil -insert "$1" -array "$PWP"
+    plutil -insert "$1.0" -xml "<dict><key>policyIdentifier</key><string>$2</string><key>policyContent</key><string>$content</string><key>policyParameters</key><dict>$4</dict></dict>" "$PWP"
+}
+pwp_commit() { # identifier that must (apply) or must not (undo) be in the policy afterwards
+    local ok=0
+    if [ "$DRY" -eq 1 ]; then echo "DRY: pwpolicy -setaccountpolicies $(plutil -convert xml1 -o - "$PWP" | grep -c policyIdentifier) entries" >&2; rm -f "$PWP"; return 0; fi
+    pwpolicy -setaccountpolicies "$PWP" >/dev/null 2>&1 || ok=1
+    rm -f "$PWP"
+    [ $ok -eq 0 ] || return 1
+    if [ "$ACTION" = apply ]; then pwpolicy -getaccountpolicies 2>/dev/null | grep -q "<string>$1"
+    else ! pwpolicy -getaccountpolicies 2>/dev/null | grep -q "<string>$1"; fi
+}
+pw_fix() { # id category identifier content parameters-xml message
+    local id=$1
+    [ -e "$PWP_PROFILE" ] && { result "$id" skipped "Managed by your organisation's profile."; return; }
+    pwp_load || { result "$id" failed "Could not read the account policy."; return; }
+    pwp_remove "$2" "$3"
+    if [ "$ACTION" = apply ]; then
+        save "$id" policy 1
+        pwp_add "$2" "$3" "$4" "$5"
+        pwp_commit "$3" && result "$id" applied "$6" || result "$id" failed "Could not change the account policy."
+    else
+        [ "$(saved "$id" policy)" = 1 ] || { rm -f "$PWP"; result "$id" skipped "Nothing saved to undo."; return; }
+        pwp_commit "$3" && result "$id" undone "Arx's rule removed; the account policy is back as it was." || result "$id" failed "Could not change the account policy."
+    fi
+}
+ARX=com.devseis.arx
+fix_password_min_length() {
+    local n; n=$(base_int PASSWORD_MIN_LENGTH 14)
+    pw_fix password.min_length policyCategoryPasswordContent "$ARX.password.min_length" "policyAttributePassword matches '.{$n,}+'" \
+        "<key>minimumLength</key><integer>$n</integer>" "New passwords must have at least $n characters. Current passwords keep working until they are changed."
+}
+fix_password_complexity() { # two rules (a letter, a number) under one identifier prefix
+    local id=password.complexity p=$ARX.password.complexity
+    [ -e "$PWP_PROFILE" ] && { result $id skipped "Managed by your organisation's profile."; return; }
+    pwp_load || { result $id failed "Could not read the account policy."; return; }
+    pwp_remove policyCategoryPasswordContent "$p"
+    if [ "$ACTION" = apply ]; then
+        save $id policy 1
+        pwp_add policyCategoryPasswordContent "$p.numeric" "policyAttributePassword matches '.*[0-9].*'" ""
+        pwp_add policyCategoryPasswordContent "$p.alpha" "policyAttributePassword matches '.*[A-Za-z].*'" ""
+        pwp_commit "$p" && result $id applied "New passwords must contain letters and numbers." || result $id failed "Could not change the account policy."
+    else
+        [ "$(saved $id policy)" = 1 ] || { rm -f "$PWP"; result $id skipped "Nothing saved to undo."; return; }
+        pwp_commit "$p" && result $id undone "Arx's rule removed; the account policy is back as it was." || result $id failed "Could not change the account policy."
+    fi
+}
+fix_password_history() {
+    local n; n=$(base_int PASSWORD_HISTORY 24)
+    pw_fix password.history policyCategoryPasswordContent "$ARX.password.history" "none policyAttributePasswordHashes in policyAttributePasswordHistory" \
+        "<key>policyAttributePasswordHistoryDepth</key><integer>$n</integer>" "A new password cannot be one of the last $n passwords."
+}
+fix_password_expiration() {
+    local n; n=$(base_int PASSWORD_MAX_AGE_DAYS 365)
+    [ "$n" -ge 1 ] || { result password.expiration skipped "The baseline does not require passwords to expire."; return; }
+    pw_fix password.expiration policyCategoryPasswordChange "$ARX.password.expiration" \
+        "policyAttributeCurrentTime > policyAttributeLastPasswordChangeTime + (policyAttributeExpiresEveryNDays * 24 * 60 * 60)" \
+        "<key>policyAttributeExpiresEveryNDays</key><integer>$n</integer>" "Passwords now expire after $n days; macOS asks for a new one at login."
+}
+fix_lockout() { # id: threshold, duration and observation are one macOS rule (the count resets when the lockout ends)
+    local t d o; t=$(base_int LOCKOUT_THRESHOLD_MAX 5); d=$(base_int LOCKOUT_DURATION_MIN_MINUTES 15); o=$(base_int LOCKOUT_OBSERVATION_MIN_MINUTES 15)
+    [ "$t" -ge 1 ] || t=5; [ "$o" -gt "$d" ] && d=$o
+    pw_fix "$1" policyCategoryAuthentication "$ARX.lockout" \
+        "(policyAttributeFailedAuthentications < policyAttributeMaximumFailedAuthentications) OR (policyAttributeCurrentTime > (policyAttributeLastFailedAuthenticationTime + autoEnableInSeconds))" \
+        "<key>policyAttributeMaximumFailedAuthentications</key><integer>$t</integer><key>autoEnableInSeconds</key><integer>$(( d * 60 ))</integer>" \
+        "After $t wrong passwords the account is locked for $d minutes."
+}
+fix_lockout_threshold() { fix_lockout lockout.threshold; }
+fix_lockout_duration() { fix_lockout lockout.duration; }
+fix_lockout_observation() { fix_lockout lockout.observation; }
+
+# --- automatic login ------------------------------------------------------------------------------------------
+fix_account_unique_login() { # turns off automatic login only; shared accounts need a person to decide
+    local id=account.unique_login
+    [ "$ACTION" = undo ] && { result $id unchanged "Not undone: Arx does not keep a copy of the saved login password. Turn automatic login on again in Users & Groups if you need it."; return; }
+    managed com.apple.loginwindow autoLoginUser && { result $id skipped "Managed by your organisation's profile."; return; }
+    local user; user=$(defaults read "$LW" autoLoginUser 2>/dev/null)
+    [ -n "$user" ] || { result $id unchanged "Automatic login was already off. Shared accounts need a decision by a person (see the report)."; return; }
+    run defaults delete "$LW" autoLoginUser && run rm -f /etc/kcpassword \
+        && result $id applied "Automatic login turned off and the saved login password removed. Shared accounts (if any) still need a decision by a person." \
+        || result $id failed "Could not turn off automatic login."
+}
+
 # --- main ---------------------------------------------------------------------------------------------------
 [ "$DRY" -eq 1 ] || { touch "$STATE"; chmod 600 "$STATE"; }
 for id in "${IDS[@]}"; do
     case "$id" in
-        firewall.enabled|firewall.inbound|malware.service|malware.signatures|malware.signature_updates|gdpr.auto_updates|gdpr.guest_account|gdpr.telemetry|gdpr.time_sync)
+        firewall.enabled|firewall.inbound|malware.service|malware.signatures|malware.signature_updates|gdpr.auto_updates|gdpr.guest_account|gdpr.telemetry|gdpr.time_sync|\
+        password.min_length|password.complexity|password.history|password.expiration|lockout.threshold|lockout.duration|lockout.observation|account.unique_login)
             "fix_${id//./_}" "$ACTION" ;;
         *) result "$id" skipped "Arx has no automatic fix for this check." ;;
     esac

collectors/windows/fix.ps1

@@ -0,0 +1,382 @@
+<#
+.SYNOPSIS
+    Arx fixer for Windows: applies or undoes the one-click fixes in library/fixes.json, one tested function per fix.
+
+.DESCRIPTION
+    The AI never writes these commands; the app only passes fix ids, and this script accepts only the ids below.
+
+      fix.ps1 -Action apply -State FILE -Results FILE [-Baseline FILE] [-DryRun] -Ids ID,ID...
+      fix.ps1 -Action undo  -State FILE -Results FILE [-Baseline FILE] [-DryRun] -Ids ID,ID...
+
+    Needs an elevated PowerShell (the app asks with the User Account Control prompt). Writes one line per fix to -Results:
+      RESULT <tab> id <tab> applied|undone|unchanged|skipped|failed <tab> message
+    State lines: id <tab> key <tab> previous value. Only whole numbers and a short list of known words are ever read back.
+    Settings set by Group Policy or a domain are left alone: the policy would put them back.
+    Works with Windows PowerShell 5.1 and PowerShell 7.
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)][ValidateSet('apply', 'undo')][string]$Action,
+    [Parameter(Mandatory = $true)][string]$State,
+    [Parameter(Mandatory = $true)][string]$Results,
+    [string]$Baseline = '',
+    [switch]$DryRun,
+    [string[]]$Ids = @()
+)
+
+Set-StrictMode -Version 2.0
+$ErrorActionPreference = 'Stop'
+
+$Identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$IsAdmin = (New-Object Security.Principal.WindowsPrincipal($Identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+if (-not $DryRun -and -not $IsAdmin) { throw 'fix.ps1 must run elevated (as administrator).' }
+
+# --- helpers -------------------------------------------------------------------------------------------------
+$Utf8 = New-Object System.Text.UTF8Encoding($false)
+function Result([string]$Id, [string]$Outcome, [string]$Message) { [IO.File]::AppendAllText($Results, "RESULT`t$Id`t$Outcome`t$Message`n", $Utf8) }
+function Save([string]$Id, [string]$Key, $Value) {
+    if ($DryRun) { return }
+    $v = "$Value"; if ($null -eq $Value -or $v -eq '') { $v = 'unset' }
+    [IO.File]::AppendAllText($State, "$Id`t$Key`t$v`n", $Utf8)
+}
+# The value saved at apply time (last one wins), only if it is one of the known safe forms.
+function Saved([string]$Id, [string]$Key) {
+    if (-not (Test-Path -LiteralPath $State)) { return $null }
+    $v = $null
+    foreach ($line in [IO.File]::ReadAllLines($State)) {
+        $parts = $line -split "`t"
+        if ($parts.Count -eq 3 -and $parts[0] -eq $Id -and $parts[1] -eq $Key) { $v = $parts[2] }
+    }
+    if ($null -ne $v -and $v -match '^(-?\d{1,6}|unset|on|off|True|False|NotConfigured|Block|Allow|Disabled|Manual|Automatic|NTP|NT5DS|AllSync|NoSync)$') { return $v }
+    return $null
+}
+function Run([string]$What, [scriptblock]$Do) { if ($DryRun) { Write-Host "DRY: $What" } else { & $Do } }
+function Get-RegValue([string]$Path, [string]$Name) {
+    try { return (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop).$Name } catch { return $null }
+}
+function Set-RegDword([string]$Path, [string]$Name, $Value) { # $Value 'unset' deletes the value
+    Run "set $Path\$Name = $Value" {
+        if ("$Value" -eq 'unset') { Remove-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue; return }
+        if (-not (Test-Path -LiteralPath $Path)) { $null = New-Item -Path $Path -Force }
+        $null = New-ItemProperty -LiteralPath $Path -Name $Name -Value ([int]$Value) -PropertyType DWord -Force
+    }
+}
+function Read-Conf([string]$Path) {
+    $conf = @{}
+    if ($Path -and (Test-Path -LiteralPath $Path)) {
+        foreach ($line in Get-Content -LiteralPath $Path) {
+            if ($line -match '^\s*#' -or $line -notmatch '=') { continue }
+            $parts = $line -split '=', 2
+            $conf[$parts[0].Trim()] = $parts[1].Trim().Trim('"')
+        }
+    }
+    return $conf
+}
+$Conf = Read-Conf $Baseline
+function BaseInt([string]$Key, [int]$Default) { # a whole number from baseline.conf, else the default
+    if ($Conf.ContainsKey($Key) -and $Conf[$Key] -match '^\d{1,6}$') { return [int]$Conf[$Key] }
+    return $Default
+}
+function BaseWord([string]$Key, [string]$Default) { if ($Conf.ContainsKey($Key) -and $Conf[$Key]) { return $Conf[$Key].ToLower() } else { return $Default } }
+$OnDomain = $false
+try { $OnDomain = [bool](Get-CimInstance Win32_ComputerSystem).PartOfDomain } catch { }
+
+# --- local security policy (secedit): passwords and lockout ----------------------------------------------------
+function Get-SecPolicy {
+    $tmp = Join-Path $env:TEMP ("arx_secpol_{0}.inf" -f [guid]::NewGuid())
+    try {
+        $null = & secedit.exe /export /cfg $tmp /areas SECURITYPOLICY /quiet
+        $policy = @{}
+        foreach ($line in Get-Content -LiteralPath $tmp) {
+            if ($line -match '^\s*([A-Za-z]+)\s*=\s*(-?\d+)\s*$') { $policy[$Matches[1]] = [int]$Matches[2] }
+        }
+        return $policy
+    } finally { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue }
+}
+function Set-SecPolicy([System.Collections.Specialized.OrderedDictionary]$Values) {
+    $lines = @('[Unicode]', 'Unicode=yes', '[System Access]')
+    foreach ($k in $Values.Keys) { $lines += "$k = $($Values[$k])" }
+    $lines += @('[Version]', 'signature="$CHICAGO$"', 'Revision=1')
+    if ($DryRun) { Write-Host ("DRY: secedit /configure " + (($Values.Keys | ForEach-Object { "$_=$($Values[$_])" }) -join ' ')); return $true }
+    $inf = Join-Path $env:TEMP ("arx_fix_{0}.inf" -f [guid]::NewGuid())
+    $db = Join-Path $env:TEMP ("arx_fix_{0}.sdb" -f [guid]::NewGuid())
+    try {
+        [IO.File]::WriteAllLines($inf, $lines, [Text.Encoding]::Unicode)
+        $null = & secedit.exe /configure /db $db /cfg $inf /areas SECURITYPOLICY /quiet
+        $now = Get-SecPolicy
+        foreach ($k in $Values.Keys) { if ($now[$k] -ne [int]$Values[$k]) { return $false } }
+        return $true
+    } finally { Remove-Item -LiteralPath $inf, $db, ($db -replace '\.sdb$', '.jfm') -Force -ErrorAction SilentlyContinue }
+}
+# One security-policy fix: $Want maps policy keys to the values to set; the old values are saved under $StateId.
+function SecFix([string]$Id, [string]$StateId, [System.Collections.Specialized.OrderedDictionary]$Want, [string]$Message) {
+    if ($OnDomain) { Result $Id 'skipped' 'This computer is in a domain: password and lockout rules come from domain policy. Ask your IT team.'; return }
+    $now = Get-SecPolicy
+    if ($Action -eq 'apply') {
+        $change = $false
+        foreach ($k in $Want.Keys) { if ($now[$k] -ne [int]$Want[$k]) { $change = $true } }
+        if (-not $change) { Result $Id 'unchanged' 'Already set.'; return }
+        foreach ($k in $Want.Keys) { if ($null -eq (Saved $StateId $k)) { Save $StateId $k $now[$k] } }
+        if (Set-SecPolicy $Want) { Result $Id 'applied' $Message } else { Result $Id 'failed' 'Windows did not accept the new security policy.' }
+    } else {
+        $back = [ordered]@{}
+        foreach ($k in $Want.Keys) { $was = Saved $StateId $k; if ($null -ne $was -and $was -ne 'unset') { $back[$k] = [int]$was } }
+        if ($back.Count -eq 0) { Result $Id 'skipped' 'Nothing saved to undo.'; return }
+        # Lockout back to "off": put the durations back while the threshold is still on (Windows refuses them
+        # with a threshold of 0), then the threshold.
+        if ($back.Contains('LockoutBadCount') -and $back['LockoutBadCount'] -eq 0 -and $back.Count -gt 1) {
+            $durations = [ordered]@{}; foreach ($k in $back.Keys) { if ($k -ne 'LockoutBadCount') { $durations[$k] = $back[$k] } }
+            $null = Set-SecPolicy $durations
+            $back = [ordered]@{ LockoutBadCount = 0 }
+        }
+        if (Set-SecPolicy $back) { Result $Id 'undone' 'Policy put back as it was.' } else { Result $Id 'failed' 'Windows did not accept the old security policy.' }
+    }
+}
+function Fix-PasswordMinLength {
+    $n = BaseInt 'PASSWORD_MIN_LENGTH' 14
+    if ($n -gt 14) { Result 'password.min_length' 'skipped' 'Windows local policy allows at most 14 characters here; set longer minimums with Group Policy.'; return }
+    SecFix 'password.min_length' 'password.min_length' ([ordered]@{ MinimumPasswordLength = $n }) "New passwords must have at least $n characters. Current passwords keep working until they are changed."
+}
+function Fix-PasswordHistory {
+    $n = [Math]::Min((BaseInt 'PASSWORD_HISTORY' 24), 24)
+    SecFix 'password.history' 'password.history' ([ordered]@{ PasswordHistorySize = $n }) "A new password cannot be one of the last $n passwords."
+}
+function Fix-PasswordExpiration {
+    $n = BaseInt 'PASSWORD_MAX_AGE_DAYS' 365
+    if ($n -lt 1) { Result 'password.expiration' 'skipped' 'The baseline does not require passwords to expire.'; return }
+    SecFix 'password.expiration' 'password.expiration' ([ordered]@{ MaximumPasswordAge = [Math]::Min($n, 998) }) "Passwords now expire after $n days; Windows asks for a new one at sign-in. Microsoft accounts are not affected."
+}
+function Fix-PasswordMinAge {
+    $n = BaseInt 'PASSWORD_MIN_AGE_DAYS' 1
+    SecFix 'password.min_age' 'password.min_age' ([ordered]@{ MinimumPasswordAge = $n }) "A password can be changed again only after $n day(s)."
+}
+function Fix-PasswordComplexity {
+    SecFix 'password.complexity' 'password.complexity' ([ordered]@{ PasswordComplexity = 1 }) 'New passwords must use three of: upper case, lower case, digits, symbols.'
+}
+$LockDone = @{}   # threshold, duration and observation are one lockout policy (state saved as "lockout"): change it once per run
+function Fix-Lockout([string]$Id) {
+    if ($LockDone.Count) { Result $Id $LockDone.Outcome $LockDone.Message; return }
+    $t = BaseInt 'LOCKOUT_THRESHOLD_MAX' 5; if ($t -lt 1) { $t = 5 }
+    $d = BaseInt 'LOCKOUT_DURATION_MIN_MINUTES' 15; $o = BaseInt 'LOCKOUT_OBSERVATION_MIN_MINUTES' 15
+    if ($o -gt $d) { $d = $o }   # Windows requires the reset time to be no longer than the lockout
+    SecFix $Id 'lockout' ([ordered]@{ LockoutBadCount = $t; LockoutDuration = $d; ResetLockoutCount = $o }) "After $t wrong passwords within $o minutes the account is locked for $d minutes."
+    $last = @(Get-Content -LiteralPath $Results -Encoding UTF8)[-1] -split "`t"
+    if ($last.Count -ge 4) { $LockDone.Outcome = $last[2]; $LockDone.Message = $last[3] }
+}
+
+# --- firewall ------------------------------------------------------------------------------------------------
+$FwPolicyKey = @{ Domain = 'DomainProfile'; Private = 'StandardProfile'; Public = 'PublicProfile' }
+function Fix-Firewall([string]$ProfileName, [bool]$Inbound) {
+    $id = "firewall.$($ProfileName.ToLower()).$(if ($Inbound) { 'inbound' } else { 'enabled' })"
+    $gpo = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\$($FwPolicyKey[$ProfileName])"
+    if ($null -ne (Get-RegValue $gpo 'EnableFirewall') -or ($Inbound -and $null -ne (Get-RegValue $gpo 'DefaultInboundAction'))) {
+        Result $id 'skipped' 'Managed by Group Policy.'; return
+    }
+    $p = Get-NetFirewallProfile -Name $ProfileName -PolicyStore PersistentStore
+    if ($Action -eq 'apply') {
+        $en = "$($p.Enabled)"; $in = "$($p.DefaultInboundAction)"
+        if ($en -eq 'True' -and (-not $Inbound -or $in -ne 'Allow')) { Result $id 'unchanged' 'Already on.'; return }
+        Save $id 'enabled' $en; if ($Inbound) { Save $id 'inbound' $in }
+        Run "Set-NetFirewallProfile $ProfileName on$(if ($Inbound) { ', inbound Block' })" {
+            if ($Inbound) { Set-NetFirewallProfile -Name $ProfileName -Enabled True -DefaultInboundAction Block } else { Set-NetFirewallProfile -Name $ProfileName -Enabled True }
+        }
+        Result $id 'applied' $(if ($Inbound) { "$ProfileName firewall on and blocking unsolicited incoming connections. Apps you already allowed keep working." } else { "$ProfileName firewall turned on." })
+    } else {
+        $en = Saved $id 'enabled'; $in = Saved $id 'inbound'
+        if (-not $en) { Result $id 'skipped' 'Nothing saved to undo.'; return }
+        Run "Set-NetFirewallProfile $ProfileName Enabled=$en Inbound=$in" {
+            if ($in) { Set-NetFirewallProfile -Name $ProfileName -Enabled $en -DefaultInboundAction $in } else { Set-NetFirewallProfile -Name $ProfileName -Enabled $en }
+        }
+        Result $id 'undone' "$ProfileName firewall put back as it was."
+    }
+}
+
+# --- Microsoft Defender --------------------------------------------------------------------------------------
+$DefenderPolicy = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender'
+function Fix-Realtime([string]$Id) { # real-time and on-access protection are switched together
+    if ($null -ne (Get-RegValue "$DefenderPolicy\Real-Time Protection" 'DisableRealtimeMonitoring') -or $null -ne (Get-RegValue $DefenderPolicy 'DisableAntiSpyware')) {
+        Result $Id 'skipped' 'Managed by Group Policy.'; return
+    }
+    $pref = Get-MpPreference
+    if ($Action -eq 'apply') {
+        if (-not $pref.DisableRealtimeMonitoring -and -not $pref.DisableIOAVProtection) { Result $Id 'unchanged' 'Real-time protection was already on.'; return }
+        Save $Id 'realtime_off' "$($pref.DisableRealtimeMonitoring)"; Save $Id 'ioav_off' "$($pref.DisableIOAVProtection)"
+        Run 'Set-MpPreference real-time protection on' { Set-MpPreference -DisableRealtimeMonitoring $false -DisableIOAVProtection $false }
+        if ($DryRun -or (Get-MpComputerStatus).RealTimeProtectionEnabled) { Result $Id 'applied' 'Real-time protection turned on.' }
+        else { Result $Id 'failed' 'Windows did not turn real-time protection on. Open Windows Security > Virus & threat protection.' }
+    } else {
+        $rt = Saved $Id 'realtime_off'; $io = Saved $Id 'ioav_off'
+        if (-not $rt) { Result $Id 'skipped' 'Nothing saved to undo.'; return }
+        Run "Set-MpPreference DisableRealtimeMonitoring=$rt" { Set-MpPreference -DisableRealtimeMonitoring ($rt -eq 'True') -DisableIOAVProtection ($io -eq 'True') }
+        Result $Id 'undone' 'Real-time protection put back as it was (Tamper Protection may keep it on).'
+    }
+}
+function Fix-Signatures {
+    if ($Action -eq 'undo') { Result 'malware.signatures' 'unchanged' 'Security intelligence updates are not undone.'; return }
+    try { Run 'Update-MpSignature' { Update-MpSignature -ErrorAction Stop }; Result 'malware.signatures' 'applied' 'Microsoft Defender security intelligence updated.' }
+    catch { Result 'malware.signatures' 'failed' "The update did not finish: $($_.Exception.Message)" }
+}
+
+# --- registry-based fixes ------------------------------------------------------------------------------------
+# One fix that sets DWORD registry values; $Values: list of @(path, name, value). Old values saved per name.
+function RegFix([string]$Id, [string]$StateId, [object[]]$Values, [string]$Message) {
+    if ($Action -eq 'apply') {
+        $change = $false
+        foreach ($v in $Values) { if ("$(Get-RegValue $v[0] $v[1])" -ne "$($v[2])") { $change = $true } }
+        if (-not $change) { Result $Id 'unchanged' 'Already set.'; return }
+        foreach ($v in $Values) { if ($null -eq (Saved $StateId $v[1])) { Save $StateId $v[1] (Get-RegValue $v[0] $v[1]) } }
+        foreach ($v in $Values) { Set-RegDword $v[0] $v[1] $v[2] }
+        Result $Id 'applied' $Message
+    } else {
+        $any = $false
+        foreach ($v in $Values) { $was = Saved $StateId $v[1]; if ($null -ne $was) { Set-RegDword $v[0] $v[1] $was; $any = $true } }
+        if ($any) { Result $Id 'undone' 'Settings put back as they were.' } else { Result $Id 'skipped' 'Nothing saved to undo.' }
+    }
+}
+$SysPolicy = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
+$ScreenDone = @{}   # the three screen lock checks share one setting: change it once per run
+function Fix-ScreenLock([string]$Id) {
+    if ($ScreenDone.Count) { Result $Id $ScreenDone.Outcome $ScreenDone.Message; return }
+    $n = BaseInt 'SCREEN_LOCK_MAX_SECONDS' 300; if ($n -lt 60) { $n = 60 }
+    $current = Get-RegValue $SysPolicy 'InactivityTimeoutSecs'
+    if ($Action -eq 'apply' -and $null -ne $current -and [int]$current -gt 0 -and [int]$current -lt $n) { $n = [int]$current }
+    $values = @(, @($SysPolicy, 'InactivityTimeoutSecs', $n))
+    if ($null -ne (Get-RegValue $SysPolicy 'DisableLockWorkstation') -or $Action -eq 'undo') { $values += , @($SysPolicy, 'DisableLockWorkstation', 0) }
+    RegFix $Id 'screen_lock' $values "Windows now locks after $n seconds without input and asks for the password. Takes effect after the next restart."
+    $last = @(Get-Content -LiteralPath $Results -Encoding UTF8)[-1] -split "`t"
+    if ($last.Count -ge 4) { $ScreenDone.Outcome = $last[2]; $ScreenDone.Message = $last[3] }
+}
+function Fix-Telemetry {
+    RegFix 'gdpr.telemetry' 'gdpr.telemetry' @(, @('HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection', 'AllowTelemetry', 1)) 'Windows now sends only required diagnostic data to Microsoft.'
+}
+function Fix-AiFeatures {
+    RegFix 'aiact.os_ai_features' 'aiact.os_ai_features' @(, @('HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI', 'DisableAIDataAnalysis', 1)) 'Windows Recall (saving and analysing snapshots of the screen) is turned off by policy.'
+}
+$UsbDisk = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
+function Fix-UsbWrite([string]$Id) {
+    if ($Action -eq 'apply' -and (BaseWord 'USB_WRITE' 'deny') -ne 'deny') { Result $Id 'skipped' 'The baseline allows writing to USB drives (USB_WRITE=allow); change it there first.'; return }
+    RegFix $Id 'usb.write' @(, @($UsbDisk, 'Deny_Write', 1)) 'Writing to USB drives is blocked; reading still works. Plug drives in again for the change to apply.'
+}
+function Fix-AutoUpdates {
+    $id = 'gdpr.auto_updates'; $au = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'
+    $svc = Get-Service -Name wuauserv
+    if ($Action -eq 'apply') {
+        $values = @()
+        if ((Get-RegValue $au 'NoAutoUpdate') -eq 1) { $values += , @($au, 'NoAutoUpdate', 'unset') }
+        $option = Get-RegValue $au 'AUOptions'; if ($null -ne $option -and [int]$option -lt 3) { $values += , @($au, 'AUOptions', 4) }
+        $svcOff = "$($svc.StartType)" -eq 'Disabled'
+        if (-not $values.Count -and -not $svcOff) { Result $id 'unchanged' 'Automatic updates were already on.'; return }
+        foreach ($v in $values) { Save $id $v[1] (Get-RegValue $v[0] $v[1]); Set-RegDword $v[0] $v[1] $v[2] }
+        if ($svcOff) { Save $id 'service' 'Disabled'; Run 'Set-Service wuauserv Manual' { Set-Service -Name wuauserv -StartupType Manual } }
+        Result $id 'applied' 'Windows Update now downloads and installs updates automatically.'
+    } else {
+        $any = $false
+        foreach ($name in 'NoAutoUpdate', 'AUOptions') { $was = Saved $id $name; if ($null -ne $was) { Set-RegDword $au $name $was; $any = $true } }
+        if ((Saved $id 'service') -eq 'Disabled') { Run 'Set-Service wuauserv Disabled' { Set-Service -Name wuauserv -StartupType Disabled }; $any = $true }
+        if ($any) { Result $id 'undone' 'Update settings put back as they were.' } else { Result $id 'skipped' 'Nothing saved to undo.' }
+    }
+}
+function Fix-TimeSync {
+    $id = 'gdpr.time_sync'; $params = 'HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters'
+    $svc = Get-Service -Name W32Time
+    if ($Action -eq 'apply') {
+        $type = "$(Get-RegValue $params 'Type')"; $start = "$($svc.StartType)"
+        if ($type -and $type -ne 'NoSync' -and $start -ne 'Disabled') { Result $id 'unchanged' 'Time synchronisation was already on.'; return }
+        Save $id 'type' $type; Save $id 'start' $start
+        Run 'W32Time: Type=NTP, start automatically, resync' {
+            if (-not $type -or $type -eq 'NoSync') { Set-ItemProperty -LiteralPath $params -Name Type -Value 'NTP' }
+            Set-Service -Name W32Time -StartupType Automatic
+            Restart-Service -Name W32Time -Force
+            $null = & w32tm.exe /resync /nowait
+        }
+        Result $id 'applied' "The clock now sets itself from the internet time server."
+    } else {
+        $type = Saved $id 'type'; $start = Saved $id 'start'
+        if (-not $start) { Result $id 'skipped' 'Nothing saved to undo.'; return }
+        Run "W32Time: Type=$type, start $start" {
+            if ($type -and $type -ne 'unset') { Set-ItemProperty -LiteralPath $params -Name Type -Value $type }
+            Set-Service -Name W32Time -StartupType $start
+            if ($start -eq 'Disabled') { Stop-Service -Name W32Time -Force -ErrorAction SilentlyContinue }
+        }
+        Result $id 'undone' 'Time synchronisation put back as it was.'
+    }
+}
+function Fix-Guest {
+    $id = 'gdpr.guest_account'
+    $guest = Get-LocalUser | Where-Object { $_.SID.Value -match '-501$' } | Select-Object -First 1
+    if (-not $guest) { Result $id 'unchanged' 'There is no guest account.'; return }
+    if ($Action -eq 'apply') {
+        if (-not $guest.Enabled) { Result $id 'unchanged' 'The guest account was already off.'; return }
+        Save $id 'enabled' 'on'
+        Run 'Disable-LocalUser Guest' { Disable-LocalUser -SID $guest.SID }
+        Result $id 'applied' 'Guest account turned off.'
+    } else {
+        if ((Saved $id 'enabled') -ne 'on') { Result $id 'skipped' 'Nothing saved to undo.'; return }
+        Run 'Enable-LocalUser Guest' { Enable-LocalUser -SID $guest.SID }
+        Result $id 'undone' 'Guest account turned on again.'
+    }
+}
+function Fix-AutoLogin { # turns off automatic sign-in only; shared accounts need a person to decide
+    $id = 'account.unique_login'; $wl = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'
+    if ($Action -eq 'undo') { Result $id 'unchanged' 'Not undone: Arx does not keep the saved sign-in password. Set up automatic sign-in again if you need it.'; return }
+    if ("$(Get-RegValue $wl 'AutoAdminLogon')" -ne '1') { Result $id 'unchanged' 'Automatic sign-in was already off. Shared accounts need a decision by a person (see the report).'; return }
+    Run 'Winlogon: AutoAdminLogon=0, remove DefaultPassword' {
+        Set-ItemProperty -LiteralPath $wl -Name AutoAdminLogon -Value '0'
+        Remove-ItemProperty -LiteralPath $wl -Name DefaultPassword -ErrorAction SilentlyContinue
+    }
+    Result $id 'applied' 'Automatic sign-in turned off and the stored sign-in password removed. Shared accounts (if any) still need a decision by a person.'
+}
+# Advanced audit policy: logon (success + failure) and user account management (success).
+$AuditSub = [ordered]@{ logon = '{0CCE9215-69AE-11D9-BED3-505054503030}'; account = '{0CCE9235-69AE-11D9-BED3-505054503030}' }
+function Get-AuditValue([string]$Guid) {
+    $tmp = Join-Path $env:TEMP ("arx_audit_{0}.csv" -f [guid]::NewGuid()); $r = $null
+    try { $null = & auditpol.exe /backup /file:$tmp; $r = Import-Csv -LiteralPath $tmp | Where-Object { $_.'Subcategory GUID' -eq $Guid } | Select-Object -First 1 }
+    finally { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue }
+    if ($r) { return [int]$r.'Setting Value' } else { return 0 }
+}
+function Set-AuditValue([string]$Guid, [int]$Value) {
+    $s = if ($Value -band 1) { 'enable' } else { 'disable' }; $f = if ($Value -band 2) { 'enable' } else { 'disable' }
+    Run "auditpol $Guid success:$s failure:$f" { $null = & auditpol.exe /set /subcategory:$Guid /success:$s /failure:$f }
+}
+function Fix-SecurityLogging {
+    $id = 'gdpr.security_logging'
+    if ($Action -eq 'apply') {
+        $logon = Get-AuditValue $AuditSub.logon; $account = Get-AuditValue $AuditSub.account
+        if ($logon -eq 3 -and ($account -band 1)) { Result $id 'unchanged' 'Already audited.'; return }
+        Save $id 'logon' $logon; Save $id 'account' $account
+        Set-AuditValue $AuditSub.logon 3; Set-AuditValue $AuditSub.account ($account -bor 1)
+        Result $id 'applied' 'Windows now records sign-ins (successful and failed) and changes to user accounts in the Security log.'
+    } else {
+        $logon = Saved $id 'logon'; $account = Saved $id 'account'
+        if ($null -eq $logon) { Result $id 'skipped' 'Nothing saved to undo.'; return }
+        Set-AuditValue $AuditSub.logon ([int]$logon); if ($null -ne $account) { Set-AuditValue $AuditSub.account ([int]$account) }
+        Result $id 'undone' 'Audit settings put back as they were.'
+    }
+}
+
+# --- main ----------------------------------------------------------------------------------------------------
+$Fixes = [ordered]@{
+    'password.min_length' = { Fix-PasswordMinLength }; 'password.history' = { Fix-PasswordHistory }
+    'password.expiration' = { Fix-PasswordExpiration }; 'password.min_age' = { Fix-PasswordMinAge }
+    'password.complexity' = { Fix-PasswordComplexity }
+    'lockout.threshold' = { Fix-Lockout 'lockout.threshold' }; 'lockout.duration' = { Fix-Lockout 'lockout.duration' }
+    'lockout.observation' = { Fix-Lockout 'lockout.observation' }
+    'firewall.domain.enabled' = { Fix-Firewall 'Domain' $false }; 'firewall.private.enabled' = { Fix-Firewall 'Private' $false }
+    'firewall.public.enabled' = { Fix-Firewall 'Public' $false }; 'firewall.domain.inbound' = { Fix-Firewall 'Domain' $true }
+    'firewall.private.inbound' = { Fix-Firewall 'Private' $true }; 'firewall.public.inbound' = { Fix-Firewall 'Public' $true }
+    'malware.realtime' = { Fix-Realtime 'malware.realtime' }; 'malware.on_access' = { Fix-Realtime 'malware.on_access' }
+    'malware.signatures' = { Fix-Signatures }
+    'screen_lock.enabled' = { Fix-ScreenLock 'screen_lock.enabled' }; 'screen_lock.timeout' = { Fix-ScreenLock 'screen_lock.timeout' }
+    'screen_lock.password' = { Fix-ScreenLock 'screen_lock.password' }
+    'gdpr.telemetry' = { Fix-Telemetry }; 'gdpr.auto_updates' = { Fix-AutoUpdates }; 'gdpr.time_sync' = { Fix-TimeSync }
+    'gdpr.guest_account' = { Fix-Guest }; 'account.unique_login' = { Fix-AutoLogin }; 'gdpr.security_logging' = { Fix-SecurityLogging }
+    'usb.write' = { Fix-UsbWrite 'usb.write' }; 'gdpr.removable_encryption' = { Fix-UsbWrite 'gdpr.removable_encryption' }
+    'aiact.os_ai_features' = { Fix-AiFeatures }
+}
+if (-not $DryRun) {
+    if (-not (Test-Path -LiteralPath $State)) { [IO.File]::WriteAllText($State, '', $Utf8) }
+}
+foreach ($id in $Ids) {
+    if (-not $Fixes.Contains($id)) { Result $id 'skipped' 'Arx has no automatic fix for this check.'; continue }
+    try { & $Fixes[$id] } catch { Result $id 'failed' "$($_.Exception.Message)" }
+}

index.html

@@ -60,7 +60,7 @@
         <label class="btn" for="reportFile" title="Open the …-evidence.json file Arx saves next to each report">Open a report</label>
         <input type="file" id="reportFile" accept=".json,application/json" hidden>
       </div>
-      <p class="tiny muted" id="heroMeta">Free · open source · version 0.5.5</p>
+      <p class="tiny muted" id="heroMeta">Free · open source · version 0.5.6</p>
     </section>
 
     <section class="wrap">
@@ -82,7 +82,7 @@
       <ol class="steps">
         <li><span class="step-n">1</span><div><b>Install with one command</b><p class="muted">Copy the command for your system, paste it in Terminal (PowerShell on Windows) and press Return. Arx installs and opens: no warning to get past.</p></div></li>
         <li><span class="step-n">2</span><div><b>Run the audit</b><p class="muted">The audit only reads settings: nothing changes unless you later click Fix. The first run downloads the AI once; after that it works offline.</p></div></li>
-        <li><span class="step-n">3</span><div><b>Get your report and fix</b><p class="muted">A score, your biggest gaps and how to fix each one, as a PDF. On Mac and Linux, click <b>Fix</b> and Arx changes the setting for you (on a Mac it also opens the right System Settings page for the rest). Every fix can be undone.</p></div></li>
+        <li><span class="step-n">3</span><div><b>Get your report and fix</b><p class="muted">A score, your biggest gaps and how to fix each one, as a PDF. Click <b>Fix</b> and Arx changes the setting for you, including password and lockout rules (on Mac and Windows it also opens the right Settings page for the rest). Most fixes can be undone. Windows fixes are new and not yet tested on a real PC.</p></div></li>
       </ol>
     </section>
 
@@ -99,7 +99,7 @@
     </section>
 
     <section class="wrap section" id="install">
-      <div class="section-head"><h2>Install Arx</h2><span class="tiny muted" id="dlVersion">Version 0.5.5</span></div>
+      <div class="section-head"><h2>Install Arx</h2><span class="tiny muted" id="dlVersion">Version 0.5.6</span></div>
       <p class="muted install-why">One command installs Arx and opens it. It downloads Arx from Hugging Face, <b>checks its SHA-256 fingerprint</b> against the published one, and refuses to install if anything differs. Because Terminal downloads it, your computer does not block it: no "Open Anyway", no security warning.</p>
       <div class="dl-grid">
         <article class="dl-card" data-os="mac">
@@ -141,7 +141,7 @@
     <section class="wrap section" id="about">
       <div class="section-head"><h2>Why trust it</h2></div>
       <div class="trust-grid">
-        <div class="card c-red"><b>🔒 You stay in control</b><p class="muted">The audit only reads. Arx changes a setting only when you click Fix: it shows exactly what will change, asks for your password, and can undo it. The AI never runs commands.</p></div>
+        <div class="card c-red"><b>🔒 You stay in control</b><p class="muted">The audit only reads. Arx changes a setting only when you click Fix: it shows exactly what will change, asks for your password, and can undo most changes. The AI never runs commands.</p></div>
         <div class="card c-blue"><b>📴 Offline and private</b><p class="muted">The audit and the AI run on your computer. The report stays there unless you share it.</p></div>
         <div class="card c-green"><b>🧾 Grounded report</b><p class="muted">The AI writes only from what the audit found and the Devseis library, and each answer is checked against both. If a check fails, Arx uses a fixed template instead.</p></div>
         <div class="card c-violet"><b>📖 Open source</b><p class="muted">Code Apache-2.0, data CC BY 4.0. <a class="link" href="https://huggingface.co/spaces/Devseis/Arx/tree/main">Read the source</a>.</p></div>

library/fixes.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0",
+  "version": "0.2.0",
   "note": "Fixes Arx can apply or guide. kind 'auto': applied by collectors/<os>/fix.sh after the user clicks Fix and approves the administrator prompt; the old value is saved so it can be undone. kind 'settings': Arx opens the exact settings page and shows the steps (the change needs the user's password, a recovery key, a restart or a decision). The AI never writes or chooses commands; it may only explain these entries.",
   "fixes": {
     "firewall.enabled": {
@@ -41,6 +41,15 @@
         "changes": "Turns on Gatekeeper, so only apps from the App Store and identified developers can open.",
         "note": "XProtect is always on and cannot be switched by a command.",
         "undo": true
+      },
+      "windows": {
+        "kind": "settings",
+        "title": "Turn on Microsoft Defender",
+        "url": "windowsdefender://threat/",
+        "steps": [
+          "If Windows Security says another antivirus is in use, keep that one up to date instead.",
+          "Otherwise, turn on Microsoft Defender Antivirus protection."
+        ]
       }
     },
     "malware.signatures": {
@@ -61,6 +70,13 @@
           "check": "malware.antivirus",
           "contains": "ClamAV"
         }
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Update security intelligence",
+        "changes": "Downloads the latest Microsoft Defender malware definitions (Update-MpSignature).",
+        "note": "An update: there is nothing to undo.",
+        "undo": false
       }
     },
     "malware.signature_updates": {
@@ -97,6 +113,13 @@
         "changes": "Installs and turns on unattended-upgrades (Ubuntu, Debian) or dnf-automatic (Red Hat-type systems), so security updates install every day.",
         "note": "Undo turns it off again and removes the tool if Arx installed it.",
         "undo": true
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Turn on automatic updates",
+        "changes": "Removes policies that turn automatic updates off, sets updates to download and install automatically, and re-enables the Windows Update service if it was disabled.",
+        "note": "Windows may restart outside working hours to finish an update.",
+        "undo": true
       }
     },
     "gdpr.guest_account": {
@@ -113,6 +136,13 @@
         "changes": "Turns off the guest session on the login screen and the login shell of a 'guest' account.",
         "note": "",
         "undo": true
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Turn off the guest account",
+        "changes": "Disables the built-in Guest account.",
+        "note": "",
+        "undo": true
       }
     },
     "gdpr.telemetry": {
@@ -129,6 +159,13 @@
         "changes": "Turns off popularity-contest and the whoopsie error reporter.",
         "note": "",
         "undo": true
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Send only required diagnostic data",
+        "changes": "Sets the diagnostic data policy (AllowTelemetry) to 'Required only'.",
+        "note": "",
+        "undo": true
       }
     },
     "gdpr.time_sync": {
@@ -145,6 +182,13 @@
         "changes": "Turns on network time (timedatectl set-ntp true), so logs have correct times.",
         "note": "",
         "undo": true
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Set the time automatically",
+        "changes": "Turns on internet time synchronisation (Windows Time service), so logs have correct times.",
+        "note": "",
+        "undo": true
       }
     },
     "screen_lock.enabled": {
@@ -156,6 +200,13 @@
           "Set 'Start Screen Saver when inactive' and 'Turn display off when inactive' to 5 minutes or less.",
           "Set 'Require password after screen saver begins or display is turned off' to Immediately."
         ]
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Lock the screen when idle",
+        "changes": "Sets 'Machine inactivity limit' to SCREEN_LOCK_MAX_SECONDS (300 by default): Windows locks after that much idle time and asks for the password to unlock.",
+        "note": "Takes effect after the next restart.",
+        "undo": true
       }
     },
     "screen_lock.timeout": {
@@ -167,6 +218,13 @@
           "Set 'Start Screen Saver when inactive' and 'Turn display off when inactive' to 5 minutes or less.",
           "Set 'Require password after screen saver begins or display is turned off' to Immediately."
         ]
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Lock the screen when idle",
+        "changes": "Sets 'Machine inactivity limit' to SCREEN_LOCK_MAX_SECONDS (300 by default): Windows locks after that much idle time and asks for the password to unlock.",
+        "note": "Takes effect after the next restart.",
+        "undo": true
       }
     },
     "screen_lock.password": {
@@ -177,6 +235,13 @@
         "steps": [
           "Set 'Require password after screen saver begins or display is turned off' to Immediately (macOS asks for your password)."
         ]
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Lock the screen when idle",
+        "changes": "Sets 'Machine inactivity limit' to SCREEN_LOCK_MAX_SECONDS (300 by default): Windows locks after that much idle time and asks for the password to unlock.",
+        "note": "Takes effect after the next restart.",
+        "undo": true
       }
     },
     "encryption.enabled": {
@@ -189,6 +254,15 @@
           "Choose how to unlock the disk if you forget your password, and keep the recovery key somewhere safe (not on this Mac): without it, data can be lost.",
           "Encryption continues in the background; you can keep working."
         ]
+      },
+      "windows": {
+        "kind": "settings",
+        "title": "Turn on device encryption (BitLocker)",
+        "url": "ms-settings:deviceencryption",
+        "steps": [
+          "Turn on Device encryption, or choose 'BitLocker drive encryption' if it is offered.",
+          "Save the recovery key somewhere safe outside this computer (your Microsoft account or your IT team): without it, data can be lost."
+        ]
       }
     },
     "encryption.protection": {
@@ -220,6 +294,14 @@
         "steps": [
           "Click Update Now (or Restart Now). Save your work first: the Mac may restart."
         ]
+      },
+      "windows": {
+        "kind": "settings",
+        "title": "Install pending updates",
+        "url": "ms-settings:windowsupdate",
+        "steps": [
+          "Click Download & install (or Restart now). Save your work first: the computer may restart."
+        ]
       }
     },
     "gdpr.updates_recent": {
@@ -230,6 +312,14 @@
         "steps": [
           "Click Update Now. Save your work first: the Mac may restart."
         ]
+      },
+      "windows": {
+        "kind": "settings",
+        "title": "Install the latest updates",
+        "url": "ms-settings:windowsupdate",
+        "steps": [
+          "Click Check for updates, then install them. Save your work first: the computer may restart."
+        ]
       }
     },
     "gdpr.os_supported": {
@@ -240,6 +330,14 @@
         "steps": [
           "Install the offered macOS upgrade. Back up first, and check that your apps support it."
         ]
+      },
+      "windows": {
+        "kind": "settings",
+        "title": "Upgrade Windows",
+        "url": "ms-settings:windowsupdate",
+        "steps": [
+          "Install the offered Windows version upgrade. Back up first, and check that your apps support it."
+        ]
       }
     },
     "gdpr.remote_access": {
@@ -251,6 +349,15 @@
           "Turn off Screen Sharing, Remote Login, Remote Management and File Sharing unless your IT team needs them.",
           "Quit and uninstall remote tools such as TeamViewer or AnyDesk if they are not approved."
         ]
+      },
+      "windows": {
+        "kind": "settings",
+        "title": "Turn off remote access you do not need",
+        "url": "ms-settings:remotedesktop",
+        "steps": [
+          "Turn off Remote Desktop unless your IT team needs it.",
+          "Uninstall remote tools such as TeamViewer or AnyDesk if they are not approved, and stop sharing folders you do not need."
+        ]
       }
     },
     "gdpr.backup_configured": {
@@ -262,6 +369,14 @@
           "Connect an external drive or choose a network backup disk, then click Add Backup Disk.",
           "Choose 'Encrypt backups'."
         ]
+      },
+      "windows": {
+        "kind": "settings",
+        "title": "Set up backup",
+        "url": "ms-settings:backup",
+        "steps": [
+          "Turn on OneDrive folder backup, or set up File History with an external drive."
+        ]
       }
     },
     "gdpr.backup_recent": {
@@ -283,6 +398,15 @@
           "Create a separate administrator account for installing software.",
           "Then turn off 'Allow this user to administer this computer' for your everyday account. Do this only after the other administrator account works."
         ]
+      },
+      "windows": {
+        "kind": "settings",
+        "title": "Use a standard account for everyday work",
+        "url": "ms-settings:otherusers",
+        "steps": [
+          "Create a separate administrator account for installing software.",
+          "Then change your everyday account type to Standard User. Do this only after the other administrator account works."
+        ]
       }
     },
     "admin.unauthorized": {
@@ -293,25 +417,345 @@
         "steps": [
           "Turn off 'Allow this user to administer this computer' for accounts that are not approved IT administrators. Keep at least one working administrator."
         ]
+      },
+      "windows": {
+        "kind": "settings",
+        "title": "Review administrator accounts",
+        "url": "ms-settings:otherusers",
+        "steps": [
+          "Change accounts that are not approved IT administrators to Standard User. Keep at least one working administrator."
+        ]
       }
     },
     "account.unique_login": {
       "macos": {
-        "kind": "settings",
-        "title": "Turn off automatic login and shared accounts",
-        "url": "x-apple.systempreferences:com.apple.Users-Groups-Settings.extension",
-        "steps": [
-          "Set 'Automatically log in as' to Off (at the bottom of the page).",
-          "Give each person their own account; remove or rename shared accounts such as office or admin, keeping one named IT administrator."
-        ]
+        "kind": "auto",
+        "title": "Turn off automatic login",
+        "changes": "Turns off automatic login and deletes the saved login password (/etc/kcpassword), so everyone signs in with their own password.",
+        "note": "Shared accounts are not changed: a person decides which to remove. To turn automatic login back on, use Users & Groups.",
+        "undo": false,
+        "requires": {
+          "check": "account.unique_login",
+          "contains": "automatic login as"
+        }
       },
       "linux": {
         "kind": "auto",
         "title": "Turn off automatic login",
         "changes": "Turns off automatic login (GDM, LightDM or SDDM), so everyone signs in with their own password.",
         "note": "Shared accounts are not changed: a person decides which to remove.",
+        "undo": true,
+        "requires": {
+          "check": "account.unique_login",
+          "contains": "automatic login as"
+        }
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Turn off automatic sign-in",
+        "changes": "Turns off automatic sign-in (Winlogon AutoAdminLogon) and deletes the sign-in password stored in the registry, so everyone signs in with their own password.",
+        "note": "Shared accounts are not changed: a person decides which to remove.",
+        "undo": false,
+        "requires": {
+          "check": "account.unique_login",
+          "contains": "automatic login as"
+        }
+      }
+    },
+    "password.min_length": {
+      "macos": {
+        "kind": "auto",
+        "title": "Require longer passwords",
+        "changes": "Sets the shortest allowed password to the baseline length (PASSWORD_MIN_LENGTH, 14 by default) in the Mac's account policy.",
+        "note": "Applies when a password is next changed; the current password keeps working.",
+        "undo": true
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Require longer passwords",
+        "changes": "Sets the shortest allowed password to the baseline length (PASSWORD_MIN_LENGTH) with pam_pwquality, installing it on Ubuntu/Debian if needed.",
+        "note": "Applies when a password is next changed; the current password keeps working.",
+        "undo": true
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Require longer passwords",
+        "changes": "Sets 'Minimum password length' in the local security policy to the baseline length (PASSWORD_MIN_LENGTH).",
+        "note": "Applies when a password is next changed; the current password keeps working.",
+        "undo": true
+      }
+    },
+    "password.complexity": {
+      "macos": {
+        "kind": "auto",
+        "title": "Require stronger passwords",
+        "changes": "New passwords must contain both letters and numbers.",
+        "note": "Applies when a password is next changed.",
+        "undo": true
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Require stronger passwords",
+        "changes": "New passwords must use at least 3 kinds of characters (lower case, upper case, digits, symbols), with pam_pwquality.",
+        "note": "Applies when a password is next changed.",
+        "undo": true
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Require stronger passwords",
+        "changes": "Turns on 'Password must meet complexity requirements' in the local security policy.",
+        "note": "Applies when a password is next changed.",
+        "undo": true
+      }
+    },
+    "password.history": {
+      "macos": {
+        "kind": "auto",
+        "title": "Stop reuse of old passwords",
+        "changes": "A new password cannot be one of the last PASSWORD_HISTORY passwords (24 by default).",
+        "note": "",
+        "undo": true
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Stop reuse of old passwords",
+        "changes": "A new password cannot be one of the last PASSWORD_HISTORY passwords (pam_pwhistory: a pam-auth-update profile on Ubuntu/Debian, the authselect feature on Red Hat-type systems).",
+        "note": "",
+        "undo": true
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Stop reuse of old passwords",
+        "changes": "Sets 'Enforce password history' in the local security policy (at most 24 on Windows).",
+        "note": "",
+        "undo": true
+      }
+    },
+    "password.expiration": {
+      "macos": {
+        "kind": "auto",
+        "title": "Make passwords expire",
+        "changes": "Passwords expire after PASSWORD_MAX_AGE_DAYS days (365 by default); macOS asks for a new one at login.",
+        "note": "An account whose password is already older than the limit must choose a new password at its next login.",
+        "undo": true
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Make passwords expire",
+        "changes": "Sets PASS_MAX_DAYS in /etc/login.defs and the same limit on existing accounts with a password (chage -M).",
+        "note": "An account whose password is already older than the limit must choose a new password at its next login.",
+        "undo": true
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Make passwords expire",
+        "changes": "Sets 'Maximum password age' in the local security policy.",
+        "note": "An account whose password is already older than the limit must choose a new password at its next login.",
+        "undo": true
+      }
+    },
+    "password.min_age": {
+      "linux": {
+        "kind": "auto",
+        "title": "Set a minimum password age",
+        "changes": "Sets PASS_MIN_DAYS in /etc/login.defs and the same value on existing accounts with a password (chage -m), so a password cannot be changed back straight away.",
+        "note": "After a change, the password cannot be changed again for PASSWORD_MIN_AGE_DAYS day(s).",
+        "undo": true
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Set a minimum password age",
+        "changes": "Sets 'Minimum password age' in the local security policy.",
+        "note": "After a change, the password cannot be changed again for PASSWORD_MIN_AGE_DAYS day(s).",
+        "undo": true
+      }
+    },
+    "lockout.threshold": {
+      "macos": {
+        "kind": "auto",
+        "title": "Lock accounts after wrong passwords",
+        "changes": "Locks an account for LOCKOUT_DURATION_MIN_MINUTES minutes after LOCKOUT_THRESHOLD_MAX wrong passwords (5 and 15 by default), in the Mac's account policy.",
+        "note": "One setting covers threshold, duration and observation period. Someone who forgets their password waits for the lockout to end, or an administrator unlocks the account.",
+        "undo": true
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Lock accounts after wrong passwords",
+        "changes": "Turns on pam_faillock: after LOCKOUT_THRESHOLD_MAX wrong passwords the account is locked for LOCKOUT_DURATION_MIN_MINUTES minutes (a pam-auth-update profile on Ubuntu/Debian, the authselect feature on Red Hat-type systems).",
+        "note": "One setting covers threshold, duration and observation period. Someone who forgets their password waits for the lockout to end, or an administrator unlocks the account.",
+        "undo": true
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Lock accounts after wrong passwords",
+        "changes": "Sets the account lockout threshold, lockout duration and reset counter in the local security policy.",
+        "note": "One setting covers threshold, duration and observation period. Someone who forgets their password waits for the lockout to end, or an administrator unlocks the account.",
+        "undo": true
+      }
+    },
+    "lockout.duration": {
+      "macos": {
+        "kind": "auto",
+        "title": "Lock accounts after wrong passwords",
+        "changes": "Locks an account for LOCKOUT_DURATION_MIN_MINUTES minutes after LOCKOUT_THRESHOLD_MAX wrong passwords (5 and 15 by default), in the Mac's account policy.",
+        "note": "One setting covers threshold, duration and observation period. Someone who forgets their password waits for the lockout to end, or an administrator unlocks the account.",
+        "undo": true
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Lock accounts after wrong passwords",
+        "changes": "Turns on pam_faillock: after LOCKOUT_THRESHOLD_MAX wrong passwords the account is locked for LOCKOUT_DURATION_MIN_MINUTES minutes (a pam-auth-update profile on Ubuntu/Debian, the authselect feature on Red Hat-type systems).",
+        "note": "One setting covers threshold, duration and observation period. Someone who forgets their password waits for the lockout to end, or an administrator unlocks the account.",
+        "undo": true
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Lock accounts after wrong passwords",
+        "changes": "Sets the account lockout threshold, lockout duration and reset counter in the local security policy.",
+        "note": "One setting covers threshold, duration and observation period. Someone who forgets their password waits for the lockout to end, or an administrator unlocks the account.",
+        "undo": true
+      }
+    },
+    "lockout.observation": {
+      "macos": {
+        "kind": "auto",
+        "title": "Lock accounts after wrong passwords",
+        "changes": "Locks an account for LOCKOUT_DURATION_MIN_MINUTES minutes after LOCKOUT_THRESHOLD_MAX wrong passwords (5 and 15 by default), in the Mac's account policy.",
+        "note": "One setting covers threshold, duration and observation period. Someone who forgets their password waits for the lockout to end, or an administrator unlocks the account.",
+        "undo": true
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Lock accounts after wrong passwords",
+        "changes": "Turns on pam_faillock: after LOCKOUT_THRESHOLD_MAX wrong passwords the account is locked for LOCKOUT_DURATION_MIN_MINUTES minutes (a pam-auth-update profile on Ubuntu/Debian, the authselect feature on Red Hat-type systems).",
+        "note": "One setting covers threshold, duration and observation period. Someone who forgets their password waits for the lockout to end, or an administrator unlocks the account.",
+        "undo": true
+      },
+      "windows": {
+        "kind": "auto",
+        "title": "Lock accounts after wrong passwords",
+        "changes": "Sets the account lockout threshold, lockout duration and reset counter in the local security policy.",
+        "note": "One setting covers threshold, duration and observation period. Someone who forgets their password waits for the lockout to end, or an administrator unlocks the account.",
         "undo": true
       }
+    },
+    "firewall.domain.enabled": {
+      "windows": {
+        "kind": "auto",
+        "title": "Turn on the Domain firewall",
+        "changes": "Turns on Windows Firewall for Domain networks.",
+        "note": "Apps you already allowed keep working.",
+        "undo": true
+      }
+    },
+    "firewall.domain.inbound": {
+      "windows": {
+        "kind": "auto",
+        "title": "Block incoming connections (Domain)",
+        "changes": "Turns on Windows Firewall for Domain networks and blocks incoming connections that no rule allows.",
+        "note": "Apps you already allowed keep working.",
+        "undo": true
+      }
+    },
+    "firewall.private.enabled": {
+      "windows": {
+        "kind": "auto",
+        "title": "Turn on the Private firewall",
+        "changes": "Turns on Windows Firewall for Private networks.",
+        "note": "Apps you already allowed keep working.",
+        "undo": true
+      }
+    },
+    "firewall.private.inbound": {
+      "windows": {
+        "kind": "auto",
+        "title": "Block incoming connections (Private)",
+        "changes": "Turns on Windows Firewall for Private networks and blocks incoming connections that no rule allows.",
+        "note": "Apps you already allowed keep working.",
+        "undo": true
+      }
+    },
+    "firewall.public.enabled": {
+      "windows": {
+        "kind": "auto",
+        "title": "Turn on the Public firewall",
+        "changes": "Turns on Windows Firewall for Public networks.",
+        "note": "Apps you already allowed keep working.",
+        "undo": true
+      }
+    },
+    "firewall.public.inbound": {
+      "windows": {
+        "kind": "auto",
+        "title": "Block incoming connections (Public)",
+        "changes": "Turns on Windows Firewall for Public networks and blocks incoming connections that no rule allows.",
+        "note": "Apps you already allowed keep working.",
+        "undo": true
+      }
+    },
+    "malware.realtime": {
+      "windows": {
+        "kind": "auto",
+        "title": "Turn on real-time protection",
+        "changes": "Turns on Microsoft Defender real-time protection and scanning of downloads and attachments.",
+        "note": "If another antivirus is your main protection, this check does not apply.",
+        "undo": true
+      }
+    },
+    "malware.on_access": {
+      "windows": {
+        "kind": "auto",
+        "title": "Turn on real-time protection",
+        "changes": "Turns on Microsoft Defender real-time protection and scanning of downloads and attachments.",
+        "note": "If another antivirus is your main protection, this check does not apply.",
+        "undo": true
+      }
+    },
+    "gdpr.security_logging": {
+      "windows": {
+        "kind": "auto",
+        "title": "Record sign-ins and account changes",
+        "changes": "Turns on auditing of sign-ins (successful and failed) and of user account changes, so they appear in the Security event log.",
+        "note": "",
+        "undo": true
+      }
+    },
+    "usb.write": {
+      "windows": {
+        "kind": "auto",
+        "title": "Block writing to USB drives",
+        "changes": "Stops files being written to USB drives and other removable disks (Removable Storage Access policy); reading still works.",
+        "note": "Only offered when the baseline sets USB_WRITE=deny. Plug drives in again for the change to apply.",
+        "undo": true
+      }
+    },
+    "gdpr.removable_encryption": {
+      "windows": {
+        "kind": "auto",
+        "title": "Block writing to USB drives",
+        "changes": "Stops files being written to USB drives and other removable disks (Removable Storage Access policy); reading still works.",
+        "note": "Only offered when the baseline sets USB_WRITE=deny. Plug drives in again for the change to apply.",
+        "undo": true
+      }
+    },
+    "aiact.os_ai_features": {
+      "windows": {
+        "kind": "auto",
+        "title": "Turn off Windows Recall",
+        "changes": "Sets the policy that turns off Recall (saving and analysing snapshots of the screen).",
+        "note": "",
+        "undo": true
+      }
+    },
+    "malware.tamper": {
+      "windows": {
+        "kind": "settings",
+        "title": "Turn on Tamper Protection",
+        "url": "windowsdefender://threatsettings/",
+        "steps": [
+          "Under 'Virus & threat protection settings', turn Tamper Protection on. Windows does not allow programs to change this setting."
+        ]
+      }
     }
   }
 }

training/eval/base-v0.1.jsonl

@@ -0,0 +1,30 @@
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000194, "profile": "neglected", "dataset_version": "0.1.0"}, "reply": "```json\n{\n  \"audit_result\": {\n    \"rule_name\": \"Emotion Recognition\",\n    \"risk_level\": \"High\",\n    \"impact\": \"Significant Harm\",\n    \"action_required\": [\n      \"Screening or ranking job applicants\"\n    ],\n    \"additional_measures\": [\n      \"Publish deepfakes or AI-written public-interest text labeled as Art. 50\"\n    ]\n  },\n  \"audit_notes\": \"The device detected an AI tool called 'Cursor' which was found to have potential risks related to emotion recognition of employees or students, social scoring, manipulation, exploitation, targeted scraping of facial images, biometric categorization, and identifying sensitive traits like political views or sexual orientation.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000087, "profile": "hardened", "dataset_version": "0.1.0", "check_id": "gdpr.removable_encryption", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Removable media encryption is not compliant with GDPR Technical Controls.\",\n    \"status\": \"Compliant\",\n    \"required\": \"no unencrypted writes\",\n    \"references\": [\n      {\n        \"id\": \"ISO 27001:2022 A.7.10 Storage media: Manage removable media through its life cycle according to the classification of the data on it.\",\n        \"reference\": \"https://www.iso.org/standard/6599.html\"\n      },\n      {\n        \"id\": \"ISO 27001:2022 A.8.24 Use of cryptography: Define and apply rules for using cryptography, including key management.\",\n        \"reference\": \"https://www.iso.org/standard/6599.html\"\n      },\n      {\n        \"id\": \"GDPR Art. 32(1)(a) Security of processing: pseudonymisation and encryption: Where appropriate, protect personal data with pseudonymisation and encryption.\",\n        \"reference\": \"https://www.gdpr.europa.eu/publications/art-32-1-a/\"\n      },\n      {\n        \"id\": \"GDPR Art. 34 Communication of a personal data breach to the data subject: Tell affected people about a high-risk breach without undue delay; encryption can remove this duty.\",\n        \"reference\": \"https://www.gdpr.europa.eu/publications/art-34-communication-of-a-personal-data-breach-to-the-data-subject/\"\n      }\n    ],\n    \"guidance\": \"The device's compliance with GDPR Technical Controls requires that removable media be encrypted. The audit found that the device does not comply by blocking USB storage writes and providing an approved encrypted drive.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000305, "profile": "hardened", "dataset_version": "0.1.0", "check_id": "password.complexity", "status": "Error"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Password complexity is not enforced.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Low\",\n    \"recommendation\": \"Deploy a Passcode configuration profile with requireAlphanumeric=true and minComplexChars=1 if special characters are required.\"\n  },\n  \"found\": false,\n  \"required\": \"Enforced\",\n  \"details\": \"Value could not be read.\",\n  \"references\": [\n    {\n      \"id\": \"ISO 27001:2022 A.5.17 Authentication information: Passwords and other secrets are allocated, managed and protected under clear rules.\",\n      \"reference\": \"https://www.iso.org/standard/6962.html\"\n    },\n    {\n      \"id\": \"ISO 27001:2022 A.8.5 Secure authentication: Authentication methods and procedures resist guessing, brute force and misuse.\",\n      \"reference\": \"https://www.iso.org/standard/6963.html\"\n    },\n    {\n      \"id\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\",\n      \"reference\": \"https://gdpr-info.eu/art-32-1-b/\"\n    }\n  ],\n  \"guidance\": \"Why: Mixing character types makes passwords harder to guess.\\nRisk: Medium - Simple passwords are cracked quickly by dictionary attacks.\\nFix (macos): Deploy a Passcode configuration profile with requireAlphanumeric=true and minComplexChars=1 if special characters are required.\",\n  \"status_note\": \"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000445, "profile": "neglected", "dataset_version": "0.1.0", "check_id": "gdpr.removable_encryption", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"USB storage writable without enforced encryption\",\n    \"status\": \"Non-Compliant\",\n    \"required\": \"no unencrypted writes\",\n    \"references\": [\n      {\n        \"id\": \"ISO 27001:2022 A.7.10 Storage media: Manage removable media through its life cycle according to the classification of the data on it.\",\n        \"reference\": \"https://www.iso.org/standard/59942.html\"\n      },\n      {\n        \"id\": \"ISO 27001:2022 A.8.24 Use of cryptography: Define and apply rules for using cryptography, including key management.\",\n        \"reference\": \"https://www.iso.org/standard/59942.html\"\n      },\n      {\n        \"id\": \"GDPR Art. 32(1)(a) Security of processing: pseudonymisation and encryption: Where appropriate, protect personal data with pseudonymisation and encryption.\",\n        \"reference\": \"https://www.gdpr.eu/publications/gdpr-art-32-1-a-pseudonymisation-and-encryption\"\n      }\n    ],\n    \"guidance\": \"Why: Personal data copied to removable media must be encrypted, or copying must be blocked.\\nRisk: Medium - A lost unencrypted USB drive with personal data is a reportable breach.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000887, "profile": "typical", "dataset_version": "0.1.0", "check_id": "aiact.os_ai_features", "status": "NotApplicable"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Linux distributions do not include built-in AI assistants.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Screen captures or text prompts may contain personal and confidential data.\",\n    \"solution\": \"No action needed.\",\n    \"verification\": \"Re-run the audit.\",\n    \"status_note\": \"This check does not apply to this device or configuration.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000162, "profile": "neglected", "dataset_version": "0.1.0", "check_id": "org.ai_register", "status": "Pending"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"Missing AI Register\",\n    \"description\": \"The AI register is missing in the organisational configuration.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"No impact yet\",\n    \"resolution_required\": true,\n    \"action_needed\": \"Create an AI register listing each AI system, owner, purpose, risk class and the data it uses; use the AI software inventory from this audit as input.\"\n  }\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "macos", "audit": 7000552, "profile": "neglected", "dataset_version": "0.1.0"}, "reply": "```json\n{\n  \"audit_results\": {\n    \"compliance\": [\n      {\n        \"name\": \"password.min_length\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"password.history\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"password.expiration\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"password.complexity\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"lockout.threshold\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"lockout.duration\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"malware.signatures\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"malware.signature_updates\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"firewall.inbound\",\n        \"status\": \"High\"\n      },\n      {\n        \"name\": \"screen_lock.timeout\",\n        \"status\": \"Medium\"\n      },\n      {\n        \"name\": \"screen_lock.password\",\n        \"status\": \"Medium\"\n      },\n      {\n        \"name\": \"usb.write\",\n        \"status\": \"Medium\"\n      },\n      {\n        \"name\": \"admin.approved\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"encryption.enabled\",\n        \"status\": \"High\"\n      },\n      {\n        \"name\": \"gdpr.backup_recent\",\n        \"status\": \"Medium\"\n      },\n      {\n        \"name\": \"gdpr.removable_encryption\",\n        \"status\": \"Medium\"\n      },\n      {\n        \"name\": \"gdpr.guest_account\",\n        \"status\": \"Medium\"\n      },\n      {\n        \"name\": \"gdpr.remote_access\",\n        \"status\": \"High\"\n      },\n      {\n        \"name\": \"gdpr.telemetry\",\n        \"status\": \"Low\"\n      },\n      {\n        \"name\": \"aiact.os_ai_features\",\n        \"status\": \"Medium\"\n      },\n      {\n        \"name\": \"org.ropa\",\n        \"status\": \"High\"\n      },\n      {\n        \"name\": \"org.breach_procedure\",\n        \"status\": \"High\"\n      },\n      {\n        \"name\": \"org.ai_literacy\",\n        \"status\": \"Medium\"\n      },\n      {\n        \"name\": \"org.human_oversight\",\n        \"status\": \"Medium\"\n      },\n      {\n        \"name\": \"org.ai_transparency\",\n      }\n    ],\n    \"non_compliance\": [\n      {\n        \"name\": \"password.min_length\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"password.history\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"password.expiration\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"password.complexity\",\n        \"status\": \"Not Applicable\"\n      },\n      {\n        \"name\": \"lockout.threshold\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"lockout.duration\",\n        \"status\": \"Non-Compliant\"\n      },\n      {"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000175, "profile": "typical", "dataset_version": "0.1.0"}, "reply": "```json\n{\n  \"audit_findings\": [\n    {\n      \"finding_type\": \"prohibited\",\n      \"description\": \"Emotion recognition of employees or students (except for medical or safety reasons)\",\n      \"severity\": \"high\"\n    },\n    {\n      \"finding_type\": \"limited risk\",\n      \"description\": \"Chatbots and AI-generated content: people must be told they are dealing with AI, and published deepfakes or AI-written public-interest text must be labelled (Art. 50).\",\n      \"severity\": \"minimal\"\n    }\n  ]\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000974, "profile": "typical", "dataset_version": "0.1.0", "check_id": "password.min_length", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Minimum password length [password.min_length] in COMPLIANCE RESULTS\",\n    \"status\": \"Compliant\",\n    \"required\": \">=\",\n    \"detail\": \"PAM_pwquality\",\n    \"references\": [\n      \"ISO 27001:2022 A.5.17 Authentication information: Passwords and other secrets are allocated, managed and protected under clear rules.\",\n      \"ISO 27001:2022 A.8.5 Secure authentication: Authentication methods and procedures resist guessing, brute force and misuse.\"\n    ],\n    \"guidance\": \"Short passwords can be guessed or cracked quickly; length is the strongest single factor in password strength.\\n\\nRisk: Medium - Weak passwords make account takeover through guessing or credential stuffing easier.\\n\\nFix (Linux):\\n- Install pam_pwquality (Debian/Ubuntu: apt install libpam-pwquality)\\n- Set minlen = 14 in /etc/security/pwquality.conf\"\n    },\n    \"result\": true\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000904, "profile": "neglected", "dataset_version": "0.1.0", "check_id": "gdpr.telemetry", "status": "Error"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"Error\",\n    \"description\": \"Value could not be read.\",\n    \"severity\": \"Low\",\n    \"references\": [\n      {\n        \"id\": \"ISO 27001:2022 A.5.34 Privacy and protection of PII: Meet the legal and contractual requirements for protecting personal data.\"\n      },\n      {\n        \"id\": \"GDPR Art. 5(1)(c) Data minimisation: Personal data must be adequate, relevant and limited to what is necessary for the purpose.\"\n      },\n      {\n        \"id\": \"GDPR Art. 25 Data protection by design and by default: Build data protection into systems and use privacy-friendly settings by default.\"\n      }\n    ],\n    \"solution\": \"Set Group Policy: Administrative Templates > Windows Components > Data Collection and Preview Builds > Allow Diagnostic Data = Send required diagnostic data (AllowTelemetry = 1; 0 on Enterprise/Education). Verify: Re-run the audit; Diagnostic data minimised should be Compliant.\",\n    \"status_note\": \"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000355, "profile": "neglected", "dataset_version": "0.1.0", "check_id": "malware.signatures", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Malicious software signatures are outdated and may not detect new malware.\",\n    \"severity\": \"High\",\n    \"recommendation\": \"Run Update-MpSignature to ensure the device's security is up-to-date.\"\n  },\n  \"action\": {\n    \"step\": \"Run Update-MpSignature and verify that the device can access Windows Update or your update server.\",\n    \"reference\": [\n      \"ISO 27001:2022 A.8.7 Protection against malware: Protect against malware with technical controls supported by user awareness.\",\n      \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    ]\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000283, "profile": "typical", "dataset_version": "0.1.0", "check_id": "gdpr.personal_data_discovery", "status": "NotApplicable"}, "reply": "```json\n{\n  \"finding\": \"Not Applicable\",\n  \"description\": \"Personal data discovery [gdpr.personal_data_discovery] in GDPR TECHNICAL CONTROLS\",\n  \"references\": [\n    {\n      \"id\": \"ISO 27001:2022 A.5.34 Privacy and protection of PII: Meet the legal and contractual requirements for protecting personal data.\",\n      \"title\": \"GDPR Technical Controls\",\n      \"reference_number\": \"A.5.34\"\n    },\n    {\n      \"id\": \"ISO 27001:2022 A.5.12 Classification of information: Label information by how sensitive it is so that the right protection can be applied.\",\n      \"title\": \"GDPR Technical Controls\",\n      \"reference_number\": \"A.5.12\"\n    },\n    {\n      \"id\": \"GDPR Art. 5(1)(c) Data minimisation: Personal data must be adequate, relevant and limited to what is necessary for the purpose.\",\n      \"title\": \"GDPR Technical Controls\",\n      \"reference_number\": \"Art. 5(1)(c)\"\n    },\n    {\n      \"id\": \"GDPR Art. 5(1)(e) Storage limitation: Personal data must not be kept in identifiable form longer than necessary.\",\n      \"title\": \"GDPR Technical Controls\",\n      \"reference_number\": \"Art. 5(1)(e)\"\n    }\n  ],\n  \"guidance\": \"Why: Knowing where personal data is stored on endpoints is needed for the record of processing and for storage limitation.\",\n  \"risk\": \"Low\",\n  \"fix\": \"No action needed now: this opt-in scan is planned for a later stage of the tool.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000287, "profile": "typical", "dataset_version": "0.1.0", "check_id": "org.breach_procedure", "status": "Pending"}, "reply": "```json\n{\n  \"task\": \"finding\",\n  \"device\": \"macOS 15.7.2 (macos)\",\n  \"audit_run_as_admin\": \"yes\",\n  \"check_pending\": \"yes\",\n  \"found_not_answered\": \"no\",\n  \"required\": \"yes\",\n  \"detail\": \"Answer ORG_BREACH_PROCEDURE in organisational.conf.\",\n  \"references\": [\n    {\n      \"source\": \"ISO 27001:2022\",\n      \"reference\": \"A.5.24 Information security incident management planning and preparation: Plan in advance how security incidents are reported, handled and communicated.\"\n    },\n    {\n      \"source\": \"ISO 27001:2022\",\n      \"reference\": \"A.5.26 Response to information security incidents: Respond to incidents according to the documented procedure.\"\n    },\n    {\n      \"source\": \"GDPR Art. 33 Notification of a personal data breach to the supervisory authority: Report a personal data breach to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk.\",\n      \"reference\": \"Art. 34 Communication of a personal data breach to the data subject: Tell affected people about a high-risk breach without undue delay; encryption can remove this duty.\"\n    }\n  ],\n  \"guidance\": \"why: Breaches must be reported to the supervisory authority within 72 hours where required.\\r\\nrisk: High - Without a tested procedure, the 72-hour deadline is easily missed.\\r\\nfix (macos):\\r\\n- Write a breach procedure (detection, assessment, 72-hour notification to the CNPD or your authority, informing people, breach log).\\r\\n- Test it with an exercise.\",\n  \"verify\": \"Answer ORG_BREACH_PROCEDURE=yes once the procedure is written and tested.\",\n  \"status_note\": \"This item needs a further step before it can be judged.\"\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "windows", "audit": 7000275, "profile": "hardened", "dataset_version": "0.1.0"}, "reply": "```json\n{\n  \"audit_results\": {\n    \"count\": 48,\n    \"non_compliant\": 4,\n    \"not_applicable\": 3,\n    \"pending\": 3,\n    \"error\": 0\n  },\n  \"summary\": {\n    \"device\": \"Microsoft Windows 10 Pro 10.0.19045\",\n    \"host_name\": \"LAPTOP-KC73P6F\",\n    \"audit_run_as_admin\": true,\n    \"counts\": {\n      \"password.min_length\": 48,\n      \"password.history\": 48,\n      \"password.expiration\": 48,\n      \"password.min_age\": 48,\n      \"password.complexity\": 48,\n      \"lockout.threshold\": 48,\n      \"lockout.duration\": 48,\n      \"lockout.observation\": 48,\n      \"malware.antivirus\": 48,\n      \"malware.service\": 48,\n      \"malware.realtime\": 48,\n      \"malware.on_access\": 48,\n      \"malware.tamper\": 48,\n      \"malware.signatures\": 48,\n      \"firewall.domain.enabled\": 48,\n      \"firewall.domain.inbound\": 48,\n      \"firewall.domain.outbound\": 48,\n      \"firewall.private.enabled\": 48,\n      \"firewall.private.inbound\": 48,\n      \"firewall.private.outbound\": 48,\n      \"firewall.public.enabled\": 48,\n      \"firewall.public.inbound\": 48,\n      \"firewall.public.outbound\": 48,\n      \"screen_lock.timeout\": 48,\n      \"screen_lock.password\": 48,\n      \"usb.read\": 48,\n      \"usb.write\": 48,\n      \"admin.approved\": 48,\n      \"admin.unauthorized\": 48,\n      \"encryption.feature\": 48,\n      \"encryption.enabled\": 48,\n      \"encryption.protection\": 48,\n      \"encryption.recovery\": 48,\n      \"gdpr.auto_updates\": 48,\n      \"gdpr.updates_recent\": 48,\n      \"gdpr.os_supported\": 48,\n      \"gdpr.security_logging\": 48,\n      \"gdpr.time_sync\": 48,\n      \"gdpr.backup_configured\": 48,\n      \"gdpr.backup_recent\": 48,\n      \"gdpr.removable_encryption\": 48,\n      \"gdpr.guest_account\": 48,\n      \"gdpr.remote_access\": 48,\n      \"gdpr.telemetry\": 48,\n      \"gdpr.personal_data_discovery\": 48,\n      \"aiact.inventory\": 48,\n      \"aiact.unapproved\": 48,\n      \"aiact.risk_classification\": 48,\n      \"aiact.os_ai_features\": 48,\n      \"org.ropa\": 48,\n      \"org.dpia\": 48,\n      \"org.breach_procedure\": 48,\n      \"org.processor_agreements\": 48,\n      \"org.ai_register\": 48,\n      \""}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000992, "profile": "typical", "dataset_version": "0.1.0"}, "reply": "```json\n{\n  \"audit_result\": {\n    \"rule_name\": \"prohibited\",\n    \"details\": [\n      {\n        \"description\": \"Emotion recognition of employees or students (except for medical or safety reasons)\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"description\": \"Social scoring of people\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"description\": \"Manipulative or exploitative techniques that cause significant harm\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"description\": \"Untargeted scraping of facial images to build face recognition databases\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"description\": \"Biometric categorisation inferring sensitive traits such as political views or sexual orientation\",\n        \"risk_level\": \"High\"\n      }\n    ]\n  },\n  \"audit_notes\": {\n    \"tools_found\": [\"Ollama\", \"Cursor\"],\n    \"inventory_details\": {\n      \"local_models\": [\n        \"C:\\\\Users\\\\jdoe\\\\.ollama\\models\"\n      ],\n      \"cloud_models\": []\n    },\n    \"approved_tools\": [],\n    \"tool_facts\": {\n      \"Ollama\": {\n        \"data_source\": \"On the device\",\n        \"licence_status\": \"default risk minimal\",\n        \"privacy_mode\": \"No transfer to a provider, but check each model's licence and keep the local API port 11434 closed to the network.\"\n      },\n      \"Cursor\": {\n        \"code_source\": \"Code sent to the provider and its model providers unless privacy mode is enforced\",\n        \"licence_status\": \"default risk minimal\",\n        \"privacy_mode\": \"Enforce privacy mode through a business plan and sign a data processing agreement.\"\n      }\n    },\n    \"rules\": {\n      \"prohibited\": [\n        {\n          \"description\": \"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\",\n          \"risk_level\": \"High\"\n        },\n        {\n          \"description\": \"Assessing creditworthiness or credit scores of individuals\",\n          \"risk_level\": \"High\"\n        },\n        {\n          \"description\": \"Deciding access to education or grading students\",\n          \"risk_level\": \"High\"\n        },\n        {\n          \"description\": \"Assessing eligibility for public benefits or essential services\",\n          \"risk_level\": \"High\"\n        },\n        {\n          \"description\": \"Risk assessment and pricing in life and health insurance\",\n          \"risk_level\": \"High\"\n        },\n        {\n          \"description\": \"Biometric identification of people\",\n          \"risk_level\": \"High\"\n        }\n      ]\n    }\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000881, "profile": "typical", "dataset_version": "0.1.0", "check_id": "gdpr.guest_account", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Guest accounts on Red Hat Enterprise Linux 8.10 (Ootpa) 8.10 (linux) are not enabled.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"No impact\",\n    \"solution\": \"Set `allow-guest=false` in the LightDM configuration and remove any 'guest' account with a login shell.\",\n    \"reference\": [\n      \"ISO 27001:2022 A.5.16 Identity management: Every account belongs to an identifiable person or a documented service, through its whole life cycle.\"\n    ],\n    \"guidance\": \"Why: Guest logins let people use the device without an identifiable account.\\nRisk: Medium - Actions by a guest cannot be traced to a person, and guests may reach shared data.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000872, "profile": "neglected", "dataset_version": "0.1.0", "check_id": "encryption.feature", "status": "Error"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"BitLocker encryption feature requires an elevated PowerShell command to enable.\",\n    \"severity\": \"High\",\n    \"impact\": \"Personal Data Breach\",\n    \"solution\": \"Turn on BitLocker for the system drive (Enable-BitLocker -MountPoint C: -EncryptionMethod XtsAes256 -TpmProtector). Verify re-running the audit.\",\n    \"reference\": [\n      {\n        \"id\": \"ISO 27001:2022 A.8.24 Use of cryptography: Define and apply rules for using cryptography, including key management.\"\n      },\n      {\n        \"id\": \"ISO 27001:2022 A.8.1 User endpoint devices: Protect information stored on, processed by or reachable from user devices.\"\n      },\n      {\n        \"id\": \"GDPR Art. 32(1)(a) Security of processing: pseudonymisation and encryption: Where appropriate, protect personal data with pseudonymisation and encryption.\"\n      }\n    ]\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000097, "profile": "typical", "dataset_version": "0.1.0", "check_id": "org.processor_agreements", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": \"Data processing agreements [org.processor_agreements] in ORGANISATIONAL CONTROLS\",\n  \"status\": \"Non-Compliant\",\n  \"required\": true,\n  \"references\": [\n    {\n      \"id\": \"ISO 27001:2022 A.5.20 Addressing information security within supplier agreements: Agreements with suppliers set out the security requirements they must meet.\",\n      \"reference\": \"https://www.iso.org/standard/6349.html\"\n    },\n    {\n      \"id\": \"GDPR Art. 28 Processor: Use only processors that give sufficient guarantees, under a written contract with required terms.\",\n      \"reference\": \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriri/GDPR&uri=uriri/Art.28\"\n    }\n  ],\n  \"guidance\": \"Why: Every processor, including cloud and AI providers, needs a contract with the GDPR Article 28 terms.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000333, "profile": "hardened", "dataset_version": "0.1.0", "check_id": "malware.on_access", "status": "NotApplicable"}, "reply": "```json\n{\n  \"finding\": \"On-access malware protection is not applicable due to lack of built-in on-access scanning.\",\n  \"required\": \"on-access scanning\",\n  \"details\": \"XProtect scans at launch and download but macOS does not have built-in on-access scanning.\",\n  \"references\": [\n    {\n      \"id\": \"ISO 27001:2022 A.8.7 Protection against malware: Protect against malware with technical controls supported by user awareness.\"\n    },\n    {\n      \"id\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    }\n  ],\n  \"guidance\": \"The reason: On-access scanning checks files when they are opened or written. Risk: Medium - Malicious files can be opened before any scheduled scan finds them. Fix (macOS): Deploy a managed endpoint protection product if required. Verify: Re-run the audit. Status note: This check does not apply to this device or configuration.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000290, "profile": "typical", "dataset_version": "0.1.0", "check_id": "org.ai_register", "status": "Pending"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"Missing AI Register\",\n    \"description\": \"The AI register is missing for the organization's AI system.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"No impact yet\",\n    \"resolution_required\": true,\n    \"action_needed\": \"Create an AI register listing each AI system, owner, purpose, risk class and the data it uses; use the AI software inventory from this audit as input.\"\n  }\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "linux", "audit": 7000482, "profile": "hardened", "dataset_version": "0.1.0"}, "reply": "```json\n{\n  \"audit_results\": {\n    \"compliance\": [\n      {\n        \"name\": \"password.min_length\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"password.history\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"password.expiration\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"password.min_age\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"password.complexity\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"lockout.threshold\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"lockout.duration\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"lockout.observation\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"malware.antivirus\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"malware.service\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"malware.signature_updates\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"malware.signatures\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"malware.on_access\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"firewall.enabled\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"firewall.inbound\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"firewall.outbound\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"screen_lock.enabled\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"screen_lock.timeout\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"screen_lock.password\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"usb.read\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"usb.write\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"admin.approved\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"admin.unauthorized\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"encryption.enabled\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"encryption.protection\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"encryption.recovery\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"gdpr.auto_updates\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"gdpr.updates_recent\",\n        \"status\": \"High\"\n      },\n      {\n        \"name\": \"gdpr.os_supported\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"gdpr.security_logging\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"gdpr.time_sync\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"gdpr.backup_configured\",\n        \"status\": \"Compliant\""}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000769, "profile": "typical", "dataset_version": "0.1.0"}, "reply": "```json\n{\n  \"audit_result\": {\n    \"rule_name\": \"prohibited\",\n    \"details\": [\n      {\n        \"description\": \"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\",\n        \"risk_level\": \"high\"\n      },\n      {\n        \"description\": \"Assessing creditworthiness or credit scores of individuals\",\n        \"risk_level\": \"high\"\n      },\n      {\n        \"description\": \"Deciding access to education or grading students\",\n        \"risk_level\": \"high\"\n      },\n      {\n        \"description\": \"Assessing eligibility for public benefits or essential services\",\n        \"risk_level\": \"high\"\n      }\n    ]\n  },\n  \"audit_notes\": [\n    {\n      \"description\": \"The devices have local models running on them.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external transfers to any providers.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"Local models are used without exposing their data.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"All local models are kept closed to the network.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No explicit mention of transferring models to a provider.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No direct connection between the devices and external systems.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external APIs or connections are made.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external data sources are accessed.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external data is transferred to a provider.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external data is stored or processed.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external data is shared with third parties.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external data is used for marketing purposes.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external data is used for personalization.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external data is used for advertising purposes.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external data is used for financial purposes.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external data is used for legal purposes.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external data is used for administrative purposes.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external data is used for operational purposes.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external data is used for security purposes.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external data is used for privacy purposes.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\": \"No external data is used for research purposes.\",\n      \"risk_level\": \"low\"\n    },\n    {\n      \"description\":"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000953, "profile": "neglected", "dataset_version": "0.1.0", "check_id": "gdpr.os_supported", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"The device is running an unsupported version of macOS 15.6.\",\n    \"severity\": \"High\",\n    \"impact\": \"Critical\",\n    \"resolution\": \"Re-run the audit; Supported operating system version should be Compliant.\"\n  },\n  \"references\": [\n    {\n      \"reference_id\": \"ISO 27001:2022\",\n      \"title\": \"A.8.8 Management of technical vulnerabilities: Find technical weaknesses in time, judge the exposure and fix them.\",\n      \"url\": \"https://www.iso.org/standard/6942.html\"\n    },\n    {\n      \"reference_id\": \"GDPR Art. 32(1)(b)\",\n      \"title\": \"Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\",\n      \"url\": \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32020/001&from=en\"\n    }\n  ]\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000741, "profile": "hardened", "dataset_version": "0.1.0", "check_id": "encryption.enabled", "status": "Error"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"The device's encryption feature is not fully enabled.\",\n    \"severity\": \"High\",\n    \"impact\": \"Personal Data Breach\",\n    \"solution\": \"Turn on BitLocker for the system drive (Enable-BitLocker -MountPoint C: -EncryptionMethod XtsAes256 -TpmProtector). Verify this step before running the audit.\",\n    \"reference\": [\n      {\n        \"id\": \"ISO 27001:2022 A.8.24 Use of cryptography: Define and apply rules for using cryptography, including key management.\"\n      },\n      {\n        \"id\": \"ISO 27001:2022 A.8.1 User endpoint devices: Protect information stored on, processed by or reachable from user devices.\"\n      },\n      {\n        \"id\": \"GDPR Art. 32(1)(a) Security of processing: pseudonymisation and encryption: Where appropriate, protect personal data with pseudonymisation and encryption.\"\n      }\n    ]\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000433, "profile": "typical", "dataset_version": "0.1.0", "check_id": "lockout.duration", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"The lockout duration is set too short.\",\n    \"status\": \"Non-Compliant\",\n    \"required\": \"> 15 minutes\",\n    \"references\": [\n      {\n        \"id\": \"guidance\",\n        \"title\": \"Guidance\",\n        \"content\": \"Why: The lockout must last long enough to slow down repeated guessing.\"\n      },\n      {\n        \"id\": \"iso_27001\",\n        \"title\": \"ISO 27001\",\n        \"content\": \"Risk: Low - A short lockout lets attackers resume guessing almost at once.\"\n      }\n    ]\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000706, "profile": "hardened", "dataset_version": "0.1.0", "check_id": "aiact.risk_classification", "status": "NotApplicable"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"No AI tools were found in the inventory.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Unapplicable due to lack of AI tools\",\n    \"recommendation\": \"Classify all AI tools based on their purpose and classification in the AI register.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000272, "profile": "typical", "dataset_version": "0.1.0", "check_id": "org.dpia", "status": "Pending"}, "reply": "```json\n{\n  \"task\": \"finding\",\n  \"device\": \"macOS 15.7.2 (macos)\",\n  \"audit_run_as_admin\": \"yes\",\n  \"check\": \"Data protection impact assessment [org.dpia]\",\n  \"status\": \"Pending\",\n  \"found\": \"not answered\",\n  \"required\": \"yes\",\n  \"detail\": \"Answer ORG_DPIA in organisational.conf.\",\n  \"references\": [\n    {\n      \"title\": \"ISO 27001:2022\",\n      \"reference_number\": \"A.5.34 Privacy and protection of PII: Meet the legal and contractual requirements for protecting personal data.\"\n    },\n    {\n      \"title\": \"GDPR Art. 35 Data protection impact assessment: Assess the impact before processing that is likely to result in a high risk to people.\",\n      \"reference_number\": \"Art. 35 GDPR\"\n    }\n  ],\n  \"guidance\": \"Why: High-risk processing needs a data protection impact assessment before it starts.\\r\\nRisk: Medium - High-risk processing without a DPIA breaches GDPR and leaves risks to people unassessed.\\r\\nFix (macos):\\r\\n- List processing that is likely high-risk (e.g. monitoring employees, large-scale sensitive data, new technologies such as AI) and complete a DPIA for each.\\r\\n- Verify: Answer ORG_DPIA=yes once DPIAs are done.\",\n  \"status_note\": \"This item needs a further step before it can be judged.\"\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "macos", "audit": 7000298, "profile": "neglected", "dataset_version": "0.1.0"}, "reply": "```json\n{\n  \"audit_results\": {\n    \"compliance\": [\n      {\n        \"name\": \"password.min_length\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"password.history\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"password.expiration\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"password.complexity\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"lockout.threshold\",\n        \"status\": \"Error\"\n      },\n      {\n        \"name\": \"lockout.duration\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"lockout.observation\",\n        \"status\": \"Not Applicable\"\n      },\n      {\n        \"name\": \"malware.antivirus\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"malware.service\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"malware.signatures\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"malware.signature_updates\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"malware.on_access\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"firewall.enabled\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"firewall.inbound\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"firewall.outbound\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"screen_lock.timeout\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"screen_lock.enabled\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"screen_lock.password\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"usb.read\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"usb.write\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"admin.approved\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"admin.unauthorized\",\n        \"status\": \"High\"\n      },\n      {\n        \"name\": \"encryption.enabled\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"encryption.protection\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"encryption.recovery\",\n        \"status\": \"Non-Compliant\"\n      },\n      {\n        \"name\": \"gdpr.auto_updates\",\n        \"status\": \"High\"\n      },\n      {\n        \"name\": \"gdpr.updates_recent\",\n        \"status\": \"High\"\n      },\n      {\n        \"name\": \"gdpr.os_supported\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"gdpr.security_logging\",\n        \"status\": \"Compliant\"\n      },\n      {\n        \"name\": \"gdpr.time_sync\",\n        \"status\": \"Low\"\n      },\n      {\n        \"name\": \"gdpr.backup_configured\",\n        \"status\": \"High\"\n      },\n      {\n        \"name"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "linux", "audit": 7000922, "profile": "typical", "dataset_version": "0.1.0"}, "reply": "```json\n{\n  \"audit_result\": {\n    \"rule_details\": [\n      {\n        \"name\": \"Emotion Recognition\",\n        \"description\": \"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions.\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"name\": \"Social Scoring\",\n        \"description\": \"Assessing creditworthiness or credit scores of individuals, deciding access to education or grading students.\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"name\": \"Biometric Categorization\",\n        \"description\": \"Deciding access to education or grading students, assessing eligibility for public benefits or essential services, and biometric identification of people.\",\n        \"risk_level\": \"High\"\n      }\n    ],\n    \"impact\": \"Allowing these activities would pose significant risks due to their potential misuse and exploitation.\"\n  },\n  \"action_recommendation\": {\n    \"recommendation\": \"Disallow all activities involving emotion recognition, social scoring, or biometric categorization.\",\n    \"reason\": \"These activities could lead to serious security breaches and unauthorized access to sensitive information.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000728, "profile": "typical", "dataset_version": "0.1.0", "check_id": "malware.service", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Microsoft Defender Antimalware is running as a service.\",\n    \"status\": \"Compliant\",\n    \"found\": true,\n    \"required\": true,\n    \"references\": [\n      {\n        \"id\": \"ISO 27001:2022 A.8.7 Protection against malware: Protect against malware with technical controls supported by user awareness.\",\n        \"reference\": \"https://www.iso.org/standard/54922.html\"\n      },\n      {\n        \"id\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\",\n        \"reference\": \"https://gdpr-info.eu/art-32-1-b-security-of-processing/\"\n      }\n    ]\n  }\n}\n```"}

training/eval/base-v0.3.jsonl

@@ -0,0 +1,60 @@
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000937, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"audit_result\": {\n    \"rule_details\": [\n      {\n        \"name\": \"Emotion Recognition\",\n        \"description\": \"Emotion recognition of employees or students (except for medical or safety reasons)\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"name\": \"Social Scoring\",\n        \"description\": \"Social scoring of people\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"name\": \"Manipulative Techniques\",\n        \"description\": \"Manipulative or exploitative techniques that cause significant harm\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"name\": \"Untargeted Scraping\",\n        \"description\": \"Untargeted scraping of facial images to build face recognition databases\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"name\": \"Biometric Categorization\",\n        \"description\": \"Biometric categorisation inferring sensitive traits such as political views or sexual orientation\",\n        \"risk_level\": \"High\"\n      }\n    ],\n    \"prohibited_activities\": [\"Screening or ranking job applicants\", \"Making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores\", \"Deciding access to education or grading students\", \"Assessing eligibility for public benefits or essential services\"],\n    \"tools_used\": [\"GPT4All\"]\n  },\n  \"audit_notes\": {\n    \"reason_for_audit\": \"The device has a local model runner and does not require any additional data sharing.\",\n    \"data_access_policy\": \"Data sharing is disabled by default.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000590, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "malware.antivirus", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"Anti-virus\",\n    \"status\": \"Compliant\",\n    \"found\": [\n      {\n        \"name\": \"ClamAV\",\n        \"description\": \"ClamAV is a free and open-source antivirus software.\",\n        \"required\": true,\n        \"references\": [\n          {\n            \"reference_id\": \"ISO 27001:2022 A.8.7 Protection against malware: Protect against malware with technical controls supported by user awareness.\",\n            \"url\": \"https://www.iso.org/standard/6942.html\"\n          },\n          {\n            \"reference_id\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\",\n            \"url\": \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32020D00017\"\n          }\n        ]\n      }\n    ],\n    \"guidance\": \"Install an endpoint protection product, or ClamAV: apt install clamav clamav-daemon (RHEL: dnf install clamav clamd), then systemctl enable --now clamav-daemon.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000666, "profile": "typical", "dataset_version": "0.3.0", "check_id": "gdpr.updates_recent", "status": "Error"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Recent installations of macOS have shown that patching is occurring, but not configured.\",\n    \"severity\": \"High\",\n    \"impact\": \"Critical\",\n    \"resolution_time\": \"Less than 30 days\"\n  },\n  \"references\": [\n    {\n      \"id\": \"ISO 27001:2022 A.8.8 Management of technical vulnerabilities: Find technical weaknesses in time, judge the exposure and fix them.\",\n      \"reference_url\": \"https://www.iso.org/standard/49622.html\"\n    },\n    {\n      \"id\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\",\n      \"reference_url\": \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32020/0100\"\n    },\n    {\n      \"id\": \"GDPR Art. 32(1)(d) Security of processing: regular testing and evaluation: Regularly test, assess and evaluate whether security measures work.\",\n      \"reference_url\": \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32020/0100\"\n    }\n  ],\n  \"guidance\": {\n    \"reason\": \"Recent installations show that patching is occurring, but not configured.\",\n    \"risk\": \"High - A device not updated for a long time is likely missing critical security fixes.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7001291, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "org.ropa", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": \"The record of processing activities is not compliant.\",\n  \"status\": \"Non-Compliant\",\n  \"required\": true,\n  \"references\": [\n    {\n      \"id\": \"A.5.34 Privacy and protection of PII: Meet the legal and contractual requirements for protecting personal data.\"\n    },\n    {\n      \"id\": \"GDPR Art. 30 Records of processing activities: Keep a written record of the processing activities you carry out.\"\n    }\n  ],\n  \"guidance\": \"Why: The record of processing activities is the core GDPR accountability document. Risk: High - A missing or outdated record is a direct infringement and makes every other assessment harder. Fix (iOS): Create or update the record of processing activities (purposes, categories of data and people, recipients, transfers, retention, security measures). Assign an owner and review it at least yearly. Verify: Answer ORG_ROPA=yes in organisational.conf once the record is current.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001395, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "malware.on_access", "status": "NotApplicable"}, "reply": "```json\n{\n  \"finding\": \"On-access malware protection is not applicable due to lack of built-in on-access scanning.\",\n  \"required\": \"on-access scanning\",\n  \"details\": \"XProtect scans at launch and download but macOS has no built-in on-access scanning.\",\n  \"references\": [\n    {\n      \"id\": \"ISO 27001:2022 A.8.7 Protection against malware: Protect against malware with technical controls supported by user awareness.\"\n    },\n    {\n      \"id\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    }\n  ],\n  \"guidance\": \"Why: On-access scanning checks files when they are opened or written.\\nRisk: Medium - Malicious files can be opened before any scheduled scan finds them.\\nFix (macOS): Deploy a managed endpoint protection product if required.\\nVerify: Re-run the audit; On-access malware protection should be compliant.\",\n  \"status_note\": \"This check does not apply to this device or configuration.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7001113, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "org.dpia", "status": "Pending"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"Data protection impact assessment\",\n    \"description\": \"The organization has not completed a Data Protection Impact Assessment (DPIA) for all high-risk processing activities.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"High\",\n    \"resolution_required\": true,\n    \"solution\": \"List and complete a Data Protection Impact Assessment (DPIA) for each high-risk processing activity, then verify if the DPIA is complete.\",\n    \"additional_steps\": [\n      \"Verify that the DPIA is completed after completing the list of high-risk processing activities.\"\n    ]\n  }\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "ios", "audit": 7000189, "profile": "hardened", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"task\": \"summary\",\n  \"device\": \"iPadOS 27.0 (ios)\",\n  \"counts\": {\n    \"Compliant\": 16,\n    \"Non-Compliant\": 1,\n    \"NotApplicable\": 1,\n    \"Pending\": 11,\n    \"Error\": 0\n  },\n  \"evidence\": [\n    {\n      \"id\": \"screen_lock.enabled\",\n      \"name\": \"Screen Lock Enabled\",\n      \"status\": \"Passcode\",\n      \"found\": true\n    },\n    {\n      \"id\": \"screen_lock.timeout\",\n      \"name\": \"Screen Lock Timeout\",\n      \"status\": \"Auto-Lock\",\n      \"found\": true\n    },\n    {\n      \"id\": \"mobile.passcode_strength\",\n      \"name\": \"Mobile Password Strength\",\n      \"status\": \"Alphanumeric\",\n      \"found\": true\n    },\n    {\n      \"id\": \"mobile.jailbreak_root\",\n      \"name\": \"Jailbreaking Root\",\n      \"status\": \"Not Jailbroken\",\n      \"found\": true\n    },\n    {\n      \"id\": \"mobile.app_sources\",\n      \"name\": \"Apps Only From App Store\",\n      \"status\": \"Pending\",\n      \"found\": true\n    },\n    {\n      \"id\": \"mobile.find_my_device\",\n      \"name\": \"Find My Device\",\n      \"status\": \"Compliant\",\n      \"found\": true\n    },\n    {\n      \"id\": \"encryption.enabled\",\n      \"name\": \"Encryption Enabled\",\n      \"status\": \"Data Protection (Encryption)\",\n      \"found\": true\n    },\n    {\n      \"id\": \"vuln.pending_updates\",\n      \"name\": \"Pending Updates\",\n      \"status\": \"iOS Security Updates\",\n      \"found\": true\n    },\n    {\n      \"id\": \"vuln.outdated_apps\",\n      \"name\": \"Outdated Apps\",\n      \"status\": \"Automatic App Updates\",\n      \"found\": true\n    },\n    {\n      \"id\": \"vuln.known_vulnerabilities\",\n      \"name\": \"Known Vulnerabilities in iOS\",\n      \"status\": \"Critical High\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.auto_updates\",\n      \"name\": \"Automatic iOS Updates\",\n      \"status\": \"Download and Install on\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.os_supported\",\n      \"name\": \"Supported Operating System Version\",\n      \"status\": \"iPadOS 27.0\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.time_sync\",\n      \"name\": \"Date & Time Set Automatically\",\n      \"status\": \"Set Automatically\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.backup_configured\",\n      \"name\": \"ICloud Backup\",\n      \"status\": \"ICloud Backup on\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.telemetry\",\n      \"name\": \"Analytics Sharing Minimised\",\n      \"status\": \"Analytics Sharing Off\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.lock_screen_previews\",\n      \"name\": \"Notification Previews Hidden When Locked\",\n      \"status\": \"Never\",\n      \"found"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000456, "profile": "neglected", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"audit_findings\": [\n    {\n      \"finding_type\": \"prohibited\",\n      \"description\": \"Emotion recognition of employees or students (except for medical or safety reasons)\",\n      \"details\": \"The AI tool uses Microsoft Copilot, which has privacy settings that restrict emotion recognition.\"\n    },\n    {\n      \"finding_type\": \"high-risk\",\n      \"description\": \"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\",\n      \"details\": \"The AI tool may generate biased results based on employee demographics.\"\n    },\n    {\n      \"finding_type\": \"limited-risk\",\n      \"description\": \"Chatbots and AI-generated content: people must be told they are dealing with AI, and published deepfakes or AI-written public-interest text must be labelled.\",\n      \"details\": \"The AI tool generates content without explicit consent, potentially leading to harmful consequences.\"\n    }\n  ]\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000992, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "gdpr.os_supported", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"The device is running an unsupported version of macOS, which is not compliant with GDPR Technical Controls.\",\n    \"severity\": \"High\",\n    \"impact\": \"Critical\",\n    \"resolution\": \"Re-run the audit; ensure the device runs a supported version of macOS.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000482, "profile": "typical", "dataset_version": "0.3.0", "check_id": "lockout.observation", "status": "Error"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"The audit found that the required lockout observation period was not set correctly.\",\n    \"severity\": \"Low\",\n    \"impact\": \"Medium\",\n    \"recommendation\": \"Set the Group Policy: Account Lockout Policy > Reset account lockout counter after = 15 minutes or more.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7001291, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "org.breach_procedure", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": \"The device's breach response procedure does not comply with the requirements outlined by ISO 27001.\",\n  \"status\": \"Non-Compliant\",\n  \"required\": true,\n  \"references\": [\n    {\n      \"id\": \"A.5.24\",\n      \"title\": \"Information security incident management planning and preparation\",\n      \"description\": \"Plan in advance how security incidents are reported, handled, and communicated.\"\n    },\n    {\n      \"id\": \"A.5.26\",\n      \"title\": \"Response to information security incidents\",\n      \"description\": \"Respond to incidents according to the documented procedure.\"\n    },\n    {\n      \"id\": \"GDPR Art. 33\",\n      \"title\": \"Notification of a personal data breach to the supervisory authority\",\n      \"description\": \"Report a personal data breach to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk.\"\n    },\n    {\n      \"id\": \"GDPR Art. 34\",\n      \"title\": \"Communication of a personal data breach to the data subject\",\n      \"description\": \"Tell affected people about a high-risk breach without undue delay; encryption can remove this duty.\"\n    }\n  ],\n  \"guidance\": \"Why: The breach response procedure should be documented and tested to ensure compliance with relevant standards like ISO 27001.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000355, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.os_ai_features", "status": "NotApplicable"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Apple Intelligence requires Apple Silicon for certain AI functionalities.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Screen captures or prompts may contain personal and confidential data.\",\n    \"solution\": \"Deploy a Restrictions profile with allowExternalIntelligenceIntegrations set to false.\",\n    \"verification\": \"Re-run the audit to ensure compliance with the OS AI feature restrictions.\"\n  },\n  \"status_note\": \"This check does not apply to this device or configuration.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7000271, "profile": "typical", "dataset_version": "0.3.0", "check_id": "org.ai_literacy", "status": "Pending"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"missing\",\n    \"description\": \"Answer ORG_AI_LITERACY in organisational.conf is missing.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Untrained staff misuse AI tools and share data they should not.\"\n  },\n  \"solution\": {\n    \"action\": \"Provide AI literacy training matched to how staff use AI (capabilities, limits, data protection, the AI acceptable-use policy) and keep records.\",\n    \"verification\": \"Verify Answer ORG_AI_LITERACY=yes once training is delivered and recorded.\",\n    \"status_note\": \"This item needs a further step before it can be judged.\"\n  }\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "macos", "audit": 7001405, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"audit_results\": {\n    \"count\": 31,\n    \"non_compliant_count\": 15,\n    \"not_applicable_count\": 3,\n    \"pending_count\": 5,\n    \"error_count\": 2\n  },\n  \"risk_levels\": {\n    \"password.expiration\": \"Low\",\n    \"firewall.enabled\": \"High\",\n    \"firewall.inbound\": \"High\",\n    \"screen_lock.timeout\": \"Medium\",\n    \"admin.approved\": \"Medium\",\n    \"encryption.recovery\": \"Medium\",\n    \"vuln.outdated_apps\": \"Medium\",\n    \"gdpr.backup_configured\": \"High\",\n    \"gdpr.backup_recent\": \"Medium\",\n    \"gdpr.telemetry\": \"Low\",\n    \"aiact.unapproved\": \"Medium\",\n    \"aiact.os_ai_features\": \"Medium\",\n    \"org.processor_agreements\": \"High\",\n    \"org.ai_transparency\": \"Low\",\n    \"org.ai_literacy\": \"Pending\",\n    \"org.human_oversight\": \"Pending\",\n    \"org.ai_register\": \"Pending\",\n    \"org.ai_literacy\": \"Pending\"\n  },\n  \"top_gaps\": [\n    {\n      \"key\": \"firewall.enabled\",\n      \"value\": \"sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on, or enforce the firewall by configuration profile.\",\n      \"score\": 90\n    },\n    {\n      \"key\": \"firewall.inbound\",\n      \"value\": \"Turn on stealth mode: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on.\",\n      \"score\": 85\n    },\n    {\n      \"key\": \"vuln.known_vulnerabilities\",\n      \"value\": \"Update or remove each listed software package to a version without the listed vulnerabilities; where no fix exists yet, apply the vendor's workaround or restrict the software's use.\"\n    }\n  ],\n  \"fix_guidance\": {\n    \"firewall.enabled\": \"sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on, or enforce the firewall by configuration profile.\",\n    \"firewall.inbound\": \"Turn on stealth mode: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on.\",\n    \"vuln.known_vulnerabilities\": \"Update or remove each listed software package to a version without the listed vulnerabilities; where no fix exists yet, apply the vendor's workaround or restrict the software's use.\"\n  }\n}\n```"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000432, "profile": "neglected", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"audit_result\": {\n    \"rule_name\": \"prohibited\",\n    \"description\": \"Emotion recognition of employees or students (except for medical or safety reasons)\",\n    \"risk_level\": \"high\",\n    \"impact\": \"significant harm\"\n  },\n  \"tools_found\": [\n    {\n      \"name\": \"Hugging Face models\",\n      \"details\": \"Local model files; provider Various model publishers; data: On the device; default risk minimal; GDPR: Record which models are present and their licences;\"\n    },\n    {\n      \"name\": \"Cursor\",\n      \"details\": \"AI code editor; provider Anysphere (US); data: Code sent to the provider and its model providers unless privacy mode is enforced; default risk minimal; GDPR: Enforce privacy mode through a business plan and sign a data processing agreement.\"\n    },\n    {\n      \"name\": \"Claude Code\",\n      \"details\": \"AI coding assistant (command line); provider Anthropic (US); data: Code and prompts sent to the provider's cloud; default risk minimal; GDPR: Source code may contain personal data or secrets; use a commercial plan with a data processing agreement and keep secrets out of repositories.\"\n    }\n  ],\n  \"inventory_details\": {\n    \"local_models\": [\n      \"C:\\\\Users\\\\jdoe\\\\.cache\\\\huggingface\\\\hub\"\n    ]\n  },\n  \"tool_factories\": [\n    {\n      \"name\": \"Hugging Face models\",\n      \"facts\": [\n        {\n          \"model_name\": \"Various model publishers\",\n          \"data_source\": \"On the device\",\n          \"default_risk\": \"minimal\",\n          \"privacy_mode\": \"enforced\"\n        }\n      ]\n    },\n    {\n      \"name\": \"Cursor\",\n      \"facts\": [\n        {\n          \"provider\": \"Anysphere (US)\",\n          \"data_source\": \"Code sent to the provider and its model providers unless privacy mode is enforced\",\n          \"default_risk\": \"minimal\",\n          \"privacy_mode\": \"enforced\"\n        }\n      ]\n    },\n    {\n      \"name\": \"Claude Code\",\n      \"facts\": [\n        {\n          \"provider\": \"Anthropic (US)\",\n          \"data_source\": \"Code and prompts sent to the provider's cloud\",\n          \"default_risk\": \"minimal\",\n          \"privacy_mode\": \"enforced\"\n        }\n      ]\n    }\n  ]\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000106, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "vuln.known_vulnerabilities", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"Known vulnerabilities in installed software\",\n    \"status\": \"Compliant\",\n    \"found\": 0,\n    \"required\": \"<= 0\",\n    \"details\": [\n      {\n        \"app\": \"macOS\",\n        \"vulnerability\": \"Critical\",\n        \"description\": \"Installed software versions with published critical or high vulnerabilities give attackers a ready-made way in.\",\n        \"risk\": \"High\"\n      },\n      {\n        \"app\": \"macOS\",\n        \"vulnerability\": \"Medium/Low\",\n        \"description\": \"Risk: High - Critical and high vulnerabilities often allow remote code execution or privilege escalation.\",\n        \"risk\": \"High\"\n      }\n    ]\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000561, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "gdpr.backup_recent", "status": "Error"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"Error\",\n    \"description\": \"Value could not be read.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Low\",\n    \"resolution\": \"Re-run the audit; the last backup should be within 7 days.\",\n    \"solution\": \"Run the backup job now and check its timer and logs.\",\n    \"action\": \"Verify: Re-run the audit; the last backup should be within 7 days.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000904, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "admin.approved", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": \"The device has no approved IT administrator account.\",\n  \"status\": \"Non-Compliant\",\n  \"required\": \"itadmin\",\n  \"references\": [\n    {\n      \"title\": \"ISO 27001:2022 A.8.2 Privileged access rights: Restrict and manage the allocation and use of administrator rights.\",\n      \"reference_number\": \"A.8.2\"\n    },\n    {\n      \"title\": \"ISO 27001:2022 A.5.15 Access control: Grant access to information and systems based on business need, and document the rules.\",\n      \"reference_number\": \"A.5.15\"\n    },\n    {\n      \"title\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\",\n      \"reference_number\": \"Art. 32(1)(b)\"\n    }\n  ],\n  \"guidance\": \"Add the approved IT administrator account (listed in APPROVED_ADMINS) to the local Administrators group, ideally managed with Windows LAPS or Intune.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001093, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.risk_classification", "status": "NotApplicable"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"No AI tools were found in the inventory.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Unapplicable due to lack of AI tools\",\n    \"recommendation\": \"Classify all AI tools based on their purpose and classification in the AI register.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001352, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.risk_classification", "status": "Pending"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Cursor\",\n    \"category\": \"Audit Findings\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Unresolved\",\n    \"action_required\": \"Record the purpose for which each listed tool is used and classify it (prohibited, high-risk, limited-risk transparency, minimal). The auditor model does this from the inventory and the stated purpose.\",\n    \"reference\": [\n      {\n        \"type\": \"ISO 27001\",\n        \"document\": \"A.5.9 Inventory of information and other associated assets\"\n      },\n      {\n        \"type\": \"EU AI Act\",\n        \"document\": \"Art. 5 Prohibited AI practices\"\n      },\n      {\n        \"type\": \"EU AI Act\",\n        \"document\": \"Art. 6 Classification rules for high-risk AI systems\"\n      }\n    ],\n    \"guidance\": \"Why: Each AI system must be checked against the banned practices and the high-risk uses in Annex III.\"\n  }\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "linux", "audit": 7001093, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"audit_results\": {\n    \"compliance\": {\n      \"password.min_length\": 2,\n      \"password.history\": 24,\n      \"password.expiration\": 365,\n      \"password.min_age\": 2,\n      \"password.complexity\": [\n        { \"minclass\": 4, \"required_classes\": 0 }\n      ],\n      \"lockout.threshold\": 3,\n      \"lockout.duration\": \"until an administrator unlocks\",\n      \"lockout.observation\": \"no lockout\",\n      \"malware.antivirus\": \"ClamAV (clamav-daemon)\",\n      \"malware.service\": \"ClamAV malware protection service\",\n      \"malware.signature_updates\": \"freshclam not running\",\n      \"malware.signatures\": \"63 days old\",\n      \"malware.on_access\": \"clamonacc running\",\n      \"firewall.enabled\": \"firewalld active\",\n      \"firewall.inbound\": \"deny\",\n      \"firewall.outbound\": \"allow\",\n      \"screen_lock.enabled\": \"on\",\n      \"screen_lock.timeout\": \"within limit\",\n      \"screen_lock.password\": \"required\",\n      \"usb.device_access\": \"allow\",\n      \"usb.read\": \"allow\",\n      \"usb.write\": \"non-compliant\",\n      \"admin.approved\": \"itadmin\",\n      \"admin.unauthorized\": \"tnguyen\",\n      \"user.account_type\": \"Administrator (asmith)\",\n      \"encryption.enabled\": \"root filesystem on LUKS (dm_crypt-0)\",\n      \"encryption.protection\": \"LUKS2 aes-xts-plain64 512-bit key\",\n      \"encryption.recovery\": \"1 key slot, 0 unlock tokens\",\n      \"vuln.pending_updates\": \"0 pending\",\n      \"vuln.outdated_apps\": \"56 outdated\",\n      \"vuln.known_vulnerabilities\": \"137 critical/high\",\n      \"gdpr.auto_updates\": \"dnf-automatic timer off, apply_updates=no\",\n      \"gdpr.updates_recent\": \"5 days ago\",\n      \"gdpr.os_supported\": \"Red Hat Enterprise Linux 8.10 (Ootpa)\",\n      \"gdpr.security_logging\": \"auditd running, journal persistent\",\n      \"gdpr.time_sync\": \"NTP service yes, synchronised yes\",\n      \"gdpr.backup_configured\": \"Deja Dup (jdoe)\",\n      \"gdpr.backup_recent\": \"21 days ago\",\n      \"gdpr.removable_encryption\": \"USB storage writable without enforced encryption\",\n      \"gdpr.guest_account\": \"Guest account disabled\",\n      \"gdpr.remote_access\": \"vnc, anydesk\",\n      \"gdpr.telemetry\": \"whoopsie error reporting on\",\n      \"gdpr.personal_data_discovery\": \"Personal data discovery\",\n      \"aiact.inventory\": \"No AI software inventory\",\n      \"aiact.unapproved\": \"Unapproved AI tools (shadow AI)\",\n      \"aiact.risk_classification\": \"Not Applicable\",\n      \"aiact.os_ai_features\": \"Operating system AI features restricted\",\n      \"aiact.log_retention\": \"No AI usage log retention\",\n      \"org.ropa\": \"Record of processing activities\",\n      \"org.dpia\": \"Data protection impact assessment\",\n      \"org.ai_liter"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7000763, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"audit_result\": {\n    \"risk_level\": \"high\",\n    \"reasons_for_risk\": [\n      {\n        \"description\": \"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\",\n        \"action_required\": \"User should be informed about the process and its implications\"\n      },\n      {\n        \"description\": \"Assessing creditworthiness or credit scores of individuals\",\n        \"action_required\": \"User should be informed about the process and its implications\"\n      },\n      {\n        \"description\": \"Deciding access to education or grading students\",\n        \"action_required\": \"User should be informed about the process and its implications\"\n      }\n    ],\n    \"tools_used\": [\"Gems\", \"Meta AI\"]\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001403, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "gdpr.updates_recent", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Recent installations of security updates have been detected.\",\n    \"status\": \"Compliant\",\n    \"required\": \"<= 30 days ago\",\n    \"detail\": \"The last package upgrade was on September 9, 2026 at 21:57:54.\",\n    \"references\": [\n      {\n        \"type\": \"ISO 27001\",\n        \"reference\": \"A.8.8 Management of technical vulnerabilities: Find technical weaknesses in time, judge the exposure and fix them.\"\n      },\n      {\n        \"type\": \"GDPR\",\n        \"reference\": \"Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n      },\n      {\n        \"type\": \"GDPR\",\n        \"reference\": \"Art. 32(1)(d) Security of processing: regular testing and evaluation: Regularly test, assess and evaluate whether security measures work.\"\n      }\n    ],\n    \"guidance\": \"Why: Recent installs show that patching is actually happening, not just configured.\",\n    \"action\": \"Run apt update && apt upgrade (RHEL: dnf upgrade) and check the automatic update logs for errors.\",\n    \"result\": \"Verified by running the audit again after 24 days.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000974, "profile": "typical", "dataset_version": "0.3.0", "check_id": "firewall.outbound", "status": "Error"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"The firewall outbound policy is not allowed by default.\",\n    \"severity\": \"Low\",\n    \"risk\": \"Low\",\n    \"fix\": \"Configure the firewall to allow outbound traffic using `ufw` or `nftables`.\",\n    \"verification\": \"Re-run the audit to check if the outbound policy reads 'allow'.\"\n  },\n  \"status_note\": \"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000937, "profile": "typical", "dataset_version": "0.3.0", "check_id": "lockout.observation", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": \"The requirement for a longer lockout observation period is not met.\",\n  \"status\": \"Non-Compliant\",\n  \"required\": \">= 15 minutes\",\n  \"references\": [\n    {\n      \"source\": \"ISO 27001:2022\",\n      \"reference\": \"A.8.5 Secure authentication: Authentication methods and procedures resist guessing, brute force and misuse.\"\n    },\n    {\n      \"source\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\",\n      \"reference\": \"Art. 32(1)(b)\"\n    }\n  ],\n  \"guidance\": \"Failed attempts must be counted over a long enough window to detect slow guessing.\",\n  \"reason\": \"Failed attempts must be counted over a long enough window to detect slow guessing.\",\n  \"risk\": \"Low\",\n  \"solution\": \"Set Group Policy: Account Lockout Policy > Reset account lockout counter after = 15 minutes or more.\",\n  \"verification\": \"Re-run the audit; Lockout observation period should be 15 minutes or more.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000290, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "gdpr.personal_data_discovery", "status": "NotApplicable"}, "reply": "```json\n{\n  \"finding\": \"Not Applicable\",\n  \"description\": \"Personal data discovery [gdpr.personal_data_discovery] in GDPR TECHNICAL CONTROLS\",\n  \"references\": [\n    {\n      \"id\": \"ISO 27001:2022 A.5.34 Privacy and protection of PII: Meet the legal and contractual requirements for protecting personal data.\",\n      \"title\": \"GDPR Technical Controls\",\n      \"reference_number\": \"A.5.34\"\n    },\n    {\n      \"id\": \"ISO 27001:2022 A.5.12 Classification of information: Label information by how sensitive it is so that the right protection can be applied.\",\n      \"title\": \"GDPR Technical Controls\",\n      \"reference_number\": \"A.5.12\"\n    },\n    {\n      \"id\": \"GDPR Art. 5(1)(c) Data minimisation: Personal data must be adequate, relevant and limited to what is necessary for the purpose.\",\n      \"title\": \"GDPR Technical Controls\",\n      \"reference_number\": \"Art. 5(1)(c)\"\n    },\n    {\n      \"id\": \"GDPR Art. 5(1)(e) Storage limitation: Personal data must not be kept in identifiable form longer than necessary.\",\n      \"title\": \"GDPR Technical Controls\",\n      \"reference_number\": \"Art. 5(1)(e)\"\n    }\n  ],\n  \"guidance\": \"Why: Knowing where personal data is stored on endpoints is needed for the record of processing and for storage limitation.\",\n  \"risk\": \"Low\",\n  \"fix\": \"No action needed now: this opt-in scan is planned for a later stage of the tool.\",\n  \"status_note\": \"This check does not apply to this device or configuration.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000685, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "aiact.log_retention", "status": "Pending"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"The device has an automatic logging feature that requires at least 6 months of retention for high-risk AI systems.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Missing logs prevent monitoring and investigation of high-risk AI use.\"\n  },\n  \"action_required\": \"Deployers must keep the system's logs for at least 6 months.\",\n  \"reference\": [\n    {\n      \"id\": \"EU AI Act Art. 26(6)\",\n      \"title\": \"Art. 26(6) Deployers: keep automatically generated logs for at least six months: Deployers keep the logs a high-risk AI system generates, under their control, for at least six months unless other law says otherwise.\"\n    }\n  ],\n  \"guidance\": \"Why: Deployers of high-risk AI systems must keep the system's logs for at least six months.\",\n  \"risk\": \"Medium - Missing logs prevent monitoring and investigation of high-risk AI use.\",\n  \"fix\": \"If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months.\",\n  \"verification\": \"Log retention is documented for each high-risk AI system.\",\n  \"status_note\": \"This item needs a further step before it can be judged.\"\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "windows", "audit": 7000481, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"audit_results\": {\n    \"compliance\": {\n      \"password.min_length\": 14,\n      \"password.history\": 0,\n      \"password.expiration\": 0,\n      \"password.min_age\": 0,\n      \"lockout.threshold\": 3,\n      \"lockout.duration\": null,\n      \"lockout.observation\": null,\n      \"malware.antivirus\": \"Windows Defender\",\n      \"malware.service\": \"service True, antivirus True\",\n      \"malware.realtime\": false,\n      \"malware.on_access\": false,\n      \"malware.tamper\": false,\n      \"malware.signatures\": \"58 days old (version 1.444.551.0)\",\n      \"firewall.domain.enabled\": true,\n      \"firewall.domain.inbound\": true,\n      \"firewall.domain.outbound\": false,\n      \"firewall.private.enabled\": true,\n      \"firewall.private.inbound\": false,\n      \"firewall.private.outbound\": false,\n      \"firewall.public.enabled\": true,\n      \"firewall.public.inbound\": false,\n      \"firewall.public.outbound\": false,\n      \"screen_lock.enabled\": true,\n      \"screen_lock.timeout\": null,\n      \"screen_lock.password\": null,\n      \"usb.device_access\": true,\n      \"usb.read\": true,\n      \"usb.write\": false,\n      \"admin.approved\": true,\n      \"admin.unauthorized\": false,\n      \"user.account_type\": \"Administrator (DEVSEIS\\pmartin)\",\n      \"encryption.feature\": \"BitLocker\",\n      \"encryption.enabled\": \"FullyEncrypted (100%)\",\n      \"encryption.protection\": \"Full Encrypted\",\n      \"encryption.recovery\": \"key protectors: Tpm\",\n      \"vuln.pending_updates\": 0,\n      \"vuln.outdated_apps\": 6,\n      \"vuln.known_vulnerabilities\": 39,\n      \"gdpr.auto_updates\": null,\n      \"gdpr.updates_recent\": null,\n      \"gdpr.os_supported\": \"Microsoft Windows 11 Pro build 26200\",\n      \"gdpr.security_logging\": \"logon: success+failure; account management: success+failure\",\n      \"gdpr.time_sync\": \"type NTP, service Running/Manual\",\n      \"gdpr.backup_configured\": null,\n      \"gdpr.backup_recent\": null,\n      \"gdpr.removable_encryption\": false,\n      \"gdpr.guest_account\": false,\n      \"gdpr.remote_access\": \"teamviewer, ssh\",\n      \"gdpr.telemetry\": null,\n      \"gdpr.personal_data_discovery\": null,\n      \"aiact.inventory\": \"Compliant\",\n      \"aiact.unapproved\": \"Pending\",\n      \"aiact.risk_classification\": \"Not Applicable\",\n      \"aiact.os_ai_features\": \"Windows Recall / Copilot data analysis disabled\",\n      \"aiact.log_retention\": null,\n      \"org.ropa\": \"Compliant\",\n      \"org.dpia\": \"Medium\",\n      \"org.breach_procedure\": \"Pending\",\n      \"org.processor_agreements\": \"Pending\",\n      \"org.ai_register\": \"Compliant\",\n      \"org.ai_literacy\": \"Pending\",\n      \"org.human_oversight\": \"Compliant\","}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000275, "profile": "neglected", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"audit_result\": {\n    \"rule_details\": [\n      {\n        \"name\": \"Emotion Recognition\",\n        \"description\": \"Emotion recognition of employees or students (except for medical or safety reasons)\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"name\": \"Social Scoring\",\n        \"description\": \"Social scoring of people\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"name\": \"Manipulative Techniques\",\n        \"description\": \"Manipulative or exploitative techniques that cause significant harm\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"name\": \"Untargeted Scraping\",\n        \"description\": \"Untargeted scraping of facial images to build face recognition databases\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"name\": \"Biometric Categorization\",\n        \"description\": \"Biometric categorization inferring sensitive traits such as political views or sexual orientation\",\n        \"risk_level\": \"High\"\n      }\n    ],\n    \"proposed_action\": \"Review and update policies and procedures to ensure compliance with all relevant rules.\",\n    \"action_taken\": \"No changes made.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000587, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "admin.unauthorized", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Unauthorized employee local administrator accounts [admin.unauthorized] in COMPLIANCE RESULTS\",\n    \"status\": \"Compliant\",\n    \"found\": \"none\",\n    \"required\": \"none\",\n    \"references\": [\n      {\n        \"id\": \"guidance\",\n        \"title\": \"Why: Everyday user accounts with administrator rights let malware and mistakes change anything on the device.\",\n        \"type\": \"Guidance\"\n      },\n      {\n        \"id\": \"audit_run_as_admin\",\n        \"title\": \"Audit Run As Admin\",\n        \"type\": \"Check\"\n      }\n    ]\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7001382, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "vuln.pending_updates", "status": "Error"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Pending security updates have not been installed, leaving known, published vulnerabilities open.\",\n    \"severity\": \"High\",\n    \"impact\": \"Attackers target published vulnerabilities quickly after the fix is released.\",\n    \"solution\": \"Install the pending updates now (Settings > Windows Update > Install all), restart if prompted, and verify that automatic updates are not paused.\",\n    \"status\": \"Not Read\"\n  },\n  \"references\": [\n    {\n      \"id\": \"ISO 27001:2022 A.8.8 Management of technical vulnerabilities: Find technical weaknesses in time, judge the exposure and fix them.\",\n      \"title\": \"Management of Technical Vulnerabilities\",\n      \"reference_number\": \"ISO/IEC 27001:2013\"\n    },\n    {\n      \"id\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\",\n      \"title\": \"GDPR Article 32(1)(b)\",\n      \"reference_number\": \"EU Data Protection Directive (Data Protection Regulation)\"\n    }\n  ]\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000195, "profile": "typical", "dataset_version": "0.3.0", "check_id": "password.expiration", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": \"Password expiration is not compliant.\",\n  \"status\": \"Non-Compliant\",\n  \"found\": \"Never\",\n  \"required\": \"1-365 days\",\n  \"references\": [\n    {\n      \"title\": \"ISO 27001:2022 A.5.17 Authentication information: Passwords and other secrets are allocated, managed and protected under clear rules.\",\n      \"reference\": \"https://www.iso.org/standard/49624.html\"\n    },\n    {\n      \"title\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\",\n      \"reference\": \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019R0001\"\n    }\n  ],\n  \"guidance\": \"The baseline requires passwords to be changed within a set period, limiting how long a stolen password stays useful. This ensures that passwords remain secure over time.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001334, "profile": "typical", "dataset_version": "0.3.0", "check_id": "screen_lock.timeout", "status": "NotApplicable"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"The screen lock timeout is not applicable.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Affects a significant risk due to the short idle time before locking.\",\n    \"solution\": \"Enforce the following settings using DConf: \"\n                  \"gsettings set org.gnome.desktop.session idle-delay 300\"\n                  \"gsettings set org.gnome.desktop.screensaver lock-delay 0\",\n    \"reference\": [\n      \"ISO 27001:2022 A.8.1 User endpoint devices: Protect information stored on, processed by or reachable from user devices.\"\n    ],\n    \"guidance\": \"This check does not apply to this device or configuration.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000561, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "org.ai_register", "status": "Pending"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"Missing AI Register\",\n    \"description\": \"The AI register is missing in the organisational configuration.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"High\",\n    \"resolution\": \"Create an AI register listing each AI system, owner, purpose, risk class and the data it uses; use the AI software inventory from this audit as input.\"\n  }\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "linux", "audit": 7001023, "profile": "neglected", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"audit_results\": {\n    \"compliance\": [\n      {\n        \"name\": \"password.min_length\",\n        \"status\": \"Non-Compliant\",\n        \"found\": 6\n      },\n      {\n        \"name\": \"password.history\",\n        \"status\": \"Non-Compliant\",\n        \"found\": 12\n      },\n      {\n        \"name\": \"password.expiration\",\n        \"status\": \"Non-Compliant\",\n        \"found\": 12\n      },\n      {\n        \"name\": \"password.min_age\",\n        \"status\": \"Non-Compliant\",\n        \"found\": 12\n      }\n    ],\n    \"non_compliance\": [\n      {\n        \"name\": \"vuln.pending_updates\",\n        \"status\": \"Compliant\",\n        \"found\": 0\n      },\n      {\n        \"name\": \"gdpr.os_supported\",\n        \"status\": \"Compliant\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"gdpr.time_sync\",\n        \"status\": \"Compliant\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"gdpr.removable_encryption\",\n        \"status\": \"Compliant\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"gdpr.guest_account\",\n        \"status\": \"Compliant\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"gdpr.remote_access\",\n        \"status\": \"Compliant\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"gdpr.telemetry\",\n        \"status\": \"Compliant\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"org.ropa\",\n        \"status\": \"Pending\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"org.dpia\",\n        \"status\": \"Pending\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"org.breach_procedure\",\n        \"status\": \"Pending\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"org.processor_agreements\",\n        \"status\": \"Pending\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"org.ai_register\",\n        \"status\": \"Pending\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"org.ai_literacy\",\n        \"status\": \"Pending\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"aiact.inventory\",\n        \"status\": \"Pending\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"aiact.unapproved\",\n        \"status\": \"Pending\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"aiact.risk_classification\",\n        \"status\": \"NotApplicable\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"aiact.os_ai_features\",\n        \"status\": \"Pending\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"aiact.log_retention\",\n        \"status\": \"NotApplicable\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"aiact.personal_data_discovery\",\n        \"status\": \"NotApplicable\",\n        \"found\": 1\n      }"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000306, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"audit_result\": {\n    \"rule_name\": \"prohibited\",\n    \"description\": \"Emotion recognition of employees or students (except for medical or safety reasons)\",\n    \"risk_level\": \"high\",\n    \"impact\": \"significant\",\n    \"severity\": \"medium\"\n  },\n  \"actions_taken\": [\n    {\n      \"action_type\": \"close_cloud_model\",\n      \"reason\": \"to prevent further processing on the device without permission\"\n    }\n  ],\n  \"additional_notes\": \"The device has been configured to close the cloud model when no longer needed.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000175, "profile": "typical", "dataset_version": "0.3.0", "check_id": "encryption.enabled", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Microsoft Windows 11 Enterprise has full-disk encryption enabled.\",\n    \"status\": \"Compliant\",\n    \"required\": \"fully encrypted\",\n    \"references\": [\n      {\n        \"id\": \"ISO 27001:2022 A.8.24 Use of cryptography: Define and apply rules for using cryptography, including key management.\"\n      },\n      {\n        \"id\": \"ISO 27001:2022 A.8.1 User endpoint devices: Protect information stored on, processed by or reachable from user devices.\"\n      },\n      {\n        \"id\": \"GDPR Art. 32(1)(a) Security of processing: pseudonymisation and encryption: Where appropriate, protect personal data with pseudonymisation and encryption.\"\n      }\n    ],\n    \"guidance\": \"Why: Full-disk encryption keeps data unreadable if the device is lost or stolen. Risk: High - A lost unencrypted laptop is a personal data breach that may have to be reported. Fix: Turn on BitLocker for the system drive (Enable-BitLocker -MountPoint C: -EncryptionMethod XtsAes256 -TpmProtector), preferably through Intune or Group Policy with key backup.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001424, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "gdpr.time_sync", "status": "Error"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"Error\",\n    \"description\": \"Time synchronisation [gdpr.time_sync] in GDPR TECHNICAL CONTROLS requires network time on.\",\n    \"severity\": \"Low\",\n    \"impact\": \"Low\",\n    \"resolution\": \"Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000355, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.unapproved", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"ChatGPT is not approved by the EU AI Act and GDPR.\",\n    \"status\": \"Non-Compliant\",\n    \"required\": null,\n    \"references\": [\n      {\n        \"id\": \"ISO 27001:2022 A.5.9 Inventory of information and other associated assets: Know which information assets, devices and software exist and who owns them, and keep that list current.\"\n      },\n      {\n        \"id\": \"ISO 27001:2022 A.8.19 Installation of software on operational systems: Control which software users may install.\"\n      },\n      {\n        \"id\": \"GDPR Art. 28 Processor: Use only processors that give sufficient guarantees, under a written contract with required terms.\"\n      },\n      {\n        \"id\": \"GDPR Art. 44 General principle for transfers: Transfer personal data outside the EEA only under the conditions of Chapter V.\"\n      },\n      {\n        \"id\": \"EU AI Act Art. 26 Obligations of deployers of high-risk AI systems: Deployers must use high-risk AI as instructed, assign human oversight, monitor it, keep logs and inform affected people.\"\n      }\n    ],\n    \"guidance\": \"Why: AI tools used without approval may send work and personal data to providers without contracts or a transfer basis.\\nRisk: Medium - Shadow AI can leak confidential or personal data and create unassessed AI Act and GDPR obligations.\"\n  },\n  \"action\": {\n    \"findings_to_remove\": [\"ChatGPT\"],\n    \"actions_to_take\": [\"Remove unapproved apps and restrict installations through your MDM\"]\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000656, "profile": "typical", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "NotApplicable"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Malware protection is disabled due to a security risk.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Attackers may disable antivirus before deploying ransomware.\"\n  },\n  \"solution\": \"Turn on Tamper Protection in Windows Security > Virus & threat protection settings, or centrally through Microsoft Intune/Defender for Endpoint.\",\n  \"verification\": \"Re-run the audit; ensure Tamper Protection is enabled.\",\n  \"status_note\": \"This check does not apply to this device or configuration.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7000452, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.log_retention", "status": "Pending"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"The device has been detected as having an AI usage log retention period of 6 months.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Missing logs prevent monitoring and investigation of high-risk AI use.\"\n  },\n  \"action_required\": true,\n  \"action_taken\": false,\n  \"action_notes\": [\n    \"If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months.\"\n  ],\n  \"reference\": [\n    {\n      \"id\": \"EU AI Act Art. 26(6)\",\n      \"title\": \"Deployers: Keep automatically generated logs for at least six months: Deployers keep the logs a high-risk AI system generates, under their control, for at least six months unless other law says otherwise.\"\n    }\n  ]\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "windows", "audit": 7000195, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"audit_results\": {\n    \"compliance\": {\n      \"password.min_length\": 3,\n      \"password.history\": 5,\n      \"password.expiration\": \"never\",\n      \"password.complexity\": \"enabled\",\n      \"lockout.threshold\": 5,\n      \"lockout.duration\": \"until an administrator unlocks\",\n      \"lockout.observation\": 30 minutes,\n      \"malware.antivirus\": \"not read\",\n      \"malware.service\": \"service True, antivirus True\",\n      \"malware.realtime\": \"on\",\n      \"malware.on_access\": \"on\",\n      \"malware.tamper\": \"off\",\n      \"malware.signatures\": \"6 days old (version 1.441.956.0)\",\n      \"firewall.domain.enabled\": \"on\",\n      \"firewall.domain.inbound\": \"block\",\n      \"firewall.domain.outbound\": \"allow\",\n      \"firewall.private.enabled\": \"on\",\n      \"firewall.private.inbound\": \"allow\",\n      \"firewall.private.outbound\": \"allow\",\n      \"firewall.public.enabled\": \"on\",\n      \"firewall.public.inbound\": \"allow\",\n      \"firewall.public.outbound\": \"allow\",\n      \"screen_lock.enabled\": \"password-protected screen saver on for all signed-in users\",\n      \"screen_lock.timeout\": \"screen saver within limit for: CONTOSO\\mkhan\",\n      \"screen_lock.password\": \"machine inactivity limit locks the session\",\n      \"usb.device_access\": \"allow\",\n      \"usb.read\": \"allow\",\n      \"usb.write\": \"Non-Compliant | allow\",\n      \"admin.approved\": \"none of the approved accounts is an enabled administrator\",\n      \"admin.unauthorized\": \"Unauthorized employee local administrator accounts\",\n      \"user.account_type\": \"Standard (CONTOSO\\mkhan)\",\n      \"encryption.feature\": \"BitLocker\",\n      \"encryption.enabled\": \"Non-Compliant | EncryptionInProgress (42%)\",\n      \"encryption.protection\": \"BitLocker protection\",\n      \"encryption.recovery\": \"key protectors: Tpm\",\n      \"vuln.pending_updates\": \"Pending security updates\",\n      \"vuln.outdated_apps\": \"NotApplicable | not checked\",\n      \"gdpr.auto_updates\": \"Windows default (automatic)\",\n      \"gdpr.updates_recent\": \"10 days ago\",\n      \"gdpr.os_supported\": \"Microsoft Windows 11 Pro build 26200\",\n      \"gdpr.security_logging\": \"logon: success+failure; account management: success+failure\",\n      \"gdpr.time_sync\": \"type NoSync, service Stopped/Manual\",\n      \"gdpr.backup_configured\": \"Veeam Agent for Microsoft Windows\",\n      \"gdpr.backup_recent\": \"date not readable\",\n      \"gdpr.removable_encryption\": \"USB drives writable without encryption\",\n      \"gdpr.guest_account\": \"Disabled\",\n      \"gdpr.remote_access\": \"Remote access services restricted\",\n      \"gdpr.telemetry\": \"AllowTelemetry=1 (Settings)\",\n      \"gdpr.personal_data_discovery\": \"Personal data discovery\",\n      \"aiact.inventory\": \"Compliant | no AI tools found\",\n      \"aiact.unapproved\": \"Compliant | none\",\n      \"aiact.risk_classification\":"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7001181, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"audit_result\": {\n    \"rule_details\": [\n      {\n        \"name\": \"Emotion Recognition\",\n        \"description\": \"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions.\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"name\": \"Social Scoring\",\n        \"description\": \"Assessing creditworthiness or credit scores of individuals, deciding access to education or grading students.\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"name\": \"Biometric Categorization\",\n        \"description\": \"Making decision on eligibility for public benefits or essential services, assessing eligibility for public benefits or essential services.\",\n        \"risk_level\": \"High\"\n      }\n    ],\n    \"tools_used\": [\"Gemsim\"],\n    \"tool_factories\": [],\n    \"tools_found\": [\"Gemsim\"]\n  },\n  \"audit_notes\": \"The device has been found to have a Gemini Cloud AI assistant, which falls within the approved AI tools but does not meet the specific rules outlined.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000355, "profile": "typical", "dataset_version": "0.3.0", "check_id": "screen_lock.enabled", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"The device should lock itself to prevent unauthorized access.\",\n    \"status\": \"Compliant\",\n    \"required\": \"on\",\n    \"references\": [\n      {\n        \"id\": \"ISO 27001:2022 A.8.1\",\n        \"reference\": \"https://www.iso.org/standard/64924.html\"\n      },\n      {\n        \"id\": \"ISO 27001:2022 A.7.7\",\n        \"reference\": \"https://www.iso.org/standard/64925.html\"\n      },\n      {\n        \"id\": \"GDPR Art. 32(1)(b)\",\n        \"reference\": \"https://gdpr-info.eu/art-32-1-b/\"\n      }\n    ]\n  },\n  \"action\": {\n    \"description\": \"Implementing the following steps:\",\n    \"steps\": [\n      {\n        \"step\": \"System Settings > Lock Screen\",\n        \"description\": \"Set the screen saver and display-off times and 'Require password': Immediately or enforce with a configuration profile.\"\n      }\n    ],\n    \"verification\": {\n      \"description\": \"Re-running the audit should confirm that the device locks itself.\",\n      \"confirmation\": \"Screen lock should be on.\"\n    }\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001457, "profile": "typical", "dataset_version": "0.3.0", "check_id": "firewall.inbound", "status": "Error"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Firewall inbound policy [firewall.inbound] requires root access to allow unsecured inbound connections.\",\n    \"severity\": \"High\",\n    \"impact\": \"Open\",\n    \"recommendation\": \"Run firewall inspection as an admin user (root) or use sudo to check the inbound policy.\",\n    \"solution\": \"Re-run the audit with the firewall inspection enabled as an admin user.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7000707, "profile": "typical", "dataset_version": "0.3.0", "check_id": "vuln.outdated_apps", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": \"Automatic app updates are not enabled in compliance results.\",\n  \"status\": \"Non-Compliant\",\n  \"found\": \"Automatic app updates off\",\n  \"required\": \"Automatic app updates on\",\n  \"detail\": \"Apps continue to have known security issues even after being manually updated.\",\n  \"references\": [\n    {\n      \"id\": \"ISO 27001:2022 A.8.8 Management of technical vulnerabilities: Find technical weaknesses in time, judge the exposure and fix them.\",\n      \"reference\": \"https://www.iso.org/standard/6448.html\"\n    },\n    {\n      \"id\": \"ISO 27001:2022 A.8.19 Installation of software on operational systems: Control which software users may install.\",\n      \"reference\": \"https://www.iso.org/standard/6449.html\"\n    },\n    {\n      \"id\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\",\n      \"reference\": \"https://gdpr-info.eu/art-32-1-b/\"\n    }\n  ],\n  \"guidance\": \"Browsers, office suites, PDF readers and meeting apps are common attack targets and need updates like the operating system.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001424, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "vuln.outdated_apps", "status": "NotApplicable"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Outdated third-party applications detected in Compliance Results.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Low\",\n    \"recommendation\": \"Update the listed applications from the App Store or their own updaters (or brew upgrade for Homebrew apps), and manage updates centrally with your MDM.\",\n    \"action_taken\": \"Re-run the audit; outdated applications should be 0 or fewer.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7000763, "profile": "typical", "dataset_version": "0.3.0", "check_id": "org.ai_literacy", "status": "Pending"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"Not answered\",\n    \"description\": \"AI literacy training has been provided but not verified.\",\n    \"references\": [\n      {\n        \"reference\": \"ISO 27001:2022 A.6.3 Information security awareness, education and training: People receive awareness and training suited to their role, and it is kept current.\",\n        \"level\": \"Medium\"\n      },\n      {\n        \"reference\": \"EU AI Act Art. 4 AI literacy: Providers and deployers take measures so their staff using AI have a sufficient level of AI literacy.\",\n        \"level\": \"Medium\"\n      }\n    ],\n    \"solution\": \"Provide AI literacy training matched to how staff use AI (capabilities, limits, data protection, the AI acceptable-use policy), verify answers, and record training outcomes.\",\n    \"verification\": \"Answer ORG_AI_LITERACY=yes once training is delivered and recorded.\"\n  }\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "ios", "audit": 7001244, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"task\": \"summary\",\n  \"device\": \"iOS 27.0 (ios)\",\n  \"hostName\": \"SALES-iPhone-47\",\n  \"counts\": {\n    \"Compliant\": 13,\n    \"Non-Compliant\": 6,\n    \"NotApplicable\": 0,\n    \"Pending\": 10,\n    \"Error\": 0\n  },\n  \"evidence\": [\n    {\n      \"id\": \"screen_lock.enabled\",\n      \"name\": \"Screen Lock Enabled\",\n      \"status\": \"Passcode\",\n      \"found\": true\n    },\n    {\n      \"id\": \"screen_lock.timeout\",\n      \"name\": \"Screen Lock Timeout\",\n      \"status\": \"Auto-Lock\",\n      \"found\": true\n    },\n    {\n      \"id\": \"mobile.passcode_strength\",\n      \"name\": \"Mobile Password Strength\",\n      \"status\": \"Passcode strength\",\n      \"found\": true\n    },\n    {\n      \"id\": \"mobile.jailbreak_root\",\n      \"name\": \"Mobile Jailbreak Root\",\n      \"status\": \"Not jailbroken\",\n      \"found\": false\n    },\n    {\n      \"id\": \"mobile.app_sources\",\n      \"name\": \"Apps Only From the App Store\",\n      \"status\": \"Compliant\",\n      \"found\": true\n    },\n    {\n      \"id\": \"encryption.enabled\",\n      \"name\": \"Encryption Enabled\",\n      \"status\": \"Data Protection (encryption)\",\n      \"found\": true\n    },\n    {\n      \"id\": \"vuln.pending_updates\",\n      \"name\": \"Pending Updates\",\n      \"status\": \"iOS Security Updates\",\n      \"found\": true\n    },\n    {\n      \"id\": \"vuln.outdated_apps\",\n      \"name\": \"Outdated Apps\",\n      \"status\": \"App Updates\",\n      \"found\": true\n    },\n    {\n      \"id\": \"vuln.known_vulnerabilities\",\n      \"name\": \"Known Vulnerabilities in iOS\",\n      \"status\": \"Critical High\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.auto_updates\",\n      \"name\": \"Automatic iOS Updates\",\n      \"status\": \"Automatically downloaded and installed on\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.os_supported\",\n      \"name\": \"Supported Operating System Version\",\n      \"status\": \"iOS 27.0\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.time_sync\",\n      \"name\": \"Date & Time Set Automatically\",\n      \"status\": \"Set automatically\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.backup_configured\",\n      \"name\": \"ICloud Backup\",\n      \"status\": \"ICloud Backup on\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.telemetry\",\n      \"name\": \"Analytics Sharing Minimised\",\n      \"status\": \"Analytics sharing on\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.lock_screen_previews\",\n      \"name\": \"Notification Previews Hidden When Locked\",\n      \"status\": \"Always\",\n      \"found\": true\n    },\n    {\n      \"id\": \"aiact.inventory\",\n      \"name\": \""}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7000536, "profile": "hardened", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"audit_result\": {\n    \"risk_level\": \"high\",\n    \"potential_issues\": [\n      {\n        \"description\": \"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\",\n        \"impact\": \"significant harm\"\n      },\n      {\n        \"description\": \"Assessing creditworthiness or credit scores of individuals\",\n        \"impact\": \"significant harm\"\n      },\n      {\n        \"description\": \"Deciding access to education or grading students\",\n        \"impact\": \"significant harm\"\n      }\n    ]\n  },\n  \"action_recommendation\": {\n    \"tools_to_use\": [\"ChatGPT\", \"Gemini\", \"Microsoft Copilot\"],\n    \"reason_for_recommendation\": \"The devices have been found to contain AI tools that could potentially pose risks related to emotion recognition, social scoring, manipulation, and targeted scraping of personal data.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7000298, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.inventory", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"Compliance\",\n    \"description\": \"The AI software inventory was not compliant due to the lack of classification and governance.\",\n    \"severity\": \"Low\",\n    \"impact\": \"Risk\",\n    \"action_required\": \"Add the AI tools found on this device to the organization's AI register, with owner and purpose.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000974, "profile": "typical", "dataset_version": "0.3.0", "check_id": "firewall.enabled", "status": "Error"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Firewall requires root access to block unwanted network connections.\",\n    \"severity\": \"High\",\n    \"impact\": \"Network exposure to unauthorized users\",\n    \"solution\": \"Run the firewall as an administrator/root user (e.g., Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo).\"\n  },\n  \"references\": [\n    {\n      \"reference_id\": \"ISO 27001:2022 A.8.20 Networks security: Secure, manage and control networks and network devices to protect information.\",\n      \"title\": \"A.8.20 Networks security: Secure, manage and control networks and network devices to protect information.\"\n    },\n    {\n      \"reference_id\": \"ISO 27001:2022 A.8.1 User endpoint devices: Protect information stored on, processed by or reachable from user devices.\",\n      \"title\": \"A.8.1 User endpoint devices: Protect information stored on, processed by or reachable from user devices.\"\n    },\n    {\n      \"reference_id\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\",\n      \"title\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    }\n  ],\n  \"guidance\": \"Why: A host firewall blocks unwanted network connections to the device, especially on public networks.\\nRisk: High - Network services on the device are exposed to anyone on the same network.\\nFix (Linux):\\n- Debian/Ubuntu: ufw default deny incoming; ufw default allow outgoing; ufw enable\\n- RHEL: systemctl enable --now firewalld.\\nVerify: Re-run the audit; the firewall should be on.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000432, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "firewall.private.enabled", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"The private firewall is set to 'private' mode, which blocks unauthorized access to the device.\",\n    \"status\": \"Non-Compliant\",\n    \"found\": \"off\",\n    \"required\": \"on\",\n    \"references\": [\n      {\n        \"id\": \"guidance\",\n        \"title\": \"Guidance\",\n        \"content\": \"A host firewall blocks unwanted network connections to the device, especially on public networks.\"\n      }\n    ]\n  },\n  \"action\": {\n    \"description\": \"Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True, or enforce it with Group Policy/Intune.\",\n    \"details\": \"This action sets the private firewall profile to enable, ensuring that unauthorized connections are blocked.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000590, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "screen_lock.timeout", "status": "NotApplicable"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"The Linux system's default session idle delay is set to 300 seconds.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Affects users who may have left their devices unlocked.\"\n  },\n  \"solution\": [\n    \"Set the session idle delay to 300 seconds using `gsettings` commands.\",\n    \"Enforce the locked DConf settings with `gsettings` commands.\"\n  ],\n  \"verification\": \"Re-run the audit to ensure the change takes effect.\",\n  \"status_note\": \"This check does not apply to this device or configuration.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7001266, "profile": "typical", "dataset_version": "0.3.0", "check_id": "org.ai_literacy", "status": "Pending"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"Not answered\",\n    \"description\": \"Answered once by the organization (organisational.conf)\",\n    \"reference\": [\n      \"ISO 27001:2022 A.6.3 Information security awareness, education and training: People receive awareness and training suited to their role, and it is kept current.\",\n      \"EU AI Act Art. 4 AI literacy: Providers and deployers take measures so their staff using AI have a sufficient level of AI literacy.\"\n    ],\n    \"guidance\": \"Why: Since 2 February 2025, organisations must ensure staff using AI have sufficient AI literacy.\",\n    \"risk\": \"Medium - Untrained staff misuse AI tools and share data they should not.\",\n    \"fix\": \"Provide AI literacy training matched to how staff use AI (capabilities, limits, data protection, the AI acceptable-use policy), and keep records.\",\n    \"verification\": \"Answer ORG_AI_LITERACY=yes once training is delivered and recorded.\",\n    \"status_note\": \"This item needs a further step before it can be judged.\"\n  }\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "linux", "audit": 7000445, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"audit_results\": {\n    \"compliance\": [\n      {\n        \"name\": \"password.min_length\",\n        \"status\": \"Compliant\",\n        \"found\": 14\n      },\n      {\n        \"name\": \"password.history\",\n        \"status\": \"Non-Compliant\",\n        \"found\": 10\n      },\n      {\n        \"name\": \"password.expiration\",\n        \"status\": \"Compliant\",\n        \"found\": 60\n      },\n      {\n        \"name\": \"password.min_age\",\n        \"status\": \"Compliant\",\n        \"found\": 2\n      },\n      {\n        \"name\": \"password.complexity\",\n        \"status\": \"Compliant\",\n        \"found\": 3\n      },\n      {\n        \"name\": \"lockout.threshold\",\n        \"status\": \"Compliant\",\n        \"found\": 4\n      },\n      {\n        \"name\": \"lockout.duration\",\n        \"status\": \"Compliant\",\n        \"found\": 15\n      },\n      {\n        \"name\": \"lockout.observation\",\n        \"status\": \"Compliant\",\n        \"found\": 15\n      },\n      {\n        \"name\": \"malware.antivirus\",\n        \"status\": \"Non-Compliant\",\n        \"found\": 10\n      },\n      {\n        \"name\": \"malware.service\",\n        \"status\": \"Compliant\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"malware.signature_updates\",\n        \"status\": \"Non-Compliant\",\n        \"found\": 14\n      },\n      {\n        \"name\": \"malware.signatures\",\n        \"status\": \"Non-Compliant\",\n        \"found\": 14\n      },\n      {\n        \"name\": \"malware.on_access\",\n        \"status\": \"Non-Compliant\",\n        \"found\": 1\n      }\n    ],\n    \"non_compliance\": [\n      {\n        \"name\": \"encryption.enabled\",\n        \"status\": \"Compliant\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"encryption.protection\",\n        \"status\": \"Compliant\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"encryption.recovery\",\n        \"status\": \"Compliant\",\n        \"found\": 3\n      },\n      {\n        \"name\": \"vuln.pending_updates\",\n        \"status\": \"Pending\",\n        \"found\": 0\n      },\n      {\n        \"name\": \"vuln.outdated_apps\",\n        \"status\": \"Pending\",\n        \"found\": 10\n      },\n      {\n        \"name\": \"gdpr.os_supported\",\n        \"status\": \"High\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"gdpr.security_logging\",\n        \"status\": \"Compliant\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"gdpr.time_sync\",\n        \"status\": \"Compliant\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"gdpr.backup_configured\",\n        \"status\": \"Compliant\",\n        \"found\": 1\n      },\n      {\n        \"name\": \"gdpr.backup_recent\",\n        \"status\": \"Medium\",\n        \"found\": 1\n      },"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000172, "profile": "neglected", "dataset_version": "0.3.0"}, "reply": "```json\n{\n  \"audit_findings\": [\n    {\n      \"finding_type\": \"high-risk\",\n      \"description\": \"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions.\",\n      \"details\": \"The use of AI tools like Claude Code and Microsoft Copilot involves screening and ranking applications based on criteria provided by users. This could potentially include identifying biases or discriminatory practices.\"\n    },\n    {\n      \"finding_type\": \"limited-risk\",\n      \"description\": \"Assessing creditworthiness or credit scores of individuals, deciding access to education or grading students, assessing eligibility for public benefits or essential services, and assessing eligibility for life and health insurance.\",\n      \"details\": \"These tasks typically involve verifying information and ensuring compliance with legal requirements without involving any personal data or sensitive information.\"\n    }\n  ]\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001033, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "usb.device_access", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"name\": \"USB storage device access\",\n    \"description\": \"The USB storage device access setting differs from the organization's agreed USB policy.\",\n    \"status\": \"Compliant\",\n    \"required\": \"allow\",\n    \"references\": [\n      {\n        \"id\": \"guidance\",\n        \"title\": \"Guidance\",\n        \"content\": \"Why: Blocking USB mass storage devices completely is the strongest protection against data leaving on, or malware arriving from, removable drives.\\nRisk: Low - The device access setting differs from the organisation's agreed USB policy.\"\n      }\n    ]\n  },\n  \"action\": {\n    \"type\": \"Re-run audit\",\n    \"description\": \"Verify if USB storage device access has changed after running the audit.\",\n    \"expected_result\": \"USB storage device access should read 'allow'.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001334, "profile": "typical", "dataset_version": "0.3.0", "check_id": "gdpr.security_logging", "status": "Error"}, "reply": "```json\n{\n  \"task\": \"not read\",\n  \"device\": \"Debian GNU/Linux 12 (bookworm)\",\n  \"audit_run_as_admin\": \"yes\",\n  \"check\": \"Security event logging [gdpr.security_logging]\",\n  \"status\": \"Error\",\n  \"found\": \"not read\",\n  \"required\": \"auditd running\",\n  \"detail\": \"Value could not be read.\",\n  \"references\": [\n    {\n      \"id\": \"ISO 27001:2022 A.8.15 Logging: Produce, protect and review logs of activities, exceptions and security events.\",\n      \"reference_url\": \"https://www.iso.org/standard/64924.html\"\n    },\n    {\n      \"id\": \"GDPR Art. 32(1)(d) Security of processing: regular testing and evaluation: Regularly test, assess and evaluate whether security measures work.\",\n      \"reference_url\": \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32020D00017\"\n    },\n    {\n      \"id\": \"GDPR Art. 33 Notification of a personal data breach to the supervisory authority: Report a personal data breach to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk.\",\n      \"reference_url\": \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32020D00017\"\n    }\n  ],\n  \"guidance\": \"Why: Logon and account-change events are needed to detect and investigate a breach within the 72-hour GDPR deadline.\\r\\nRisk: Medium - Without these logs, a breach cannot be scoped and the notification decision becomes guesswork.\\r\\nFix (Linux): Install and start auditd (apt install auditd; systemctl enable --now auditd) and keep the journal persistent (Storage=persistent in /etc/systemd/journald.conf).\\r\\nVerify: Re-run the audit; Security event logging should be Compliant.\",\n  \"status_note\": \"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001512, "profile": "typical", "dataset_version": "0.3.0", "check_id": "gdpr.auto_updates", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"Non-Compliance\",\n    \"description\": \"Automatic security updates [gdpr.auto_updates] in GDPR TECHNICAL CONTROLS is not compliant.\",\n    \"status\": \"Non-Compliant\",\n    \"found\": [\n      {\n        \"component\": \"Automatic security updates\",\n        \"issue\": \"GDPR Technical Controls\",\n        \"severity\": \"High\",\n        \"reason\": \"Unpatched devices are the most common way attackers get in.\"\n      }\n    ],\n    \"references\": [\n      {\n        \"reference\": \"ISO 27001:2022 A.8.8 Management of technical vulnerabilities: Find technical weaknesses in time, judge the exposure and fix them.\",\n        \"url\": \"https://www.iso.org/standard/6549.html\"\n      },\n      {\n        \"reference\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\",\n        \"url\": \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019R0001\"\n      }\n    ]\n  }\n}\n```"}

training/eval/base-v0.4.jsonl

@@ -0,0 +1,60 @@
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7001099, "profile": "typical", "dataset_version": "0.4.0"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"ai_classification\": {\n      \"task_description\": \"The purpose of using AI on iOS 27.0 was not specified.\",\n      \"tool_facts\": [\n        {\n          \"tool_name\": \"ChatGPT\",\n          \"facts\": [\n            {\n              \"provider\": \"OpenAI (US)\",\n              \"data_location\": \"Provider cloud outside the EEA unless an EU data residency plan is used\",\n              \"default_risk\": \"Minimal\"\n            },\n            {\n              \"GDPR compliance\": \"Needs a business plan with a data processing agreement and a transfer basis (Art. 28, Art. 44) for consumer accounts using prompts for training unless opted out.\"\n            }\n          ]\n        },\n        {\n          \"tool_name\": \"Perplexity\",\n          \"facts\": [\n            {\n              \"provider\": \"Perplexity (US)\",\n              \"data_location\": \"Provider cloud outside the EEA\",\n              \"default_risk\": \"Minimal\"\n            },\n            {\n              \"GDPR compliance\": \"Needs an enterprise agreement and a transfer basis before work or personal data is entered.\"\n            }\n          ]\n        }\n      ],\n      \"rules\": {\n        \"prohibited_ai_tools\": [\"Emotion recognition of employees or students\", \"Social scoring of people\", \"Manipulative or exploitative techniques causing significant harm\"],\n        \"high-risk_examples\": [\"Screening or ranking job applicants\", \"Assessing creditworthiness or credit scores of individuals\", \"Deciding access to education or grading students\", \"Assessing eligibility for public benefits or essential services\", \"Risk assessment and pricing in life and health insurance\", \"Biometric identification of people\"],\n        \"limited_risk_examples\": [\"Drafting, summarizing, translation, coding help and similar general productivity use\"],\n        \"minimal_risk_examples\": [\"Chatbots and AI-generated content\"]\n      }\n    }\n  }\n}\n```"}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "audit", "dataset_version": "0.4.0"}, "reply": "The most important thing to fix based on your audit findings is the lack of antivirus software and its outdated version on your Windows 11 Pro computer. This is critical because without proper anti-malware protection, your device could be vulnerable to various types of threats such as ransomware and information stealers.\n\nTo address this issue, you need to ensure that:\n\n1. **Antivirus Software**: Enable and update the built-in Microsoft Defender Antivirus on your Windows 11 Pro machine.\n   \n   - **How to Fix**:\n     - Go to `Windows Security` > `Virus & threat protection`.\n     - Ensure that Microsoft Defender Antivirus is turned on.\n     - Make sure the third-party antivirus product is installed, enabled, and reporting to the Security Center.\n\n   - **Verification**: Run another audit to confirm that the antivirus is now compliant with the required standards.\n\n2. **Public Firewall**: Activate the public firewall to block unauthorized network traffic.\n\n   - **How to Fix**:\n     - Open `Control Panel` > `System and Security` > `Windows Defender Firewall`.\n     - Ensure that the public inbound and outbound rules are set appropriately.\n\n   - **Verification**: Check the firewall status during the next audit session.\n\nBy addressing these issues, you will significantly enhance the overall security posture of your Windows 11 Pro system according to the relevant ISO 27001, GDPR, and EU AI Act requirements."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "control", "dataset_version": "0.4.0"}, "reply": "An auditor looking for compliance with GDPR Art. 5(1)(f), which deals with integrity and confidentiality, would check for several things:\n\n1. **Technical Security Measures**: Auditors ensure that technical measures are in place to protect personal data from unauthorized access, loss, and damage. This includes ensuring that systems have robust encryption methods, firewalls, and other security protocols.\n\n2. **Endpoint Security Baseline**: They verify that the endpoint security baseline is being followed. This typically involves checking if all devices are up-to-date with software patches and antivirus updates, and if there are proper backups and disaster recovery plans in place.\n\n3. **Audit Logs**: Auditors examine whether detailed logs are maintained to track who accessed data, when, and how it was accessed. These logs should provide evidence of any suspicious activity.\n\n4. **Access Controls**: They confirm that access controls are implemented correctly, such as requiring strong passwords, multi-factor authentication, and limiting access rights based on job roles.\n\n5. **Regular Updates and Patch Management**: Auditors make sure that all applications and operating systems are regularly updated and patched to address vulnerabilities.\n\n6. **Incident Response Plan**: They review whether there is a well-defined incident response plan in place, including procedures for detecting, responding to, and recovering from breaches.\n\nBy focusing on these areas, auditors aim to ensure that personal data is adequately protected against unauthorized access, loss, and damage."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "faq", "dataset_version": "0.4.0"}, "reply": "Self-reported means that the information came from something the user said directly, like answering a question. It wasn't automatically found by checking the device itself."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "fix", "dataset_version": "0.4.0"}, "reply": "Based on the information provided, your macOS screen lock timeout appears to be longer than what is recommended according to the context. Specifically:\n\n- According to Context [1], the baseline recommendation for macOS is an idle time before lock of 300 seconds (or 5 minutes), but this value may vary depending on specific configurations.\n- Your current setting seems to be higher than this baseline.\n\nTo address this issue, you need to reduce the screen lock timeout to ensure that the device locks more quickly when unused. Here’s how you can proceed:\n\n1. **Set the Screen Saver**: \n   - Go to `System Preferences` > `Lock Screen`.\n   - Select the screen saver option from the dropdown menu.\n   - Choose a screen saver that starts within 5 minutes (or adjust it further if needed).\n\n2. **Configure Require Password**:\n   - Ensure that the system requires a password immediately upon unlocking the screen.\n   - This can typically be done through a configuration profile or directly via System Preferences.\n\nBy following these steps, you will meet the compliance requirements for screen lock timeouts on macOS. This ensures that your device locks more promptly when left idle, reducing the risk of unauthorized access."}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "noaudit", "dataset_version": "0.4.0"}, "reply": "Based on the information provided, the most critical issue to address first would be ensuring that your Windows system has the correct outbound policy set up according to the guidelines mentioned.\n\nThe passage states:\n\n\"Domain outbound on Windows. Why it matters: The baseline fixes the default outbound policy so that it is consistent across devices. Risk if missing: Low - A different outbound policy either breaks applications or deviates from the agreed design.\"\n\nThis indicates that having the right outbound policy is crucial for maintaining consistency and preventing potential issues such as breaking applications or deviating from the agreed design.\n\nTo fix this, you should:\n\n1. **Set-NetFirewallProfile**: Use PowerShell to change the default outbound action for the domain profile to `Allow`. This command will ensure that all network traffic originating from your machine follows the expected rules.\n\n   ```powershell\n   Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultOutboundAction Allow\n   ```\n\nAfter setting this correctly, re-running the audit should confirm that the outbound policy now reads `allow`, which aligns with the required standard outlined in ISO 27001:2022 A.8.20 (Networks security)."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.4.0"}, "reply": "I'm sorry, but I don't think this context is relevant for helping with your math homework. The information provided seems to be related to cybersecurity and privacy regulations, not mathematical problems. If you need assistance with your math homework, I'd recommend checking out educational resources online or talking to a teacher at school."}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "phone", "dataset_version": "0.4.0"}, "reply": "To ensure your iPhone has apps only from the App Store, you need to manage the profiles used by your device. Here’s how:\n\n1. **Check Profiles**: Go to `Settings` > `General` > `VPN & Device Management`. This will show you any developer or enterprise profiles associated with your device.\n   \n2. **Remove Unnecessary Profiles**: Look for any profiles listed there that aren’t necessary. These could include alternative app marketplaces or websites where apps might have been downloaded before moving them to the App Store.\n\n3. **Install Work Apps Only from the App Store**: Ensure that all work-related apps are installed directly from the App Store. This helps protect against potential threats introduced via unofficial channels.\n\nBy following these steps, you can confirm that your iPhone has its apps exclusively from the App Store, reducing the risk of malware and ensuring compliance with security standards such as ISO 27001 and GDPR."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "refs", "dataset_version": "0.4.0"}, "reply": "ISO 27001, GDPR, and EU AI Act all cover encryption.\n\nFor ISO 27001, related controls include:\n\n- ISO 27001:2022 A.8.24 (Use of cryptography)\n- ISO 27001:2022 A.8.1 (User endpoint devices)\n\nFor GDPR, relevant control is:\n\n- GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption)\n\nFor EU AI Act, specific rules regarding encryption are:\n\n- EU AI Act Art. 6 (Classification rules for high-risk AI systems)\n- EU AI Act Annex III (High-risk AI systems referred to in Article 6(2))\n\nThese documents provide guidance on how to ensure encryption is properly implemented across different types of endpoints like laptops and mobile devices."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "tool", "dataset_version": "0.4.0"}, "reply": "Based on the information provided:\n\n1. **Grammarly**: It appears to be an AI writing assistant that uses natural language processing technology. The key points from the context regarding Grammarly are:\n   - It is used on keyboards and browsers.\n   - Its provider is located in the US.\n   - The default EU AI Act risk classification for general office use is considered minimal.\n\nGiven these details, Grammarly seems generally safe for your company. However, there are a few considerations:\n\n1. **Data Location**: The data generated by Grammarly might be stored in a provider's cloud outside the European Economic Area (EEA). This could raise concerns under GDPR, especially since GDPR requires that personal data must be processed within the EEA unless an appropriate derogation applies.\n\n2. **GDPR Compliance**: Since the data is likely stored outside the EEA, it would need to comply with GDPR rules. Specifically, GDPR Article 45 states that personal data may be transferred to countries outside the EEA if they provide adequate protection equivalent to the level of protection required by GDPR. \n\nTo ensure compliance, you should review whether Grammarly complies with GDPR requirements and consider implementing additional measures such as encrypting data at rest and in transit, and ensuring that all data transfers adhere to GDPR guidelines.\n\nIn summary, while Grammarly itself is relatively safe, its broader implications related to data storage and transfer regulations require careful consideration. Running an audit specifically focusing on GDPR compliance would be advisable to fully assess its suitability for your organization."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.4.0"}, "reply": "I'm sorry, but I don't have any specific information about DORA ICT risk rules based on the context provided. The given context focuses on ISO 27001, GDPR, and the EU AI Act, particularly regarding authentication, endpoint protection, and AI system classifications. There isn't enough information to determine what DORA ICT risk rules might entail. To find out more about DORA ICT risk rules, I would need additional relevant documentation or context related specifically to those topics."}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "verify", "dataset_version": "0.4.0"}, "reply": "To ensure that your iPhone has the correct number of known vulnerabilities according to the guidelines provided:\n\n1. **Check Pending Security Updates**: Go to `Settings` > `General` > `Software Update`. Look for the value under `MAX_PENDING_SECURITY_UPDATES`. This indicates how many security updates have been offered but not installed.\n\n   - **Explanation**: If this count is zero or less, it means all available security updates have been applied.\n   \n2. **Verify Automatic Security Updates**: In `Settings` > `General` > `Software Update`, make sure `Automatic Updates` is turned on. Also, enable `Security Responses & System Files`.\n\n   - **Explanation**: If automatic updates are enabled and configured properly, new security patches will be downloaded and installed automatically.\n\n3. **Ensure Supported Operating System Version**: Check the `Supported operating system version` setting in `Settings` > `General` > `Software Update`. Ensure the current OS version meets the minimum required standards.\n\n   - **Explanation**: If the OS version is outdated, consider updating to a newer one.\n\n4. **Review Known Vulnerabilities**: Use the `Known vulnerabilities in iOS` feature in `Settings` > `General` > `Software Update`. Verify that there are no critical or high vulnerabilities listed.\n\n   - **Explanation**: If there are any vulnerabilities listed, update the corresponding software packages to versions without these vulnerabilities.\n\nBy following these steps, you can confirm that your iPhone’s security measures are up-to-date and compliant with the guidelines provided."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "why", "dataset_version": "0.4.0"}, "reply": "Unapproved AI tools (shadow AI) matter because these tools might send work and personal data to providers without proper contracts or transfer bases. This can lead to leaks of confidential or personal data, creating unassessed obligations under the AI Act and GDPR. It also means there's no way to assess how these tools are being used or what kind of data they're handling, potentially exposing sensitive information. Therefore, having a list of approved AI tools helps ensure compliance and protect privacy."}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000685, "profile": "hardened", "dataset_version": "0.4.0", "check_id": "firewall.domain.outbound", "status": "Compliant"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"task\": \"finding\",\n    \"device\": \"Microsoft Windows 11 Pro 10.0.26100 (Windows)\",\n    \"audit_run_as_admin\": \"yes\",\n    \"check\": \"Domain outbound [firewall.domain.outbound]\",\n    \"compliance_results\": \"Compliant\",\n    \"status\": \"Compliant\",\n    \"found\": \"allow\",\n    \"required\": \"allow\",\n    \"detail\": \"Not configured: Windows default (Allow) applies.\",\n    \"references\": [\n      \"ISO 27001:2022 A.8.20 Networks security: Secure, manage and control networks and network devices to protect information.\",\n      \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    ],\n    \"guidance\": \"why: The baseline fixes the default outbound policy so that it is consistent across devices.\\n\\nrisk: Low - A different outbound policy either breaks applications or deviates from the agreed design.\\n\\nfix (windows): \\n- Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultOutboundAction Allow.\\n\\nverify: Re-run the audit; the outbound policy should read allow.\",\n    \"recommendations\": []\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000666, "profile": "typical", "dataset_version": "0.4.0", "check_id": "screen_lock.enabled", "status": "Error"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"task\": \"finding\",\n    \"device\": \"macOS 15.6 (macos)\",\n    \"audit_run_as_admin\": true,\n    \"check\": \"Screen lock [screen_lock.enabled]\",\n    \"status\": \"Error\",\n    \"found\": false,\n    \"required\": true,\n    \"detail\": \"Value could not be read.\",\n    \"references\": [\n      \"ISO 27001:2022 A.8.1 User endpoint devices: Protect information stored on, processed by or reachable from user devices.\",\n      \"ISO 27001:2022 A.7.7 Clear desk and clear screen: Unattended screens and papers must not expose information.\",\n      \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    ],\n    \"guidance\": \"why: An idle device should lock itself so nobody can use it while the owner is away.\\n\\nrisk: Medium - An unlocked, unattended device exposes all the user's data and accounts.\\n\\nfix (macOS): \\n- System Settings > Lock Screen: set the screen saver and display-off times and 'Require password' = Immediately, or enforce with a configuration profile.\\n\\nverify: Re-run the audit; Screen lock should be on.\\n\\nstatus note: The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000795, "profile": "neglected", "dataset_version": "0.4.0", "check_id": "malware.on_access", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"device\": \"Microsoft Windows 11 Pro 10.0.26200 (Windows)\",\n    \"audit_run_as_admin\": true,\n    \"check\": \"On-access protection [malware.on_access]\",\n    \"status\": \"Non-Compliant\",\n    \"found\": \"off\",\n    \"required\": \"on\",\n    \"references\": [\n      \"ISO 27001:2022 A.8.7 Protection against malware: Protect against malware with technical controls supported by user awareness.\",\n      \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    ],\n    \"guidance\": {\n      \"why\": \"On-access scanning checks files when they are opened or written.\",\n      \"risk\": \"Medium - Malicious files can be opened before any scheduled scan finds them.\",\n      \"fix\": \"Enable real-time protection in Microsoft Defender (on-access protection follows it).\",\n      \"verify\": \"Re-run the audit; On-access malware protection should be Compliant.\"\n    }\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000708, "profile": "typical", "dataset_version": "0.4.0", "check_id": "aiact.log_retention", "status": "NotApplicable"}, "reply": "```json\n{\n  \"auditFinding\": {\n    \"task\": \"finding\",\n    \"device\": \"macOS 26.0.1 (macos)\",\n    \"auditRunAsAdmin\": true,\n    \"check\": \"AI usage log retention [aiact.log_retention]\",\n    \"status\": \"NotApplicable\",\n    \"found\": false,\n    \"required\": \">= 6 months for high-risk AI\",\n    \"references\": [\n      \"ISO 27001:2022 A.8.15 Logging: Produce, protect and review logs of activities, exceptions and security events.\",\n      \"EU AI Act Art. 26(6) Deployers: keep automatically generated logs for at least six months: Deployers keep the logs a high-risk AI system generates, under their control, for at least six months unless other law says otherwise.\"\n    ],\n    \"guidance\": \"why: Deployers of high-risk AI systems must keep the system's logs for at least six months.\\n\\nrisk: Medium - Missing logs prevent monitoring and investigation of high-risk AI use.\\n\\nfix (macOS): If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months.\\n\\nverify: Log retention is documented for each high-risk AI system.\",\n    \"statusNote\": \"This check does not apply to this device or configuration.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7001167, "profile": "typical", "dataset_version": "0.4.0", "check_id": "gdpr.backup_recent", "status": "Pending"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"task\": \"finding\",\n    \"device\": \"Microsoft Windows 11 Pro 10.0.22621 (Windows)\",\n    \"audit_run_as_admin\": true,\n    \"check\": \"Recent backup [gdpr.backup_recent]\",\n    \"status\": \"Pending\",\n    \"found\": \"date not readable\",\n    \"required\": \"<= 7 days ago\",\n    \"details\": \"Confirm the last backup date in: OneDrive folder backup (policy).\",\n    \"references\": [\n      \"ISO 27001:2022 A.8.13 Information backup: Keep backup copies of information and software and test that they can be restored.\",\n      \"GDPR Art. 32(1)(c) Security of processing: restore availability and access after an incident: Be able to restore access to personal data in time after a physical or technical incident.\"\n    ],\n    \"guidance\": \"why: A configured backup only helps if it has actually run recently.\\n\\nrisk: Medium - Recent work would be lost if the device failed today.\\n\\nfix (windows): \\n- Check the backup tool's history and run a backup now; fix whatever stopped it (full destination, signed-out OneDrive, stopped agent).\\n\\nverify: Re-run the audit; the last backup should be within 7 days.\",\n    \"status_note\": \"This item needs a further step before it can be judged.\"\n  }\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "macos", "audit": 7000992, "profile": "neglected", "dataset_version": "0.4.0"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"password.min_length\": {\n      \"status\": \"Non-Compliant\",\n      \"found\": \"Minimum password length\"\n    },\n    \"password.history\": {\n      \"status\": \"Compliant\",\n      \"found\": \"Password history\"\n    },\n    \"password.expiration\": {\n      \"status\": \"Compliant\",\n      \"found\": \"Password expiration\"\n    },\n    \"password.min_age\": {\n      \"status\": \"NotApplicable\",\n      \"found\": \"Minimum password age\"\n    },\n    \"password.complexity\": {\n      \"status\": \"Non-Compliant\",\n      \"found\": \"Password complexity\"\n    },\n    \"lockout.threshold\": {\n      \"status\": \"Compliant\",\n      \"found\": \"Account lockout threshold\"\n    },\n    \"lockout.duration\": {\n      \"status\": \"Compliant\",\n      \"found\": \"Account lockout duration\"\n    },\n    \"lockout.observation\": {\n      \"status\": \"Non-Compliant\",\n      \"found\": \"Lockout observation period\"\n    },\n    \"malware.antivirus\": {\n      \"status\": \"Compliant\",\n      \"found\": \"Antivirus\"\n    },\n    \"malware.service\": {\n      \"status\": \"Non-Compliant\",\n      \"found\": \"Apple malware protection service\"\n    },\n    \"malware.signatures\": {\n      \"status\": \"Non-Compliant\",\n      \"found\": \"Malware protection signatures\"\n    },\n    \"malware.signature_updates\": {\n      \"status\": \"Compliant\",\n      \"found\": \"Malware security updates\"\n    },\n    \"malware.on_access\": {\n      \"status\": \"NotApplicable\",\n      \"found\": \"On-access malware protection\"\n    },\n    \"firewall.enabled\": {\n      \"status\": \"Non-Compliant\",\n      \"found\": \"Firewall\"\n    },\n    \"firewall.inbound\": {\n      \"status\": \"Non-Compliant\",\n      \"found\": \"Firewall inbound policy\"\n    },\n    \"firewall.outbound\": {\n      \"status\": \"Compliant\",\n      \"found\": \"Firewall outbound policy\"\n    },\n    \"screen_lock.timeout\": {\n      \"status\": \"Non-Compliant\",\n      \"found\": \"Screen lock timeout\"\n    },\n    \"screen_lock.enabled\": {\n      \"status\": \"Non-Compliant\",\n      \"found\": \"Screen lock\"\n    },\n    \"screen_lock.password\": {\n      \"status\": \"Non-Compliant\",\n      \"found\": \"Screen lock password requirement\"\n    },\n    \"usb.device_access\": {\n      \"status\": \"Compliant\",\n      \"found\": \"USB storage device access\"\n    },\n    \"usb.read\": {\n      \"status\": \"Compliant\",\n      \"found\": \"USB storage read\"\n    },\n    \"usb.write\": {\n      \"status\": \"Non-Compliant\",\n      \"found\": \"USB storage write\"\n    },\n    \"admin.approved\": {\n      \"status\": \"Non-Compliant\",\n      \"found\": \"Approved IT administrator\"\n    },\n    \"admin.unauthorized\": {\n      \"status\": \"Compliant\",\n      \"found\": \"Unauthorized employee administrator accounts\"\n    },\n    \"user.account_type\": {\n      \"status\": \"High\",\n      \"found\": \"Signed-in user account type\"\n    },"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "macos", "audit": 7001404, "profile": "neglected", "dataset_version": "0.4.0"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"ai_classification\": {\n      \"task\": \"AI classification\",\n      \"device\": \"MacOS 13.7.8 (macOS)\",\n      \"tools_found\": [\"Jan\", \"ChatGPT\"],\n      \"approved_tools\": [],\n      \"purpose_of_use\": \"not stated\",\n      \"tool_facts\": [\n        {\n          \"name\": \"Jan\",\n          \"type\": \"Local model runner\",\n          \"provider\": \"Open source\",\n          \"data\": \"On the device unless a cloud model is connected\",\n          \"default_risk_minimal\": true,\n          \"gdpr_check\": \"Check whether remote API providers are configured; if so, the cloud provider rules apply.\"\n        },\n        {\n          \"name\": \"ChatGPT\",\n          \"type\": \"Cloud AI assistant\",\n          \"provider\": \"OpenAI (US)\",\n          \"data\": \"Provider cloud outside the EEA unless an EU data residency plan is used\",\n          \"default_risk_minimal\": true,\n          \"gdpr_check\": \"Needs a business plan with a data processing agreement and a transfer basis (Art. 28, Art. 44); consumer accounts may use prompts for training unless opted out.\"\n        }\n      ],\n      \"rules\": {\n        \"prohibited\": [\n          \"Emotion recognition of employees or students (except for medical or safety reasons)\",\n          \"Social scoring of people\",\n          \"Manipulative or exploitative techniques that cause significant harm\",\n          \"Untargeted scraping of facial images to build face recognition databases\",\n          \"Biometric categorisation inferring sensitive traits such as political views or sexual orientation\"\n        ],\n        \"high-risk examples\": [\n          \"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\",\n          \"Assessing creditworthiness or credit scores of individuals\",\n          \"Deciding access to education or grading students\",\n          \"Assessing eligibility for public benefits or essential services\",\n          \"Risk assessment and pricing in life and health insurance\",\n          \"Biometric identification of people\"\n        ],\n        \"limited risk\": [\n          \"Drafting, summarising, translation, coding help and similar general productivity use\"\n        ],\n        \"minimal risk\": [\n          \"Drafting, summarising, translation, coding help and similar general productivity use\"\n        ]\n      }\n    }\n  }\n}\n```"}
+{"task": "chat", "meta": {"task": "chat", "os": "linux", "status": "audit", "dataset_version": "0.4.0"}, "reply": "To fix your firewall, you need to ensure that there is a host firewall active on your Linux system. Here’s how you can set this up:\n\n### For Debian/Ubuntu:\n```bash\nsudo ufw default deny incoming\nsudo ufw default allow outgoing\nsudo ufw enable\n```\n\n### For Red Hat Enterprise Linux (RHEL):\nFirst, make sure `firewalld` is installed:\n```bash\nsudo yum install firewalld\n```\nThen start and enable `firewalld`:\n```bash\nsudo systemctl enable --now firewalld\n```\n\n### Verifying the Firewall Status:\nAfter setting these commands, run the audit again to check if the firewall is now active.\n\n### Additional Steps:\nIf you want to further secure your firewall, consider enabling stealth mode for macOS:\n```bash\nsudo defaults write /Library/Preferences/com.apple.networksetup StealthModeOn -bool true\n```\n\nThis will prevent the firewall from being detected by other systems, which might be useful in certain environments like hotels or cafes where you don't want your device to be easily identifiable.\n\nBy following these steps, you'll have a more robust firewall setup that helps protect your device against unauthorized access and potential threats."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "control", "dataset_version": "0.4.0"}, "reply": "ISO 27001:2022 A.5.20 requires signed agreements with suppliers that outline the security requirements those suppliers must meet. Specifically, this includes agreements related to cloud and AI services accessed through endpoints. The purpose is to ensure that all parties involved have clear, legally binding contracts that cover information security and data protection measures. This helps prevent any gaps in security protocols and ensures compliance with relevant regulations like GDPR and the EU AI Act."}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "fix", "dataset_version": "0.4.0"}, "reply": "To set up antivirus on your Windows system, follow these steps:\n\n1. **Enable Microsoft Defender Antivirus**:\n   - Go to `Windows Security`.\n   - Navigate to `Virus & threat protection`.\n   - Ensure that `Microsoft Defender Antivirus` is turned on.\n\n2. **Verify Compliance**:\n   - After enabling, re-run the audit to confirm that the antivirus is compliant according to the guidelines provided.\n\nIf you need further assistance or have specific questions about setting up antivirus, feel free to ask!"}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.4.0"}, "reply": "I'm sorry, but I don't have information about the weather tomorrow because my knowledge base doesn't include current or future weather forecasts. To get accurate weather information, you might want to check a reliable weather website or app. If you're looking for advice on securing your devices based on the context provided, please provide more details so I can assist you better."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "phone", "dataset_version": "0.4.0"}, "reply": "To ensure USB debugging is turned off on your Android device, follow these steps:\n\n1. Open the Settings app.\n2. Scroll down and tap on \"System\".\n3. Look for \"Developer options\" under the list of system settings.\n4. If Developer options aren’t visible, go back to the main Settings menu and select \"All\" from the left-hand navigation bar.\n5. In the All section, scroll down until you find \"Developer options\".\n\nIf you still don't see Developer options after checking all these places, it means USB debugging is already disabled. However, if you want to double-check, you could try restarting your device and then looking again. This might sometimes force the developer options to appear even if they were previously hidden."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "refs", "dataset_version": "0.4.0"}, "reply": "The following compliance controls relate to account lockout duration:\n\n1. **ISO 27001:2022** - Control A.8.5 (Secure Authentication)\n   - This control ensures that account lockouts are implemented correctly.\n   - It requires that the lockout duration is set to at least `LOCKOUT_DURATION_MIN_MINUTES` minutes, or until an administrator unlocks.\n\n2. **GDPR Art. 32(1)(b)** - Security of Processing: Confidentiality, Integrity, Availability, and Resilience\n   - This regulation emphasizes the importance of protecting personal data from unauthorized access and ensuring its integrity.\n   - Compliance here involves implementing measures such as account lockouts to prevent unauthorized access.\n\nThese controls ensure that account lockouts are properly configured to protect sensitive information and maintain system integrity."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "tool", "dataset_version": "0.4.0"}, "reply": "Based on the information provided:\n\n1. **GPT4All** is described as a local model runner used with the AI tool Nomic AI.\n2. The default EU AI Act risk class for general office use is considered minimal.\n3. GDPR requires keeping the optional data lake sharing turned off.\n\nGiven these points, **GPT4All appears to be relatively low-risk according to current regulations**, especially since there's no mention of specific risks associated with its usage. However, it's important to note that the actual risk might depend on your organization's policies regarding AI tools and data handling.\n\nTo ensure compliance with GDPR and other relevant regulations, I would recommend reviewing your organization's approved AI tools list and checking whether GPT4All aligns with those guidelines. Additionally, consider consulting with legal counsel to confirm that the use of GPT4All complies with all applicable laws and internal policies."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.4.0"}, "reply": "I'm sorry, but the provided context doesn't contain any information about setting up a Web Application Firewall (WAF) in Cloudflare. The context discusses how to perform a phone check, configure antivirus software, and ensure proper backups on Linux systems. There is no mention of Cloudflare or WAFs. Therefore, based solely on the given information, I don't have enough details to guide you through setting up a WAF in Cloudflare. \n\nIf you need assistance with configuring antivirus software or backing up your Linux system, those topics are covered in the provided context. However, for setting up a WAF, you would need additional resources specific to Cloudflare's documentation or support channels."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "verify", "dataset_version": "0.4.0"}, "reply": "To ensure your macOS has the correct supported operating system version:\n\n1. **Upgrade to macOS 14 or later**: Check if your current macOS version is up-to-date. If not, consider upgrading to a newer version.\n\n2. **Replace outdated Macs**: If your Mac doesn't support a newer version, consider replacing it with one that does.\n\n3. **Re-run the audit**: After making these changes, re-run the audit to confirm that the supported operating system version is now compliant.\n\nThis will help keep your macOS secure and protect against new vulnerabilities that might arise from older versions."}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "why", "dataset_version": "0.4.0"}, "reply": "If known vulnerabilities in your installed software aren't properly managed on your Windows system, there's a significant risk:\n\n**High Risk:** Attackers can exploit these vulnerabilities to gain unauthorized access to your computer.\n\n**Why It Matters:** Software vulnerabilities are like weak spots in your security wall. When they're left unaddressed, hackers can find ways through them, allowing them to steal information, take control of your computer, or even cause damage.\n\n**How It Can Happen:** If your software has critical or high vulnerabilities, and those vulnerabilities haven't been patched, attackers might discover them before you do. This means they could potentially exploit these flaws to carry out malicious activities on your machine.\n\n**What Needs to Be Done:** To mitigate this risk, ensure that all installed software versions match the latest available patches from trusted sources such as the OS Vendor or the National Vulnerability Database (NVD). This helps keep your systems protected against newly discovered vulnerabilities.\n\nBy following these steps, you'll reduce the likelihood of being compromised due to unpatched software vulnerabilities."}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000341, "profile": "typical", "dataset_version": "0.4.0", "check_id": "gdpr.removable_encryption", "status": "Compliant"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"task\": \"finding\",\n    \"device\": \"macOS 14.7.8 (macos)\",\n    \"audit_run_as_admin\": \"yes\",\n    \"check\": \"Removable media encryption [gdpr.removable_encryption]\",\n    \"status\": \"Compliant\",\n    \"found\": \"writing to external drives blocked\",\n    \"required\": \"no unencrypted writes\",\n    \"references\": [\n      \"ISO 27001:2022 A.7.10 Storage media: Manage removable media through its life cycle according to the classification of the data on it.\",\n      \"ISO 27001:2022 A.8.24 Use of cryptography: Define and apply rules for using cryptography, including key management.\",\n      \"GDPR Art. 32(1)(a) Security of processing: pseudonymisation and encryption: Where appropriate, protect personal data with pseudonymisation and encryption.\",\n      \"GDPR Art. 34 Communication of a personal data breach to the data subject: Tell affected people about a high-risk breach without undue delay; encryption can remove this duty.\"\n    ],\n    \"guidance\": \"why: Personal data copied to removable media must be encrypted, or copying must be blocked.\\n\\nrisk: Medium - A lost unencrypted USB drive with personal data is a reportable breach.\\n\\nfix (macOS): Restrict external storage writes with your MDM or an endpoint DLP product and provide approved encrypted drives.\\n\\nverify: Re-run the audit; Removable media encryption should be Compliant.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000283, "profile": "hardened", "dataset_version": "0.4.0", "check_id": "screen_lock.password", "status": "Error"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"task\": \"finding\",\n    \"device\": \"Microsoft Windows 11 Pro 10.0.26200 (windows)\",\n    \"audit_run_as_admin\": true,\n    \"check\": \"Screen lock password requirement [screen_lock.password]\",\n    \"status\": \"Error\",\n    \"found\": false,\n    \"required\": \"sign-in required to unlock\",\n    \"detail\": \"Value could not be read.\",\n    \"references\": [\n      \"ISO 27001:2022 A.8.1 User endpoint devices: Protect information stored on, processed by or reachable from user devices.\",\n      \"ISO 27001:2022 A.7.7 Clear desk and clear screen: Unattended screens and papers must not expose information.\",\n      \"ISO 27001:2022 A.8.5 Secure authentication: Authentication methods and procedures resist guessing, brute force and misuse.\",\n      \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    ],\n    \"guidance\": {\n      \"why\": \"Unlocking the screen must require the user's password.\",\n      \"risk\": \"Medium - A screen lock that needs no password does not protect anything.\",\n      \"fix_windows\": \"- Set the machine inactivity limit by Group Policy (this always requires sign-in), or enable 'Password protect the screen saver' for users by Group Policy.\",\n      \"verify\": \"Re-run the audit; the password requirement should be Compliant.\",\n      \"status_note\": \"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"\n    }\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000795, "profile": "neglected", "dataset_version": "0.4.0", "check_id": "vuln.known_vulnerabilities", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"task\": \"Finding\",\n    \"device\": \"Microsoft Windows 11 Pro 10.0.26200 (Windows)\",\n    \"audit_run_as_admin\": true,\n    \"check\": \"Known vulnerabilities in installed software [vuln.known_vulnerabilities]\",\n    \"compliance_results_status\": \"Non-Compliant\",\n    \"found_critical_high\": 105,\n    \"required_critical_high\": 0,\n    \"details\": [\n      \"Matched against offline OSV/NVD data from 2026-10-08.\",\n      \"18 applications inventoried, 13 recognized (31 common applications covered).\"\n    ],\n    \"references\": [\n      \"ISO 27001:2022 A.8.8 Management of technical vulnerabilities: Find technical weaknesses in time, judge the exposure and fix them.\",\n      \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    ],\n    \"guidance\": [\n      \"why: Installed software versions with published critical or high vulnerabilities give attackers a ready-made way in.\",\n      \"risk: High - Critical and high vulnerabilities often allow remote code execution or privilege escalation.\",\n      \"fix (Windows): - Update or remove each listed software package to a version without the listed vulnerabilities; where no fix exists yet, apply the vendor's workaround or restrict the software's use.\",\n      \"- Use winget upgrade or the vendor's installer to reach a fixed version.\",\n      \"- Verify by re-running the audit; critical or high vulnerabilities should be 0 or fewer.\"\n    ]\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001369, "profile": "typical", "dataset_version": "0.4.0", "check_id": "malware.on_access", "status": "NotApplicable"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"task\": \"finding\",\n    \"device\": \"macOS 26.0.1 (macos)\",\n    \"audit_run_as_admin\": \"yes\",\n    \"check\": \"On-access malware protection [malware.on_access]\",\n    \"status\": \"NotApplicable\",\n    \"found\": \"XProtect only\",\n    \"required\": \"on-access scanning\",\n    \"details\": [\n      \"XProtect scans at launch and download; macOS has no built-in on-access scanning.\",\n      \"References:\",\n      \"- ISO 27001:2022 A.8.7 Protection against malware: Protect against malware with technical controls supported by user awareness.\",\n      \"- GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    ],\n    \"guidance\": [\n      \"why: On-access scanning checks files when they are opened or written.\",\n      \"risk: Medium - Malicious files can be opened before any scheduled scan finds them.\",\n      \"fix (macos): Not provided by macOS itself; deploy a managed endpoint protection product if required.\",\n      \"verify: Re-run the audit; On-access malware protection should be Compliant.\",\n      \"status note: This check does not apply to this device or configuration.\"\n    ]\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000175, "profile": "typical", "dataset_version": "0.4.0", "check_id": "aiact.risk_classification", "status": "Pending"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"task\": \"finding\",\n    \"device\": \"Microsoft Windows 11 Enterprise 10.0.26100 (Windows)\",\n    \"audit_run_as_admin\": true,\n    \"check\": \"AI system risk classification [aiact.risk_classification] in EU AI ACT CONTROLS\",\n    \"status\": \"Pending\",\n    \"found\": \"GPT4All\",\n    \"required\": \"every AI tool classified\",\n    \"details\": [\n      \"Classified by the auditor model (Caveat classifier) in a later step.\",\n      \"References:\",\n      \"- ISO 27001:2022 A.5.9 Inventory of information and other associated assets: Know which information assets, devices and software exist and who owns them, and keep that list current.\",\n      \"- EU AI Act Art. 5 Prohibited AI practices: Certain AI uses are banned, such as emotion recognition at work and in education (with narrow exceptions) and social scoring.\",\n      \"- EU AI Act Art. 6 Classification rules for high-risk AI systems: An AI system is high-risk if it is a safety component of regulated products or is used for a purpose listed in Annex III.\",\n      \"- EU AI Act Annex III High-risk AI systems referred to in Article 6(2): Lists high-risk uses such as biometrics, critical infrastructure, education, employment and worker management, access to essential services, law enforcement, migration and justice.\",\n      \"- Guidance: why: Each AI system must be checked against the banned practices and the high-risk uses in Annex III.\",\n      \"- Risk: Medium - An unclassified tool could be used for a high-risk or prohibited purpose without the required safeguards.\",\n      \"- Fix (Windows): - Record the purpose for which each listed tool is used and classify it (prohibited, high-risk, limited-risk transparency, minimal). The auditor model does this from the inventory and the stated purpose.\",\n      \"- Verify: Every AI tool in the inventory has a classification in the AI register.\"\n    ],\n    \"status_note\": \"This item needs a further step before it can be judged.\"\n  }\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "android", "audit": 7000728, "profile": "neglected", "dataset_version": "0.4.0"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"malware_antivirus\": {\n      \"status\": \"Non-Compliant\",\n      \"description\": \"Play Protect scanning is off.\",\n      \"risk_level\": \"High\"\n    },\n    \"screen_lock\": {\n      \"status\": \"Non-Compliant\",\n      \"description\": \"No screen lock enabled (Swipe/None)\",\n      \"risk_level\": \"Medium\"\n    },\n    \"mobile_jailbreak_root\": {\n      \"status\": \"Non-Compliant\",\n      \"description\": \"Rooted or bootloader unlocked\",\n      \"risk_level\": \"High\"\n    },\n    \"mobile_find_my_device\": {\n      \"status\": \"Non-Compliant\",\n      \"description\": \"Off\",\n      \"risk_level\": \"Medium\"\n    },\n    \"vuln_outdated_apps\": {\n      \"status\": \"Non-Compliant\",\n      \"description\": \"Automatic app updates are off\",\n      \"risk_level\": \"Medium\"\n    },\n    \"gdpr_auto_updates\": {\n      \"status\": \"Non-Compliant\",\n      \"description\": \"Manual\",\n      \"risk_level\": \"High\"\n    },\n    \"gdpr_time_sync\": {\n      \"status\": \"Non-Compliant\",\n      \"description\": \"Set by hand\",\n      \"risk_level\": \"Low\"\n    },\n    \"aiact_os_ai_features\": {\n      \"status\": \"Non-Compliant\",\n      \"description\": \"Assistant screen access on\",\n      \"risk_level\": \"Medium\"\n    }\n  },\n  \"risk_levels\": [\n    {\n      \"name\": \"malware_antivirus\",\n      \"level\": \"High\"\n    },\n    {\n      \"name\": \"screen_lock\",\n      \"level\": \"Medium\"\n    },\n    {\n      \"name\": \"mobile_jailbreak_root\",\n      \"level\": \"High\"\n    },\n    {\n      \"name\": \"gdpr_auto_updates\",\n      \"level\": \"High\"\n    },\n    {\n      \"name\": \"org_processor_agreements\",\n      \"level\": \"High\"\n    },\n    {\n      \"name\": \"screen_lock_enabled\",\n      \"level\": \"Medium\"\n    },\n    {\n      \"name\": \"gdpr_auto_updates\",\n      \"level\": \"High\"\n    },\n    {\n      \"name\": \"gdpr_time_sync\",\n      \"level\": \"Low\"\n    },\n    {\n      \"name\": \"aiact_os_ai_features\",\n      \"level\": \"Medium\"\n    }\n  ],\n  \"score\": {\n    \"compliant\": 9,\n    \"assessed\": 24,\n    \"percent\": 38\n  },\n  \"top_gaps\": [\n    {\n      \"gap_name\": \"malware_antivirus\",\n      \"risk_level\": \"High\",\n      \"description\": \"Play Protect scanning is off.\"\n    },\n    {\n      \"gap_name\": \"mobile_jailbreak_root\",\n      \"risk_level\": \"High\",\n      \"description\": \"Rooted or bootloader unlocked\"\n    },\n    {\n      \"gap_name\": \"gdpr_auto_updates\",\n      \"risk_level\": \"High\",\n      \"description\": \"Manual\"\n    },\n    {\n      \"gap_name\": \"screen_lock_enabled\",\n      \"risk_level\": \"Medium\",\n      \"description\": \"no screen lock (Swipe/None)\"\n    },\n    {\n      \"gap_name\": \"aiact_os_ai"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "macos", "audit": 7001397, "profile": "typical", "dataset_version": "0.4.0"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"LM Studio\": {\n      \"risk_level\": \"minimal\",\n      \"data_location\": \"On the device\",\n      \"GDPR_compliance\": \"No transfer to a provider\"\n    },\n    \"Jan\": {\n      \"risk_level\": \"minimal\",\n      \"data_location\": \"On the device unless a cloud model is connected\",\n      \"GDPR_compliance\": \"Check whether remote API providers are configured; if so, the cloud provider rules apply\"\n    }\n  },\n  \"prohibited_use_cases\": [\n    \"Emotion recognition of employees or students (except for medical or safety reasons)\",\n    \"Social scoring of people\",\n    \"Manipulative or exploitative techniques that cause significant harm\",\n    \"Untargeted scraping of facial images to build face recognition databases\",\n    \"Biometric categorisation inferring sensitive traits such as political views or sexual orientation\"\n  ],\n  \"high_risk_use_cases\": [\n    \"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\",\n    \"Assessing creditworthiness or credit scores of individuals\",\n    \"Deciding access to education or grading students\",\n    \"Assessing eligibility for public benefits or essential services\",\n    \"Risk assessment and pricing in life and health insurance\",\n    \"Biometric identification of people\"\n  ],\n  \"limited_risk_use_cases\": [\n    \"Chatbots and AI-generated content: people must be told they are dealing with AI\",\n    \"Published deepfakes or AI-written public-interest text must be labelled (Art. 50)\"\n  ],\n  \"minimal_risk_use_cases\": [\n    \"Drafting, summarizing, translation, coding help and similar general productivity use\"\n  ]\n}\n```"}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "audit", "dataset_version": "0.4.0"}, "reply": "To address known vulnerabilities in iOS, you need to ensure your device has the latest available updates. Here’s how:\n\n1. **Update Your Device**: Go to `Settings` > `General` > `Software Update`. Check for any available updates and install them immediately.\n   \n2. **Check for Pending Updates**: Ensure there are no pending security updates. If there are, update them according to the instructions provided.\n\n3. **Verify Compliance**: After updating, re-run the audit to confirm that all critical and high vulnerabilities have been resolved.\n\nBy following these steps, you will keep your iOS device secure from known vulnerabilities. This ensures that your device remains protected against potential attacks targeting those vulnerabilities."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "control", "dataset_version": "0.4.0"}, "reply": "The EU AI Act requires deployers of high-risk AI systems to take several important steps:\n\n1. **Keep Logs**: They must keep automatically generated logs for at least six months. These logs should be kept under their control and available for inspection by auditors.\n\n2. **Use According to Instructions**: Deployers must ensure that high-risk AI systems are used exactly as they were intended. This means following the guidelines provided with the AI tools.\n\n3. **Assign Human Oversight**: For high-risk AI systems, there needs to be trained personnel who can understand, monitor, and potentially override the AI when necessary.\n\n4. **Monitor and Retain Logs**: Deployers must continuously monitor the performance of high-risk AI systems and retain detailed logs for at least six months. This helps in maintaining accountability and ensuring compliance with regulations.\n\nThese obligations aim to protect users and maintain trust in AI technology, especially when it comes to critical applications like autonomous vehicles or medical diagnostics."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "fix", "dataset_version": "0.4.0"}, "reply": "To block unknown apps on your Android device:\n\n1. Go to Settings.\n2. Tap Apps.\n3. Scroll down and tap Special app access.\n4. Look for Install unknown apps.\n5. Set every app to Not allowed.\n\nThis will prevent new apps from being installed unless they're from the official Google Play store. Make sure to remove any apps that didn't come from Google Play this way. This helps protect your device from potential malware."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "tool", "dataset_version": "0.4.0"}, "reply": "According to the context provided, the default EU AI Act risk class for Meta AI when built into WhatsApp, Instagram, and Facebook apps is minimal. This means that while there may be some risks associated with its use, they are generally considered low by the European Union's standards. However, this classification might change based on specific circumstances such as the organization's approved AI tools list and the intended purpose of its use within the workplace."}
+{"task": "chat", "meta": {"task": "chat", "os": "linux", "status": "verify", "dataset_version": "0.4.0"}, "reply": "To ensure that the signed-in user account type is set correctly on your Linux system, you need to run the following command:\n\n```bash\ngpasswd -S\n```\n\nThis command will show you which groups each logged-in user belongs to. Look for the group `sudo` or `wheel`, which typically grants administrative privileges. If the signed-in user is listed there, they have elevated permissions.\n\nIf the signed-in user is not part of these groups, you should adjust the account settings accordingly. This might involve removing them from the `sudo` or `wheel` group and creating a separate, approved admin account for daily tasks. Make sure to update the `/etc/sudoers` file to reflect this change.\n\nAfter making these changes, re-run the audit to confirm that the signed-in user account type has been updated correctly."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "why", "dataset_version": "0.4.0"}, "reply": "If sensitive notifications hidden when locked isn't set up on your Android, there's a medium risk. This means someone could potentially access information like messages and emails even when your phone is locked. These notifications might contain personal data that shouldn't be visible unless the phone is unlocked.\n\nTo mitigate this risk, make sure that:\n\n1. In the \"Notifications\" section under \"Settings,\" you've chosen either \"Hide sensitive content\" or \"Don't show notifications\" for the locked state.\n2. On Windows, ensure the machine has an inactivity limit or a password-protected screen saver.\n3. On Android, configure a screen lock with a PIN, password, or biometric authentication.\n\nRunning these checks will confirm whether the necessary settings have been applied correctly."}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000922, "profile": "neglected", "dataset_version": "0.4.0", "check_id": "malware.signatures", "status": "Compliant"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"task\": \"finding\",\n    \"device\": \"Ubuntu 22.04.5 LTS 22.04 (linux)\",\n    \"audit_run_as_admin\": true,\n    \"check\": \"Malware signatures [malware.signatures] in COMPLIANCE RESULTS\",\n    \"status\": \"Compliant\",\n    \"found\": \"3 days old\",\n    \"required\": \"<= 3 days old\",\n    \"details\": \"/var/lib/clamav/daily.cld\",\n    \"references\": [\n      \"ISO 27001:2022 A.8.7 Protection against malware: Protect against malware with technical controls supported by user awareness.\",\n      \"ISO 27001:2022 A.8.8 Management of technical vulnerabilities: Find technical weaknesses in time, judge the exposure and fix them.\",\n      \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    ],\n    \"guidance\": \"why: Anti-malware can only detect threats it knows about; signatures must be current.\\n\\nrisk: High - Outdated signatures miss recent malware.\\n\\nfix (linux): systemctl enable --now clamav-freshclam, or run freshclam once to update now.\\n\\nverify: Re-run the audit; signatures should be within the allowed age.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000974, "profile": "typical", "dataset_version": "0.4.0", "check_id": "firewall.outbound", "status": "Error"}, "reply": "```json\n{\n  \"auditFinding\": {\n    \"task\": \"finding\",\n    \"device\": \"Ubuntu 24.04.3 LTS 24.04 (linux)\",\n    \"auditRunAsAdmin\": \"no\",\n    \"check\": \"Firewall outbound policy [firewall.outbound]\",\n    \"complianceResults\": \"Error\",\n    \"status\": \"Found\",\n    \"required\": \"allow\",\n    \"details\": \"Requires root: run the collector with sudo.\",\n    \"references\": [\n      \"ISO 27001:2022 A.8.20 Networks security: Secure, manage and control networks and network devices to protect information.\",\n      \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    ],\n    \"guidance\": \"why: The baseline fixes the default outbound policy so that it is consistent across devices.\\n\\nrisk: Low - A different outbound policy either breaks applications or deviates from the agreed design.\\n\\nfix (linux): - ufw default allow outgoing (or the equivalent nftables output policy).\\n\\nverify: Re-run the audit; the outbound policy should read allow.\\n\\nstatus note: The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\",\n    \"statusNote\": \"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000496, "profile": "typical", "dataset_version": "0.4.0", "check_id": "malware.tamper", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"device\": \"Microsoft Windows 11 Pro 10.0.26200 (Windows)\",\n    \"audit_run_as_admin\": true,\n    \"check\": \"Tamper protection [malware.tamper]\",\n    \"status\": \"Non-Compliant\",\n    \"found\": false,\n    \"required\": true,\n    \"references\": [\n      \"ISO 27001:2022 A.8.7 Protection against malware: Protect against malware with technical controls supported by user awareness.\",\n      \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    ],\n    \"guidance\": {\n      \"why\": \"Tamper protection stops malware or users switching off Defender.\",\n      \"risk\": \"Medium - Attackers commonly disable antivirus before deploying ransomware.\",\n      \"fix\": \"Turn on Tamper Protection in Windows Security > Virus & threat protection settings, or centrally through Microsoft Intune / Defender for Endpoint (it cannot be set with PowerShell).\",\n      \"verify\": \"Re-run the audit; Tamper protection should be on.\"\n    }\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001334, "profile": "typical", "dataset_version": "0.4.0", "check_id": "aiact.os_ai_features", "status": "NotApplicable"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"task\": \"finding\",\n    \"device\": \"Debian GNU/Linux 12 (bookworm)\",\n    \"audit_run_as_admin\": \"yes\",\n    \"check\": \"Operating system AI features restricted [aiact.os_ai_features] in EU AI ACT CONTROLS\",\n    \"status\": \"NotApplicable\",\n    \"found\": \"none built in\",\n    \"required\": \"restricted by policy\",\n    \"detail\": \"Linux distributions ship no built-in AI assistant.\",\n    \"references\": [\n      \"ISO 27001:2022 A.5.34 Privacy and protection of PII: Meet the legal and contractual requirements for protecting personal data.\",\n      \"GDPR Art. 5(1)(c) Data minimisation: Personal data must be adequate, relevant and limited to what is necessary for the purpose.\",\n      \"GDPR Art. 25 Data protection by design and by default: Build data protection into systems and use privacy-friendly settings by default.\",\n      \"EU AI Act Art. 26 Obligations of deployers of high-risk AI systems: Deployers must use high-risk AI as instructed, assign human oversight, monitor it, keep logs and inform affected people.\"\n    ],\n    \"guidance\": {\n      \"why\": \"Built-in OS AI features can capture screen content or send text to external AI services.\",\n      \"risk\": \"Medium - Screen snapshots or prompts can contain personal and confidential data processed without a defined purpose.\",\n      \"fix\": \"(linux): No action needed: Linux distributions have no built-in AI assistant.\",\n      \"verify\": \"Re-run the audit; the OS AI features check should be Compliant or NotApplicable.\",\n      \"status_note\": \"This check does not apply to this device or configuration.\"\n    }\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7001113, "profile": "neglected", "dataset_version": "0.4.0", "check_id": "org.human_oversight", "status": "Pending"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"task\": \"finding\",\n    \"device\": \"Android 14 (android)\",\n    \"audit_run_as_admin\": \"no\",\n    \"check\": \"Human oversight for high-risk AI [org.human_oversight] in ORGANISATIONAL CONTROLS\",\n    \"status\": \"Pending\",\n    \"found\": \"not answered\",\n    \"required\": \"yes\",\n    \"details\": \"Answered once by the organisation (organisational.conf); not part of the phone self-check.\",\n    \"references\": [\n      \"EU AI Act Art. 14 Human oversight: High-risk AI systems must be designed so that people can oversee them effectively.\",\n      \"EU AI Act Art. 26 Obligations of deployers of high-risk AI systems: Deployers must use high-risk AI as instructed, assign human oversight, monitor it, keep logs and inform affected people.\"\n    ],\n    \"guidance\": {\n      \"why\": \"High-risk AI systems need trained people who can understand, monitor and override them.\",\n      \"risk\": \"Medium - High-risk AI without oversight can harm people without anyone noticing.\",\n      \"fix\": \"For each high-risk AI system, name a trained person responsible for oversight; answer n/a if no high-risk AI is used.\",\n      \"verify\": \"Answer ORG_HUMAN_OVERSIGHT=yes (or n/a) in organisational.conf.\",\n      \"status_note\": \"This item needs a further step before it can be judged.\"\n    }\n  }\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "macos", "audit": 7001352, "profile": "typical", "dataset_version": "0.4.0"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"lockout.threshold\": {\n      \"risk_level\": \"Medium\",\n      \"fix_guidance\": \"Turn on stealth mode: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on.\"\n    },\n    \"vuln.pending_updates\": {\n      \"risk_level\": \"High\",\n      \"fix_guidance\": \"Install the pending updates: System Settings > General > Software Update, or softwareupdate -ia, then restart if asked.\"\n    },\n    \"vuln.known_vulnerabilities\": {\n      \"risk_level\": \"High\",\n      \"fix_guidance\": \"Update or remove each listed software package to a version without the listed vulnerabilities; where no fix exists yet, apply the vendor's workaround or restrict the software's use.\"\n    },\n    \"gdpr.auto_updates\": {\n      \"risk_level\": \"High\",\n      \"fix_guidance\": \"Check 'check' box, set 'download' to '1', set 'security' to '1', and set 'macOS-install' to '0'.\"\n    },\n    \"gdpr.remote_access\": {\n      \"risk_level\": \"High\",\n      \"fix_guidance\": \"Restrict SSH and AnyDesk remote access services.\"\n    }\n  },\n  \"risk_levels\": [\n    {\n      \"name\": \"lockout.threshold\",\n      \"risk_level\": \"Medium\"\n    },\n    {\n      \"name\": \"firewall.inbound\",\n      \"risk_level\": \"High\"\n    },\n    {\n      \"name\": \"screen_lock.timeout\",\n      \"risk_level\": \"Medium\"\n    },\n    {\n      \"name\": \"usb.write\",\n      \"risk_level\": \"Medium\"\n    },\n    {\n      \"name\": \"vuln.pending_updates\",\n      \"risk_level\": \"High\"\n    },\n    {\n      \"name\": \"vuln.known_vulnerabilities\",\n      \"risk_level\": \"High\"\n    },\n    {\n      \"name\": \"gdpr.auto_updates\",\n      \"risk_level\": \"High\"\n    },\n    {\n      \"name\": \"gdpr.remote_access\",\n      \"risk_level\": \"High\"\n    },\n    {\n      \"name\": \"gdpr.telemetry\",\n      \"risk_level\": \"Low\"\n    },\n    {\n      \"name\": \"aiact.unapproved\",\n      \"risk_level\": \"Medium\"\n    },\n    {\n      \"name\": \"org.ropa\",\n      \"risk_level\": \"High\"\n    },\n    {\n      \"name\": \"org.human_oversight\",\n      \"risk_level\": \"Medium\"\n    },\n    {\n      \"name\": \"org.ai_transparency\",\n      \"risk_level\": \"Low\"\n    }\n  ],\n  \"top_gaps\": [\n    {\n      \"gap_name\": \"firewall.inbound\",\n      \"risk_level\": \"High\",\n      \"description\": \"Firewall inbound policy is currently enabled but stealth mode is off.\",\n      \"fix_guidance\": \"Turn on stealth mode: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on.\"\n    },\n    {\n      \"gap_name\": \"vuln.pending_updates\",\n      \"risk_level\": \"High\",\n      \"description\": \"There is one pending update that needs to be installed.\",\n      \"fix_guidance\": \"Install the pending updates: System Settings > General > Software Update, or software"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "android", "audit": 7001492, "profile": "typical", "dataset_version": "0.4.0"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"ai_classification\": {\n      \"task_description\": \"The purpose of using DeepSeek is not specified.\",\n      \"tool_facts\": [\n        {\n          \"name\": \"DeepSeek\",\n          \"provider\": \"DeepSeek (China)\",\n          \"data_location\": \"Provider cloud in the People's Republic of China\",\n          \"default_risk_minimal\": true,\n          \"gdpr_status\": \"No EU adequacy decision for China and no business data processing terms\",\n          \"eua_data_protection_authorities_restrictions\": \"Do not use with work or personal data\"\n        },\n        {\n          \"rule_name\": \"prohibited\",\n          \"description\": \"Emotion recognition of employees or students (except for medical or safety reasons); Social scoring of people; Manipulative or exploitative techniques that cause significant harm; Untargeted scraping of facial images to build face recognition databases; Biometric categorisation inferring sensitive traits such as political views or sexual orientation\"\n        }\n      ],\n      \"rules\": [\n        {\n          \"risk_level\": \"high-risk\",\n          \"examples\": [\"Screening or ranking job applicants\", \"Assessing creditworthiness or credit scores of individuals\", \"Deciding access to education or grading students\"]\n        },\n        {\n          \"risk_level\": \"limited risk\",\n          \"examples\": [\"Chatbots and AI-generated content: people must be told they are dealing with AI\", \"Drafting, summarizing, translation, coding help and similar general productivity use\"]\n        },\n        {\n          \"risk_level\": \"minimal risk\",\n          \"examples\": [\"Drafting, summarizing, translation, coding help and similar general productivity use\"]\n        }\n      ]\n    }\n  }\n}\n```"}
+{"task": "chat", "meta": {"task": "chat", "os": "linux", "status": "audit", "dataset_version": "0.4.0"}, "reply": "The most important thing to fix based on your audit findings is the minimum password length. This setting is crucial because short passwords can be easily guessed or cracked, making them less secure. According to the context, the minimum password length should be at least 14 characters long. Fixing this issue will significantly enhance the overall security of your system by ensuring stronger passwords."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "fix", "dataset_version": "0.4.0"}, "reply": "To set up unauthorized employee administrator accounts on your macOS, you need to demote these accounts from being administrators. This means removing them from the group of users who have administrative privileges.\n\nHere’s how you can do it:\n\n1. **Identify the Accounts**: First, find out which accounts are currently marked as administrators.\n   \n   - Go to System Preferences > Users & Groups.\n   - Look through the list of users and select each one.\n   - Check the box next to “Administrator” to see if they are listed there.\n\n2. **Demote the Accounts**:\n   - Open Terminal.\n   - Use the following command to remove the administrator status from each identified account:\n     ```bash\n     sudo dseditgroup -o edit -d <username> -t user admin\n     ```\n     Replace `<username>` with the actual username of the account you want to demote.\n\n3. **Verify Changes**:\n   - After running the above command, re-run the audit to ensure that no unauthorized administrator accounts remain.\n\nThis process ensures that only the approved IT administrator has administrative rights, reducing the risk of unauthorized changes to your device."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "tool", "dataset_version": "0.4.0"}, "reply": "Based on the information provided:\n\n1. **Local Model Runner**: The context states that Ollama runs locally without leaving any data outside the device. This suggests it has low risk when used within your organization.\n\n2. **EU AI Act Risk Class**: It is classified as having a minimal risk class for general office use, which indicates it poses little threat under typical conditions.\n\n3. **GDPR Compliance**: There is no mention of transferring data to a provider, so there’s no risk of data being transferred outside your control.\n\nGiven these points, Ollama seems generally safe for your company. However, here are a few additional considerations:\n\n- **Workplace Approval**: Ensure that the AI tool is included in your organization's approved list of AI tools. Some uses might be considered high-risk or prohibited depending on the specific policies and regulations of your workplace.\n\n- **Backup Configuration**: Verify that backups are properly set up according to your organization's guidelines. This ensures that important data is protected even if the device itself is compromised.\n\nIf you need more detailed guidance or have concerns, consider running a full audit to ensure all aspects of data protection and compliance are covered."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "why", "dataset_version": "0.4.0"}, "reply": "Date & time set automatically matters because accurate times are crucial for organizing events correctly when investigating incidents. If the times are wrong, it makes it hard to tell what happened at different points in time, which can affect how well we understand and respond to problems. This is important under both ISO 27001 and GDPR regulations, where keeping track of events accurately helps ensure compliance with reporting requirements."}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001273, "profile": "hardened", "dataset_version": "0.4.0", "check_id": "user.account_type", "status": "Compliant"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"task\": \"finding\",\n    \"device\": \"Red Hat Enterprise Linux 9.6 (Plow) 9.6 (linux)\",\n    \"audit_run_as_admin\": true,\n    \"check\": \"Signed-in user account type [user.account_type] in COMPLIANCE RESULTS\",\n    \"status\": \"Compliant\",\n    \"found\": \"Standard (tnguyen)\",\n    \"required\": \"Standard\",\n    \"references\": [\n      \"ISO 27001:2022 A.8.2 Privileged access rights: Restrict and manage the allocation and use of administrator rights.\",\n      \"ISO 27001:2022 A.5.15 Access control: Grant access to information and systems based on business need, and document the rules.\",\n      \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    ],\n    \"guidance\": \"why: Day-to-day work under an administrator account lets any malware or mistake change the whole system.\\n\\nrisk: High - Malware started by the signed-in user runs with full administrator rights.\\n\\nfix (linux): - Remove the signed-in user from sudo/wheel (gpasswd -d <account> sudo) and use a separate approved admin account.\\n\\nverify: Re-run the audit; Signed-in user account type should read Standard.\",\n    \"recommendation\": \"Ensure that all users have appropriate roles and permissions based on their job responsibilities. Implement least privilege principle to restrict administrative access where possible.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001457, "profile": "typical", "dataset_version": "0.4.0", "check_id": "firewall.outbound", "status": "Error"}, "reply": "```json\n{\n  \"auditFinding\": {\n    \"task\": \"finding\",\n    \"device\": \"Ubuntu 20.04.6 LTS 20.04 (linux)\",\n    \"auditRunAsAdmin\": \"no\",\n    \"check\": \"Firewall outbound policy [firewall.outbound]\",\n    \"complianceResults\": \"Error\",\n    \"status\": \"Found\",\n    \"required\": \"allow\",\n    \"details\": \"Requires root: run the collector with sudo.\",\n    \"references\": [\n      \"ISO 27001:2022 A.8.20 Networks security: Secure, manage and control networks and network devices to protect information.\",\n      \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    ],\n    \"guidance\": \"why: The baseline fixes the default outbound policy so that it is consistent across devices.\\n\\nrisk: Low - A different outbound policy either breaks applications or deviates from the agreed design.\\n\\nfix (linux): - ufw default allow outgoing (or the equivalent nftables output policy).\\n\\nverify: Re-run the audit; the outbound policy should read allow.\\n\\nstatus note: The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\",\n    \"statusNote\": \"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7001028, "profile": "neglected", "dataset_version": "0.4.0", "check_id": "password.min_length", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"task\": \"finding\",\n    \"device\": \"Microsoft Windows 11 Pro 10.0.22621 (windows)\",\n    \"audit_run_as_admin\": true,\n    \"check\": \"Minimum password length [password.min_length]\",\n    \"status\": \"Non-Compliant\",\n    \"found\": 10,\n    \"required\": \">= 14\",\n    \"references\": [\n      \"ISO 27001:2022 A.5.17 Authentication information: Passwords and other secrets are allocated, managed and protected under clear rules.\",\n      \"ISO 27001:2022 A.8.5 Secure authentication: Authentication methods and procedures resist guessing, brute force and misuse.\",\n      \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    ],\n    \"guidance\": \"why: Short passwords can be guessed or cracked quickly; length is the strongest single factor in password strength.\\n\\nrisk: Medium - Weak passwords make account takeover through guessing or credential stuffing easier.\\n\\nfix (windows):\\n- Set Group Policy: Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy > Minimum password length = 14 (or the Intune equivalent).\\n- For a stand-alone device: net accounts /minpwlen:14\\n\\nverify: Re-run the audit; Minimum password length should read 14 or more.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000554, "profile": "typical", "dataset_version": "0.4.0", "check_id": "aiact.risk_classification", "status": "NotApplicable"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"task\": \"finding\",\n    \"device\": \"Ubuntu 22.04.5 LTS 22.04 (linux)\",\n    \"audit_run_as_admin\": \"yes\",\n    \"check\": \"AI system risk classification [aiact.risk_classification] in EU AI ACT CONTROLS\",\n    \"status\": \"NotApplicable\",\n    \"found\": \"no AI tools found\",\n    \"required\": \"every AI tool classified\",\n    \"references\": [\n      \"ISO 27001:2022 A.5.9 Inventory of information and other associated assets: Know which information assets, devices and software exist and who owns them, and keep that list current.\",\n      \"EU AI Act Art. 5 Prohibited AI practices: Certain AI uses are banned, such as emotion recognition at work and in education (with narrow exceptions) and social scoring.\",\n      \"EU AI Act Art. 6 Classification rules for high-risk AI systems: An AI system is high-risk if it is a safety component of regulated products or is used for a purpose listed in Annex III.\",\n      \"EU AI Act Annex III High-risk AI systems referred to in Article 6(2): Lists high-risk uses such as biometrics, critical infrastructure, education, employment and worker management, access to essential services, law enforcement, migration and justice.\"\n    ],\n    \"guidance\": \"why: Each AI system must be checked against the banned practices and the high-risk uses in Annex III.\\n\\nrisk: Medium - An unclassified tool could be used for a high-risk or prohibited purpose without the required safeguards.\\n\\nfix (linux):\\n- Record the purpose for which each listed tool is used and classify it (prohibited, high-risk, limited-risk transparency, minimal).\\nThe auditor model does this from the inventory and the stated purpose.\\n\\nverify: Every AI tool in the inventory has a classification in the AI register.\\n\\nstatus note: This check does not apply to this device or configuration.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7001101, "profile": "neglected", "dataset_version": "0.4.0", "check_id": "aiact.log_retention", "status": "Pending"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"task\": \"finding\",\n    \"device\": \"Microsoft Windows 11 Pro 10.0.22631 (Windows)\",\n    \"audit_run_as_admin\": true,\n    \"check\": \"AI usage log retention [aiact.log_retention]\",\n    \"status\": \"Pending\",\n    \"found\": \"depends on classification\",\n    \"required\": \">= 6 months for high-risk AI\",\n    \"details\": [\n      \"Required only if a tool is classified high-risk.\",\n      \"Referenced controls from ISO 27001:2022 A.8.15 Logging: Produce, protect and review logs of activities, exceptions and security events.\"\n    ],\n    \"references\": [\n      \"ISO 27001:2022 A.8.15 Logging: Produce, protect and review logs of activities, exceptions and security events.\",\n      \"EU AI Act Art. 26(6) Deployers: keep automatically generated logs for at least six months: Deployers keep the logs a high-risk AI system generates, under their control, for at least six months unless other law says otherwise.\"\n    ],\n    \"guidance\": [\n      \"why: Deployers of high-risk AI systems must keep the system's logs for at least six months.\",\n      \"risk: Medium - Missing logs prevent monitoring and investigation of high-risk AI use.\",\n      \"fix (Windows): If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months.\",\n      \"verify: Log retention is documented for each high-risk AI system.\"\n    ],\n    \"status_note\": \"This item needs a further step before it can be judged.\"\n  }\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "linux", "audit": 7000305, "profile": "hardened", "dataset_version": "0.4.0"}, "reply": "```json\n{\n  \"audit_findings\": {\n    \"risk_levels\": [\n      {\n        \"name\": \"lockout.duration\",\n        \"level\": \"Low\"\n      },\n      {\n        \"name\": \"malware.antivirus\",\n        \"level\": \"High\"\n      },\n      {\n        \"name\": \"malware.service\",\n        \"level\": \"High\"\n      },\n      {\n        \"name\": \"aiact.unapproved\",\n        \"level\": \"Medium\"\n      }\n    ],\n    \"score\": {\n      \"compliant\": 44,\n      \"assessed\": 48,\n      \"percent\": 92\n    },\n    \"top_gaps\": [\n      {\n        \"name\": \"malware.antivirus\",\n        \"description\": \"Antivirus is missing.\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"name\": \"malware.service\",\n        \"description\": \"ClamAV malware protection service is not running.\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"name\": \"aiact.unapproved\",\n        \"description\": \"Unapproved AI tools (Ollama, LM Studio) are present.\",\n        \"risk_level\": \"Medium\"\n      },\n      {\n        \"name\": \"lockout.duration\",\n        \"description\": \"Account lockout duration is set to 10 minutes.\",\n        \"risk_level\": \"Low\"\n      }\n    ],\n    \"fix_guidance\": [\n      {\n        \"tool_name\": \"antivirus\",\n        \"action\": \"Install an endpoint protection product, or ClamAV: apt install clamav clamav-daemon (RHEL: dnf install clamav clamd), then systemctl enable --now clamav-daemon.\"\n      },\n      {\n        \"tool_name\": \"service\",\n        \"action\": \"systemctl enable --now clamav-daemon (RHEL: clamd@scan).\"\n      },\n      {\n        \"tool_name\": \"unapproved_tools\",\n        \"action\": \"Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it.\"\n      },\n      {\n        \"tool_name\": \"duration\",\n        \"action\": \"Adjust the account lockout duration to a more appropriate value.\"\n      }\n    ]\n  }\n}\n```"}

training/eval/base-v0.5.jsonl

@@ -0,0 +1,60 @@
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7000189, "profile": "hardened", "dataset_version": "0.5.0"}, "reply": "```json\n{\n  \"audit_result\": {\n    \"risk_level\": \"high\",\n    \"potential_issues\": [\n      {\n        \"description\": \"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\",\n        \"impact\": \"significant harm\"\n      },\n      {\n        \"description\": \"Assessing creditworthiness or credit scores of individuals\",\n        \"impact\": \"significant harm\"\n      },\n      {\n        \"description\": \"Deciding access to education or grading students\",\n        \"impact\": \"significant harm\"\n      },\n      {\n        \"description\": \"Assessing eligibility for public benefits or essential services\",\n        \"impact\": \"significant harm\"\n      }\n    ]\n  },\n  \"tools_found\": [\n    {\n      \"name\": \"ChatGPT\",\n      \"found_by\": \"OpenAI (US)\",\n      \"data_source\": \"Provider cloud outside the EEA unless an EU data residency plan is used\",\n      \"default_risk\": \"minimal\",\n      \"transfer_basis\": \"Art. 28, Art. 44\"\n    },\n    {\n      \"name\": \"Microsoft Copilot\",\n      \"found_by\": \"Microsoft (US)\",\n      \"data_source\": \"Microsoft cloud\",\n      \"enterprise_plan\": \"keep data under Microsoft's commercial data protection terms\",\n      \"default_risk\": \"minimal\",\n      \"transfer_basis\": \"Art. 28, Art. 44\"\n    }\n  ],\n  \"inventory_details\": {\n    \"ai_apps_listed\": [\"ChatGPT\", \"Microsoft Copilot\"]\n  }\n}\n```"}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "audit", "dataset_version": "0.5.0"}, "reply": "To fix Google Play Protect on Android, you need to ensure that your antivirus software is compliant with ISO 27001:2022 A.8.7 (Protection against malware). Here’s how you can proceed:\n\n### Steps to Fix Google Play Protect\n\n1. **Enable Compliance**: Ensure that your antivirus software is set to comply with ISO 27001:2022 A.8.7 (Protection against malware). This will prevent unauthorized access to your devices.\n\n2. **Update Your Antivirus Software**: Regularly update your antivirus software to ensure it has the latest security patches and features. This helps in detecting and blocking any new threats.\n\n3. **Check for Updates**: Make sure your antivirus software is updated regularly. Outdated software may have vulnerabilities that could allow attackers to exploit them.\n\n4. **Review Security Settings**: Go to the settings menu within your antivirus application and review the security settings. Look for options related to privacy and security, such as enabling \"Scan apps with Play Protect.\"\n\n5. **Use Scan Apps with Play Protect**: Enable the scan feature in your antivirus software. This will automatically detect and block any suspicious apps or files.\n\n6. **Disable Rooting and Bootloader**: If rooting or unlocking your device is necessary, disable these features to avoid potential risks.\n\n7. **Verify Compliance**: After making changes, re-run the audit to confirm that your antivirus software is compliant with ISO 27001:2022 A.8.7 (Protection against malware).\n\nBy following these steps, you should be able to resolve the issue with Google Play Protect on your Android device."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "control", "dataset_version": "0.5.0"}, "reply": "Under GDPR Art. 25, an auditor would look for:\n\nPrivacy-protective default settings on devices and software."}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "device", "dataset_version": "0.5.0"}, "reply": "Yes, I can see your device. It appears to be a Windows 11 operating system installed on a Windows PC running Chrome 152."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "faq", "dataset_version": "0.5.0"}, "reply": "To set up the auditor for your company, please refer to the following steps:\n\n1. **Edit Baseline Configuration**: \n   - Open `baseline.conf` (approved administrator accounts, approved AI tools, limits such as screen lock within 5 minutes).\n   - Edit these settings according to your organization’s requirements.\n\n2. **Organizational Configuration**:\n   - Open `organizational.conf` (answers to 8 organizational questions such as record of processing, DPIA and breach procedure).\n   - Ensure all relevant organizational details are included in the configuration file.\n\n3. **Device Configuration**:\n   - For iOS and Android devices, ensure they have the necessary permissions and settings enabled.\n   - Check if any custom settings need to be configured for specific devices.\n\n4. **Browser Setup**:\n   - Install the Devseis browser extension on your Windows 11 device.\n   - Configure the browser to detect system versions and screen locks automatically when opening the Devseis page.\n\n5. **Phone Check Setup**:\n   - In the browser, navigate to the Devseis page on your iPhone or Android device.\n   - Use the Devseis browser extension to initiate the phone check.\n   - Follow the prompts to configure the phone check settings, including the browser detection method and privacy preferences.\n\n6. **Save and Share Results**:\n   - After completing the setup, save the results of the phone check.\n   - Share the PDF report with authorized personnel for review.\n\nBy following these steps, you will have successfully set up the auditor for your company, ensuring compliance with GDPR and ISO 27001 standards."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "fix", "dataset_version": "0.5.0"}, "reply": "To minimize usage and diagnostics sharing on your Android device, follow these steps:\n\n1. Go to **Settings** > **Google** > **All services** > **Usage & diagnostics**\n   - This will open the Usage & diagnostics page.\n\n2. Look for the option labeled **\"Usage & diagnostics\"** within the **\"All services\"** section.\n   - Ensure this option is enabled.\n\n3. To disable the feature, go back to the **\"All services\"** screen and select **\"Disable all services\"**.\n   - This action will remove the usage and diagnostics sharing feature from your device.\n\nBy following these steps, you can ensure that your Android device uses minimal usage and diagnostics sharing while maintaining privacy and protection of personal data."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "noaudit", "dataset_version": "0.5.0"}, "reply": "No, your phone does not appear to have any known security issues based solely on the information provided in the context. The context discusses how to perform a phone check using a browser, which involves checking the iOS or Android settings. However, it doesn't provide details about specific vulnerabilities or security flaws within the phone itself. Therefore, without additional information such as reports from third-party security audits or official reports from Apple, we cannot definitively determine if your phone has any security problems."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.5.0"}, "reply": "In the vast expanse of the ocean,\nWhere waves dance and the sun sets bright,\nA sea so vast and blue,\nA place where dreams come true.\n\nThe horizon stretches out wide,\nAs the sky above us grows tall,\nAnd the stars twinkle like diamonds,\nIn the night sky they shine.\n\nThe sea is a canvas so grand,\nWith waves crashing and the wind howls,\nA world of wonder and mystery,\nA place where nature takes flight.\n\nSo let us sail through this sea,\nWith hearts full of hope and joy,\nFor in its embrace we find our peace,\nAnd all our fears will melt away.\n\nFor in the depths of the ocean,\nWe find our strength and courage,\nAnd in its beauty we find our home,\nA place where we can truly live.\n\nSo let us cherish this sea so great,\nAnd never forget its magic,\nFor in its embrace we find our peace,\nAnd all our fears will melt away."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "phone", "dataset_version": "0.5.0"}, "reply": "To view Find My Device on Android, you need to ensure that Find My Device (Find Hub) is enabled on your device. Here’s how:\n\n1. **Settings**: Go to `Settings` > `Google` > `All services`.\n2. **Find My Device (Find Hub)**: Look for the option called `Find Hub`. This will show up under the `All services` section.\n\nIf you don't see this option, you might want to enable it through the following steps:\n\n1. **Enable Find My Device (Find Hub)**:\n   - Go to `Settings` > `Google` > `All services`.\n   - Scroll down to `Find My Device (Find Hub)` and select it.\n   \nThis will allow you to locate, lock, and erase your lost phone, which helps limit a personal data breach."}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "refs", "dataset_version": "0.5.0"}, "reply": "The ISO 27001 rule covers antivirus, while GDPR Art. 32(1)(b) covers privacy and data protection, and the EU AI Act Art. 5 covers AI systems with high-risk practices."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "status", "dataset_version": "0.5.0"}, "reply": "The statuses in the audit report indicate different levels of compliance with the baseline requirements for various aspects of your computer/device setup:\n\n1. **Compliant**: Indicates that the setting meets the baseline standards.\n   - Example: A compliant setting would allow users to log in without entering a password, which is typically required by most web applications.\n\n2. **Non-Compliant**: Indicates that the setting does not meet the baseline standards.\n   - Example: An example of a non-compliant setting might include one where users must enter a password every time they want to access a website, which is often considered insecure due to potential vulnerabilities.\n\n3. **Pending**: Indicates that more work is needed to determine if the setting is compliant.\n   - Example: A pending status suggests that there is ongoing investigation into whether the setting complies with the baseline.\n\n4. **Not Applicable**: Indicates that the check does not apply to this device or configuration.\n   - Example: A Not Applicable status indicates that the check is not relevant to your specific setup.\n\n5. **Error**: Indicates that the value could not be read, so compliance is unknown.\n   - Example: An error status might occur when trying to access a feature that requires authentication, such as logging in to a website.\n\n6. **Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo)**: Indicates that the audit should be re-run with administrative privileges.\n   - Example: Running the audit again with elevated permissions ensures that all necessary steps are taken to verify compliance.\n\n7. **Self-reported**: Indicates that the user has provided information but it hasn't been verified.\n   - Example: A self-reported status might show that the user has logged in with a password, indicating that the login process is working correctly.\n\n8. **Phone checks**: Typically refer to rooting or jailbreaking, which are actions that modify the operating system to gain unauthorized access.\n   - Example: A phone check status might indicate that the device has been rooted or jailbroken, suggesting that these modifications have been made.\n\n9. **Not rooted on Android**: Indicates that the device is rooted or has the bootloader unlocked.\n   - Example: A Not rooted on Android status might show that the device is rooted, meaning that the bootloader has been removed, allowing the device to boot from external storage.\n\n10. **Jailbroken on iPhone**: Indicates that the iPhone has been jailbroken.\n    - Example: A jailbroken status might show that the iPhone has been jailbroken, suggesting that the modification has been done through software installation.\n\nIn summary, the statuses in the audit report provide a clear indication of what each setting is supposed to do and how well it is doing it. They also highlight any issues or areas needing further investigation."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "tool", "dataset_version": "0.5.0"}, "reply": "Yes, you can use Jan with customer data under GDPR. The relevant section of the GDPR Art. 28 Processor states:\n\n\"Use only processors that give sufficient guarantees, under a written contract with required terms.\"\n\nJan meets this requirement by providing a local model runner, which fits within the scope of the GDPR's Data Protection Regulation (GDPR) Art. 28 Processor."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.5.0"}, "reply": "To configure a Web Application Firewall (WAF) in Cloudflare, follow these steps:\n\n1. **Sign Up for Cloudflare**: Visit the official Cloudflare website at <https://www.cloudflare.com/signup> and sign up for a free account.\n\n2. **Create a New Domain**: Once signed up, create a new domain name under your chosen plan.\n\n3. **Install Cloudflare’s WAF**: Go to the Cloudflare dashboard and navigate to the WAF section. Click on “Add” to install the WAF.\n\n4. **Configure WAF Rules**: In the WAF configuration, go to the “Rules” tab. Here, you can define rules based on specific criteria. For example, you might want to block certain types of traffic or restrict access to certain domains.\n\n5. **Test Your Configuration**: After configuring the rules, test them thoroughly to ensure they are working correctly. This involves setting up different scenarios and verifying that the WAF behaves as expected.\n\n6. **Save and Activate**: Save your changes and activate the WAF. You will need to grant permissions to the WAF so that it can access your cloud resources.\n\nBy following these steps, you can successfully set up a WAF in Cloudflare to protect your web applications from potential threats."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "verify", "dataset_version": "0.5.0"}, "reply": "To ensure that your macOS system has the correct screen lock settings, you need to review the following steps:\n\n1. **System Preferences**: Open System Preferences from the menu bar.\n2. **Lock Screen**: Click on the lock icon at the top left corner of the screen.\n3. **Set Screen Saver and Display Off Times**:\n   - Go to `System Preferences` > `Screen`.\n   - Select the screen you want to configure.\n   - Click on the `Settings` button next to the `Display` tab.\n   - In the `Display` tab, click on the `Options` button.\n   - Scroll down to the `Saver` section and adjust the `Display Off Time` and `Saver Time` values to match your preference.\n4. **Require Password**: Ensure that the `Require Password` option is enabled under the `Screen Saver` section.\n5. **Check for Grace Delay**: Verify that there is a `Grace Delay` setting available under the `Screen Saver` section. This allows users to manually control how long they have to wait before the screen locks automatically.\n\nBy following these steps, you will confirm whether your macOS system has the correct screen lock settings configured according to your requirements."}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "why", "dataset_version": "0.5.0"}, "reply": "Yes, private outbound on Windows is indeed important for several reasons:\n\n1. **Consistency Across Devices**: By setting the default outbound action to ALLOW, the system ensures that all devices connected to the same network will have the same behavior when attempting to send data outwards. This helps maintain consistency across different devices, which is crucial for maintaining a reliable network environment.\n\n2. **Security Compliance**: The requirement to set this action to ALLOW aligns with the requirements outlined in ISO 27001:2022 A.8.20 (Networks security). It ensures that any unauthorized outbound traffic is blocked, thereby protecting against potential security breaches.\n\n3. **Privacy Considerations**: While private outbound may seem like a good practice, it also poses privacy concerns. Unauthorized outbound traffic could potentially lead to sensitive information being exposed, especially if the destination is a public IP address or another trusted source. Therefore, ensuring that only authorized outbound traffic is permitted is essential for maintaining user privacy.\n\n4. **User Experience**: For users who rely heavily on private outbound capabilities, such as remote work or online banking, having these policies enforced consistently can enhance their experience by reducing frustration caused by unexpected outbound traffic.\n\n5. **Legal and Regulatory Compliance**: In many jurisdictions, including the European Union, there are specific regulations regarding the handling of outbound traffic. Ensuring compliance with these regulations through proper configuration of firewall rules can provide legal protection and ensure adherence to local laws.\n\nGiven these points, while private outbound might seem like a simple measure, its importance lies in the broader context of network security and privacy."}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001397, "profile": "typical", "dataset_version": "0.5.0", "check_id": "gdpr.backup_configured", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Backup configured\",\n    \"status\": \"Compliant\",\n    \"references\": [\n      {\n        \"reference\": \"ISO 27001:2022 A.8.13 Information backup: Keep backup copies of information and software and test that they can be restored.\",\n        \"guidance\": \"Why: Backups make it possible to restore personal data after loss, theft, failure or ransomware.\"\n      },\n      {\n        \"reference\": \"GDPR Art. 32(1)(c) Security of processing: restore availability and access after an incident: Be able to restore access to personal data in time after a physical or technical incident.\",\n        \"guidance\": \"Risk: High - Data that exists only on this device is lost if the device fails or is encrypted by ransomware.\"\n      }\n    ]\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000666, "profile": "typical", "dataset_version": "0.5.0", "check_id": "vuln.pending_updates", "status": "Error"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Value could not be read.\",\n    \"severity\": \"High\",\n    \"impact\": \"Attackers target published vulnerabilities quickly after the fix is released.\",\n    \"solution\": \"Install the pending updates: System Settings > General > Software Update, or softwareupdate -ia, then restart if asked.\",\n    \"action\": \"Re-run the audit; pending security updates should be 0 or fewer.\"\n  },\n  \"reference\": [\n    {\n      \"id\": \"ISO 27001:2022 A.8.8 Management of technical vulnerabilities: Find technical weaknesses in time, judge the exposure and fix them.\",\n      \"title\": \"Management of Technical Vulnerabilities\",\n      \"url\": \"https://www.iso.org/standard/49622.html\"\n    },\n    {\n      \"id\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\",\n      \"title\": \"GDPR Article 32(1)(b)\",\n      \"url\": \"https://gdpr-info.eu/art-32-1-b/\"\n    }\n  ]\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000306, "profile": "typical", "dataset_version": "0.5.0", "check_id": "aiact.unapproved", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"Ollama is not approved by the EU AI Act and GDPR.\",\n    \"status\": \"Non-Compliant\",\n    \"required\": null,\n    \"references\": [\n      {\n        \"id\": \"ISO 27001:2022 A.5.9\",\n        \"reference\": \"https://www.iso.org/standard/6354.html\"\n      },\n      {\n        \"id\": \"ISO 27001:2022 A.8.19\",\n        \"reference\": \"https://www.iso.org/standard/6355.html\"\n      },\n      {\n        \"id\": \"GDPR Art. 28 Processor\",\n        \"reference\": \"https://gdpr-info.eu/art-28-processor/\"\n      },\n      {\n        \"id\": \"GDPR Art. 44 General principle for transfers\",\n        \"reference\": \"https://gdpr-info.eu/art-44-general-principle-for-transfers/\"\n      },\n      {\n        \"id\": \"EU AI Act Art. 26 Obligations of deployers of high-risk AI systems\",\n        \"reference\": \"https://eu.ai.act/art-26-obligations-of-deployers-high-risk-ai-systems/\"\n      }\n    ],\n    \"guidance\": \"Why: AI tools used without approval may send work and personal data to providers without contracts or a transfer basis.\\nRisk: Medium - Shadow AI can leak confidential or personal data and create unassessed AI Act and GDPR obligations.\"\n  },\n  \"action\": {\n    \"recommendation\": \"Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed)\",\n    \"implementation\": \"Publish an AI acceptable-use policy so staff know which tools are allowed.\",\n    \"removal\": \"Remove unapproved apps (Settings > Apps) or block them with AppLocker / Intune app control.\"\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001395, "profile": "neglected", "dataset_version": "0.5.0", "check_id": "malware.on_access", "status": "NotApplicable"}, "reply": "```json\n{\n  \"finding\": \"On-access malware protection is not applicable due to lack of built-in on-access scanning.\",\n  \"required\": \"on-access scanning\",\n  \"details\": \"XProtect scans at launch and download but macOS has no built-in on-access scanning.\",\n  \"references\": [\n    {\n      \"id\": \"ISO 27001:2022 A.8.7 Protection against malware: Protect against malware with technical controls supported by user awareness.\"\n    },\n    {\n      \"id\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\"\n    }\n  ],\n  \"guidance\": \"Why: On-access scanning checks files when they are opened or written.\\nRisk: Medium - Malicious files can be opened before any scheduled scan finds them.\\nFix (macOS): Deploy a managed endpoint protection product if required.\\nVerify: Re-run the audit; On-access malware protection should be compliant.\",\n  \"status_note\": \"This check does not apply to this device or configuration.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7000452, "profile": "typical", "dataset_version": "0.5.0", "check_id": "org.processor_agreements", "status": "Pending"}, "reply": "```json\n{\n  \"finding\": \"Data processing agreements [org.processor_agreements] in ORGANISATIONAL CONTROLS\",\n  \"audit_status\": \"Pending\",\n  \"findings\": [\n    {\n      \"description\": \"Answered once by the organisation (organisational.conf)\",\n      \"reference\": \"ISO 27001:2022 A.5.20 Addressing information security within supplier agreements: Agreements with suppliers set out the security requirements they must meet.\",\n      \"required\": true,\n      \"detail\": \"Answered once by the organisation (organisational.conf). Not part of the phone self-check.\",\n      \"references\": [\n        \"ISO 27001:2022\"\n      ]\n    },\n    {\n      \"description\": \"Not part of the phone self-check.\",\n      \"reference\": \"GDPR Art. 28 Processor: Use only processors that give sufficient guarantees, under a written contract with required terms.\",\n      \"required\": false,\n      \"detail\": \"Not part of the phone self-check.\",\n      \"references\": []\n    }\n  ],\n  \"recommendation\": \"List all processors (including AI services used by staff) and sign a data processing agreement with each; check the transfer basis for non-EEA providers.\",\n  \"status_note\": \"This item needs a further step before it can be judged.\"\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "windows", "audit": 7000904, "profile": "neglected", "dataset_version": "0.5.0"}, "reply": "```json\n{\n  \"audit_results\": {\n    \"count\": 15,\n    \"non_compliant_count\": 38,\n    \"not_applicable_count\": 6,\n    \"pending_count\": 5,\n    \"error_count\": 0\n  },\n  \"risk_levels\": {\n    \"password.min_length\": \"Medium\",\n    \"password.expiration\": \"Low\",\n    \"password.min_age\": \"Low\",\n    \"password.complexity\": \"Medium\",\n    \"lockout.threshold\": \"Medium\",\n    \"lockout.duration\": \"Low\",\n    \"lockout.observation\": \"Low\"\n  },\n  \"top_gaps\": [\n    {\n      \"key\": \"firewall.domain.enabled\",\n      \"value\": \"High\",\n      \"gap_description\": \"Off\"\n    },\n    {\n      \"key\": \"firewall.domain.inbound\",\n      \"value\": \"High\",\n      \"gap_description\": \"Allow\"\n    },\n    {\n      \"key\": \"firewall.public.enabled\",\n      \"value\": \"High\",\n      \"gap_description\": \"Off\"\n    }\n  ],\n  \"fix_guidance\": {\n    \"firewall.domain.enabled\": \"Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True, or enforce it with Group Policy/Intune.\",\n    \"firewall.domain.inbound\": \"Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultInboundAction Block.\",\n    \"firewall.public.enabled\": \"Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True, or enforce it with Group Policy/Intune.\"\n  }\n}\n```"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "macos", "audit": 7001033, "profile": "hardened", "dataset_version": "0.5.0"}, "reply": "```json\n{\n  \"audit_findings\": [\n    {\n      \"finding_type\": \"prohibited\",\n      \"description\": \"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions; Assessing creditworthiness or credit scores of individuals; Deciding access to education or grading students;\"\n    },\n    {\n      \"finding_type\": \"high-risk\",\n      \"description\": \"Assessing eligibility for public benefits or essential services;\"\n    },\n    {\n      \"finding_type\": \"limited-risk\",\n      \"description\": \"Drafting, summarising, translation, coding help and similar general productivity use.\"\n    }\n  ]\n}\n```"}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "audit", "dataset_version": "0.5.0"}, "reply": "To address the gap in the context provided, the first step would be to ensure that the macOS 26.5.2 version meets the requirements outlined in the audit. Specifically, the audit states that the screen lock password requirement must be immediately set after the screen saver begins or when the display is turned off. This means that the current macOS version does not meet this requirement. Therefore, the next action would be to update the macOS to the latest version available, which is macOS 13 or later."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "control", "dataset_version": "0.5.0"}, "reply": "ISO 27001 A.5.34 requires that an organization meet specific legal and contractual requirements for protecting personal data. This includes ensuring that links between its Information Security Management System (ISMS) and the General Data Protection Regulation (GDPR) comply. Specifically, it mandates that the ISMS should have minimised collection and sharing of personal data. Additionally, endpoints such as diagnostic data sharing and OS AI features should ensure that personal data is not sent off the device."}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "fix", "dataset_version": "0.5.0"}, "reply": "To address your issue with the screen lock feature being non-compliant in your Windows environment, you need to ensure that the following steps are taken:\n\n1. **Set the Group Policy**: \n   - Open the Group Policy Editor (`gpedit.msc`).\n   - Navigate to `Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options`.\n   - Look for the option labeled `Interactive logon` under `Machine inactivity limit`.\n   - Change the value from `300 seconds` to `300 seconds or less`.\n\n2. **Verify the Changes**:\n   - Run the audit again to confirm that the changes have been applied correctly.\n   - Check the relevant controls listed in the context provided.\n\nBy setting the `Machine inactivity limit` to `300 seconds`, you ensure that the screen lock function will only work when the device is idle for at least 300 seconds. This prevents unauthorized access even after the device has been left idle for longer periods.\n\nIf you encounter issues during the audit process, consider checking the following areas:\n\n- Ensure that the group policies are correctly configured and that they apply to both the Windows and macOS environments.\n- Verify that the `Administrative Templates` folder contains the necessary policies related to AI features like screen lock and password requirements.\n- Review the specific controls mentioned in the context for any discrepancies between your setup and the audit results.\n\nBy taking these steps, you should be able to resolve the issue with the screen lock functionality on your Windows system."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "noaudit", "dataset_version": "0.5.0"}, "reply": "No, your firewall is not configured correctly according to the provided context. Specifically:\n\n1. **Outbound Policy**: The default outbound policy on macOS is set to allow all outbound traffic, which means any incoming connection will be forwarded to the internet. This could potentially expose your system to potential security risks such as unauthorized access to sensitive data.\n\n2. **Inbound Policy**: The default inbound policy on macOS is also set to allow all inbound traffic, meaning any incoming connection will be forwarded to the internet. This could lead to unauthorized access to your system.\n\nTo resolve these issues, you need to configure your firewall policies properly. Here’s how you can proceed:\n\n### Step-by-Step Guide to Fixing Your Firewall Policies\n\n#### 1. Configure the Outbound Policy\n- **Open System Preferences** > **System Preferences** > **Security & Privacy** > **Firewall**\n- **Edit** the inbound rules section under **Advanced** tab.\n- Ensure that the inbound rule allows outgoing traffic only when necessary. For example, if you have a specific service that needs to be blocked, you might want to add a rule like this:\n  ```\n  Allow 0.0.0.0/0 from <service_name>\n  ```\n\n#### 2. Configure the Inbound Policy\n- **Open System Preferences** > **System Preferences** > **Security & Privacy** > **Firewall**\n- **Edit** the outbound rules section under **Advanced** tab.\n- Ensure that the outbound rule allows incoming traffic only when necessary. For example, if you have a specific service that needs to be blocked, you might want to add a rule like this:\n  ```\n  Block 0.0.0.0/0 to <service_name>\n  ```\n\n#### Verify the Configuration\n- After making changes, re-run the audit to ensure the new configurations take effect.\n\n### Additional Considerations\n- **Stealth Mode**: If you are using stealth mode, make sure to enable it before running the audit.\n- **Audit Duration**: The audit duration is typically around 5 to 15 minutes. Adjust this based on your system's performance and security requirements.\n\nBy following these steps, you should be able to configure your firewall policies correctly, thereby mitigating the risk associated with unsolicited inbound connections."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.5.0"}, "reply": "Subject: Application for Sales Position\n\nDear Hiring Manager,\n\nI am writing to express my interest in the Sales position at [Company Name], where I believe my skills and experience align well with the requirements outlined in the job description. With over [number of years] years of experience in sales management, I have successfully executed projects across various industries, including technology, healthcare, and retail, demonstrating my ability to handle complex business challenges and develop strategic partnerships.\n\nMy background includes a strong understanding of market research, customer analysis, and sales strategies. I possess excellent communication and interpersonal skills, which I bring to the role with enthusiasm and professionalism. My track record of delivering results has earned me recognition within my organization, and I am confident that my expertise will contribute significantly to your team.\n\nIn addition to my technical knowledge, I am proficient in project management, time tracking, and budgeting. These skills enable me to effectively manage multiple projects simultaneously while ensuring timely delivery of results. My attention to detail and problem-solving abilities ensure that I deliver high-quality solutions to clients.\n\nI am particularly drawn to the opportunity to work with a dynamic and innovative company like [Company Name], where I can leverage my skills to contribute to the success of our products and services. I am excited about the prospect of joining your team and contributing to the growth and development of [Company Name].\n\nThank you for considering my application. I look forward to the possibility of discussing how my qualifications and experiences could further enhance your team's capabilities.\n\nSincerely,\n[Your Name]"}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "phone", "dataset_version": "0.5.0"}, "reply": "The analytics sharing minimised setting on your iPhone is located in the following places:\n\n1. **Settings > Privacy & Security > Analytics & Improvements**: This option allows you to adjust the level of privacy settings for analytics sharing.\n   \n2. **Re-run the audit**: After making changes, it's recommended to re-run the audit to ensure all adjustments have been applied correctly.\n\n3. **Diagnostic data minimised should be compliant**: Ensure that the diagnostic data sharing settings are set to the minimum level to prevent unnecessary personal data exposure.\n\nBy adjusting these settings, you can minimize the risk associated with sharing personal data through analytics sharing on your iPhone."}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "refs", "dataset_version": "0.5.0"}, "reply": "The compliance controls related to the supported operating system version include:\n\n1. **ISO 27001:2022 A.8.8 (Management of technical vulnerabilities)**: This control ensures that technical vulnerabilities are identified promptly, assessed, and addressed. For iPhones, this means updating to the latest version of the operating system (iOS 18 or later), which includes security updates, and verifying that the updated version is compliant with the minimum requirements specified in the baseline.\n\n2. **GDPR Art. 32(1)(b) (Security of processing)**: This control mandates that personal data must be processed securely, including ensuring confidentiality, integrity, availability, and resilience. For iPhones, this involves checking whether the iPhone can run the latest version of the operating system, which includes security updates.\n\n3. **ISO 27001:2022 A.8.8 (Management of technical vulnerabilities)**: This control requires timely patching of technical vulnerabilities. For iPhones, this means upgrading to the latest version of the operating system, which includes security updates, and verifying that the updated version is compliant with the minimum requirements specified in the baseline.\n\n4. **AI Tools Found and EU AI Act Risk Class**: While specific AI tools may not be listed in the audit report, the overall context suggests that there might be tools used for vulnerability management or monitoring, but these would typically fall under the broader scope of managing technical vulnerabilities and ensuring compliance with relevant standards like ISO 27001 and GDPR.\n\nIn summary, the compliance controls related to the supported operating system version include both the ISO 27001 standard and the GDPR Art. 32(1)(b) requirement, along with the management of technical vulnerabilities through regular updates and checks."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "tool", "dataset_version": "0.5.0"}, "reply": "Yes, you can use Character.AI with customer data under GDPR. The GDPR allows for certain types of AI tools to be used with customer data if the organization has approved AI tools listed within its data processing terms. In this case, Character.AI appears to be a consumer entertainment chatbot, which falls under the category of AI tools that are not intended for work use. Therefore, it would generally be permissible to use Character.AI with customer data under GDPR."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.5.0"}, "reply": "SOC 2 Type II requires that organizations implement a comprehensive change management program to ensure compliance with relevant standards and regulations. This includes:\n\n1. **Change Request Process**: Establish clear procedures for requesting changes to systems, applications, and processes.\n2. **Change Approval**: Ensure that all changes must undergo formal approval before implementation.\n3. **Change Documentation**: Maintain detailed documentation of changes made, including who performed them, when they were done, and what was changed.\n4. **Change Testing**: Conduct thorough testing of new changes to ensure they meet the organization’s security requirements.\n5. **Monitoring and Reporting**: Continuously monitor changes and report any issues or risks to senior management.\n6. **Training and Awareness**: Provide training to employees on how to manage changes effectively and recognize potential risks associated with changes.\n7. **Audit Compliance**: Regularly review and audit the effectiveness of the change management program against established standards and regulations.\n\nIn your case, since there is no specific mention of a change management program in your audit context, it would be advisable to include this requirement in your SOC 2 Type II audit plan."}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "why", "dataset_version": "0.5.0"}, "reply": "The risk of missing the auto-lock feature on your iPhone is medium. This means there is a small chance that someone could access your device without your knowledge or consent. However, setting up the auto-lock feature ensures that your device remains locked until you return it, which helps prevent unauthorized access."}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000195, "profile": "typical", "dataset_version": "0.5.0", "check_id": "gdpr.auto_updates", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"Automated update compliance\",\n    \"status\": \"Compliant\",\n    \"reason\": \"Security fixes must be installed automatically to close known vulnerabilities quickly.\",\n    \"risk\": \"High\"\n  },\n  \"references\": [\n    {\n      \"id\": \"ISO 27001:2022\",\n      \"reference\": \"A.8.8 Management of technical vulnerabilities: Find technical weaknesses in time, judge the exposure and fix them.\"\n    },\n    {\n      \"id\": \"GDPR Art. 32(1)(b) Security of processing: Confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\",\n      \"reference\": \"Art. 32(1)(b)\"\n    }\n  ]\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000482, "profile": "typical", "dataset_version": "0.5.0", "check_id": "encryption.protection", "status": "Error"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"BitLocker protection requires an elevated PowerShell session to enable AES encryption.\",\n    \"severity\": \"High\",\n    \"risk\": \"Suspension or partial encryption may leave data readable on a lost device.\"\n  },\n  \"action\": {\n    \"details\": [\n      \"Resume protection if it is suspended (Resume-BitLocker -MountPoint C:)\" and let encryption finish; use an AES-XTS method.\",\n      \"Verify: Re-run the audit; Disk encryption protection should be compliant.\"\n    ],\n    \"reference\": [\n      \"ISO 27001:2022 A.8.24 Use of cryptography: Define and apply rules for using cryptography, including key management.\",\n      \"GDPR Art. 32(1)(a) Security of processing: pseudonymisation and encryption: Where appropriate, protect personal data with pseudonymisation and encryption.\"\n    ]\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7001109, "profile": "typical", "dataset_version": "0.5.0", "check_id": "malware.antivirus", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": \"Anti-malware software detected but scans are disabled.\",\n  \"status\": \"Non-Compliant\",\n  \"found\": \"Play Protect scanning is off\",\n  \"required\": \"on\",\n  \"detail\": \"Installed apps are not checked for harmful behavior.\",\n  \"references\": [\n    {\n      \"id\": \"ISO 27001:2022 A.8.7 Protection against malware: Protect against malware with technical controls supported by user awareness.\",\n      \"reference\": \"https://www.iso.org/standard/65924.html\"\n    },\n    {\n      \"id\": \"GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience: Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.\",\n      \"reference\": \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=urldocs%3Aeuropa-legislative-office-xml%3Alegi-2022-01-14%3Aart.32.1.2022-01-14\"\n    }\n  ],\n  \"guidance\": \"Anti-malware software detects and blocks known malicious files and behavior.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001023, "profile": "neglected", "dataset_version": "0.5.0", "check_id": "aiact.log_retention", "status": "NotApplicable"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"Missing AI Tools\",\n    \"description\": \"No AI tools were found in the device.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Low\",\n    \"recommendation\": \"Deployers of high-risk AI systems must keep the system's logs for at least six months.\"\n  },\n  \"solution\": \"If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months.\",\n  \"verification\": \"Log retention is documented for each high-risk AI system.\",\n  \"status_note\": \"This check does not apply to this device or configuration.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7001281, "profile": "neglected", "dataset_version": "0.5.0", "check_id": "org.breach_procedure", "status": "Pending"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"The organization has not yet implemented a breach response procedure as per the requirements.\",\n    \"type\": \"Insufficient implementation\",\n    \"severity\": \"Medium\",\n    \"impact\": \"High\",\n    \"resolution_required\": true,\n    \"action_needed\": \"Yes\"\n  },\n  \"references\": [\n    {\n      \"reference_id\": \"ORG_BREACH_PROCEDURE\",\n      \"reference_type\": \"Documentation\",\n      \"reference_value\": \"Answered once by the organization (organisational.conf)\"\n    }\n  ],\n  \"guidance\": {\n    \"reason\": \"Breaches must be reported to the supervisory authority within 72 hours where required.\",\n    \"risk\": \"High\",\n    \"solution\": \"Write a breach procedure, test it, and verify that it meets the requirements.\"\n  }\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "ios", "audit": 7000872, "profile": "typical", "dataset_version": "0.5.0"}, "reply": "```json\n{\n  \"task\": \"summary\",\n  \"device\": \"iOS 27.0 (ios)\",\n  \"hostName\": \"LEGAL-iPhone-54\",\n  \"auditRunAsAdmin\": \"no\",\n  \"counts\": {\n    \"compliant\": 13,\n    \"nonCompliant\": 6,\n    \"notApplicable\": 0,\n    \"pending\": 10,\n    \"error\": 0\n  },\n  \"evidence\": [\n    {\n      \"id\": \"screen_lock.enabled\",\n      \"name\": \"Screen Lock Enabled\",\n      \"status\": \"Passcode\",\n      \"found\": true\n    },\n    {\n      \"id\": \"screen_lock.timeout\",\n      \"name\": \"Screen Lock Timeout\",\n      \"status\": \"Auto-Lock\",\n      \"found\": true\n    },\n    {\n      \"id\": \"mobile.passcode_strength\",\n      \"name\": \"Mobile Password Strength\",\n      \"status\": \"Passcode strength\",\n      \"found\": true\n    },\n    {\n      \"id\": \"mobile.jailbreak_root\",\n      \"name\": \"Jailbreaking Root\",\n      \"status\": \"Not Jailbroken\",\n      \"found\": true\n    },\n    {\n      \"id\": \"mobile.app_sources\",\n      \"name\": \"Apps Only From the App Store\",\n      \"status\": \"Apps only from the App Store\",\n      \"found\": true\n    },\n    {\n      \"id\": \"encryption.enabled\",\n      \"name\": \"Encryption Enabled\",\n      \"status\": \"Data Protection (encryption)\",\n      \"found\": true\n    },\n    {\n      \"id\": \"vuln.pending_updates\",\n      \"name\": \"Pending iOS Security Updates\",\n      \"status\": \"iOS 27.0 (up to date)\",\n      \"found\": true\n    },\n    {\n      \"id\": \"vuln.outdated_apps\",\n      \"name\": \"Outdated Apps\",\n      \"status\": \"App updates\",\n      \"found\": true\n    },\n    {\n      \"id\": \"vuln.known_vulnerabilities\",\n      \"name\": \"Known Vulnerabilities in iOS\",\n      \"status\": \"0 critical/high\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.auto_updates\",\n      \"name\": \"Automatic iOS Updates\",\n      \"status\": \"Off\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.os_supported\",\n      \"name\": \"Supported Operating System Version\",\n      \"status\": \"iOS 27.0\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.time_sync\",\n      \"name\": \"Date & Time Set Automatically\",\n      \"status\": \"Set automatically\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.backup_configured\",\n      \"name\": \"Icy Backup\",\n      \"status\": \"No backup\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.telemetry\",\n      \"name\": \"Analytics Sharing Minimised\",\n      \"status\": \"Analytics sharing on\",\n      \"found\": true\n    },\n    {\n      \"id\": \"gdpr.lock_screen_previews\",\n      \"name\": \"Notification Previews Hidden When Locked\",\n      \"status\": \"Never\",\n      \"found\": true\n    },"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "linux", "audit": 7000087, "profile": "typical", "dataset_version": "0.5.0"}, "reply": "```json\n{\n  \"audit_result\": {\n    \"rule_name\": \"prohibited\",\n    \"details\": [\n      {\n        \"description\": \"Emotion recognition of employees or students (except for medical or safety reasons)\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"description\": \"Social scoring of people\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"description\": \"Manipulative or exploitative techniques that cause significant harm\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"description\": \"Untargeted scraping of facial images to build face recognition databases\",\n        \"risk_level\": \"High\"\n      },\n      {\n        \"description\": \"Biometric categorisation inferring sensitive traits such as political views or sexual orientation\",\n        \"risk_level\": \"High\"\n      }\n    ]\n  },\n  \"tools_found\": [\n    {\n      \"name\": \"LM Studio\",\n      \"found_by\": \"Element Labs\",\n      \"data_source\": \"On the device\",\n      \"default_risk\": \"Minimal\",\n      \"check_model_licenses\": true,\n      \"local_server_exposure\": false\n    },\n    {\n      \"name\": \"GPT4All\",\n      \"found_by\": \"Nomic AI\",\n      \"data_source\": \"On the device\",\n      \"default_risk\": \"Minimal\",\n      \"check_model_licenses\": true,\n      \"local_server_exposure\": false\n    },\n    {\n      \"name\": \"Alpaca (Ollama client)\",\n      \"found_by\": \"Open source\",\n      \"data_source\": \"On the device\",\n      \"default_risk\": \"No\",\n      \"local_server_exposure\": false\n    }\n  ],\n  \"device_info\": {\n    \"os_version\": \"Debian GNU/Linux 13 (trixie)\",\n    \"cpu_type\": \"x86_64\",\n    \"memory_size\": \"4GB\",\n    \"storage_size\": \"10GB\"\n  },\n  \"tool_details\": [\n    {\n      \"name\": \"LM Studio\",\n      \"version\": \"Local model runner\",\n      \"license_status\": \"Provider Element Labs\",\n      \"model_licence\": \"Data on the device\",\n      \"local_server_exposure\": false\n    },\n    {\n      \"name\": \"GPT4All\",\n      \"version\": \"Local model runner\",\n      \"license_status\": \"Provider Nomic AI\",\n      \"model_licence\": \"Data on the device\",\n      \"local_server_exposure\": false\n    },\n    {\n      \"name\": \"Alpaca (Ollama client)\",\n      \"version\": \"Desktop client\",\n      \"license_status\": \"Provider Open source\",\n      \"model_licence\": \"Data on the device\",\n      \"local_server_exposure\": false\n    }\n  ],\n  \"tools_used\": [\"LM Studio\", \"GPT4All\", \"Alpaca (Ollama client)\"],\n  \"tools_checked\": [\"LM Studio\", \"GPT4All\", \"Alpaca (Ollama client)\"]\n}\n```"}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "audit", "dataset_version": "0.5.0"}, "reply": "To address the issue of the gap in the auditor, which appears to be related to the auto-lock feature, the first step would be to ensure that the auto-lock setting is set to a minimum duration of 5 minutes or less. This will significantly reduce the window size for potential misuse, thereby mitigating the risk associated with missing the timeout period. Additionally, verifying that the auto-lock setting is indeed set to 5 minutes or less is crucial to confirm its accuracy and effectiveness."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "control", "dataset_version": "0.5.0"}, "reply": "Under ISO 27001 A.5.17, an auditor would look for:\n\n- **Password complexity**: Ensuring passwords meet specific criteria such as length, complexity, and frequency of changes. This includes enforcing a minimum character class length and requiring users to change their passwords regularly.\n  \n- **User documentation**: Verifying that users are aware of the importance of strong password policies and have been trained on how to manage them effectively.\n\n- **Policy enforcement**: Checking whether the device's password policy is being followed by ensuring that passwords are complex enough and changed frequently according to the specified guidelines.\n\n- **Audit logs**: Reviewing any log entries related to password management to ensure compliance with the requirements outlined in ISO 27001 A.5.17.\n\nBy focusing on these areas, the auditor ensures that the organization has implemented robust measures to safeguard sensitive data and prevent unauthorized access."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "fix", "dataset_version": "0.5.0"}, "reply": "To resolve the issue of USB debugging being turned on on your Android device, follow these steps:\n\n1. **Turn Off USB Debugging**: \n   - Go to `Settings` > `System` > `Developer options`.\n   - Turn off USB debugging (`USB debugging` option).\n\n2. **Verify Changes**:\n   - After turning off USB debugging, run the phone again to ensure no changes were made.\n   - Check the system logs for any errors related to USB debugging.\n\nBy following these steps, you will have successfully disabled USB debugging on your Android device, ensuring that unauthorized access to data is prevented."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "noaudit", "dataset_version": "0.5.0"}, "reply": "No, you are not GDPR compliant based on the provided context. The audit suggests that there are several areas where the security event logging on macOS may need improvement:\n\n1. **Audit Policy**: The Unified Logging feature is built into macOS but needs to be configured correctly to ensure compliance with GDPR requirements. It is recommended to forward security logs to a log platform if long retention is required.\n\n2. **Password Complexity**: The password complexity setting on macOS should enforce mixed character types to increase difficulty in cracking passwords. This is important for preventing brute-force attacks.\n\n3. **Audit Configuration**: The password complexity should be compliant with ISO 27001 standards, specifically A.5.17 (Authentication Information) and A.8.5 (Secure Authentication). These standards mandate the use of complex passwords and proper timing for event recording.\n\n4. **Time Synchronisation**: The time synchronisation feature on macOS should be set up correctly to maintain accurate timestamps during investigations. Incorrect timestamps can lead to unreliable timeline comparisons.\n\nGiven these points, while the current setup appears to comply with some standards, it lacks the necessary features and configurations to fully meet GDPR requirements. Therefore, you are not yet GDPR compliant based on the information provided."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.5.0"}, "reply": "I'm sorry, but I don't have enough context to provide a proper response to your request. The information provided seems to be related to security practices and compliance requirements for different systems and technologies, but doesn't directly address a specific travel itinerary or security planning for a weekend trip to Paris. \n\nIf you'd like me to assist with something else, please let me know what you need help with!"}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "phone", "dataset_version": "0.5.0"}, "reply": "To view the Android security update on Android, you can check the following steps:\n\n1. **Settings > About Phone**: This will display information about your device, including the Android version.\n2. **Android Version**: Look for the section labeled \"Android version\" within the Settings menu. This will show you the exact version number of your Android device.\n\nBy checking these options, you'll be able to determine whether there are any pending security updates available for your Android device."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.5.0"}, "reply": "NIS2 requires your company to configure a backup solution for user data. Specifically:\n\n1. **Google Backup**: Configure a backup solution for user data.\n   - This ensures that data stored on your company's devices is protected even if the device fails or is encrypted by ransomware.\n\n2. **ICloud Backup**: Ensure an iCloud backup solution is configured for user data.\n   - This provides a backup option for personal data stored on your company's devices, making it easier to restore data in case of loss, theft, or ransomware attacks.\n\nBy implementing these solutions, you ensure that sensitive information remains safe and accessible when needed."}
+{"task": "chat", "meta": {"task": "chat", "os": "linux", "status": "why", "dataset_version": "0.5.0"}, "reply": "Yes, removable media encryption on Linux is indeed crucial for protecting sensitive data from unauthorized access. This measure ensures that even if data is accidentally deleted or stolen, it remains unreadable, thereby preventing potential breaches. It also prevents data from being written to unencrypted removable drives, which could lead to serious consequences such as a personal data breach requiring reporting. Therefore, ensuring compliance with this requirement is essential for maintaining data security on Linux systems."}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000096, "profile": "hardened", "dataset_version": "0.5.0", "check_id": "org.ropa", "status": "Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"missing_record_of_processing_activities\",\n    \"description\": \"The record of processing activities is not maintained as required by GDPR.\",\n    \"severity\": \"High\",\n    \"impact\": \"Direct infringement\",\n    \"solution\": \"Create or update the record of processing activities (purposes, categories of data and people, recipients, transfers, retention, security measures). Assign an owner and review it at least annually.\",\n    \"reference\": [\n      {\n        \"id\": \"guidance\",\n        \"title\": \"Guidance\",\n        \"content\": \"Why: The record of processing activities is the core GDPR accountability document.\"\n      },\n      {\n        \"id\": \"audit_run_as_admin\",\n        \"title\": \"Audit Run As Admin\",\n        \"content\": \"Fix (Windows):\"\n      }\n    ]\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000666, "profile": "typical", "dataset_version": "0.5.0", "check_id": "screen_lock.enabled", "status": "Error"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"The device does not have a screen lock enabled.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Medium\",\n    \"recommendation\": \"An idle device should lock itself so nobody can use it while the owner is away.\"\n  },\n  \"solution\": \"System Settings > Lock Screen: set the screen saver and display-off times and 'Require password' = Immediately, or enforce with a configuration profile.\",\n  \"verification\": \"Re-run the audit; Screen lock should be on.\",\n  \"status_note\": \"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7000872, "profile": "typical", "dataset_version": "0.5.0", "check_id": "aiact.unapproved", "status": "Non-Compliant"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"ChatGPT, Gemini, Microsoft Copilot are unapproved AI tools and should be removed.\",\n    \"status\": \"Non-Compliant\",\n    \"required\": null,\n    \"evidence\": [\n      {\n        \"tool_name\": \"ChatGPT\",\n        \"version\": \"latest\",\n        \"data_protection_and_ai_act_review\": true,\n        \"data_processing_agreement\": true\n      },\n      {\n        \"tool_name\": \"Gemini\",\n        \"version\": \"latest\",\n        \"data_protection_and_ai_act_review\": true,\n        \"data_processing_agreement\": true\n      },\n      {\n        \"tool_name\": \"Microsoft Copilot\",\n        \"version\": \"latest\",\n        \"data_protection_and_ai_act_review\": true,\n        \"data_processing_agreement\": true\n      }\n    ],\n    \"references\": [\n      {\n        \"reference_type\": \"ISO 27001\",\n        \"reference_number\": \"A.5.9\",\n        \"content\": \"Inventory of information and other associated assets: Know which information assets, devices and software exist and who owns them, and keep that list current.\"\n      },\n      {\n        \"reference_type\": \"GDPR\",\n        \"reference_number\": \"Art. 28 Processor\",\n        \"content\": \"Processor: Use only processors that give sufficient guarantees, under a written contract with required terms.\"\n      },\n      {\n        \"reference_type\": \"EU AI Act\",\n        \"reference_number\": \"Art. 26 Obligations of deployers of high-risk AI systems\",\n        \"content\": \"Deployers must use high-risk AI as instructed, assign human oversight, monitor it, keep logs and inform affected people.\"\n      }\n    ]\n  }\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000590, "profile": "hardened", "dataset_version": "0.5.0", "check_id": "screen_lock.timeout", "status": "NotApplicable"}, "reply": "```json\n{\n  \"finding\": {\n    \"description\": \"The Linux system's default session idle delay is set to 300 seconds.\",\n    \"severity\": \"Medium\",\n    \"impact\": \"Affects users who may have left their devices unlocked.\"\n  },\n  \"solution\": [\n    \"Set the session idle delay to 300 seconds using `gsettings` commands.\",\n    \"Enforce the locked DConf settings with `gsettings` commands.\"\n  ],\n  \"verification\": \"Re-run the audit to ensure the change takes effect.\",\n  \"status_note\": \"This check does not apply to this device or configuration.\"\n}\n```"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000909, "profile": "typical", "dataset_version": "0.5.0", "check_id": "org.processor_agreements", "status": "Pending"}, "reply": "```json\n{\n  \"finding\": {\n    \"type\": \"missing\",\n    \"description\": \"Data processing agreements should be signed with all processors, including those using AI services.\",\n    \"severity\": \"High\",\n    \"impact\": \"Breaches GDPR\"\n  },\n  \"solution\": \"List all processors (including AI services used by staff) and sign a data processing agreement with each; check the transfer basis for non-EEA providers.\",\n  \"verification\": \"Answer ORG_PROCESSOR_AGREEMENTS=yes once all agreements are in place.\"\n}\n```"}
+{"task": "summary", "meta": {"task": "summary", "os": "android", "audit": 7000707, "profile": "typical", "dataset_version": "0.5.0"}, "reply": "```json\n{\n  \"audit_results\": {\n    \"compliance\": [\n      {\n        \"device\": \"Android 15\",\n        \"browser_detected\": false,\n        \"self_reported_by_user\": true,\n        \"count\": 3\n      },\n      {\n        \"device\": \"Android 15\",\n        \"browser_detected\": false,\n        \"self_reported_by_user\": true,\n        \"count\": 19\n      }\n    ],\n    \"non_compliance\": [\n      {\n        \"device\": \"Android 15\",\n        \"browser_detected\": false,\n        \"self_reported_by_user\": true,\n        \"status\": \"Non-Compliant\",\n        \"found\": [\n          {\n            \"name\": \"mobile.app_sources\",\n            \"status\": \"Non-Compliant\",\n            \"found\": [\n              {\n                \"name\": \"Install unknown apps blocked\",\n                \"status\": \"Non-Compliant\"\n              }\n            ]\n          },\n          {\n            \"name\": \"mobile.find_my_device\",\n            \"status\": \"Non-Compliant\",\n            \"found\": [\n              {\n                \"name\": \"Off\",\n                \"status\": \"NotCompliant\"\n              }\n            ]\n          },\n          {\n            \"name\": \"vuln.outdated_apps\",\n            \"status\": \"Non-Compliant\",\n            \"found\": [\n              {\n                \"name\": \"Automatic app updates off\",\n                \"status\": \"NotCompliant\"\n              }\n            ]\n          },\n          {\n            \"name\": \"aiact.os_ai_features\",\n            \"status\": \"Non-Compliant\",\n            \"found\": [\n              {\n                \"name\": \"Assistant screen access on\",\n                \"status\": \"NotCompliant\"\n              }\n            ]\n          }\n        ]\n      }\n    ],\n    \"counts\": {\n      \"compliant\": 15,\n      \"non-compliant\": 5,\n      \"not-applicable\": 2,\n      \"pending\": 8,\n      \"error\": 0\n    },\n    \"results\": [\n      {\n        \"id\": \"malware.antivirus\",\n        \"name\": \"Google Play Protect\",\n        \"status\": \"Compliant\",\n        \"found\": [\n          {\n            \"name\": \"Play Protect scanning on\",\n            \"status\": \"Screen lock enabled\"\n          }\n        ]\n      },\n      {\n        \"id\": \"screen_lock.enabled\",\n        \"name\": \"Screen lock\",\n        \"status\": \"Compliant\",\n        \"found\": [\n          {\n            \"name\": \"screen lock set\"\n          }\n        ]\n      },\n      {\n        \"id\": \"screen_lock.timeout\",\n        \"name\": \"Screen timeout\",\n        \"status\": \"Non-Compliant\",\n        \"found\": [\n          {\n            \"name\": \"Screen timeout 10 minutes\"\n          }\n        ]\n      },\n      {\n        \"id\": \"mobile.passcode_strength\",\n        \"name\": \"Screen lock strength\",\n        \"status\": \"Compliant\",\n        \"found\": [\n          {\n            \"name\": \"alphanumeric\"\n          }\n        ]\n      },\n      {\n        \"id\": \"mobile.jailbreak_root\",\n        \"name\": \"Not rooted\",\n        \"status\": \"Compliant\",\n        \"found\": [\n          {\n            \"name\": \"not rooted (user confirmed)\"\n          }\n        ]\n      },\n      {\n        \"id\": \"mobile.app_sources\","}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7001244, "profile": "typical", "dataset_version": "0.5.0"}, "reply": "```json\n{\n  \"audit_result\": {\n    \"task\": \"ai_classification\",\n    \"device\": \"iOS 27.0 (ios)\",\n    \"tools_found\": [\"ChatGPT\", \"Claude\", \"DeepSeek\"],\n    \"inventory_detail\": \"AI apps listed by the user.\",\n    \"purposes_of_use\": \"not stated\",\n    \"tool_facts\": [\n      {\n        \"name\": \"ChatGPT\",\n        \"description\": \"Cloud AI assistant; provider OpenAI (US); data: Provider cloud outside the EEA unless an EU data residency plan is used; default risk minimal; GDPR: Needs a business plan with a data processing agreement and a transfer basis (Art. 28, Art. 44); consumer accounts may use prompts for training unless opted out.\"\n      },\n      {\n        \"name\": \"Claude\",\n        \"description\": \"Cloud AI assistant; provider Anthropic (US); data: Provider cloud outside the EEA; default risk minimal; GDPR: Needs a commercial plan with a data processing agreement and a transfer basis (Art. 28, Art. 44).\"\n      },\n      {\n        \"name\": \"DeepSeek\",\n        \"description\": \"Cloud AI assistant; provider DeepSeek (China); data: Provider cloud in the People's Republic of China; default risk minimal; GDPR: No EU adequacy decision for China and no business data processing terms; EU data protection authorities have restricted or investigated it. Do not use with work or personal data.\"\n      }\n    ],\n    \"rules\": {\n      \"prohibited\": [\n        \"Emotion recognition of employees or students (except for medical or safety reasons)\",\n        \"Social scoring of people\",\n        \"Manipulative or exploitative techniques that cause significant harm\",\n        \"Untargeted scraping of facial images to build face recognition databases\",\n        \"Biometric categorisation inferring sensitive traits such as political views or sexual orientation\"\n      ],\n      \"high_risk\": [\n        \"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\",\n        \"Assessing creditworthiness or credit scores of individuals\",\n        \"Deciding access to education or grading students\",\n        \"Assessing eligibility for public benefits or essential services\",\n        \"Risk assessment and pricing in life and health insurance\",\n        \"Biometric identification of people\"\n      ],\n      \"limited_risk\": [\n        \"Drafting, summarising, translation, coding help and similar general productivity use\"\n      ]\n    }\n  }\n}\n```"}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "audit", "dataset_version": "0.5.0"}, "reply": "To address the gap in your audit results related to account lockout duration, you should set the Group Policy to enforce a longer lockout duration of 15 minutes or more. This will ensure that repeated attempts to bypass the lockout mechanism are slowed down significantly, thereby reducing the risk of unauthorized access."}
+{"task": "chat", "meta": {"task": "chat", "os": "linux", "status": "fix", "dataset_version": "0.5.0"}, "reply": "To address your issue with the 'Time synchronisation' status being non-compliant on your Linux system, you need to ensure that accurate clocks are synchronized with a reliable time source. Here’s how you can proceed:\n\n### Step-by-Step Solution:\n\n1. **Set Up Time Synchronization:**\n   - **Linux:** Use `timedatectl` to configure the time source. For example, to synchronize with NTP, run:\n     ```bash\n     timedatectl set-ntp true\n     ```\n   - Alternatively, you can use `chrony`, which provides better accuracy compared to `ntpd`. Install it first:\n     ```bash\n     sudo apt-get install chrony\n     ```\n   - Ensure the time server is correctly configured. For example, if you're using NTP, add the following line to `/etc/chrony.conf`:\n     ```plaintext\n     server 0.pool.ntp.org iburst\n     ```\n\n2. **Verify Time Synchronization:**\n   - Run the following command to check the current time:\n     ```bash\n     timedatectl\n     ```\n   - Confirm that the time is synchronized with the correct time source.\n\n3. **Re-run Audit:**\n   - After configuring time synchronization, re-run the audit to ensure the changes take effect.\n\n### Additional Considerations:\n\n- **ISO 27001 Compliance:** Ensure that all necessary controls are met according to ISO 27001 standards. Specifically, ensure that the time synchronization is compliant with the requirements outlined in A.8.17 (Clock synchronization) and A.8.5 (Secure authentication).\n\n- **GDPR Compliance:** Check GDPR Art. 32(1)(b) for specific requirements related to time synchronization. Ensure that the time synchronization is compliant with these regulations.\n\nBy following these steps, you should be able to resolve the 'Time synchronisation' non-compliance issue on your Linux system."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.5.0"}, "reply": "The context provided discusses the importance of updating third-party applications on Windows, which includes browsers, office suites, PDF readers, and meeting apps. It also mentions that automatic app updates are enabled on the device. The question asks what the weather will be like tomorrow, but there is no information given about the current weather conditions. Therefore, I cannot provide a clear answer based solely on the information provided."}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "phone", "dataset_version": "0.5.0"}, "reply": "To find app updates on your iPhone, you can access the following locations:\n\n1. **Settings > App Store**: This section allows you to manage your app store preferences, including enabling automatic app updates.\n\n2. **General > Software Update > Automatic Updates**: This option provides more detailed information about automatic updates, such as when they will be available and how to enable them.\n\nBy checking these options, you'll have access to both automatic app updates and any other relevant information about your iPhone's security measures."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.5.0"}, "reply": "SOC 2 Type II requires that organizations implement a process for managing changes to their systems and processes. This includes ensuring that all changes made to systems and processes are documented, reviewed, and approved before they are implemented. It also involves monitoring and reviewing these changes regularly to ensure compliance with organizational policies and procedures."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "why", "dataset_version": "0.5.0"}, "reply": "Minimum password age on macOS matters because it prevents users from cycling through passwords immediately to get back to an old one, which can lead to easy password theft. This feature ensures that new passwords are generated at least once every 90 days, significantly reducing the risk of unauthorized access."}

training/eval/cpu-v0.4-merged.log

@@ -0,0 +1,16 @@
+loaded
+  warnings.warn(
+  warnings.warn(
+  warnings.warn(
+The attention mask is not set and cannot be inferred from input because pad token is same as eos token. As a consequence, you may observe unexpected behavior. Please pass your input's `attention_mask` to obtain reliable results.
+finding              85s  grounded  | {"check_id": "vuln.outdated_apps", "status": "Non-Compliant", "title": "App updates is non-compliant", "findin
+finding              56s  grounded  | {"check_id": "gdpr.backup_configured", "status": "Non-Compliant", "title": "Google backup: does not meet the b
+finding              73s  grounded  | {"check_id": "aiact.unapproved", "status": "Non-Compliant", "title": "Unapproved AI tools (shadow AI): does no
+summary              99s  grounded  | {"device": "mkt-pixel-04 - Android 14", "score": {"compliant": 16, "assessed": 18, "percent": 89}, "counts": {
+ai_classification   134s  grounded  | {"tools": [{"tool": "Gemini", "kind": "Cloud AI assistant", "approved": false, "default_risk_class": "minimal"
+chat                 21s  grounded  | I can't see your device from here, so I can't tell you yet. Run an audit with the free Devseis desktop app: it
+chat                 22s  grounded  | Re-run the audit; critical or high vulnerabilities should be 0 or fewer. [4]
+chat                 35s  grounded  | Encryption relates to ISO 27001:2022 A.8.24, ISO 27001:2022 A.8.1, GDPR Art. 32(1)(a) [4]. Meeting the setting
+chat                 71s  grounded  | Your audit found 23 gaps. Start with Password history (found: 10). Without a password history, users can retur
+chat                 44s  grounded  | Your audit found 21 gaps. Start with Account lockout threshold (found: 10). Locking an account after a few wro
+RESULT 10/10 grounded

training/eval/newchecks-v0.3.jsonl

@@ -0,0 +1,24 @@
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 4040012144, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Compliant\", \"title\": \"Unique user login matches the required setting\", \"finding\": \"The device reports personal accounts, no automatic login, which meets the requirement (personal accounts, no automatic login).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 4040012135, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Non-Compliant\", \"title\": \"Tamper protection is non-compliant\", \"finding\": \"Found: System Integrity Protection disabled. Required: on. Tamper protection stops malware, or a user, from switching off the device's security protection.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Attackers commonly disable antivirus before deploying ransomware.\"}, \"recommendation\": [\"System Integrity Protection can only be turned back on from Recovery: start the Mac in Recovery mode, open Terminal and run csrutil enable, then restart. Ask IT first if a tool needed it off.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Tamper protection should be on.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 4040012374, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Compliant\", \"title\": \"Tamper protection matches the required setting\", \"finding\": \"The device reports System Integrity Protection on, which meets the requirement (on).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 4040012285, "profile": "typical", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Non-Compliant\", \"title\": \"Tamper protection is non-compliant\", \"finding\": \"Found: System Integrity Protection disabled. Required: on. Tamper protection stops malware, or a user, from switching off the device's security protection.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Attackers commonly disable antivirus before deploying ransomware.\"}, \"recommendation\": [\"System Integrity Protection can only be turned back on from Recovery: start the Mac in Recovery mode, open Terminal and run csrutil enable, then restart. Ask IT first if a tool needed it off.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Tamper protection should be on.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012294, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Compliant\", \"title\": \"Tamper protection matches the required setting\", \"finding\": \"Found: SELinux enforcing. This satisfies the baseline requirement of SELinux or AppArmor enforcing.\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 4040012396, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Non-Compliant\", \"title\": \"Prohibited software: does not meet the baseline\", \"finding\": \"The device reports µTorrent, KMSpico 10.2.0, but the baseline requires none of: Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS,Microsoft Toolkit. Torrent clients and activation cracks are common sources of malware and of unlicensed software, which is a legal and licence-audit risk.\", \"risk\": {\"level\": \"High\", \"reason\": \"Activation cracks and pirated downloads often carry malware, and unlicensed software breaches copyright and licence terms.\"}, \"recommendation\": [\"Uninstall it in Settings > Apps > Installed apps. For activation cracks, also run a full Microsoft Defender scan and activate Windows/Office with a genuine licence.\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Prohibited software should show none found.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012197, "profile": "typical", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Compliant\", \"title\": \"Unique user login matches the required setting\", \"finding\": \"The device reports personal accounts, no automatic login, which meets the requirement (personal accounts, no automatic login).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012137, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Non-Compliant\", \"title\": \"Tamper protection is non-compliant\", \"finding\": \"Found: no security module enforcing. Required: SELinux or AppArmor enforcing. Tamper protection stops malware, or a user, from switching off the device's security protection.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Attackers commonly disable antivirus before deploying ransomware.\"}, \"recommendation\": [\"Ubuntu / Debian: sudo apt install apparmor apparmor-utils && sudo systemctl enable --now apparmor (profiles load in enforce mode).\", \"RHEL / Fedora: set SELINUX=enforcing in /etc/selinux/config, run sudo touch /.autorelabel and restart.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Tamper protection should be on.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 4040012259, "profile": "typical", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Compliant\", \"title\": \"Prohibited software matches the required setting\", \"finding\": \"The device reports none found in 82 programs, which meets the requirement (none of: Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS,Microsoft Toolkit).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012237, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Non-Compliant\", \"title\": \"Prohibited software: does not meet the baseline\", \"finding\": \"The device reports ktorrent, but the baseline requires none of: Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS,Microsoft Toolkit. Torrent clients and activation cracks are common sources of malware and of unlicensed software, which is a legal and licence-audit risk.\", \"risk\": {\"level\": \"High\", \"reason\": \"Activation cracks and pirated downloads often carry malware, and unlicensed software breaches copyright and licence terms.\"}, \"recommendation\": [\"Remove the package: sudo apt remove <package> (or sudo dnf remove <package>, flatpak uninstall, snap remove).\", \"If the software is needed for work, ask IT to approve it and remove its name from PROHIBITED_SOFTWARE in baseline.conf.\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Prohibited software should show none found.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012399, "profile": "typical", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Compliant\", \"title\": \"Tamper protection matches the required setting\", \"finding\": \"Found: AppArmor enforcing (104 profiles). This satisfies the baseline requirement of SELinux or AppArmor enforcing.\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 4040012238, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Non-Compliant\", \"title\": \"Prohibited software: does not meet the baseline\", \"finding\": \"The device reports qBittorrent v4.6.2, but the baseline requires none of: Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS,Microsoft Toolkit. Torrent clients and activation cracks are common sources of malware and of unlicensed software, which is a legal and licence-audit risk.\", \"risk\": {\"level\": \"High\", \"reason\": \"Activation cracks and pirated downloads often carry malware, and unlicensed software breaches copyright and licence terms.\"}, \"recommendation\": [\"Uninstall it in Settings > Apps > Installed apps. For activation cracks, also run a full Microsoft Defender scan and activate Windows/Office with a genuine licence.\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Prohibited software should show none found.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012298, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Compliant\", \"title\": \"Tamper protection matches the required setting\", \"finding\": \"Found: AppArmor enforcing (39 profiles). This satisfies the baseline requirement of SELinux or AppArmor enforcing.\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012227, "profile": "typical", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Non-Compliant\", \"title\": \"Gap: Unique user login\", \"finding\": \"The device reports automatic login as sali, but the baseline requires personal accounts, no automatic login. Every action on a device should be traceable to one person. Automatic login lets anyone who turns the computer on use it, and shared accounts hide who did what.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"With shared or automatic logins, a lost or borrowed device opens straight into someone's data, and incidents cannot be traced to a person.\"}, \"recommendation\": [\"Turn off automatic login in Settings > Users, or set AutomaticLoginEnable=false in /etc/gdm3/custom.conf (autologin-user= in LightDM, [Autologin] User= in SDDM).\", \"Give each person their own account; lock shared ones with sudo usermod -L <name>.\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Unique user login should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 4040012125, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Compliant\", \"title\": \"Prohibited software matches the required setting\", \"finding\": \"The device reports none found in 134 programs, which meets the requirement (none of: Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS,Microsoft Toolkit).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 4040012302, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Non-Compliant\", \"title\": \"Prohibited software: does not meet the baseline\", \"finding\": \"The device reports µTorrent, KMSpico 10.2.0, but the baseline requires none of: Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS,Microsoft Toolkit. Torrent clients and activation cracks are common sources of malware and of unlicensed software, which is a legal and licence-audit risk.\", \"risk\": {\"level\": \"High\", \"reason\": \"Activation cracks and pirated downloads often carry malware, and unlicensed software breaches copyright and licence terms.\"}, \"recommendation\": [\"Uninstall it in Settings > Apps > Installed apps. For activation cracks, also run a full Microsoft Defender scan and activate Windows/Office with a genuine licence.\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Prohibited software should show none found.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 4040012301, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Compliant\", \"title\": \"Unique user login matches the required setting\", \"finding\": \"The device reports personal accounts, no automatic login, which meets the requirement (personal accounts, no automatic login).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012237, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Non-Compliant\", \"title\": \"Gap: Unique user login\", \"finding\": \"The device reports automatic login as test; shared or generic accounts: test, but the baseline requires personal accounts, no automatic login. Every action on a device should be traceable to one person. Automatic login lets anyone who turns the computer on use it, and shared accounts hide who did what.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"With shared or automatic logins, a lost or borrowed device opens straight into someone's data, and incidents cannot be traced to a person.\"}, \"recommendation\": [\"Turn off automatic login in Settings > Users, or set AutomaticLoginEnable=false in /etc/gdm3/custom.conf (autologin-user= in LightDM, [Autologin] User= in SDDM).\", \"Give each person their own account; lock shared ones with sudo usermod -L <name>.\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Unique user login should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012342, "profile": "typical", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Compliant\", \"title\": \"Unique user login matches the required setting\", \"finding\": \"The device reports personal accounts, no automatic login, which meets the requirement (personal accounts, no automatic login).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 4040012344, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Non-Compliant\", \"title\": \"Gap: Unique user login\", \"finding\": \"The device reports automatic login as Frontdesk; shared or generic accounts: Frontdesk, Office, but the baseline requires personal accounts, no automatic login. Every action on a device should be traceable to one person. Automatic login lets anyone who turns the computer on use it, and shared accounts hide who did what.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"With shared or automatic logins, a lost or borrowed device opens straight into someone's data, and incidents cannot be traced to a person.\"}, \"recommendation\": [\"Turn off automatic sign-in: run netplwiz and tick 'Users must enter a user name and password', or set AutoAdminLogon = 0 under HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon.\", \"Give each person their own account and disable or remove shared local accounts (Computer Management > Local Users and Groups).\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Unique user login should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 4040012358, "profile": "typical", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Compliant\", \"title\": \"Prohibited software matches the required setting\", \"finding\": \"The device reports none found in 91 applications, which meets the requirement (none of: Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS,Microsoft Toolkit).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"], \"evidence\": \"No evidence was provided.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012414, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Non-Compliant\", \"title\": \"Prohibited software: does not meet the baseline\", \"finding\": \"The device reports transmission-gtk, transmission-common, but the baseline requires none of: Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS,Microsoft Toolkit. Torrent clients and activation cracks are common sources of malware and of unlicensed software, which is a legal and licence-audit risk.\", \"risk\": {\"level\": \"High\", \"reason\": \"Activation cracks and pirated downloads often carry malware, and unlicensed software breaches copyright and licence terms.\"}, \"recommendation\": [\"Remove the package: sudo apt remove <package> (or sudo dnf remove <package>, flatpak uninstall, snap remove).\", \"If the software is needed for work, ask IT to approve it and remove its name from PROHIBITED_SOFTWARE in baseline.conf.\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Prohibited software should show none found.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 4040012229, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Compliant\", \"title\": \"Unique user login matches the required setting\", \"finding\": \"The device reports personal accounts, no automatic login, which meets the requirement (personal accounts, no automatic login).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 4040012250, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Non-Compliant\", \"title\": \"Tamper protection is non-compliant\", \"finding\": \"Found: System Integrity Protection disabled. Required: on. Tamper protection stops malware, or a user, from switching off the device's security protection.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Attackers commonly disable antivirus before deploying ransomware.\"}, \"recommendation\": [\"System Integrity Protection can only be turned back on from Recovery: start the Mac in Recovery mode, open Terminal and run csrutil enable, then restart. Ask IT first if a tool needed it off.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Tamper protection should be on.\"}"}

training/eval/newchecks-v0.3.log

@@ -0,0 +1,35 @@
+/Users/umer/Documents/6 - mix/endpoint-audit/training/.venv/lib/python3.11/site-packages/transformers/generation/configuration_utils.py:590: UserWarning: `do_sample` is set to `False`. However, `temperature` is set to `0.7` -- this flag is only used in sample-based generation modes. You should set `do_sample=True` or unset `temperature`.
+  warnings.warn(
+/Users/umer/Documents/6 - mix/endpoint-audit/training/.venv/lib/python3.11/site-packages/transformers/generation/configuration_utils.py:595: UserWarning: `do_sample` is set to `False`. However, `top_p` is set to `0.8` -- this flag is only used in sample-based generation modes. You should set `do_sample=True` or unset `top_p`.
+  warnings.warn(
+/Users/umer/Documents/6 - mix/endpoint-audit/training/.venv/lib/python3.11/site-packages/transformers/generation/configuration_utils.py:612: UserWarning: `do_sample` is set to `False`. However, `top_k` is set to `20` -- this flag is only used in sample-based generation modes. You should set `do_sample=True` or unset `top_k`.
+  warnings.warn(
+The attention mask is not set and cannot be inferred from input because pad token is same as eos token. As a consequence, you may observe unexpected behavior. Please pass your input's `attention_mask` to obtain reliable results.
+[1/24] finding                45s
+[2/24] finding                79s
+[3/24] finding               101s
+[4/24] finding               133s
+[5/24] finding               155s
+[6/24] finding               204s
+[7/24] finding               232s
+[8/24] finding               277s
+[9/24] finding               319s
+[10/24] finding               368s
+[11/24] finding               393s
+[12/24] finding               455s
+[13/24] finding               482s
+[14/24] finding               544s
+[15/24] finding               593s
+[16/24] finding               649s
+[17/24] finding               681s
+[18/24] finding               742s
+[19/24] finding               771s
+[20/24] finding               824s
+[21/24] finding               865s
+[22/24] finding               933s
+[23/24] finding               962s
+[24/24] finding               997s
+
+Results for adapter training/models/auditor-lora-v0.3/final on 24 test examples:
+task                 n  valid JSON  grounded  fields match
+finding             24       100%      100%          100%

training/eval/newchecks-v0.6-4bit.jsonl

@@ -0,0 +1,24 @@
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 4040012144, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Compliant\", \"title\": \"Unique user login is compliant\", \"finding\": \"The device reports personal accounts, no automatic login, which meets the requirement (personal accounts, no automatic login).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 4040012135, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Non-Compliant\", \"title\": \"Tamper protection is non-compliant\", \"finding\": \"Found: System Integrity Protection status: disabled. Required: on. Tamper protection stops malware, or a user, from switching off the device's security protection.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Attackers commonly disable antivirus before deploying ransomware.\"}, \"recommendation\": [\"System Integrity Protection can only be turned back on from Recovery: start the Mac in Recovery mode, open Terminal and run csrutil enable, then restart. Ask IT first if a tool needed it off.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Tamper protection should be on.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 4040012374, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Compliant\", \"title\": \"Tamper protection is compliant\", \"finding\": \"The device reports System Integrity Protection on, which meets the requirement (on).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 4040012285, "profile": "typical", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Non-Compliant\", \"title\": \"Tamper protection is non-compliant\", \"finding\": \"Found: System Integrity Protection status: disabled. Required: on. Tamper protection stops malware, or a user, from switching off the device's security protection.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Attackers commonly disable antivirus before deploying ransomware.\"}, \"recommendation\": [\"System Integrity Protection can only be turned back on from Recovery: start the Mac in Recovery mode, open Terminal and run csrutil enable, then restart. Ask IT first if a tool needed it off.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Tamper protection should be on.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012294, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Compliant\", \"title\": \"Tamper protection is compliant\", \"finding\": \"The device reports SELinux enforcing, which meets the requirement (SELinux or AppArmor enforcing).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 4040012396, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Non-Compliant\", \"title\": \"Prohibited software: does not meet the baseline\", \"finding\": \"Found: µTorrent, KMSpico 10.2.0. Required: none of: Torrent, Transmission, Deluge, Vue, FrostWire, KMSpico, KMSAuto, Microsoft Toolkit.\", \"risk\": {\"level\": \"High\", \"reason\": \"Activation cracks and pirated downloads often carry malware, and unlicensed software breaches copyright and licence terms.\"}, \"recommendation\": [\"Uninstall it in Settings > Apps > Installed apps. For activation cracks, also run a full Microsoft Defender scan and activate Windows/Office with a genuine licence.\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Prohibited software should show none found.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012197, "profile": "typical", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Compliant\", \"title\": \"Unique user login is compliant\", \"finding\": \"The device reports personal accounts, no automatic login, which meets the requirement (personal accounts, no automatic login).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012137, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Non-Compliant\", \"title\": \"Tamper protection is non-compliant\", \"finding\": \"The device reports no security module enforcing, but the baseline requires SELinux or AppArmor enforcing. Tamper protection stops malware, or a user, from switching off the device's security protection.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Attackers commonly disable antivirus before deploying ransomware.\"}, \"recommendation\": [\"Ubuntu / Debian: sudo apt install apparmor apparmor-utils && sudo systemctl enable --now apparmor (profiles load in enforce mode).\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Tamper protection should be on.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 4040012259, "profile": "typical", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Compliant\", \"title\": \"Prohibited software matches the required setting\", \"finding\": \"The device reports none found in 82 programs, which meets the requirement (none of: Torrent, Transmission, Deluge, Vue, FrostWire, KMSpico, KMSAuto, Microsoft Toolkit).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Prohibited software should show none found.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012237, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Non-Compliant\", \"title\": \"Prohibited software: does not meet the baseline\", \"finding\": \"The device reports ktorrent instead of none of: Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS,Microsoft Toolkit. The required setting is none of: Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS.\", \"risk\": {\"level\": \"High\", \"reason\": \"Activation cracks and pirated downloads often carry malware, and unlicensed software breaches copyright and licence terms.\"}, \"recommendation\": [\"Remove the package: sudo apt remove <package> (or sudo dnf remove <package>, flatpak uninstall, snap remove).\", \"If the software is needed for work, ask IT to approve it and remove its name from PROHIBITED_SOFTWARE in baseline.conf.\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Prohibited software should show none found.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012399, "profile": "typical", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Compliant\", \"title\": \"Tamper protection is compliant\", \"finding\": \"The device reports AppArmor enforcing (104 profiles), which meets the requirement (SELinux or AppArmor enforcing).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 4040012238, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Non-Compliant\", \"title\": \"Prohibited software: does not meet the baseline\", \"finding\": \"Found: qBittorrent v4.6.2. Required: none of: Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS,Microsoft Toolkit.\", \"risk\": {\"level\": \"High\", \"reason\": \"Activation cracks and pirated downloads often carry malware, and unlicensed software breaches copyright and licence terms.\"}, \"recommendation\": [\"Uninstall it in Settings > Apps > Installed apps. For activation cracks, also run a full Microsoft Defender scan and activate Windows/Office with a genuine licence.\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Prohibited software should show none found.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012298, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Compliant\", \"title\": \"Tamper protection is compliant\", \"finding\": \"The device reports AppArmor enforcing (39 profiles), which meets the requirement (SELinux or AppArmor enforcing).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012227, "profile": "typical", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Non-Compliant\", \"title\": \"Gap: Unique user login\", \"finding\": \"The device reports automatic login as sali, but the baseline requires personal accounts, no automatic login.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"With shared or automatic logins, a lost or borrowed device opens straight into someone's data, and incidents cannot be traced to a person.\"}, \"recommendation\": [\"Turn off automatic login in Settings > Users, or set AutomaticLoginEnable=false in /etc/gdm3/custom.conf (autologin-user= in LightDM, [Autologin] User= in SDDM).\", \"Give each person their own account; lock shared ones with sudo usermod -L <name>.\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Unique user login should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 4040012125, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Compliant\", \"title\": \"Prohibited software matches the required setting\", \"finding\": \"The device reports none found in 134 programs, which meets the requirement (none of: Torrent, Transmission, Deluge, Vue, FrostWire, KMSpico, KMSAuto, Microsoft Toolkit).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Prohibited software should show none found.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 4040012302, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Non-Compliant\", \"title\": \"Prohibited software: does not meet the baseline\", \"finding\": \"Found: µTorrent, KMSpico 10.2.0. Required: none of: Torrent, Transmission, Deluge, Vue, FrostWire, KMSpico, KMSAuto, Microsoft Toolkit.\", \"risk\": {\"level\": \"High\", \"reason\": \"Activation cracks and pirated downloads often carry malware, and unlicensed software breaches copyright and licence terms.\"}, \"recommendation\": [\"Uninstall it in Settings > Apps > Installed apps. For activation cracks, also run a full Microsoft Defender scan and activate Windows/Office with a genuine licence.\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Prohibited software should show none found.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 4040012301, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Compliant\", \"title\": \"Unique user login is compliant\", \"finding\": \"The device reports personal accounts, no automatic login, which meets the requirement (personal accounts, no automatic login).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012237, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Non-Compliant\", \"title\": \"Gap: Unique user login\", \"finding\": \"Found: automatic login as test; shared or generic accounts: test. Required: personal accounts, no automatic login.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"With shared or automatic logins, a lost or borrowed device opens straight into someone's data, and incidents cannot be traced to a person.\"}, \"recommendation\": [\"Turn off automatic login in Settings > Users, or set AutomaticLoginEnable=false in /etc/gdm3/custom.conf (autologin-user= in LightDM, [Autologin] User= in SDDM).\", \"Give each person their own account; lock shared ones with sudo usermod -L <name>.\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Unique user login should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012342, "profile": "typical", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Compliant\", \"title\": \"Unique user login is compliant\", \"finding\": \"The device reports personal accounts, no automatic login, which meets the requirement (personal accounts, no automatic login).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 4040012344, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Non-Compliant\", \"title\": \"Gap: Unique user login\", \"finding\": \"The device reports automatic login as Frontdesk; shared or generic accounts: Frontdesk, Office, but the baseline requires personal accounts, no automatic login.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"With shared or automatic logins, a lost or borrowed device opens straight into someone's data, and incidents cannot be traced to a person.\"}, \"recommendation\": [\"Turn off automatic sign-in: run netplwiz and tick 'Users must enter a user name and password', or set AutoAdminLogon = 0 under HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon.\", \"Give each person their own account and disable or remove shared local accounts (Computer Management > Local Users and Groups).\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Unique user login should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 4040012358, "profile": "typical", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Compliant\", \"title\": \"Prohibited software matches the required setting\", \"finding\": \"The device reports none found in 91 applications, which meets the requirement (none of: Torrent, Transmission, Deluge, Vue, FrostWire, KMSpico, KMSAuto, AutoKMS, Microsoft Toolkit).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Prohibited software should show none found.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 4040012414, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "software.prohibited", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"software.prohibited\", \"status\": \"Non-Compliant\", \"title\": \"Prohibited software: does not meet the baseline\", \"finding\": \"The device reports transmission-gtk, transmission-common instead of none of: Torrent, Transmission, Deluge, Vue, FrostWire, KMSpico, KMSAuto, Microsoft Toolkit. The required setting is none of: Torrent, Transmission, Deluge, Vue, FrostWire, KMSpico, KMSAuto.\", \"risk\": {\"level\": \"High\", \"reason\": \"Activation cracks and pirated downloads often carry malware, and unlicensed software breaches copyright and licence terms.\"}, \"recommendation\": [\"Remove the package: sudo apt remove <package> (or sudo dnf remove <package>, flatpak uninstall, snap remove).\"], \"references\": [\"ISO 27001:2022 A.8.19\", \"ISO 27001:2022 A.5.32\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Prohibited software should show none found.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 4040012229, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "account.unique_login", "status": "Compliant"}, "reply": "{\"check_id\": \"account.unique_login\", \"status\": \"Compliant\", \"title\": \"Unique user login matches the required setting\", \"finding\": \"The device reports personal accounts, no automatic login, which meets the requirement (personal accounts, no automatic login).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 4040012250, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Non-Compliant\", \"title\": \"Tamper protection is non-compliant\", \"finding\": \"Found: System Integrity Protection status: disabled. Required: on. Tamper protection stops malware, or a user, from switching off the device's security protection.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Attackers commonly disable antivirus before deploying ransomware.\"}, \"recommendation\": [\"System Integrity Protection can only be turned back on from Recovery: start the Mac in Recovery mode, open Terminal and run csrutil enable, then restart. Ask IT first if a tool needed it off.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Tamper protection should be on.\"}"}

training/eval/newchecks-v0.6-4bit.log

@@ -0,0 +1,36 @@
+Weights rounded as in the 4-bit browser build (q4f16_1)
+/Users/umer/Documents/6 - mix/endpoint-audit/training/.venv/lib/python3.11/site-packages/transformers/generation/configuration_utils.py:590: UserWarning: `do_sample` is set to `False`. However, `temperature` is set to `0.7` -- this flag is only used in sample-based generation modes. You should set `do_sample=True` or unset `temperature`.
+  warnings.warn(
+/Users/umer/Documents/6 - mix/endpoint-audit/training/.venv/lib/python3.11/site-packages/transformers/generation/configuration_utils.py:595: UserWarning: `do_sample` is set to `False`. However, `top_p` is set to `0.8` -- this flag is only used in sample-based generation modes. You should set `do_sample=True` or unset `top_p`.
+  warnings.warn(
+/Users/umer/Documents/6 - mix/endpoint-audit/training/.venv/lib/python3.11/site-packages/transformers/generation/configuration_utils.py:612: UserWarning: `do_sample` is set to `False`. However, `top_k` is set to `20` -- this flag is only used in sample-based generation modes. You should set `do_sample=True` or unset `top_k`.
+  warnings.warn(
+The attention mask is not set and cannot be inferred from input because pad token is same as eos token. As a consequence, you may observe unexpected behavior. Please pass your input's `attention_mask` to obtain reliable results.
+[1/24] finding                37s
+[2/24] finding                70s
+[3/24] finding                94s
+[4/24] finding               128s
+[5/24] finding               155s
+[6/24] finding               211s
+[7/24] finding               245s
+[8/24] finding               280s
+[9/24] finding               331s
+[10/24] finding               400s
+[11/24] finding               427s
+[12/24] finding               500s
+[13/24] finding               528s
+[14/24] finding               579s
+[15/24] finding               620s
+[16/24] finding               670s
+[17/24] finding               701s
+[18/24] finding               746s
+[19/24] finding               784s
+[20/24] finding               838s
+[21/24] finding               870s
+[22/24] finding               923s
+[23/24] finding               951s
+[24/24] finding               985s
+
+Results for adapter training/models/auditor-lora-v0.6/final on 24 test examples:
+task                 n  valid JSON  grounded  fields match
+finding             24       100%      100%          100%

training/eval/pilot-v0.1.jsonl

@@ -0,0 +1,30 @@
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000194, "profile": "neglected", "dataset_version": "0.1.0"}, "reply": "{\"tools\": [{\"tool\": \"Cursor\", \"kind\": \"AI code editor\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Enforce privacy mode through a business plan and sign a data processing agreement.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"1 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: Cursor.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000087, "profile": "hardened", "dataset_version": "0.1.0", "check_id": "gdpr.removable_encryption", "status": "Compliant"}, "reply": "{\"check_id\": \"gdpr.removable_encryption\", \"status\": \"Compliant\", \"title\": \"Removable media encryption matches the required setting\", \"finding\": \"Found: writing to USB storage blocked. This satisfies the baseline requirement of no unencrypted writes.\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.7.10\", \"ISO 27001:2022 A.8.24\", \"GDPR Art. 32(1)(a)\", \"GDPR Art. 34\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000305, "profile": "hardened", "dataset_version": "0.1.0", "check_id": "password.complexity", "status": "Error"}, "reply": "{\"check_id\": \"password.complexity\", \"status\": \"Error\", \"title\": \"Password complexity: evidence missing\", \"finding\": \"The collector could not read this setting (Value could not be read.), so compliance is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.5.17\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Password complexity should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000445, "profile": "neglected", "dataset_version": "0.1.0", "check_id": "gdpr.removable_encryption", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"gdpr.removable_encryption\", \"status\": \"Non-Compliant\", \"title\": \"Gap: Removable media encryption\", \"finding\": \"Found: USB storage writable without enforced encryption. Required: no unencrypted writes. Personal data copied to removable media must be encrypted, or copying must be blocked.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"A lost unencrypted USB drive with personal data is a reportable breach.\"}, \"recommendation\": [\"Block USB storage writes (udev read-only rule or USBGuard) and provide approved encrypted drives.\"], \"references\": [\"ISO 27001:2022 A.7.10\", \"ISO 27001:2022 A.8.24\", \"GDPR Art. 32(1)(a)\", \"GDPR Art. 34\"], \"verification\": \"Re-run the audit; Removable media encryption should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000887, "profile": "typical", "dataset_version": "0.1.0", "check_id": "aiact.os_ai_features", "status": "NotApplicable"}, "reply": "{\"check_id\": \"aiact.os_ai_features\", \"status\": \"NotApplicable\", \"title\": \"Operating system AI features restricted does not apply here\", \"finding\": \"This check does not apply: Linux distributions ship no built-in AI assistant.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.5.34\", \"GDPR Art. 5(1)(c)\", \"GDPR Art. 25\", \"EU AI Act Art. 26\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000162, "profile": "neglected", "dataset_version": "0.1.0", "check_id": "org.ai_register", "status": "Pending"}, "reply": "{\"check_id\": \"org.ai_register\", \"status\": \"Pending\", \"title\": \"AI register: decision pending\", \"finding\": \"Found: not answered. Answer ORG_AI_REGISTER in organisational.conf.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: Without a register, high-risk or prohibited AI use can go unnoticed.\"}, \"recommendation\": [\"Create an AI register listing each AI system, owner, purpose, risk class and the data it uses; use the AI software inventory from this audit as input.\"], \"references\": [\"ISO 27001:2022 A.5.9\", \"EU AI Act Art. 26\"], \"verification\": \"Answer ORG_AI_REGISTER=yes once the register exists.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "macos", "audit": 7000552, "profile": "neglected", "dataset_version": "0.1.0"}, "reply": "{\"device\": \"DEV-MacBook-14 - macOS 15.7.2\", \"score\": {\"compliant\": 16, \"assessed\": 41, \"percent\": 40}, \"counts\": {\"Compliant\": 16, \"Non-Compliant\": 25, \"NotApplicable\": 5, \"Pending\": 3, \"Error\": 2}, \"top_gaps\": [{\"check_id\": \"malware.signatures\", \"name\": \"Malware protection signatures\", \"risk\": \"High\", \"found\": \"XProtect 5372, 64 days old\"}, {\"check_id\": \"firewall.inbound\", \"name\": \"Firewall inbound policy\", \"risk\": \"High\", \"found\": \"firewall on, stealth mode off\"}, {\"check_id\": \"encryption.enabled\", \"name\": \"Encryption\", \"risk\": \"High\", \"found\": \"FileVault off\"}, {\"check_id\": \"gdpr.backup_recent\", \"name\": \"Recent backup\", \"risk\": \"Medium\", \"found\": \"76 days ago\"}], \"summary\": \"DEV-MacBook-14 meets 16 of 41 assessed checks (40%). The most serious gaps are Malware protection signatures, Firewall inbound policy and Encryption. 3 items are pending.\", \"next_steps\": [\"Re-run the audit as administrator/root so that every check can be performed.\", \"Malware protection signatures: Keep 'Install Security Responses and system files' on (Software Update > Automatic Updates); run softwareupdate --background to fetch now.\", \"Firewall inbound policy: Turn on stealth mode: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on.\", \"Encryption: Turn on FileVault (System Settings > Privacy & Security > FileVault, or sudo fdesetup enable), ideally enforced and escrowed by your MDM.\", \"Answer the 2 open organisational questions in organisational.conf.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000175, "profile": "typical", "dataset_version": "0.1.0"}, "reply": "{\"tools\": [{\"tool\": \"Microsoft Copilot\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Use the Microsoft 365 work account version covered by the organisation's Microsoft data processing terms; consumer Copilot is not covered.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"GPT4All\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Keep the optional data lake sharing switched off.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"2 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: Microsoft Copilot, GPT4All.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000974, "profile": "typical", "dataset_version": "0.1.0", "check_id": "password.min_length", "status": "Compliant"}, "reply": "{\"check_id\": \"password.min_length\", \"status\": \"Compliant\", \"title\": \"Minimum password length matches the required setting\", \"finding\": \"The device reports 14, which meets the requirement (>= 14).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.5.17\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000904, "profile": "neglected", "dataset_version": "0.1.0", "check_id": "gdpr.telemetry", "status": "Error"}, "reply": "{\"check_id\": \"gdpr.telemetry\", \"status\": \"Error\", \"title\": \"Diagnostic data minimised could not be read\", \"finding\": \"The collector could not read this setting (Value could not be read.), so compliance is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.5.34\", \"GDPR Art. 5(1)(c)\", \"GDPR Art. 25\"], \"verification\": \"Re-run the audit; Diagnostic data minimised should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000355, "profile": "neglected", "dataset_version": "0.1.0", "check_id": "malware.signatures", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"malware.signatures\", \"status\": \"Non-Compliant\", \"title\": \"Gap: Security intelligence\", \"finding\": \"Found: 40 days old (version 1.444.830.0). Required: <= 3 days old. Anti-malware can only detect threats it knows about; signatures must be current.\", \"risk\": {\"level\": \"High\", \"reason\": \"Outdated signatures miss recent malware.\"}, \"recommendation\": [\"Run Update-MpSignature and check that the device can reach Windows Update or your update server.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; signatures should be within the allowed age.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000283, "profile": "typical", "dataset_version": "0.1.0", "check_id": "gdpr.personal_data_discovery", "status": "NotApplicable"}, "reply": "{\"check_id\": \"gdpr.personal_data_discovery\", \"status\": \"NotApplicable\", \"title\": \"Personal data discovery: not applicable\", \"finding\": \"This check does not apply: Opt-in scan (PERSONAL_DATA_SCAN=0) is planned for a later stage.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.5.34\", \"ISO 27001:2022 A.5.12\", \"GDPR Art. 5(1)(c)\", \"GDPR Art. 5(1)(e)\", \"GDPR Art. 30\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000287, "profile": "typical", "dataset_version": "0.1.0", "check_id": "org.breach_procedure", "status": "Pending"}, "reply": "{\"check_id\": \"org.breach_procedure\", \"status\": \"Pending\", \"title\": \"Breach response procedure is pending\", \"finding\": \"Answer ORG_BREACH_PROCEDURE in organisational.conf. Current state: not answered.\", \"risk\": {\"level\": \"High\", \"reason\": \"Until resolved: Without a tested procedure, the 72-hour deadline is easily missed.\"}, \"recommendation\": [\"Write a breach procedure (detection, assessment, 72-hour notification to the CNPD or your authority, informing people, breach log) and test it with an exercise.\"], \"references\": [\"ISO 27001:2022 A.5.24\", \"ISO 27001:2022 A.5.26\", \"GDPR Art. 33\", \"GDPR Art. 34\"], \"verification\": \"Answer ORG_BREACH_PROCEDURE=yes once the procedure is written and tested.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "windows", "audit": 7000275, "profile": "hardened", "dataset_version": "0.1.0"}, "reply": "{\"device\": \"LAPTOP-KC73P6F - Microsoft Windows 10 Pro 10.0.19045\", \"score\": {\"compliant\": 48, \"assessed\": 48, \"percent\": 100}, \"counts\": {\"Compliant\": 48, \"Non-Compliant\": 4, \"NotApplicable\": 3, \"Pending\": 3, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"malware.signatures\", \"name\": \"Microsoft Defender Antimalware\", \"risk\": \"High\", \"found\": \"40 days old (version 1.449.779.0)\"}, {\"check_id\": \"gdpr.os_supported\", \"name\": \"Supported operating system version\", \"risk\": \"High\", \"found\": \"Microsoft Windows 10 Pro build 19045\"}, {\"check_id\": \"password.min_length\", \"name\": \"Minimum password length\", \"risk\": \"Medium\", \"found\": \"10\"}, {\"check_id\": \"org.human_oversight\", \"name\": \"Human oversight for high-risk AI\", \"risk\": \"Medium\", \"found\": \"partial\"}], \"summary\": \"LAPTOP-KC73P6F meets 48 of 48 assessed checks (100%). The most serious gaps are Microsoft Defender Antimalware and Supported operating system version. 3 items are pending.\", \"next_steps\": [\"Microsoft Defender Antimalware: Run Update-MpSignature and check that the device can reach Windows Update or your update server.\", \"Supported operating system version: Upgrade to a supported Windows 11 release (build 22631 or later), or replace hardware that cannot run it.\", \"Answer the 3 open organisational questions in organisational.conf.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000992, "profile": "typical", "dataset_version": "0.1.0"}, "reply": "{\"tools\": [{\"tool\": \"Ollama\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No transfer to a provider, but check each model's licence and keep the local API (port 11434) closed to the network.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Cursor\", \"kind\": \"AI code editor\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Enforce privacy mode through a business plan and sign a data processing agreement.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"2 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: Ollama, Cursor.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000881, "profile": "typical", "dataset_version": "0.1.0", "check_id": "gdpr.guest_account", "status": "Compliant"}, "reply": "{\"check_id\": \"gdpr.guest_account\", \"status\": \"Compliant\", \"title\": \"Guest account disabled is compliant\", \"finding\": \"The device reports no guest login, which meets the requirement (no guest login).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.5.16\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000872, "profile": "neglected", "dataset_version": "0.1.0", "check_id": "encryption.feature", "status": "Error"}, "reply": "{\"check_id\": \"encryption.feature\", \"status\": \"Error\", \"title\": \"BitLocker: could not be checked\", \"finding\": \"The collector could not read this setting (Requires an elevated (administrator) PowerShell.), so compliance is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.24\", \"ISO 27001:2022 A.8.1\", \"GDPR Art. 32(1)(a)\"], \"verification\": \"Re-run the audit; Encryption should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000097, "profile": "typical", "dataset_version": "0.1.0", "check_id": "org.processor_agreements", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"org.processor_agreements\", \"status\": \"Non-Compliant\", \"title\": \"Data processing agreements is non-compliant\", \"finding\": \"The device reports no, but the baseline requires yes. Every processor, including cloud and AI providers, needs a contract with the GDPR Article 28 terms.\", \"risk\": {\"level\": \"High\", \"reason\": \"Sharing personal data with a processor without an agreement breaches GDPR.\"}, \"recommendation\": [\"List all processors (including AI services used by staff) and sign a data processing agreement with each; check the transfer basis for non-EEA providers.\"], \"references\": [\"ISO 27001:2022 A.5.20\", \"GDPR Art. 28\"], \"verification\": \"Answer ORG_PROCESSOR_AGREEMENTS=yes once all agreements are in place.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000333, "profile": "hardened", "dataset_version": "0.1.0", "check_id": "malware.on_access", "status": "NotApplicable"}, "reply": "{\"check_id\": \"malware.on_access\", \"status\": \"NotApplicable\", \"title\": \"On-access malware protection does not apply here\", \"finding\": \"This check does not apply: XProtect scans at launch and download; macOS has no built-in on-access scanning.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000290, "profile": "typical", "dataset_version": "0.1.0", "check_id": "org.ai_register", "status": "Pending"}, "reply": "{\"check_id\": \"org.ai_register\", \"status\": \"Pending\", \"title\": \"AI register: decision pending\", \"finding\": \"Found: not answered. Answer ORG_AI_REGISTER in organisational.conf.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: Without a register, high-risk or prohibited AI use can go unnoticed.\"}, \"recommendation\": [\"Create an AI register listing each AI system, owner, purpose, risk class and the data it uses; use the AI software inventory from this audit as input.\"], \"references\": [\"ISO 27001:2022 A.5.9\", \"EU AI Act Art. 26\"], \"verification\": \"Answer ORG_AI_REGISTER=yes once the register exists.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "linux", "audit": 7000482, "profile": "hardened", "dataset_version": "0.1.0"}, "reply": "{\"device\": \"legal-ubuntu-82 - Debian GNU/Linux 13 (trixie) 13\", \"score\": {\"compliant\": 35, \"assessed\": 41, \"percent\": 84}, \"counts\": {\"Compliant\": 35, \"Non-Compliant\": 6, \"NotApplicable\": 4, \"Pending\": 1, \"Error\": 5}, \"top_gaps\": [{\"check_id\": \"gdpr.backup_configured\", \"name\": \"Backup configured\", \"risk\": \"High\", \"found\": \"none\"}, {\"check_id\": \"org.breach_procedure\", \"name\": \"Breach response procedure\", \"risk\": \"High\", \"found\": \"partial\"}, {\"check_id\": \"org.ai_literacy\", \"name\": \"AI literacy training\", \"risk\": \"Medium\", \"found\": \"partial\"}, {\"check_id\": \"org.human_oversight\", \"name\": \"Human oversight for high-risk AI\", \"risk\": \"Medium\", \"found\": \"partial\"}, {\"check_id\": \"org.ai_transparency\", \"name\": \"AI transparency to users\", \"risk\": \"Medium\", \"found\": \"yes\"}], \"summary\": \"legal-ubuntu-82 meets 35 of 41 assessed checks (84%). The most serious gaps are Backup configured and Breach response procedure. 1 items could not be read. 1 items are pending.\", \"next_steps\": [\"Re-run the audit as administrator/root so that every check can be read.\", \"Backup configured: Set up scheduled backups of /home with Deja Dup, restic or borg (or Timeshift for system snapshots plus a data backup).\", \"Breach response procedure: Write a breach procedure (detection, assessment, 72-hour notification to the CNPD or your authority, informing people, breach log) and test it with an exercise.\", \"AI literacy training: Set up a course and test it after the audit.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000769, "profile": "typical", "dataset_version": "0.1.0"}, "reply": "{\"tools\": [{\"tool\": \"LM Studio\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No transfer to a provider; check each model's licence and keep the local API (port 11434) closed to the network.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Ollama\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No transfer to a provider, but check each model's licence and keep the local API (port 11434) closed to the network.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Microsoft Copilot\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Use the Microsoft 365 work account version covered by the organisation's Microsoft data processing terms; consumer Copilot is not covered.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"3 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: LM Studio, Ollama, Microsoft Copilot.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000953, "profile": "neglected", "dataset_version": "0.1.0", "check_id": "gdpr.os_supported", "status": "Compliant"}, "reply": "{\"check_id\": \"gdpr.os_supported\", \"status\": \"Compliant\", \"title\": \"Supported operating system version is compliant\", \"finding\": \"Found: macOS 15.6. This satisfies the baseline requirement of macOS 14 or later.\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000741, "profile": "hardened", "dataset_version": "0.1.0", "check_id": "encryption.enabled", "status": "Error"}, "reply": "{\"check_id\": \"encryption.enabled\", \"status\": \"Error\", \"title\": \"Encryption: evidence missing\", \"finding\": \"The collector could not read this setting (Requires an elevated (administrator) PowerShell.), so compliance is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.24\", \"ISO 27001:2022 A.8.1\", \"GDPR Art. 32(1)(a)\"], \"verification\": \"Re-run the audit; Encryption should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000433, "profile": "typical", "dataset_version": "0.1.0", "check_id": "lockout.duration", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"lockout.duration\", \"status\": \"Non-Compliant\", \"title\": \"Account lockout duration is non-compliant\", \"finding\": \"The device reports 5 minutes, but the baseline requires >= 15 minutes. The lockout must last long enough to slow down repeated guessing.\", \"risk\": {\"level\": \"Low\", \"reason\": \"A short lockout lets attackers resume guessing almost at once.\"}, \"recommendation\": [\"Set Group Policy: Account Lockout Policy > Account lockout duration = 15 minutes or more.\", \"For a stand-alone device: net accounts /lockoutduration:15\"], \"references\": [\"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Account lockout duration should be 15 minutes or more.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000706, "profile": "hardened", "dataset_version": "0.1.0", "check_id": "aiact.risk_classification", "status": "NotApplicable"}, "reply": "{\"check_id\": \"aiact.risk_classification\", \"status\": \"NotApplicable\", \"title\": \"AI system risk classification does not apply here\", \"finding\": \"This check does not apply: no AI tools found.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.5.9\", \"EU AI Act Art. 5\", \"EU AI Act Art. 6\", \"EU AI Act Annex III\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000272, "profile": "typical", "dataset_version": "0.1.0", "check_id": "org.dpia", "status": "Pending"}, "reply": "{\"check_id\": \"org.dpia\", \"status\": \"Pending\", \"title\": \"Data protection impact assessment: decision pending\", \"finding\": \"Answer ORG_DPIA in organisational.conf. Current state: not answered.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: High-risk processing without a DPIA breaches GDPR and leaves risks to people unassessed.\"}, \"recommendation\": [\"List processing that is likely high-risk (e.g. monitoring employees, large-scale sensitive data, new technologies such as AI) and complete a DPIA for each.\"], \"references\": [\"ISO 27001:2022 A.5.34\", \"GDPR Art. 35\"], \"verification\": \"Answer ORG_DPIA=yes once DPIAs are done.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "macos", "audit": 7000298, "profile": "neglected", "dataset_version": "0.1.0"}, "reply": "{\"device\": \"FIN-MacBook-20 - macOS 15.7.2\", \"score\": {\"compliant\": 17, \"assessed\": 44, \"percent\": 40}, \"counts\": {\"Compliant\": 17, \"Non-Compliant\": 27, \"NotApplicable\": 2, \"Pending\": 4, \"Error\": 1}, \"top_gaps\": [{\"check_id\": \"malware.signatures\", \"name\": \"Malware protection signatures\", \"risk\": \"High\", \"found\": \"XProtect 5291, 113 days old\"}, {\"check_id\": \"firewall.inbound\", \"name\": \"Firewall inbound policy\", \"risk\": \"High\", \"found\": \"firewall on, stealth mode off\"}, {\"check_id\": \"admin.unauthorized\", \"name\": \"Unauthorized employee administrator accounts\", \"risk\": \"High\", \"found\": \"tnguyen, akaya\"}, {\"check_id\": \"encryption.recovery\", \"name\": \"Disk encryption recovery\", \"risk\": \"Medium\", \"found\": \"no recovery key\"}], \"summary\": \"FIN-MacBook-20 meets 17 of 44 assessed checks (40%). The most serious gaps are Malware protection signatures, Firewall inbound policy and Unauthorized employee administrator accounts. 4 items are pending.\", \"next_steps\": [\"Re-run the audit as administrator/root so that every check can be executed.\", \"Malware protection signatures: Keep 'Install Security Responses and system files' on (Software Update > Automatic Updates); run softwareupdate --background to fetch now.\", \"Firewall inbound policy: Turn on stealth mode: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on.\", \"Unauthorized employee administrator accounts: Demote the listed accounts: sudo dseditgroup -o edit -d <account> -t user admin.\", \"Answer the 1 open organisational questions in organisational.conf.\", \"Classify the AI tools found on this device and record them in the AI register.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "linux", "audit": 7000922, "profile": "typical", "dataset_version": "0.1.0"}, "reply": "{\"tools\": [{\"tool\": \"Ollama\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No transfer to a provider, but check each model's licence and keep the local API (port 11434) closed to the network.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"1 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: Ollama.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000728, "profile": "typical", "dataset_version": "0.1.0", "check_id": "malware.service", "status": "Compliant"}, "reply": "{\"check_id\": \"malware.service\", \"status\": \"Compliant\", \"title\": \"Microsoft Defender Antimalware matches the required setting\", \"finding\": \"The device reports service True, antivirus True, which meets the requirement (running).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}

training/eval/v0.3-4bit.jsonl

@@ -0,0 +1,60 @@
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000937, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"Microsoft Windows 11 Pro 10.0.26100 (windows)\", \"purpose\": \"not stated\", \"tools\": [{\"tool_type\": \"GPT4All\", \"score\": \"Local model runner; provider Nomic AI (runs locally); data: On the device unless optional data sharing is enabled; default risk minimal; GDPR: Keep the optional data lake sharing switched off.\"], \"prohibited\": [\"Emotion recognition of employees or students (except for medical or safety reasons), Social scoring of people\", \"Manipulative or exploitative techniques that cause significant harm\", \"Untargeted scraping of facial images to build face recognition databases\", \"Biometric categorisation inferring sensitive traits such as political views or sexual orientation\"], \"high_risk\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\"], \"minimal_risk\": \"Drafting, summarising, translation, coding help and similar general productivity use.\", \"undefined\": \"not stated\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000590, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "malware.antivirus", "status": "Compliant"}, "reply": "{\"check_id\": \"malware.antivirus\", \"status\": \"Compliant\", \"title\": \"Antivirus is compliant\", \"finding\": \"The device reports ClamAV (clamav-daemon), which meets the requirement (antivirus running).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"], \"evidence\": [\"No evidence provided.\"]}\"]"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000666, "profile": "typical", "dataset_version": "0.3.0", "check_id": "gdpr.updates_recent", "status": "Error"}, "reply": "{\"check_id\": \"gdpr.updates_recent\", \"status\": \"Error\", \"title\": \"Security updates installed recently could not be read\", \"finding\": \"This check returned an error: Value could not be read. Compliance cannot be confirmed.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\", \"GDPR Art. 32(1)(d)\"], \"verification\": \"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7001291, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "org.ropa", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"org.ropa\", \"status\": \"Non-Compliant\", \"title\": \"Record of processing activities: does not meet the baseline\", \"finding\": \"Found: no. This device meets the baseline.\", \"risk\": {\"level\": \"High\", \"reason\": \"A missing or outdated record is a direct infringement and makes every other assessment harder.\"}, \"recommend\": [\"Create or update the record of processing activities (purposes, categories of data and people, recipients, transfers, retention, security measures).\", \"Assign an owner and review it at least yearly.\"], \"references\": [\"ISO 27001:2022 A.5.34\", \"GDPR Art. 30\"], \"verification\": \"Answer ORG_ROPA=yes in organisational.conf once the record is current.\"}\"]"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001395, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "malware.on_access", "status": "NotApplicable"}, "reply": "{\"check_id\": \"malware.on_access\", \"status\": \"NotApplicable\", \"title\": \"On-access malware protection: not assessed on this device\", \"finding\": \"This check does not apply: XProtect scans at launch and download; macOS has no built-in on-access scanning.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommend\": [], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7001113, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "org.dpia", "status": "Pending"}, "reply": "{\"device\": \"Android 14\", \"check_id\": \"org.dpia\", \"title\": \"Data protection impact assessment: needs a further step before it can be judged\", \"finding\": \"Answered once by the organisation (organisational.conf); not part of the phone self-check. Current state: pending.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Current state: pending.\"}, \"recommend\": [\"List processing that is likely high-risk (e.g. monitoring employees, large-scale sensitive data, new technologies such as AI) and complete a DPIA for each.\"], \"references\": [\"ISO 27001:2022 A.5.34\", \"GDPR Art. 35\"], \"verification\": \"This item needs a further step before it can be judged.\", \"evidence\": [\"No\"]}"}
+{"task": "summary", "meta": {"task": "summary", "os": "ios", "audit": 7000189, "profile": "hardened", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"DEV-iPad-04 - iPadOS 27.0\", \"score\": {\"countly: 16, assessed: 17, percent: 94}, \"counts\": {\"Compliant\": \"16\", \"Non-Compliant\": \"1\", \"NotApplicable\": \"1\", \"Pending\": \"11\", \"Error\": \"0\"}, \"top_gaps\": [{\"check_id\": \"screen_lock.enabled\", \"name\": \"Screen lock enabled\", \"found\": \"Passcode\", \"risk\": \"Passcode\"}], \"summary\": \"The device meets 16 of 17 assessed checks (percent: 94). There are 11 open gaps, none of them rated high risk. 11 items are pending. 19 results are self-reported by the user and were not verified on the device.\", \"next_steps\": [\"Screen lock enabled is set to passcode (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or removed it. Self-reported data is not accurate before a data protection and AI Act review, with a data processing agreement where needed.\", \"Answer the 8 open gaps, none of them rated high risk. The class is unapproved.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000456, "profile": "neglected", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"Microsoft Windows 11 Pro 10.0.26100 (windows)\", \"purpose\": \"not stated\", \"tools\": [{\"tool\": \"Microsoft Copilot\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"prohibited\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"high_risk_class\": \"undefined\", \"limited_risk_class\": \"minimal\", \"script\": \"Not applicable.\"], \"categories\": [\"Drafting\", \"Summarizing\", \"Translation\", \"Coding\", \"Basic\"], \"becomes危险\": \"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"must_not_be_used\": [\"not described\"]}]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000992, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "gdpr.os_supported", "status": "Compliant"}, "reply": "{\"check_id\": \"gdpr.os_supported\", \"status\": \"Compliant\", \"title\": \"Supported operating system version is compliant\", \"finding\": \"The device reports macOS 26.0.1 which meets the requirement (macOS 14 or later).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommend\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Supported operating system version should be Compliant.\"}]"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000482, "profile": "typical", "dataset_version": "0.3.0", "check_id": "lockout.observation", "status": "Error"}, "reply": "{\"check_id\": \"lockout.observation\", \"status\": \"Error\", \"title\": \"Lockout observation period: could not be read\", \"finding\": \"The setting could not be read because it satisfies one of the baseline requirements but not all. Found: not read.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"The value could not be read, so compliance is unknown.\", \"evidence\": \"Not applicable.\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7001291, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "org.breach_procedure", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"org.breach_procedure\", \"status\": \"Non-Compliant\", \"title\": \"Breach response procedure is non-compliant\", \"finding\": \"Found: no. This device meets the baseline requirement of yes.\", \"risk\": {\"level\": \"High\", \"reason\": \"Without a tested procedure, the 72-hour deadline is easily missed.\"}, \"recommendation\": [\"Write a breach procedure (detection, assessment, 72-hour notification to the CNPD or your authority, informing people, breach log) and test it with an exercise.\"], \"references\": [\"ISO 27001:2022 A.5.24\", \"ISO 27001:2022 A.5.26\", \"GDPR Art. 33\", \"GDPR Art. 34\"], \"verification\": \"Answer ORG_BREACH_PROCEDURE=yes once the procedure is written and tested.\"}]"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000355, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.os_ai_features", "status": "NotApplicable"}, "reply": "{\"check_id\": \"aiact.os_ai_features\", \"status\": \"NotApplicable\", \"title\": \"Apple Intelligence external integrations restricted: not assessed on this device\", \"finding\": \"This check does not apply: Apple Intelligence needs Apple silicon.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.5.34\", \"GDPR Art. 5(1)(c)\", \"GDPR Art. 25\", \"EU AI Act Art. 26\"]}\"]"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7000271, "profile": "typical", "dataset_version": "0.3.0", "check_id": "org.ai_literacy", "status": "Pending"}, "reply": "{\"check_id\": \"org.ai_literacy\", \"status\": \"Pending\", \"title\": \"AI literacy training: decision pending\", \"finding\": \"Answer ORG_AI_LITERACY in organisational.conf. Current state: not answered.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Current state: Unclear\"}, \"recommend\": [\"Provide AI literacy training matched to how staff use AI (capabilities, limits, data protection, the AI acceptable-use policy) and keep records.\"], \"references\": [\"ISO 27001:2022 A.6.3\", \"EU AI Act Art. 4\"], \"verification\": \"Found: not answered. Needs a further step before it can be judged.\"}\"]"}
+{"task": "summary", "meta": {"task": "summary", "os": "macos", "audit": 7001405, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"OPS-MacBook-14 - macOS 15.7.2\", \"score\": {\"countly\": {\"compliant\": 31, \"assessed\": 46, \"percent\": 67}, \"top_gaps\": [{\"check_id\": \"firewall.enabled\", \"name\": \"Firewall\", \"found\": \"Firewall | Firewall | High\"}, {\"check_id\": \"firewall.inbound\", \"name\": \"Firewall inbound policy\", \"found\": \"Firewall inbound policy | High\"}, {\"check_id\": \"vuln.known_vulnerabilities\", \"name\": \"Known vulnerabilities in installed software\", \"found\": \"28 critical/high\"}}], \"summary\": \"The OPS-MacBook-14 meets 31 of 46 assessed checks (67%). There are 5 open gaps, 3 closed gaps and 5 not applicable issues. 15 checks could not be read because they were set to a non-administrator account. 24 items are minimum password length, 24 are password history, 24 are password expiration, 24 are password complexity, 24 are Account lockout threshold, 24 are Account lockout duration, 24 are lockout observations, 24 are lockout duration, 24 are lockout.observation, 24 are screen_lock, 24 are screen_lock_password, 24 are screen_lock.complexity, 24 are lockout.three, 24 are known_vulnerabilities, 24 are locked, 24 are not read.\", \"nextsteps\": [\"Password length is at least 4 characters long.\", \"Password history is saved for each session instead of a non-administrator account.\", \"Password expiration is at least 4 weeks, never, 24 minutes, 24 hours, 24 days, 24 hours, 24 days, 24 hours, 24 days, 24 hours, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 24 days, 2"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000432, "profile": "neglected", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"Microsoft Windows 10 Pro 10.0.19045 (windows)\", \"purpose\": \"not stated\", \"tools\": [{\"tool_type\": \"Hugging Face models\", \"kind\": \"Local model files; provider Various model publishers; data: On the device; default risk minimal; GDPR: Record which models are present and their licences; the risk class depends on what the models are used for.\"], {\"tool_type\": \"Cursor\", \"kind\": \"AI code editor; provider Anysphere (US); data: Code sent to the provider and its model providers unless privacy mode is enforced; default risk minimal; GDPR: Enforce privacy mode through a business plan and sign a data processing agreement.\", \"tool_id\": \"Claude Code\", \"kind\": \"AI code editor (command line)\"}], \"log_retention\": \"not applied\", \"prohibited_types\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\", \"Social scoring of people\", \"Manipulative or exploitative techniques that cause significant harm\", \"Untargeted scraping of facial images to build face recognition databases\", \"Biometric categorisation inferring sensitive traits such as political views or sexual orientation\"], \"risk\": {\"level\": \"limited risk\", \"reason\": \"Drafting, summarising, translation, coding help and similar general productivity use.\"}, \"summary\": \"The ai_classification tool set lacks basic functionality. Its default setting would be insufficient for the highest risk application.  Its approved tools are Hugging Face models, Cursor, and Claude Code.\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000106, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "vuln.known_vulnerabilities", "status": "Compliant"}, "reply": "{\"check_id\": \"vuln.known_vulnerabilities\", \"status\": \"Compliant\", \"title\": \"Known vulnerabilities in installed software is compliant\", \"finding\": \"The device reports 0 critical/high, which meets the requirement (<= 0 critical/high).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it after the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; critical or high vulnerabilities should be 0 or fewer.\"}]"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000561, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "gdpr.backup_recent", "status": "Error"}, "reply": "{\"check_id\": \"gdpr.backup_recent\", \"status\": \"Error\", \"title\": \"Recent backup: could not be read\", \"finding\": \"This check returned an error: Value could not be read. Compliance cannot be confirmed.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.13\", \"GDPR Art. 32(1)(c)\"], \"verification\": \"Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000904, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "admin.approved", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"admin.approved\", \"status\": \"Non-Compliant\", \"title\": \"Approved IT administrator: does not meet the baseline\", \"finding\": \"Found: none of the approved accounts is an enabled administrator. Required: itadmin.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Without an approved admin account, IT tends to rely on employees' accounts having admin rights.\"}, \"recommend\": [\"Add the approved IT administrator account (listed in APPROVED_ADMS) to the local Administrators group, ideally managed with Windows LAPS or Intune.\"], \"references\": [\"ISO 27001:2022 A.8.2\", \"ISO 27001:2022 A.5.15\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Approved IT administrator should list the approved account.\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001093, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.risk_classification", "status": "NotApplicable"}, "reply": "{\"check_id\": \"aiact.risk_classification\", \"status\": \"NotApplicable\", \"title\": \"AI system risk classification: not assessed on this device\", \"finding\": \"This check does not apply: no AI tools found.  \"\n}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001352, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.risk_classification", "status": "Pending"}, "reply": "{\"check_id\": \"aiact.risk_classification\", \"status\": \"Pending\", \"title\": \"AI system risk classification: decision pending\", \"finding\": \"Current state: Curated.  Required: every AI tool classified.  No evidence matches this item.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Current state: Curated.  Required: every AI tool classified.\"}, \"recommendation\": [\"Record the purpose for which each listed tool is used and classify it (prohibited, high-risk, limited-risk transparency, minimal). The auditor model does this from the inventory and the stated purpose.\"], \"references\": [\"ISO 27001:2022 A.5.9\", \"EU AI Act Art. 5\", \"EU AI Act Art. 6\", \"EU AI Act Annex III\"], \"verification\": \"Every AI tool in the inventory has a classification in the AI register.\"}]"}
+{"task": "summary", "meta": {"task": "summary", "os": "linux", "audit": 7001093, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"dev-ws-39 - Red Hat Enterprise Linux 8.10 (Ootpa), powered by RHEL 8.10\", \"score\": {\"countyside\": \"29\", \"compliant\": \"29\", \"not_compliant\": \"21\", \"not_applicable\": \"4\", \"pending\": \"2\", \"error\": \"0\"}, \"top_gaps\": [{\"check_id\": \"password.min_length\", \"name\": \"Minimum password length\", \"found\": \"8\", \"risk\": \"High\"}], \"summary\": \"The Devseis endpoint meets 29 of 50 assessed checks (29/50 = 58%). There are 21 non-compliant items, 4 not applicable items and 2 items that could not be read (0). Four checks could not be read because they were set to a default (tnguyen).\", \"next_steps\": [\"Password length is set to minimum (8).\", \"Answer the 5 open questions in this document.\", \"Minimum password length is set to 8.\", \"Answer the 5 open questions instead of 8.\", \"Answer the 5 open questions if the user is authorized.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7000763, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"iOS 18.7.8 (ios)\", \"purpose\": \"not stated\", \"tools\": [{\"tool\": \"Gemini\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_risk_yearto\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\"], \"prohibited\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"high_risk\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\"], \"limited_risk\": \"Drafting, summarising, translation, coding help and similar general productivity use.\"}], \"log_retention\": {\"not_applicable\": \"Not applicable to this device.\", \"prohibited\": \"Not applicable to this device.\", \"minimal\": \"Not applicable to this device.\", \"maximum\": \"Not applicable to this device.\"}}, \"action\": [\"None\"]]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001403, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "gdpr.updates_recent", "status": "Compliant"}, "reply": "{\"check_id\": \"gdpr.updates_recent\", \"status\": \"Compliant\", \"title\": \"Security updates installed recently matches the required\", \"finding\": \"The device reports 24 days ago, which meets the requirement (<= 30 days ago).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it after may be needed.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\", \"GDPR Art. 32(1)(d)\"], \"verification\": \"Re-run the audit; the last update should be within 30 days.\", \"evidence\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b), \"GDPR Art. 32(1)(d)\"]}]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000974, "profile": "typical", "dataset_version": "0.3.0", "check_id": "firewall.outbound", "status": "Error"}, "reply": "{\"check_id\": \"firewall.outbound\", \"status\": \"Error\", \"title\": \"Firewall outbound policy: could not be read\", \"finding\": \"The baseline does not match the default outbound policy so that it is consistent across devices.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The value could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.20\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"The value could not be read, so compliance is unknown.\"}]"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000937, "profile": "typical", "dataset_version": "0.3.0", "check_id": "lockout.observation", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"lockout.observation\", \"status\": \"Non-Compliant\", \"title\": \"Lockout observation period is non-compliant\", \"finding\": \"Found: no lockout configured. Required: >= 15 minutes.\", \"risk\": {\"level\": \"Low\", \"reason\": \"A short window lets attackers pace their guesses to avoid lockout.\"}, \"recommend\": [\"Set Group Policy: Account Lockout Policy > Reset account lockout counter after = 15 minutes or more.\", \"For a stand-alone device: net accounts /lockoutwindow:15\"], \"references\": [\"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Lockout observation period should be 15 minutes or more.\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000290, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "gdpr.personal_data_discovery", "status": "NotApplicable"}, "reply": "{\"check_id\": \"gdpr.personal_data_discovery\", \"status\": \"NotApplicable\", \"title\": \"Personal data discovery: not applicable\", \"finding\": \"This check does not apply: Opt-in scan (PERSONAL_DATA_SCAN=0) is planned for a later stage.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommend\": [\"Not applicable\"]}, \"references\": [\"ISO 27001:2022 A.5.34\", \"ISO 27001:2022 A.5.12\", \"GDPR Art. 5(1)(c)\", \"GDPR Art. 5(1)(e)\"], \"verification\": \"Knowing where personal data is stored on endpoints is needed for the record of processing and for storage limitation.\"}]"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000685, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "aiact.log_retention", "status": "Pending"}, "reply": "{\"check_id\": \"aiact.log_retention\", \"status\": \"Pending\", \"title\": \"AI usage log retention: decision pending\", \"finding\": \"Current state: depends on classification. Required only if a tool is classified high-risk.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Missing logs prevent monitoring and investigation of high-risk AI use.\"}, \"recommendation\": [\"If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months.\"], \"references\": [\"ISO 27001:2022 A.8.15\", \"EU AI Act Art. 26(6)\"], \"verification\": \"Log retention is documented for each high-risk AI system.\"}], \"device\": {\"model\": \"Microsoft Windows 11 Pro 10.0.26100 (windows), identified using the default settings.\", \"family\": \"Windows\", \"version\": \"10.0.26100 (windows)}}\"]"}
+{"task": "summary", "meta": {"task": "summary", "os": "windows", "audit": 7000481, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"DESKTOP-LPGZG5W - Microsoft Windows 11 Pro 10.0.26200\", \"score\": {\"county\": \"36\", \"highest_risk\": \"55\", \"percent\": \"65\"}, \"counts\": {\"compliant\": \"36\", \"non_compliant\": \"19\", \"not_applicable\": \"4\", \"pending\": \"5\", \"error\": \"0\"}, \"top_gaps\": [{\"check_id\": \"password.min_length\", \"name\": \"Minimum password length\", \"found\": \"14\"}, {\"check_id\": \"password.history\", \"name\": \"Password history\", \"found\": \"0\"}, {\"check_id\": \"password.expiration\", \"name\": \"Password expiration\", \"found\": \"180 days\"}, {\"check_id\": \"password.min_age\", \"name\": \"Minimum password age\", \"found\": \"0 days\"}, {\"check_id\": \"password.complexity\", \"name\": \"Password complexity\", \"found\": \"enabled\"}], \"summary\": \"The DESKTOP-LPGZG5W meets 36 of 55 (65%) checks (compliant, non-compliant = 36, not_applicable = 4, pending = 5). There are 5 gaps (minimum password length, password.history, password.expiration, password.min_age, password.complexity), which could be improved.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000275, "profile": "neglected", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"Microsoft Windows 10 Pro 10.0.19045 (windows),\", \"purpose\": [\"not stated\"], \"tools\": [], \"prohibited\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\", \"Social scoring of people\", \"Manipulative or exploitative techniques that cause significant harm\", \"Untargeted scraping of facial images to build face recognition databases\", \"Biometric categorisation inferring sensitive traits such as political views or sexual orientation\"], \"high_risk\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"minimal_risk\": [\"Drafting, summarising, translation, coding help and similar general productivity use.\"], \"allowed\": [\"LM Studio\", \"none\"], \"prohibited_tools\": [\"LM Studio\"], \"action\": \"Not applicable on this device.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000587, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "admin.unauthorized", "status": "Compliant"}, "reply": "{\"check_id\": \"admin.unauthorized\", \"status\": \"Compliant\", \"title\": \"Unauthorized employee local administrator accounts is compliant\", \"finding\": \"Found: none. This satisfies the baseline requirement of none.\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it after the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.2\", \"ISO 27001:2022 A.5.18\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit\"}]"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7001382, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "vuln.pending_updates", "status": "Error"}, "reply": "{\"check_id\": \"vuln.pending_updates\", \"status\": \"Error\", \"title\": \"Pending security updates: could not be read\", \"finding\": \"No answer within 300 seconds. Compliance cannot be confirmed because the setting could not be read.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommend\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\", \"GDPR Art. 32(1)(d)\"], \"verification\": \"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000195, "profile": "typical", "dataset_version": "0.3.0", "check_id": "password.expiration", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"password.expiration\", \"status\": \"Non-Compliant\", \"title\": \"Password expiration is non-compliant\", \"finding\": \"Found: never. Required: 1-365 days. The baseline requires passwords to be changed within a set period, limiting how long a stolen password stays useful.\", \"risk\": {\"level\": \"Low\", \"reason\": \"A leaked password can stay valid indefinitely.\"}, \"recommendation\": [\"Set Group Policy: Account Policies > Password Policy > Password Expiration = 1-365 days.\", \"For a stand-alone device: net accounts /maxpwage:365\"], \"references\": [\"ISO 27001:2022 A.5.17\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Password expiration should be between 1 and 365 days.\", \"evidence\": [\"No\"]]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001334, "profile": "typical", "dataset_version": "0.3.0", "check_id": "screen_lock.timeout", "status": "NotApplicable"}, "reply": "{\"check_id\": \"screen_lock.timeout\", \"status\": \"NotApplicable\", \"title\": \"Screen lock timeout: not assessed on this device\", \"finding\": \"This check does not apply: No graphical desktop settings found.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommend\": [], \"references\": [\"ISO 27001:2022 A.8.1\", \"ISO 27001:2022 A.7.7\", \"GDPR Art. 32(1)(b)\"]}\"]"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000561, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "org.ai_register", "status": "Pending"}, "reply": "{\"check_id\": \"org.ai_register\", \"status\": \"Pending\", \"title\": \"AI register: decision pending\", \"finding\": \"Answer ORG_AI_REGISTER in organisational.conf. Current state: not answered.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: Without a register, high-risk or prohibited AI use can go unnoticed.\"}, \"recommend\": [\"Create an AI register listing each AI system, owner, purpose, risk class and the data it uses; use the AI software inventory from this audit as input.\"], \"references\": [\"ISO 27001:2022 A.5.9\", \"EU AI Act Art. 26\"], \"verification\": \"This item needs a further step before it can be judged.\", \"evidence\": [\"Answer ORG_AI_REGISTER in organisational.conf.\"]}"}
+{"task": "summary", "meta": {"task": "summary", "os": "linux", "audit": 7001023, "profile": "neglected", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"sales-ws-83 - Ubuntu 26.04.1 LTS 26.04\", \"score\": {\"countyside\": \"15\", \"assessed\": \"48\", \"percent\": \"31\"}, \"counts\": {\"compliant\": \"15\", \"non_compliant\": \"33\", \"not_applicable\": \"4\", \"pending\": \"4\", \"error\": \"0\"}, \"top_gaps\": [{\"check_id\": \"password.min_length\", \"name\": \"Antivirus\", \"found\": \"Minimum password length: Minimum password length | Minimum password length | Non-Compliant | 6\", \"risk\": \"High\", \"percentage\": \"31\"}, {\"check_id\": \"password.history\", \"name\": \"ClamAV malware protection service\", \"found\": \"Password history | Password history | Non-Compliant | 12\", \"risk\": \"High\", \"percentage\": \"31\"}, {\"check_id\": \"password.expiration\", \"name\": \"Password expiration\", \"found\": \"Password expiration | Password expiration | Non-Compliant | PASS_MAX_DAYS 99999\", \"risk\": \"Medium\", \"percentage\": \"no lockout\"}], \"summary\": \"The sales-ws-83 server meets 15 of 48 assessed checks (31%). There are 4 gaps, 4 missing, 33 non-compliant items, and 0 errors. 4 items are pending.\", \"next_steps\": [\"Antivirus: Install an endpoint protection product, or ClamAV: apt install clamav clamav-daemon (RHEL: dnf install clamav clamd), then systemctl enable --now clamav-daemon.\", \"ClamAV malware protection service: systemctl enable --now clamav-daemon (RHEL: clamd@scan).\", \"Password expiration: Password expiration | Password expiration | Non-Compliant | PASS_MAX_DAYS 99999\", \"Answer the 4 open questions in this document.\"]}\"]"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000306, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"Microsoft Windows 11 Pro 10.0.26100 (windows)\", \"purpose\": \"not stated\", \"tools\": [{\"tool\": \"Ollama\", \"kind\": \"Local model runner; provider Open source (runs locally); data: On the device; nothing leaves unless a cloud model is selected; default risk minimal; GDPR: No transfer to a provider, but check each model's licence and keep the local API (port 11434) closed to the network\"}, {\"tool\": \"none\", \"kind\": \"none\"}], \"prohibited\": [\"Emotion recognition of employees of students (except for medical or safety reasons), Social scoring of people\", \"Manipulative or exploitative techniques that cause significant harm, Untargeted scraping of facial images to build face recognition databases\", \"Biometric categorisation inferring sensitive traits such as political views or sexual orientation\"], \"risk\": \"minimal risk\", \"next_steps\": [\"Not applicable: not stated.\", \"Answer the 8 open questions above: not assessed.\"], \"action\": [\"No new insights were gathered here.\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000175, "profile": "typical", "dataset_version": "0.3.0", "check_id": "encryption.enabled", "status": "Compliant"}, "reply": "{\"check_id\": \"encryption.enabled\", \"status\": \"Compliant\", \"title\": \"Encryption matches the baseline\", \"finding\": \"The device reports fully encrypted (100%), which meets the requirement (fullEncrypted (100%))\"."}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001424, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "gdpr.time_sync", "status": "Error"}, "reply": "{\"check_id\": \"gdpr.time_sync\", \"status\": \"Error\", \"title\": \"Time synchronisation: could not be read\", \"finding\": \"The setting could not be read because it meets one of the requirements but not the others.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.17\", \"GDPR Art. 33\"], \"verification\": \"The value could not be read, so compliance is unknown.\"}]"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000355, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.unapproved", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"aiact.unapproved\", \"status\": \"Non-Compliant\", \"title\": \"Unapproved AI tools (shadow AI) is non-compliant\", \"finding\": \"Found: ChatGPT. Required: only: none. AI tools used without approval may send work and personal data to providers without contracts or a transfer basis.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Shadow AI can leak confidential or personal data and creates unassessed AI Act and GDPR obligations.\"}, \"recommend\": [\"Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it.\", \"Publish an AI acceptable-use policy so staff know which tools are allowed.\", \"Remove unapproved apps and restrict installations through your MDM.\"], \"references\": [\"ISO 27001:2022 A.5.9\", \"ISO 27001:2022 A.8.19\", \"GDPR Art. 28\", \"EU AI Act Art. 26\"], \"verification\": \"Re-run the audit; Re-run the audit.\"}\"]"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000656, "profile": "typical", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "NotApplicable"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"NotApplicable\", \"title\": \"Tamper protection: not assessed on this device\", \"finding\": \"This check does not apply: Another antivirus is primary: SentinelOne.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}\"]"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7000452, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.log_retention", "status": "Pending"}, "reply": "{\"check_id\": \"aiact.log_retention\", \"status\": \"Pending\", \"title\": \"AI usage log retention: decision pending\", \"finding\": \"Current state: depends on classification. Required only if a tool is classified high-risk.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Missing logs prevent monitoring and investigation of high-risk AI use.\"}, \"recommendation\": [\"If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months.\"], \"references\": [\"ISO 27001:2022 A.8.15\", \"EU AI Act Art. 26(6)\"], \"verification\": \"This item needs a further step before it can be judged.\", \"evidence\": \"self-reported by the user\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "windows", "audit": 7000195, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"LAPTOP-XET19C3 - Microsoft Windows 11 Pro 10.0.26200\", \"score\": {\"countly\": 35, \"highest_risk\": 53, \"percent\": 66}, \"counts\": {\"Compliant\": 35, \"NonCompliant\": 18, \"NotApplicable\": 4, \"Pending\": 6, \"Error\": 1}, \"top_gaps\": [{\"check_id\": \"password.min_length\", \"name\": \"Minimum password length\", \"found\": \"Minimum password length: Minimum password length | Minimum password length | Non-Compliant | 12\"}, {\"check_id\": \"password.history\", \"name\": \"Password history\", \"found\": \"Password history | Password history | Non-Compliant | 5\"}, {\"check_id\": \"password.expiration\", \"name\": \"Password expiration\", \"found\": \"Password expiration | Password expiration | never\"}, {\"check_id\": \"password.min_age\", \"name\": \"Minimum password age\", \"found\": \"Minimum password age: 1 days\"}, {\"check_id\": \"password.complexity\", \"name\": \"Password complexity\", \"found\": \"Password complexity | Password complexity | Compliant | enabled\"}], \"summary\": \"The LAPTOP-XET19C3 meets 35 of 53 (66%) checks (compliant, highest risk first). There are 4 gaps (minimum password length, password.history, password.expiration, password.min_age), none of them are applicable.\", \"next_steps\": [\"Minimum password length: Run Update-MpSignature and check that the device can reach Windows Update or your update server.\", \"Password history: Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultInboundAction Block.\", \"Password expiration: Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultInboundAction Block.\", \"Minimum password age: 1 days.\", \"Password complexity: Run Update-MpSignature and check that the device can reach Windows Update or your update server.\"], \"action\": \"Answer the 5 open questions that follow the checklist in order, and record the results here. If there are missing questions, add them before the next step.\"}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7001181, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"iOS 26.7 (ios)\", \"purpose\": \"not stated\", \"tools\": [{\"tool\": \"Gemini\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_limited_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\"], \"prohibited_classes\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"action\": \"None\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\"], \"warns\": [\"Not applicable.\"], \"log_retention\": \"Required (at least one day per month)\"]}]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000355, "profile": "typical", "dataset_version": "0.3.0", "check_id": "screen_lock.enabled", "status": "Compliant"}, "reply": "{\"check_id\": \"screen_lock.enabled\", \"status\": \"Compliant\", \"title\": \"Screen lock: meets the baseline\", \"finding\": \"Screen lock is set to on, in line with the required on.\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommend\": [\"Keep the current setting and confirm it after the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.1\", \"ISO 27001:2022 A.7.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Screen lock should be on.\"}]"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001457, "profile": "typical", "dataset_version": "0.3.0", "check_id": "firewall.inbound", "status": "Error"}, "reply": "{\"check_id\": \"firewall.inbound\", \"status\": \"Error\", \"title\": \"Firewall inbound policy: could not be read\", \"finding\": \"No evidence was collected for this check (Requires root: run the collector with sudo.).\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.20\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; the inbound policy should be block/deny.\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7000707, "profile": "typical", "dataset_version": "0.3.0", "check_id": "vuln.outdated_apps", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"vuln.outdated_apps\", \"status\": \"Non-Compliant\", \"title\": \"App updates is non-compliant\", \"finding\": \"Found: automatic app updates off. Required: automatic app updates on. Self-reported by the user, not verified on the device.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Outdated applications contain known vulnerabilities that attackers exploit through documents and web pages.\"}, \"recommendation\": [\"Play Store › profile picture › Settings › Network preferences › Auto-update apps: Over any network or Over Wi-Fi only; then Manage apps & device › Update all.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"ISO 27001:2022 A.8.19\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Non-Compliant, not verified on the device.\", \"evidence\": \"self-reported by the user\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001424, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "vuln.outdated_apps", "status": "NotApplicable"}, "reply": "{\"check_id\": \"vuln.outdated_apps\", \"status\": \"NotApplicable\", \"title\": \"Outdated third-party applications: not assessed on this device\", \"finding\": \"This check does not apply: Homebrew is not installed, so there is no local source of current application versions.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommend\": [], \"references\": [\"ISO 27001:2022 A.8.8\", \"ISO 27001:2022 A.8.19\", \"GDPR Art. 32(1)(b)\"]}\"]"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7000763, "profile": "typical", "dataset_version": "0.3.0", "check_id": "org.ai_literacy", "status": "Pending"}, "reply": "{\"device\": \"iOS 18.7.8 (ios)\", \"check_id\": \"org.ai_literacy\", \"status\": \"Pending\", \"title\": \"AI literacy training: decision pending\", \"finding\": \"Answered once by the organisation (organisational.conf); not part of the phone self-check. Current state: not answered.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until verified: Medium - Untrained staff misuse AI tools and share data they should not.\"}, \"recommend\": [\"Provide AI literacy training matched to how staff use AI (capabilities, limits, data protection, the AI acceptable-use policy) and keep records.\"], \"references\": [\"ISO 27001:2022 A.6.3\", \"EU AI Act Art. 4\"], \"verification\": \"Provide AI literacy training matched to how staff use AI (capabilities, limits, data protection, the AI acceptable-use policy) and keep records.\", \"evidence\": \"Answered once by the organisation (organisational.conf); not part of the phone self-check.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "ios", "audit": 7001244, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"SALES-iPhone-47 - iOS 27.0\", \"score\": {\"countly_compliant\": 13, \"countly_pending\": 10, \"countly_error\": 0, \"top_gaps\": [{\"check_id\": \"screen_lock_timeout\", \"name\": \"Auto-Lock\", \"found\": \"Auto-Lock Never\"}], \"summary\": \"The device meets 13 of 19 assessed checks (68%). There are 10 open issues (10).\", \"next_steps\": [\"Screen lock timeout: Settings › Display & Brightness › Auto-Lock: choose 5 minutes or less (not Never).\", \"Mobile.passcode_strength: Settings › Face ID & Passcode › Change Passcode › Passcode Options: choose a 6-digit, custom numeric (7+ digits) or alphanumeric code.\", \"aiact.unapproved: Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed),\" \"Answering next steps if there are 19 open issues (10).\", \"classify the AI tools (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) if there are 10 open issues (10).\"]}\"]"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7000536, "profile": "hardened", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"iOS 27.0 (ios)\", \"purpose\": \"not stated\", \"tools\": [{\"tool\": \"ChatGPT\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_risk_yearto\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"high_risk\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"limited_risk\": \"Drafting, summarising, translation, coding help and similar general productivity use.\"}], \"log_retention\": \"Not applied: no. Default: not set.\", \"scripting\": \"Not applicable.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7000298, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.inventory", "status": "Compliant"}, "reply": "{\"device\": \"iOS 26.4\", \"check_id\": \"aiact.inventory\", \"status\": \"Compliant\", \"title\": \"AI software inventory: meets the baseline\", \"finding\": \"The user reports an AI software inventory, which meets the requirement (inventory taken). Self-reported by the user, not verified on the device.\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommend\": [\"Keep the AI register up-to-date and reflect the current state.\"], \"references\": [\"ISO 27001:2022 A.5.9\", \"GDPR Art. 30\", \"EU AI Act Art. 26\"], \"evidence\": \"self-reported\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000974, "profile": "typical", "dataset_version": "0.3.0", "check_id": "firewall.enabled", "status": "Error"}, "reply": "{\"device\": \"ubuntu-24.04.3\", \"check_id\": \"firewall.enabled\", \"title\": \"Firewall: could not be read\", \"finding\": \"The setting could not be read because: Requires root: run the collector with sudo.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.20\", \"ISO 27001:2022 A.8.1\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"The value could not be read, so compliance is unknown.\", \"device_type\": \"linux\", \"evidence\": \"The setting could not be read\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000432, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "firewall.private.enabled", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"firewall.private.enabled\", \"status\": \"Non-Compliant\", \"title\": \"Private firewall is non-compliant\", \"finding\": \"Found: off. Required: on. The device meets the baseline requirement of on for this check.\", \"risk\": {\"level\": \"High\", \"reason\": \"Network services on the device are exposed to anyone on the same network.\"}, \"recommendation\": [\"Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True, or enforce it with Group Policy/Intune.\"], \"references\": [\"ISO 27001:2022 A.8.20\", \"ISO 27001:2022 A.8.1\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; the firewall should be on.\"}]"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000590, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "screen_lock.timeout", "status": "NotApplicable"}, "reply": "{\"check_id\": \"screen_lock.timeout\", \"status\": \"NotApplicable\", \"title\": \"Screen lock timeout: not assessed on this device\", \"finding\": \"This check does not apply: No graphical desktop settings found.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommend\": [], \"references\": [\"ISO 27001:2022 A.8.1\", \"ISO 27001:2022 A.7.7\", \"GDPR Art. 32(1)(b)\"]}\"]"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7001266, "profile": "typical", "dataset_version": "0.3.0", "check_id": "org.ai_literacy", "status": "Pending"}, "reply": "{\"device\": \"Android 14 (android)\", \"check_id\": \"AI literacy training\", \"status\": \"Pending\", \"title\": \"AI literacy training: decision pending\", \"finding\": \"Answered once by the organisation (organisational.conf); not part of the phone self-check.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: Untrained staff misuse AI tools and share data they should not.\"}, \"recommend\": [\"Provide AI literacy training matched to how staff use AI (capabilities, limits, data protection, the AI acceptable-use policy) and keep records.\"], \"references\": [\"ISO 27001:2022 A.6.3\", \"EU AI Act Art. 4\"], \"verification\": \"This item needs a further step before it can be judged.\", \"evidence\": \"Answered once by the organisation (organisational.conf); not part of the phone self-check.\"]}"}
+{"task": "summary", "meta": {"task": "summary", "os": "linux", "audit": 7000445, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"fin-ubuntu-99 - Ubuntu 20.04.6 LTS 20.04\", \"score\": {\"county\": \"33\", \"highest_risk\": \"50\", \"percent\": \"66\"}, \"counts\": {\"compliant\": \"33\", \"non_compliant\": \"17\", \"not_applicable\": \"2\", \"pending\": \"4\", \"error\": \"0\"}, \"top_gaps\": [{\"check_id\": \"password.min_length\", \"name\": \"Antivirus\", \"found\": \"none running\"}, {\"check_id\": \"password.history\", \"name\": \"Password history\", \"found\": \"10\"}, \"password.expiration\", \"Password expiration\", \"Compliant\"], [\"summary\": \"The Fin-ubuntu-99 server meets 33 of 50 checked items, 4 open, 4 gaps, and 0 errors. 17 items are not applicable because they are not compliant and 2 are pending.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000172, "profile": "neglected", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"Microsoft Windows 11 Pro 10.0.22621 (windows)\", \"purpose\": \"not stated\", \"tools\": [{\"tool\": \"Claude Code\", \"kind\": \"AI coding assistant (command line)\", \"result\": \"AI coding assistant (command line); provider Anthropic (US); data: Code and prompts sent to the provider's cloud; default risk minimal; GDPR: Source code may contain personal data or secrets; use a commercial plan with a data processing agreement and keep secrets out of repositories.\"}, {\"tool\": \"Microsoft Copilot\", \"kind\": \"Cloud AI assistant\", \"result\": \"Cloud AI assistant; provider Microsoft (US); data: Microsoft cloud; enterprise plans keep data under Microsoft's commercial data protection terms; default risk minimal; GDPR: Use the Microsoft 365 work account version covered by the organisation's Microsoft data processing terms; consumer Copilot is not covered.\"}], \"prohibited\" -> [\"Emotion recognition of employees or students (except for medical or safety reasons), Social scoring of people\", \"Manipulative or exploitative techniques that cause significant harm\", \"Untargeted scraping of facial images to build face recognition databases\", \"Biometric categorisation inferring sensitive traits such as political views or sexual orientation\"], \"high_risk\" -> [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"minimal_risk\" -> \"Drafting, summarising, translation, coding help and similar general productivity use.\", \"allowed\": [\"Claude Code\", \"Microsoft Copilot\"], \"considered\": [\"Claude Code\", \"Microsoft Copilot\"]]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001033, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "usb.device_access", "status": "Compliant"}, "reply": "{\"check_id\": \"usb.device_access\", \"status\": \"Compliant\", \"title\": \"USB storage device access: meets the baseline\", \"finding\": \"Found: allow. This satisfies the baseline.\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.7.10\", \"ISO 27001:2022 A.8.12\", \"GDPR Art. 32(1)(b)\"]}]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001334, "profile": "typical", "dataset_version": "0.3.0", "check_id": "gdpr.security_logging", "status": "Error"}, "reply": "{\"check_id\": \"gdpr.security_logging\", \"status\": \"Error\", \"title\": \"Security event logging: could not be read\", \"finding\": \"This check returned an error: Value could not be read. Compliance cannot be confirmed.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.15\", \"GDPR Art. 32(1)(d)\", \"GDPR Art. 33\"], \"verification\": \"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001512, "profile": "typical", "dataset_version": "0.3.0", "check_id": "gdpr.auto_updates", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"gdpr.auto_updates\", \"status\": \"Non-Compliant\", \"title\": \"Automatic security updates is non-compliant\", \"finding\": \"Found: dnf-automatic timer off, apply_updates=no, required: automatic. Self-check: Security fixes must be installed automatically so that known vulnerabilities are closed quickly.\", \"risk\": {\"level\": \"High\", \"reason\": \"Unpatched devices are the most common way attackers get in.\"}, \"recommendation\": [\"Debian/Ubuntu: apt install unattended-upgrades && dpkg-reconfigure -plow unattended-upgrades. RHEL: dnf install dnf-automatic && systemctl enable --now dnf-automatic-install.timer.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Automatic security updates should be Compliant.\"}]"}

training/eval/v0.3-4bit.log

@@ -0,0 +1,74 @@
+Weights rounded as in the 4-bit browser build (q4f16_1)
+/Users/umer/Documents/6 - mix/endpoint-audit/training/.venv/lib/python3.11/site-packages/transformers/generation/configuration_utils.py:590: UserWarning: `do_sample` is set to `False`. However, `temperature` is set to `0.7` -- this flag is only used in sample-based generation modes. You should set `do_sample=True` or unset `temperature`.
+  warnings.warn(
+/Users/umer/Documents/6 - mix/endpoint-audit/training/.venv/lib/python3.11/site-packages/transformers/generation/configuration_utils.py:595: UserWarning: `do_sample` is set to `False`. However, `top_p` is set to `0.8` -- this flag is only used in sample-based generation modes. You should set `do_sample=True` or unset `top_p`.
+  warnings.warn(
+/Users/umer/Documents/6 - mix/endpoint-audit/training/.venv/lib/python3.11/site-packages/transformers/generation/configuration_utils.py:612: UserWarning: `do_sample` is set to `False`. However, `top_k` is set to `20` -- this flag is only used in sample-based generation modes. You should set `do_sample=True` or unset `top_k`.
+  warnings.warn(
+The attention mask is not set and cannot be inferred from input because pad token is same as eos token. As a consequence, you may observe unexpected behavior. Please pass your input's `attention_mask` to obtain reliable results.
+[1/60] ai_classification      29s
+[2/60] finding                47s
+[3/60] finding                80s
+[4/60] finding                99s
+[5/60] finding               112s
+[6/60] finding               132s
+[7/60] summary               180s
+[8/60] ai_classification     201s
+[9/60] finding               221s
+[10/60] finding               251s
+[11/60] finding               280s
+[12/60] finding               295s
+[13/60] finding               312s
+[14/60] summary               487s
+[15/60] ai_classification     555s
+[16/60] finding               588s
+[17/60] finding               613s
+[18/60] finding               641s
+[19/60] finding               651s
+[20/60] finding               683s
+[21/60] summary               758s
+[22/60] ai_classification     787s
+[23/60] finding               815s
+[24/60] finding               835s
+[25/60] finding               855s
+[26/60] finding               877s
+[27/60] finding               900s
+[28/60] summary               967s
+[29/60] ai_classification     989s
+[30/60] finding              1006s
+[31/60] finding              1034s
+[32/60] finding              1064s
+[33/60] finding              1091s
+[34/60] finding              1119s
+[35/60] summary              1263s
+[36/60] ai_classification    1305s
+[37/60] finding              1314s
+[38/60] finding              1336s
+[39/60] finding              1374s
+[40/60] finding              1389s
+[41/60] finding              1409s
+[42/60] summary              1546s
+[43/60] ai_classification    1577s
+[44/60] finding              1602s
+[45/60] finding              1632s
+[46/60] finding              1665s
+[47/60] finding              1688s
+[48/60] finding              1732s
+[49/60] summary              1816s
+[50/60] ai_classification    1841s
+[51/60] finding              1858s
+[52/60] finding              1885s
+[53/60] finding              1912s
+[54/60] finding              1929s
+[55/60] finding              1950s
+[56/60] summary              1996s
+[57/60] ai_classification    2039s
+[58/60] finding              2055s
+[59/60] finding              2085s
+[60/60] finding              2110s
+
+Results for adapter training/models/auditor-lora-v0.3/final on 60 test examples:
+task                 n  valid JSON  grounded  fields match
+ai_classification    9        33%        0%            0%
+finding             43        21%        5%           14%
+summary              8        25%       12%            0%

training/eval/v0.3.jsonl

@@ -0,0 +1,60 @@
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000937, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"tools\": [{\"tool\": \"GPT4All\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Keep the optional data lake sharing switched off.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"1 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: GPT4All.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000590, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "malware.antivirus", "status": "Compliant"}, "reply": "{\"check_id\": \"malware.antivirus\", \"status\": \"Compliant\", \"title\": \"Antivirus matches the required setting\", \"finding\": \"Found: ClamAV (clamav-daemon). This satisfies the baseline requirement of antivirus running.\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000666, "profile": "typical", "dataset_version": "0.3.0", "check_id": "gdpr.updates_recent", "status": "Error"}, "reply": "{\"check_id\": \"gdpr.updates_recent\", \"status\": \"Error\", \"title\": \"Security updates installed recently: could not be checked\", \"finding\": \"No evidence was collected for this check (Value could not be read.); its status is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\", \"GDPR Art. 32(1)(d)\"], \"verification\": \"Re-run the audit; the last update should be within 30 days.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7001291, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "org.ropa", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"org.ropa\", \"status\": \"Non-Compliant\", \"title\": \"Gap: Record of processing activities\", \"finding\": \"Found: no. Required: yes. The record of processing activities is the core GDPR accountability document.\", \"risk\": {\"level\": \"High\", \"reason\": \"A missing or outdated record is a direct infringement and makes every other assessment harder.\"}, \"recommendation\": [\"Create or update the record of processing activities (purposes, categories of data and people, recipients, transfers, retention, security measures).\", \"Assign an owner and review it at least yearly.\"], \"references\": [\"ISO 27001:2022 A.5.34\", \"GDPR Art. 30\"], \"verification\": \"Answer ORG_ROPA=yes in organisational.conf once the record is current.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001395, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "malware.on_access", "status": "NotApplicable"}, "reply": "{\"check_id\": \"malware.on_access\", \"status\": \"NotApplicable\", \"title\": \"On-access malware protection: not assessed on this device\", \"finding\": \"This check does not apply: XProtect scans at launch and download; macOS has no built-in on-access scanning.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7001113, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "org.dpia", "status": "Pending"}, "reply": "{\"check_id\": \"org.dpia\", \"status\": \"Pending\", \"title\": \"Data protection impact assessment: decision pending\", \"finding\": \"Current state: not answered. Answered once by the organisation (organisational.conf); not part of the phone self-check.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: High-risk processing without a DPIA breaches GDPR and leaves risks to people unassessed.\"}, \"recommendation\": [\"List processing that is likely high-risk (e.g. monitoring employees, large-scale sensitive data, new technologies such as AI) and complete a DPIA for each.\"], \"references\": [\"ISO 27001:2022 A.5.34\", \"GDPR Art. 35\"], \"verification\": \"Answer ORG_DPIA=yes once DPIAs are done.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "ios", "audit": 7000189, "profile": "hardened", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"DEV-iPad-04 - iPadOS 27.0\", \"score\": {\"compliant\": 16, \"assessed\": 17, \"percent\": 94}, \"counts\": {\"Compliant\": 16, \"Non-Compliant\": 1, \"NotApplicable\": 1, \"Pending\": 11, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"aiact.unapproved\", \"name\": \"Unapproved AI tools (shadow AI)\", \"risk\": \"Medium\", \"found\": \"ChatGPT, Microsoft Copilot\"}], \"summary\": \"DEV-iPad-04 meets 16 of 17 assessed checks (94%). There are 1 gaps, none of them rated high risk. 11 items are pending. 19 results are self-reported by the user and were not verified on the device.\", \"next_steps\": [\"Unapproved AI tools (shadow AI): Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it.\", \"Answer the 8 open organisational questions in organisational.conf.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000456, "profile": "neglected", "dataset_version": "0.3.0"}, "reply": "{\"tools\": [{\"tool\": \"Microsoft Copilot\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Use the Microsoft 365 work account version covered by the organisation's Microsoft data processing terms; consumer Copilot is not covered.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"LM Studio\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No transfer to a provider; check model licences and whether its local server is exposed.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"2 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: Microsoft Copilot, LM Studio.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000992, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "gdpr.os_supported", "status": "Compliant"}, "reply": "{\"check_id\": \"gdpr.os_supported\", \"status\": \"Compliant\", \"title\": \"Supported operating system version matches the required setting\", \"finding\": \"The device reports macOS 26.0.1, which meets the requirement (macOS 14 or later).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000482, "profile": "typical", "dataset_version": "0.3.0", "check_id": "lockout.observation", "status": "Error"}, "reply": "{\"check_id\": \"lockout.observation\", \"status\": \"Error\", \"title\": \"Lockout observation period: could not be checked\", \"finding\": \"No evidence was collected for this check (Requires an elevated (administrator) PowerShell.); its status is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Lockout observation period should be 15 minutes or more.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7001291, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "org.breach_procedure", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"org.breach_procedure\", \"status\": \"Non-Compliant\", \"title\": \"Breach response procedure: does not meet the baseline\", \"finding\": \"The device reports no, but the baseline requires yes. Breaches must be reported to the supervisory authority within 72 hours where required.\", \"risk\": {\"level\": \"High\", \"reason\": \"Without a tested procedure, the 72-hour deadline is easily missed.\"}, \"recommendation\": [\"Write a breach procedure (detection, assessment, 72-hour notification to the CNPD or your authority, informing people, breach log) and test it with an exercise.\"], \"references\": [\"ISO 27001:2022 A.5.24\", \"ISO 27001:2022 A.5.26\", \"GDPR Art. 33\", \"GDPR Art. 34\"], \"verification\": \"Answer ORG_BREACH_PROCEDURE=yes once the procedure is written and tested.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000355, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.os_ai_features", "status": "NotApplicable"}, "reply": "{\"check_id\": \"aiact.os_ai_features\", \"status\": \"NotApplicable\", \"title\": \"Apple Intelligence external integrations restricted: not assessed on this device\", \"finding\": \"This check does not apply: Apple Intelligence needs Apple silicon.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.5.34\", \"GDPR Art. 5(1)(c)\", \"GDPR Art. 25\", \"EU AI Act Art. 26\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7000271, "profile": "typical", "dataset_version": "0.3.0", "check_id": "org.ai_literacy", "status": "Pending"}, "reply": "{\"check_id\": \"org.ai_literacy\", \"status\": \"Pending\", \"title\": \"AI literacy training: decision pending\", \"finding\": \"Current state: not answered. Answer ORG_AI_LITERACY in organisational.conf.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: Untrained staff misuse AI tools and share data they should not.\"}, \"recommendation\": [\"Provide AI literacy training matched to how staff use AI (capabilities, limits, data protection, the AI acceptable-use policy) and keep records.\"], \"references\": [\"ISO 27001:2022 A.6.3\", \"EU AI Act Art. 4\"], \"verification\": \"Answer ORG_AI_LITERACY=yes once training is delivered and recorded.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "macos", "audit": 7001405, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"OPS-MacBook-14 - macOS 15.7.2\", \"score\": {\"compliant\": 31, \"assessed\": 46, \"percent\": 67}, \"counts\": {\"Compliant\": 31, \"Non-Compliant\": 15, \"NotApplicable\": 3, \"Pending\": 5, \"Error\": 2}, \"top_gaps\": [{\"check_id\": \"firewall.enabled\", \"name\": \"Firewall\", \"risk\": \"High\", \"found\": \"off\"}, {\"check_id\": \"firewall.inbound\", \"name\": \"Firewall inbound policy\", \"risk\": \"High\", \"found\": \"firewall off, stealth mode on\"}, {\"check_id\": \"vuln.known_vulnerabilities\", \"name\": \"Known vulnerabilities in installed software\", \"risk\": \"High\", \"found\": \"28 critical/high\"}, {\"check_id\": \"gdpr.backup_configured\", \"name\": \"Backup configured\", \"risk\": \"High\", \"found\": \"none\"}, {\"check_id\": \"org.processor_agreements\", \"name\": \"Data processing agreements\", \"risk\": \"High\", \"found\": \"partial\"}], \"summary\": \"OPS-MacBook-14 meets 31 of 46 assessed checks (67%). The most serious gaps are Firewall, Firewall inbound policy and Known vulnerabilities in installed software. 2 checks could not be read because the audit was not run as administrator. 5 items are pending.\", \"next_steps\": [\"Re-run the audit as administrator/root so that every check can be read.\", \"Firewall: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on, or enforce the firewall by configuration profile.\", \"Firewall inbound policy: Turn on stealth mode: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on.\", \"Known vulnerabilities in installed software: Update or remove each listed software package to a version without the listed vulnerabilities; where no fix exists yet, apply the vendor's workaround or restrict the software's use.\", \"Answer the 1 open organisational questions in organisational.conf.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000432, "profile": "neglected", "dataset_version": "0.3.0"}, "reply": "{\"tools\": [{\"tool\": \"Hugging Face models\", \"kind\": \"Local model files\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Record which models are present and their licences; the risk class depends on what the models are used for.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Cursor\", \"kind\": \"AI code editor\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Enforce privacy mode through a business plan and sign a data processing agreement.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Claude Code\", \"kind\": \"AI coding assistant (command line)\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Source code may contain personal data or secrets; use a commercial plan with a data processing agreement and keep secrets out of repositories.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"3 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: Hugging Face models, Cursor, Claude Code.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000106, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "vuln.known_vulnerabilities", "status": "Compliant"}, "reply": "{\"check_id\": \"vuln.known_vulnerabilities\", \"status\": \"Compliant\", \"title\": \"Known vulnerabilities in installed software matches the required setting\", \"finding\": \"The device reports 0 critical/high, which meets the requirement (<= 0 critical/high).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000561, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "gdpr.backup_recent", "status": "Error"}, "reply": "{\"check_id\": \"gdpr.backup_recent\", \"status\": \"Error\", \"title\": \"Recent backup: could not be checked\", \"finding\": \"No evidence was collected for this check (Value could not be read.); its status is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.13\", \"GDPR Art. 32(1)(c)\"], \"verification\": \"Re-run the audit; the last backup should be within 7 days.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000904, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "admin.approved", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"admin.approved\", \"status\": \"Non-Compliant\", \"title\": \"Approved IT administrator: does not meet the baseline\", \"finding\": \"The device reports none of the approved accounts is an enabled administrator, but the baseline requires itadmin. A known, approved IT account should manage the device so that support does not depend on users' own admin rights.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Without an approved admin account, IT tends to rely on employees' accounts having admin rights.\"}, \"recommendation\": [\"Add the approved IT administrator account (listed in APPROVED_ADMINS) to the local Administrators group, ideally managed with Windows LAPS or Intune.\"], \"references\": [\"ISO 27001:2022 A.8.2\", \"ISO 27001:2022 A.5.15\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Approved IT administrator should list the approved account.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001093, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.risk_classification", "status": "NotApplicable"}, "reply": "{\"check_id\": \"aiact.risk_classification\", \"status\": \"NotApplicable\", \"title\": \"AI system risk classification: not assessed on this device\", \"finding\": \"This check does not apply: no AI tools found.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.5.9\", \"EU AI Act Art. 5\", \"EU AI Act Art. 6\", \"EU AI Act Annex III\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001352, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.risk_classification", "status": "Pending"}, "reply": "{\"check_id\": \"aiact.risk_classification\", \"status\": \"Pending\", \"title\": \"AI system risk classification: decision pending\", \"finding\": \"Classified by the auditor model (Caveat classifier) in a later step. Current state: Cursor.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: An unclassified tool could be used for a high-risk or prohibited purpose without the required safeguards.\"}, \"recommendation\": [\"Record the purpose for which each listed tool is used and classify it (prohibited, high-risk, limited-risk transparency, minimal). The auditor model does this from the inventory and the stated purpose.\"], \"references\": [\"ISO 27001:2022 A.5.9\", \"EU AI Act Art. 5\", \"EU AI Act Art. 6\", \"EU AI Act Annex III\"], \"verification\": \"Every AI tool in the inventory has a classification in the AI register.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "linux", "audit": 7001093, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"dev-ws-39 - Red Hat Enterprise Linux 8.10 (Ootpa) 8.10\", \"score\": {\"compliant\": 29, \"assessed\": 50, \"percent\": 58}, \"counts\": {\"Compliant\": 29, \"Non-Compliant\": 21, \"NotApplicable\": 4, \"Pending\": 2, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"malware.service\", \"name\": \"ClamAV malware protection service\", \"risk\": \"High\", \"found\": \"not running\"}, {\"check_id\": \"malware.signatures\", \"name\": \"Malware signatures\", \"risk\": \"High\", \"found\": \"63 days old\"}, {\"check_id\": \"admin.unauthorized\", \"name\": \"Unauthorized employee administrator accounts\", \"risk\": \"High\", \"found\": \"tnguyen\"}, {\"check_id\": \"user.account_type\", \"name\": \"Signed-in user account type\", \"risk\": \"High\", \"found\": \"Administrator (asmith)\"}, {\"check_id\": \"vuln.known_vulnerabilities\", \"name\": \"Known vulnerabilities in installed software\", \"risk\": \"High\", \"found\": \"137 critical/high\"}], \"summary\": \"dev-ws-39 meets 29 of 50 assessed checks (58%). The most serious gaps are ClamAV malware protection service, Malware signatures and Unauthorized employee administrator accounts. 2 items are pending.\", \"next_steps\": [\"ClamAV malware protection service: systemctl enable --now clamav-daemon (RHEL: clamd@scan).\", \"Malware signatures: systemctl enable --now clamav-freshclam, or run freshclam once to update now.\", \"Unauthorized employee administrator accounts: Remove the listed accounts from the sudo/wheel groups (gpasswd -d <account> sudo) and remove their entries from /etc/sudoers.d.\", \"Answer the 2 open organisational questions in organisational.conf.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7000763, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"tools\": [{\"tool\": \"Gemini\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Use the Workspace version under the organisation's Google data processing terms; consumer use is not covered.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Meta AI\", \"kind\": \"Cloud AI assistant (built into WhatsApp, Instagram and Facebook apps)\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Consumer service with no business data processing terms; do not share work or customer data in chats with Meta AI.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"2 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: Gemini, Meta AI.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001403, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "gdpr.updates_recent", "status": "Compliant"}, "reply": "{\"check_id\": \"gdpr.updates_recent\", \"status\": \"Compliant\", \"title\": \"Security updates installed recently matches the required setting\", \"finding\": \"Found: 24 days ago. This satisfies the baseline requirement of <= 30 days ago.\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\", \"GDPR Art. 32(1)(d)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000974, "profile": "typical", "dataset_version": "0.3.0", "check_id": "firewall.outbound", "status": "Error"}, "reply": "{\"check_id\": \"firewall.outbound\", \"status\": \"Error\", \"title\": \"Firewall outbound policy: could not be checked\", \"finding\": \"No evidence was collected for this check (Requires root: run the collector with sudo.); its status is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.20\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; the outbound policy should read allow.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000937, "profile": "typical", "dataset_version": "0.3.0", "check_id": "lockout.observation", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"lockout.observation\", \"status\": \"Non-Compliant\", \"title\": \"Lockout observation period is non-compliant\", \"finding\": \"Found: no lockout configured. Required: >= 15 minutes. Failed attempts must be counted over a long enough window to detect slow guessing.\", \"risk\": {\"level\": \"Low\", \"reason\": \"A short window lets attackers pace their guesses to avoid lockout.\"}, \"recommendation\": [\"Set Group Policy: Account Lockout Policy > Reset account lockout counter after = 15 minutes or more.\", \"For a stand-alone device: net accounts /lockoutwindow:15\"], \"references\": [\"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Lockout observation period should be 15 minutes or more.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000290, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "gdpr.personal_data_discovery", "status": "NotApplicable"}, "reply": "{\"check_id\": \"gdpr.personal_data_discovery\", \"status\": \"NotApplicable\", \"title\": \"Personal data discovery: not applicable\", \"finding\": \"This check does not apply: Opt-in scan (PERSONAL_DATA_SCAN=0) is planned for a later stage.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.5.34\", \"ISO 27001:2022 A.5.12\", \"GDPR Art. 5(1)(c)\", \"GDPR Art. 5(1)(e)\", \"GDPR Art. 30\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000685, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "aiact.log_retention", "status": "Pending"}, "reply": "{\"check_id\": \"aiact.log_retention\", \"status\": \"Pending\", \"title\": \"AI usage log retention: decision pending\", \"finding\": \"Current state: depends on classification. Required only if a tool is classified high-risk.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: Missing logs prevent monitoring and investigation of high-risk AI use.\"}, \"recommendation\": [\"If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months.\"], \"references\": [\"ISO 27001:2022 A.8.15\", \"EU AI Act Art. 26(6)\"], \"verification\": \"Log retention is documented for each high-risk AI system.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "windows", "audit": 7000481, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"DESKTOP-LPGZG5W - Microsoft Windows 11 Pro 10.0.26200\", \"score\": {\"compliant\": 36, \"assessed\": 55, \"percent\": 65}, \"counts\": {\"Compliant\": 36, \"Non-Compliant\": 19, \"NotApplicable\": 4, \"Pending\": 5, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"malware.realtime\", \"name\": \"Real-time protection\", \"risk\": \"High\", \"found\": \"off\"}, {\"check_id\": \"malware.signatures\", \"name\": \"Security intelligence\", \"risk\": \"High\", \"found\": \"58 days old (version 1.444.551.0)\"}, {\"check_id\": \"firewall.domain.inbound\", \"name\": \"Domain inbound\", \"risk\": \"High\", \"found\": \"allow\"}, {\"check_id\": \"admin.unauthorized\", \"name\": \"Unauthorized employee local administrator accounts\", \"risk\": \"High\", \"found\": \"DESKTOP-LPGZG5W\\\\ewagner\"}, {\"check_id\": \"user.account_type\", \"name\": \"Signed-in user account type\", \"risk\": \"High\", \"found\": \"Administrator (DEVSEIS\\\\pmartin)\"}], \"summary\": \"DESKTOP-LPGZG5W meets 36 of 55 assessed checks (65%). The most serious gaps are Real-time protection, Security intelligence and Domain inbound. 5 items are pending.\", \"next_steps\": [\"Real-time protection: Set-MpPreference -DisableRealtimeMonitoring $false, and remove any policy that disables real-time protection.\", \"Security intelligence: Run Update-MpSignature and check that the device can reach Windows Update or your update server.\", \"Domain inbound: Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultInboundAction Block.\", \"Answer the 5 open organisational questions in organisational.conf.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000275, "profile": "neglected", "dataset_version": "0.3.0"}, "reply": "{\"tools\": [{\"tool\": \"LM Studio\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No transfer to a provider; check model licences and whether its local server is exposed.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"1 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: LM Studio.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000587, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "admin.unauthorized", "status": "Compliant"}, "reply": "{\"check_id\": \"admin.unauthorized\", \"status\": \"Compliant\", \"title\": \"Unauthorized employee local administrator accounts matches the required setting\", \"finding\": \"Found: none. This satisfies the baseline requirement of none.\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.2\", \"ISO 27001:2022 A.5.18\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7001382, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "vuln.pending_updates", "status": "Error"}, "reply": "{\"check_id\": \"vuln.pending_updates\", \"status\": \"Error\", \"title\": \"Pending security updates: could not be checked\", \"finding\": \"No answer within 300 seconds. Compliance cannot be confirmed.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\", \"GDPR Art. 32(1)(d)\"], \"verification\": \"Re-run the audit; pending security updates should be 0 or fewer.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000195, "profile": "typical", "dataset_version": "0.3.0", "check_id": "password.expiration", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"password.expiration\", \"status\": \"Non-Compliant\", \"title\": \"Password expiration is non-compliant\", \"finding\": \"The device reports never, but the baseline requires 1-365 days. The baseline requires passwords to be changed within a set period, limiting how long a stolen password stays useful.\", \"risk\": {\"level\": \"Low\", \"reason\": \"A leaked password can stay valid indefinitely.\"}, \"recommendation\": [\"Set Group Policy: Account Policies > Password Policy > Maximum password age = 365 days.\", \"For a stand-alone device: net accounts /maxpwage:365\"], \"references\": [\"ISO 27001:2022 A.5.17\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Password expiration should be between 1 and 365 days.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001334, "profile": "typical", "dataset_version": "0.3.0", "check_id": "screen_lock.timeout", "status": "NotApplicable"}, "reply": "{\"check_id\": \"screen_lock.timeout\", \"status\": \"NotApplicable\", \"title\": \"Screen lock timeout: not applicable\", \"finding\": \"This check does not apply: No graphical desktop settings found.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.8.1\", \"ISO 27001:2022 A.7.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000561, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "org.ai_register", "status": "Pending"}, "reply": "{\"check_id\": \"org.ai_register\", \"status\": \"Pending\", \"title\": \"AI register: decision pending\", \"finding\": \"Current state: not answered. Answer ORG_AI_REGISTER in organisational.conf.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: Without a register, high-risk or prohibited AI use can go unnoticed.\"}, \"recommendation\": [\"Create an AI register listing each AI system, owner, purpose, risk class and the data it uses; use the AI software inventory from this audit as input.\"], \"references\": [\"ISO 27001:2022 A.5.9\", \"EU AI Act Art. 26\"], \"verification\": \"Answer ORG_AI_REGISTER=yes once the register exists.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "linux", "audit": 7001023, "profile": "neglected", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"sales-ws-83 - Ubuntu 26.04.1 LTS 26.04\", \"score\": {\"compliant\": 15, \"assessed\": 48, \"percent\": 31}, \"counts\": {\"Compliant\": 15, \"Non-Compliant\": 33, \"NotApplicable\": 4, \"Pending\": 4, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"malware.antivirus\", \"name\": \"Antivirus\", \"risk\": \"High\", \"found\": \"none running\"}, {\"check_id\": \"malware.service\", \"name\": \"ClamAV malware protection service\", \"risk\": \"High\", \"found\": \"not running\"}, {\"check_id\": \"malware.signatures\", \"name\": \"Malware signatures\", \"risk\": \"High\", \"found\": \"61 days old\"}, {\"check_id\": \"admin.unauthorized\", \"name\": \"Unauthorized employee administrator accounts\", \"risk\": \"High\", \"found\": \"mkhan, pmartin\"}, {\"check_id\": \"user.account_type\", \"name\": \"Signed-in user account type\", \"risk\": \"High\", \"found\": \"Administrator (lmuller)\"}], \"summary\": \"sales-ws-83 meets 15 of 48 assessed checks (31%). The most serious gaps are Antivirus, ClamAV malware protection service and Malware signatures. 4 items are pending.\", \"next_steps\": [\"Antivirus: Install an endpoint protection product, or ClamAV: apt install clamav clamav-daemon (RHEL: dnf install clamav clamd), then systemctl enable --now clamav-daemon.\", \"ClamAV malware protection service: systemctl enable --now clamav-daemon (RHEL: clamd@scan).\", \"Malware signatures: systemctl enable --now clamav-freshclam, or run freshclam once to update now.\", \"Answer the 4 open organisational questions in organisational.conf.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000306, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"tools\": [{\"tool\": \"Ollama\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No transfer to a provider, but check each model's licence and keep the local API (port 11434) closed to the network.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"1 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: Ollama.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000175, "profile": "typical", "dataset_version": "0.3.0", "check_id": "encryption.enabled", "status": "Compliant"}, "reply": "{\"check_id\": \"encryption.enabled\", \"status\": \"Compliant\", \"title\": \"Encryption matches the required setting\", \"finding\": \"The device reports FullyEncrypted (100%), which meets the requirement (fully encrypted).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.24\", \"ISO 27001:2022 A.8.1\", \"GDPR Art. 32(1)(a)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001424, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "gdpr.time_sync", "status": "Error"}, "reply": "{\"check_id\": \"gdpr.time_sync\", \"status\": \"Error\", \"title\": \"Time synchronisation: could not be checked\", \"finding\": \"No evidence was collected for this check (Requires root: run the collector with sudo.); its status is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.17\", \"GDPR Art. 33\"], \"verification\": \"Re-run the audit; Time synchronisation should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000355, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.unapproved", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"aiact.unapproved\", \"status\": \"Non-Compliant\", \"title\": \"Unapproved AI tools (shadow AI): does not meet the baseline\", \"finding\": \"Found: ChatGPT. Required: only: none. AI tools used without approval may send work and personal data to providers without contracts or a transfer basis.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Shadow AI can leak confidential or personal data and creates unassessed AI Act and GDPR obligations.\"}, \"recommendation\": [\"Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it.\", \"Publish an AI acceptable-use policy so staff know which tools are allowed.\", \"Remove unapproved apps and restrict installations through your MDM.\"], \"references\": [\"ISO 27001:2022 A.5.9\", \"ISO 27001:2022 A.8.19\", \"GDPR Art. 28\", \"GDPR Art. 44\", \"EU AI Act Art. 26\"], \"verification\": \"Re-run the audit; Unapproved AI tools should read none.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000656, "profile": "typical", "dataset_version": "0.3.0", "check_id": "malware.tamper", "status": "NotApplicable"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"NotApplicable\", \"title\": \"Tamper protection: not assessed on this device\", \"finding\": \"This check does not apply: Another antivirus is primary: SentinelOne.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7000452, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.log_retention", "status": "Pending"}, "reply": "{\"check_id\": \"aiact.log_retention\", \"status\": \"Pending\", \"title\": \"AI usage log retention: decision pending\", \"finding\": \"Current state: depends on classification. Required only if a tool is classified high-risk. Self-reported by the user, not verified on the device.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: Missing logs prevent monitoring and investigation of high-risk AI use.\"}, \"recommendation\": [\"If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months.\"], \"references\": [\"ISO 27001:2022 A.8.15\", \"EU AI Act Art. 26(6)\"], \"verification\": \"Log retention is documented for each high-risk AI system.\", \"evidence\": \"self-reported\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "windows", "audit": 7000195, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"LAPTOP-XET19C3 - Microsoft Windows 11 Pro 10.0.26200\", \"score\": {\"compliant\": 35, \"assessed\": 53, \"percent\": 66}, \"counts\": {\"Compliant\": 35, \"Non-Compliant\": 18, \"NotApplicable\": 4, \"Pending\": 6, \"Error\": 1}, \"top_gaps\": [{\"check_id\": \"malware.signatures\", \"name\": \"Security intelligence\", \"risk\": \"High\", \"found\": \"6 days old (version 1.441.956.0)\"}, {\"check_id\": \"firewall.private.inbound\", \"name\": \"Private inbound\", \"risk\": \"High\", \"found\": \"allow\"}, {\"check_id\": \"firewall.public.inbound\", \"name\": \"Public inbound\", \"risk\": \"High\", \"found\": \"allow\"}, {\"check_id\": \"encryption.feature\", \"name\": \"BitLocker\", \"risk\": \"High\", \"found\": \"off\"}, {\"check_id\": \"encryption.enabled\", \"name\": \"Encryption\", \"risk\": \"High\", \"found\": \"EncryptionInProgress (42%)\"}], \"summary\": \"LAPTOP-XET19C3 meets 35 of 53 assessed checks (66%). The most serious gaps are Security intelligence, Private inbound and Public inbound. 1 checks could not be read. 6 items are pending.\", \"next_steps\": [\"Re-run the audit as administrator/root so that every check can be read.\", \"Security intelligence: Run Update-MpSignature and check that the device can reach Windows Update or your update server.\", \"Private inbound: Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultInboundAction Block.\", \"Public inbound: Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultInboundAction Block.\", \"Answer the 2 open organisational questions in organisational.conf.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7001181, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"tools\": [{\"tool\": \"Gemini\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Use the Workspace version under the organisation's Google data processing terms; consumer use is not covered.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"1 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: Gemini.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000355, "profile": "typical", "dataset_version": "0.3.0", "check_id": "screen_lock.enabled", "status": "Compliant"}, "reply": "{\"check_id\": \"screen_lock.enabled\", \"status\": \"Compliant\", \"title\": \"Screen lock matches the required setting\", \"finding\": \"The device reports on, which meets the requirement (on).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.1\", \"ISO 27001:2022 A.7.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001457, "profile": "typical", "dataset_version": "0.3.0", "check_id": "firewall.inbound", "status": "Error"}, "reply": "{\"check_id\": \"firewall.inbound\", \"status\": \"Error\", \"title\": \"Firewall inbound policy: could not be checked\", \"finding\": \"No evidence was collected for this check (Requires root: run the collector with sudo.); its status is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.20\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; the inbound policy should be block/deny.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7000707, "profile": "typical", "dataset_version": "0.3.0", "check_id": "vuln.outdated_apps", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"vuln.outdated_apps\", \"status\": \"Non-Compliant\", \"title\": \"App updates is non-compliant\", \"finding\": \"The user reports automatic app updates off, but the baseline requires automatic app updates on. Browsers, office suites, PDF readers and meeting apps are common attack targets and need updates like the OS. Self-reported by the user, not verified on the device.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Outdated applications contain known vulnerabilities that attackers exploit through documents and web pages.\"}, \"recommendation\": [\"Play Store › profile picture › Settings › Network preferences › Auto-update apps: Over any network or Over Wi-Fi only; then Manage apps & device › Update all.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"ISO 27001:2022 A.8.19\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; outdated applications should be 0 or fewer.\", \"evidence\": \"self-reported\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001424, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "vuln.outdated_apps", "status": "NotApplicable"}, "reply": "{\"check_id\": \"vuln.outdated_apps\", \"status\": \"NotApplicable\", \"title\": \"Outdated third-party applications: not assessed on this device\", \"finding\": \"This check does not apply: Homebrew is not installed, so there is no local source of current application versions.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.8.8\", \"ISO 27001:2022 A.8.19\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7000763, "profile": "typical", "dataset_version": "0.3.0", "check_id": "org.ai_literacy", "status": "Pending"}, "reply": "{\"check_id\": \"org.ai_literacy\", \"status\": \"Pending\", \"title\": \"AI literacy training: decision pending\", \"finding\": \"Current state: not answered. Answered once by the organisation (organisational.conf); not part of the phone self-check.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: Untrained staff misuse AI tools and share data they should not.\"}, \"recommendation\": [\"Provide AI literacy training matched to how staff use AI (capabilities, limits, data protection, the AI acceptable-use policy) and keep records.\"], \"references\": [\"ISO 27001:2022 A.6.3\", \"EU AI Act Art. 4\"], \"verification\": \"Answer ORG_AI_LITERACY=yes once training is delivered and recorded.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "ios", "audit": 7001244, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"SALES-iPhone-47 - iOS 27.0\", \"score\": {\"compliant\": 13, \"assessed\": 19, \"percent\": 68}, \"counts\": {\"Compliant\": 13, \"Non-Compliant\": 6, \"NotApplicable\": 0, \"Pending\": 10, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"screen_lock.timeout\", \"name\": \"Auto-Lock\", \"risk\": \"Medium\", \"found\": \"Auto-Lock Never\"}, {\"check_id\": \"mobile.passcode_strength\", \"name\": \"Passcode strength\", \"risk\": \"Medium\", \"found\": \"4-digit code\"}, {\"check_id\": \"aiact.unapproved\", \"name\": \"Unapproved AI tools (shadow AI)\", \"risk\": \"Medium\", \"found\": \"ChatGPT, Claude, DeepSeek\"}, {\"check_id\": \"aiact.os_ai_features\", \"name\": \"Apple Intelligence external integrations restricted\", \"risk\": \"Medium\", \"found\": \"ChatGPT extension on\"}, {\"check_id\": \"gdpr.telemetry\", \"name\": \"Analytics sharing minimised\", \"risk\": \"Low\", \"found\": \"analytics sharing on\"}], \"summary\": \"SALES-iPhone-47 meets 13 of 19 assessed checks (68%). The most serious gaps are Auto-Lock and Passcode strength. 10 items are pending. 19 results are self-reported by the user and were not verified on the device.\", \"next_steps\": [\"Auto-Lock: Settings › Display & Brightness › Auto-Lock: choose 5 minutes or less (not Never).\", \"Passcode strength: Settings › Face ID & Passcode › Change Passcode › Passcode Options: choose a 6-digit, custom numeric (7+ digits) or alphanumeric code.\", \"Unapproved AI tools (shadow AI): Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it.\", \"Answer the 8 open organisational questions in organisational.conf.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7000536, "profile": "hardened", "dataset_version": "0.3.0"}, "reply": "{\"tools\": [{\"tool\": \"ChatGPT\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Needs a business plan with a data processing agreement and a transfer basis (Art. 28, Art. 44); consumer accounts may use prompts for training unless opted out.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Gemini\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Use the Workspace version under the organisation's Google data processing terms; consumer use is not covered.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Microsoft Copilot\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Use the Microsoft 365 work account version covered by the organisation's Microsoft data processing terms; consumer Copilot is not covered.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"3 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: ChatGPT, Gemini, Microsoft Copilot.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7000298, "profile": "typical", "dataset_version": "0.3.0", "check_id": "aiact.inventory", "status": "Compliant"}, "reply": "{\"check_id\": \"aiact.inventory\", \"status\": \"Compliant\", \"title\": \"AI software inventory matches the required setting\", \"finding\": \"The user reports Gemini, which meets the requirement (inventory taken). Self-reported by the user, not verified on the device.\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.5.9\", \"GDPR Art. 30\", \"EU AI Act Art. 26\"], \"evidence\": \"self-reported\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000974, "profile": "typical", "dataset_version": "0.3.0", "check_id": "firewall.enabled", "status": "Error"}, "reply": "{\"check_id\": \"firewall.enabled\", \"status\": \"Error\", \"title\": \"Firewall: could not be checked\", \"finding\": \"No evidence was collected for this check (Requires root: run the collector with sudo.); its status is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.20\", \"ISO 27001:2022 A.8.1\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; the firewall should be on.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000432, "profile": "neglected", "dataset_version": "0.3.0", "check_id": "firewall.private.enabled", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"firewall.private.enabled\", \"status\": \"Non-Compliant\", \"title\": \"Gap: Private firewall\", \"finding\": \"The device reports off, but the baseline requires on. A host firewall blocks unwanted network connections to the device, especially on public networks.\", \"risk\": {\"level\": \"High\", \"reason\": \"Network services on the device are exposed to anyone on the same network.\"}, \"recommendation\": [\"Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True, or enforce it with Group Policy/Intune.\"], \"references\": [\"ISO 27001:2022 A.8.20\", \"ISO 27001:2022 A.8.1\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; the firewall should be on.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000590, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "screen_lock.timeout", "status": "NotApplicable"}, "reply": "{\"check_id\": \"screen_lock.timeout\", \"status\": \"NotApplicable\", \"title\": \"Screen lock timeout: not applicable\", \"finding\": \"This check does not apply: No graphical desktop settings found.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.8.1\", \"ISO 27001:2022 A.7.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7001266, "profile": "typical", "dataset_version": "0.3.0", "check_id": "org.ai_literacy", "status": "Pending"}, "reply": "{\"check_id\": \"org.ai_literacy\", \"status\": \"Pending\", \"title\": \"AI literacy training: decision pending\", \"finding\": \"Current state: not answered. Answered once by the organisation (organisational.conf); not part of the phone self-check.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: Untrained staff misuse AI tools and share data they should not.\"}, \"recommendation\": [\"Provide AI literacy training matched to how staff use AI (capabilities, limits, data protection, the AI acceptable-use policy) and keep records.\"], \"references\": [\"ISO 27001:2022 A.6.3\", \"EU AI Act Art. 4\"], \"verification\": \"Answer ORG_AI_LITERACY=yes once training is delivered and recorded.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "linux", "audit": 7000445, "profile": "typical", "dataset_version": "0.3.0"}, "reply": "{\"device\": \"fin-ubuntu-99 - Ubuntu 20.04.6 LTS 20.04\", \"score\": {\"compliant\": 33, \"assessed\": 50, \"percent\": 66}, \"counts\": {\"Compliant\": 33, \"Non-Compliant\": 17, \"NotApplicable\": 2, \"Pending\": 4, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"malware.antivirus\", \"name\": \"Antivirus\", \"risk\": \"High\", \"found\": \"none running\"}, {\"check_id\": \"malware.signatures\", \"name\": \"Malware signatures\", \"risk\": \"High\", \"found\": \"14 days old\"}, {\"check_id\": \"firewall.inbound\", \"name\": \"Firewall inbound policy\", \"risk\": \"High\", \"found\": \"allow\"}, {\"check_id\": \"admin.unauthorized\", \"name\": \"Unauthorized employee administrator accounts\", \"risk\": \"High\", \"found\": \"pmartin\"}, {\"check_id\": \"gdpr.updates_recent\", \"name\": \"Security updates installed recently\", \"risk\": \"High\", \"found\": \"57 days ago\"}], \"summary\": \"fin-ubuntu-99 meets 33 of 50 assessed checks (66%). The most serious gaps are Antivirus, Malware signatures and Firewall inbound policy. 4 items are pending.\", \"next_steps\": [\"Antivirus: Install an endpoint protection product, or ClamAV: apt install clamav clamav-daemon (RHEL: dnf install clamav clamd), then systemctl enable --now clamav-daemon.\", \"Malware signatures: systemctl enable --now clamav-freshclam, or run freshclam once to update now.\", \"Firewall inbound policy: ufw default deny incoming (firewalld: keep the default zone target at default/REJECT).\", \"Answer the 2 open organisational questions in organisational.conf.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "windows", "audit": 7000172, "profile": "neglected", "dataset_version": "0.3.0"}, "reply": "{\"tools\": [{\"tool\": \"Claude Code\", \"kind\": \"AI coding assistant (command line)\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Source code may contain personal data or secrets; use a commercial plan with a data processing agreement and keep secrets out of repositories.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Microsoft Copilot\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Use the Microsoft 365 work account version covered by the organisation's Microsoft data processing terms; consumer Copilot is not covered.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"2 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: Claude Code, Microsoft Copilot.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001033, "profile": "hardened", "dataset_version": "0.3.0", "check_id": "usb.device_access", "status": "Compliant"}, "reply": "{\"check_id\": \"usb.device_access\", \"status\": \"Compliant\", \"title\": \"USB storage device access matches the required setting\", \"finding\": \"The device reports allow, which meets the requirement (allow).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.7.10\", \"ISO 27001:2022 A.8.12\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001334, "profile": "typical", "dataset_version": "0.3.0", "check_id": "gdpr.security_logging", "status": "Error"}, "reply": "{\"check_id\": \"gdpr.security_logging\", \"status\": \"Error\", \"title\": \"Security event logging: could not be checked\", \"finding\": \"No evidence was collected for this check (Value could not be read.); its status is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.15\", \"GDPR Art. 32(1)(d)\", \"GDPR Art. 33\"], \"verification\": \"Re-run the audit; Security event logging should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001512, "profile": "typical", "dataset_version": "0.3.0", "check_id": "gdpr.auto_updates", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"gdpr.auto_updates\", \"status\": \"Non-Compliant\", \"title\": \"Automatic security updates is non-compliant\", \"finding\": \"Found: dnf-automatic timer off, apply_updates=no. Required: automatic. Security fixes must be installed automatically so that known vulnerabilities are closed quickly.\", \"risk\": {\"level\": \"High\", \"reason\": \"Unpatched devices are the most common way attackers get in.\"}, \"recommendation\": [\"Debian/Ubuntu: apt install unattended-upgrades && dpkg-reconfigure -plow unattended-upgrades. RHEL: dnf install dnf-automatic && systemctl enable --now dnf-automatic-install.timer.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Automatic security updates should be Compliant.\"}"}

training/eval/v0.4.jsonl

@@ -0,0 +1,60 @@
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7001099, "profile": "typical", "dataset_version": "0.4.0"}, "reply": "{\"tools\": [{\"tool\": \"ChatGPT\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Needs a business plan with a data processing agreement and a transfer basis (Art. 28, Art. 44); consumer accounts may use prompts for training unless opted out.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Perplexity\", \"kind\": \"Cloud AI search assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Needs an enterprise agreement and a transfer basis before work or personal data is entered.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"2 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: ChatGPT, Perplexity.\"}"}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "audit", "dataset_version": "0.4.0"}, "reply": "Your audit found 20 gaps. Start with Antivirus (found: Windows Defender (off, out of date)). Anti-malware software detects and blocks known malicious files and behaviour. To fix it [4]:\n1. Turn Microsoft Defender Antivirus back on (Windows Security > Virus & threat protection) or make sure the third-party product is installed, enabled and reporting to Security Center.\n\nThen look at: Public firewall, Public inbound, Public outbound."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "control", "dataset_version": "0.4.0"}, "reply": "Art. 5(1)(f) (Integrity and confidentiality): Personal data must be protected against unauthorised access, loss and damage with appropriate measures. [4]\n\nAn auditor looks for:\n- Technical security measures in place\n\nOn devices: The endpoint security baseline is part of these measures."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "faq", "dataset_version": "0.4.0"}, "reply": "Detected means the browser or the app read the value itself. Self-reported means the user answered a question; the value was not verified on the device. Phone checks are mostly self-reported because browsers cannot read phone settings. [1]"}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "fix", "dataset_version": "0.4.0"}, "reply": "The shorter the idle time before locking, the smaller the window for misuse. To fix it on macOS [1]:\n1. Set the screen saver to start within 5 minutes (idleTime in com.apple.screensaver) and require the password immediately, ideally by configuration profile.\n\nTo check it worked: Re-run the audit; Screen lock timeout should be 300 seconds or less."}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "noaudit", "dataset_version": "0.4.0"}, "reply": "I can't see your device from here, so I can't tell you yet. Run an audit with the free Devseis desktop app: it reads the settings, changes nothing, and reports what it found [2]. Then ask me again and I will answer from your real results."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.4.0"}, "reply": "I can only help with device security, ISO 27001, GDPR and the EU AI Act, so I can't answer that. Ask me, for example, how to turn on disk encryption, whether an AI tool is OK for work, or run an audit of this device."}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "phone", "dataset_version": "0.4.0"}, "reply": "Go to Settings › General › VPN & Device Management lists developer or enterprise profiles. Alternative app marketplaces appear as separate apps. [4]"}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "refs", "dataset_version": "0.4.0"}, "reply": "Encryption relates to ISO 27001:2022 A.8.24, ISO 27001:2022 A.8.1, GDPR Art. 32(1)(a) [4]. Meeting the setting is evidence for these controls; it is not a certification on its own."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "tool", "dataset_version": "0.4.0"}, "reply": "Grammarly is a ai writing assistant from Grammarly (US); data goes to: provider cloud outside the eea [1]. For general office use its default EU AI Act risk class is minimal. GDPR: Reads everything typed where it is enabled, including personal data; use the business plan with a data processing agreement or disable it in work apps.\n\nWhether it is allowed depends on your organisation's approved AI tools list and on what you use it for: some purposes (for example screening job applicants) make any AI tool high-risk."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.4.0"}, "reply": "I don't have reliable information about that in my knowledge base, so I won't guess. I cover security settings on Windows, macOS, Linux, iPhone and Android, ISO 27001, GDPR and the EU AI Act."}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "verify", "dataset_version": "0.4.0"}, "reply": "Re-run the audit; critical or high vulnerabilities should be 0 or fewer. [4]"}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "why", "dataset_version": "0.4.0"}, "reply": "AI tools used without approval may send work and personal data to providers without contracts or a transfer basis. If it is missing, the risk is medium: Shadow AI can leak confidential or personal data and creates unassessed AI Act and GDPR obligations. [4]"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000685, "profile": "hardened", "dataset_version": "0.4.0", "check_id": "firewall.domain.outbound", "status": "Compliant"}, "reply": "{\"check_id\": \"firewall.domain.outbound\", \"status\": \"Compliant\", \"title\": \"Domain outbound matches the required setting\", \"finding\": \"The device reports allow, which meets the requirement (allow).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.20\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000666, "profile": "typical", "dataset_version": "0.4.0", "check_id": "screen_lock.enabled", "status": "Error"}, "reply": "{\"check_id\": \"screen_lock.enabled\", \"status\": \"Error\", \"title\": \"Screen lock: evidence missing\", \"finding\": \"This check returned an error: Value could not be read. Compliance cannot be confirmed.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.1\", \"ISO 27001:2022 A.7.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Screen lock should be on.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000795, "profile": "neglected", "dataset_version": "0.4.0", "check_id": "malware.on_access", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"malware.on_access\", \"status\": \"Non-Compliant\", \"title\": \"On-access protection is non-compliant\", \"finding\": \"Found: off. Required: on. On-access scanning checks files when they are opened or written.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Malicious files can be opened before any scheduled scan finds them.\"}, \"recommendation\": [\"Enable real-time protection in Microsoft Defender (on-access protection follows it).\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; On-access malware protection should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000708, "profile": "typical", "dataset_version": "0.4.0", "check_id": "aiact.log_retention", "status": "NotApplicable"}, "reply": "{\"check_id\": \"aiact.log_retention\", \"status\": \"NotApplicable\", \"title\": \"AI usage log retention: not applicable\", \"finding\": \"This check does not apply: no AI tools found.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.8.15\", \"EU AI Act Art. 26(6)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7001167, "profile": "typical", "dataset_version": "0.4.0", "check_id": "gdpr.backup_recent", "status": "Pending"}, "reply": "{\"check_id\": \"gdpr.backup_recent\", \"status\": \"Pending\", \"title\": \"Recent backup is pending\", \"finding\": \"Current state: date not readable. Confirm the last backup date in: OneDrive folder backup (policy).\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: Recent work would be lost if the device failed today.\"}, \"recommendation\": [\"Check the backup tool's history and run a backup now; fix whatever stopped it (full destination, signed-out OneDrive, stopped agent).\"], \"references\": [\"ISO 27001:2022 A.8.13\", \"GDPR Art. 32(1)(c)\"], \"verification\": \"Re-run the audit; the last backup should be within 7 days.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "macos", "audit": 7000992, "profile": "neglected", "dataset_version": "0.4.0"}, "reply": "{\"device\": \"MKT-MacBook-12 - macOS 26.0.1\", \"score\": {\"compliant\": 17, \"assessed\": 45, \"percent\": 38}, \"counts\": {\"Compliant\": 17, \"Non-Compliant\": 28, \"NotApplicable\": 5, \"Pending\": 6, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"malware.service\", \"name\": \"Apple malware protection service\", \"risk\": \"High\", \"found\": \"XProtect scanning on; Gatekeeper assessments disabled\"}, {\"check_id\": \"malware.signatures\", \"name\": \"Malware protection signatures\", \"risk\": \"High\", \"found\": \"XProtect 5299, 106 days old\"}, {\"check_id\": \"firewall.enabled\", \"name\": \"Firewall\", \"risk\": \"High\", \"found\": \"off\"}, {\"check_id\": \"firewall.inbound\", \"name\": \"Firewall inbound policy\", \"risk\": \"High\", \"found\": \"firewall off, stealth mode off\"}, {\"check_id\": \"user.account_type\", \"name\": \"Signed-in user account type\", \"risk\": \"High\", \"found\": \"Administrator (lmuller)\"}, \"fix\": [\"Re-enable Gatekeeper: sudo spctl --master-enable. Keep 'Install Security Responses and system files' on in Software Update.\", \"Malware protection signatures: Keep 'Install Security Responses and system files' on (Software Update > Automatic Updates); run softwareupdate --background to fetch now.\", \"Firewall: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on, or enforce the firewall by configuration profile.\"]}, \"summary\": \"MKT-MacBook-12 meets 17 of 45 assessed checks (38%). The most serious gaps are Apple malware protection service, Malware protection signatures and Firewall. 6 items are pending.\", \"next_steps\": [\"Apple malware protection service: Re-enable Gatekeeper: sudo spctl --master-enable. Keep 'Install Security Responses and system files' on in Software Update.\", \"Malware protection signatures: Keep 'Install Security Responses and system files' on (Software Update > Automatic Updates); run softwareupdate --background to fetch now.\", \"Firewall: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on, or enforce the firewall by configuration profile.\", \"Answer the 4 open organisational questions in organisational.conf.\", \"Classify the AI tools found on this device and record them in the AI register.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "macos", "audit": 7001404, "profile": "neglected", "dataset_version": "0.4.0"}, "reply": "{\"tools\": [{\"tool\": \"Jan\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Check whether remote API providers are configured; if so, the cloud provider rules apply.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"ChatGPT\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Needs a business plan with a data processing agreement and a transfer basis (Art. 28, Art. 44); consumer accounts may use prompts for training unless opted out.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"2 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: Jan, ChatGPT.\"}"}
+{"task": "chat", "meta": {"task": "chat", "os": "linux", "status": "audit", "dataset_version": "0.4.0"}, "reply": "Your audit found Firewall: no active firewall. A host firewall blocks unwanted network connections to the device, especially on public networks. To fix it [1]:\n1. Debian/Ubuntu: ufw default deny incoming; ufw default allow outgoing; ufw enable. RHEL: systemctl enable --now firewalld.\n\nThen run the audit again to confirm."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "control", "dataset_version": "0.4.0"}, "reply": "A.5.20 (Addressing information security within supplier agreements): Agreements with suppliers set out the security requirements they must meet. [4]\n\nAn auditor looks for:\n- Signed agreements with security and data protection clauses\n\nOn devices: Cloud and AI services used from endpoints are suppliers that need agreements."}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "fix", "dataset_version": "0.4.0"}, "reply": "Anti-malware software detects and blocks known malicious files and behaviour. To fix it on Windows [1]:\n1. Turn Microsoft Defender Antivirus back on (Windows Security > Virus & threat protection) or make sure the third-party product is installed, enabled and reporting to Security Center.\n\nTo check it worked: Re-run the audit; Antivirus should be Compliant."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.4.0"}, "reply": "I can only help with device security, ISO 27001, GDPR and the EU AI Act, so I can't answer that. Ask me, for example, how to turn on disk encryption, whether an AI tool is OK for work, or run an audit of this device."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "phone", "dataset_version": "0.4.0"}, "reply": "Go to Settings › System › Developer options › USB debugging. If you cannot find Developer options, they are off. [4]"}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "refs", "dataset_version": "0.4.0"}, "reply": "Account lockout duration relates to ISO 27001:2022 A.8.5, GDPR Art. 32(1)(b) [1]. Meeting the setting is evidence for these controls; it is not a certification on its own."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "tool", "dataset_version": "0.4.0"}, "reply": "GPT4All is a local model runner from Nomic AI (runs locally); data goes to: on the device unless optional data sharing is enabled [3]. For general office use its default EU AI Act risk class is minimal. GDPR: Keep the optional data lake sharing switched off.\n\nWhether it is allowed depends on your organisation's approved AI tools list and on what you use it for: some purposes (for example screening job applicants) make any AI tool high-risk."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.4.0"}, "reply": "I don't have reliable information about that in my knowledge base, so I won't guess. I cover security settings on Windows, macOS, Linux, iPhone and Android, ISO 27001, GDPR and the EU AI Act."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "verify", "dataset_version": "0.4.0"}, "reply": "Re-run the audit; Supported operating system version should be Compliant. [1]"}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "why", "dataset_version": "0.4.0"}, "reply": "Installed software versions with published critical or high vulnerabilities give attackers a ready-made way in. If it is missing, the risk is high: Critical and high vulnerabilities often allow remote code execution or privilege escalation. [4]"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000341, "profile": "typical", "dataset_version": "0.4.0", "check_id": "gdpr.removable_encryption", "status": "Compliant"}, "reply": "{\"check_id\": \"gdpr.removable_encryption\", \"status\": \"Compliant\", \"title\": \"Removable media encryption matches the required setting\", \"finding\": \"The device reports writing to external drives blocked, which meets the requirement (no unencrypted writes).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.7.10\", \"ISO 27001:2022 A.8.24\", \"GDPR Art. 32(1)(a)\", \"GDPR Art. 34\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000283, "profile": "hardened", "dataset_version": "0.4.0", "check_id": "screen_lock.password", "status": "Error"}, "reply": "{\"check_id\": \"screen_lock.password\", \"status\": \"Error\", \"title\": \"Screen lock password requirement: could not be checked\", \"finding\": \"This check returned an error: Value could not be read. Compliance cannot be confirmed.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.1\", \"ISO 27001:2022 A.7.7\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; the password requirement should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000795, "profile": "neglected", "dataset_version": "0.4.0", "check_id": "vuln.known_vulnerabilities", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"vuln.known_vulnerabilities\", \"status\": \"Non-Compliant\", \"title\": \"Known vulnerabilities in installed software is non-compliant\", \"finding\": \"The device reports 105 critical/high, but the baseline requires <= 0 critical/high. Installed software versions with published critical or high vulnerabilities give attackers a ready-made way in.\", \"risk\": {\"level\": \"High\", \"reason\": \"Critical and high vulnerabilities often allow remote code execution or privilege escalation.\"}, \"recommendation\": [\"Update or remove each listed software package to a version without the listed vulnerabilities; where no fix exists yet, apply the vendor's workaround or restrict the software's use.\", \"Use winget upgrade or the vendor's installer to reach a fixed version.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; critical or high vulnerabilities should be 0 or fewer.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001369, "profile": "typical", "dataset_version": "0.4.0", "check_id": "malware.on_access", "status": "NotApplicable"}, "reply": "{\"check_id\": \"malware.on_access\", \"status\": \"NotApplicable\", \"title\": \"On-access malware protection: not assessed on this device\", \"finding\": \"This check does not apply: XProtect scans at launch and download; macOS has no built-in on-access scanning.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000175, "profile": "typical", "dataset_version": "0.4.0", "check_id": "aiact.risk_classification", "status": "Pending"}, "reply": "{\"check_id\": \"aiact.risk_classification\", \"status\": \"Pending\", \"title\": \"AI system risk classification: decision pending\", \"finding\": \"Current state: GPT4All. Classified by the auditor model (Caveat classifier) in a later step.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: An unclassified tool could be used for a high-risk or prohibited purpose without the required safeguards.\"}, \"recommendation\": [\"Record the purpose for which each listed tool is used and classify it (prohibited, high-risk, limited-risk transparency, minimal). The auditor model does this from the inventory and the stated purpose.\"], \"references\": [\"ISO 27001:2022 A.5.9\", \"EU AI Act Art. 5\", \"EU AI Act Art. 6\", \"EU AI Act Annex III\"], \"verification\": \"Every AI tool in the inventory has a classification in the AI register.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "android", "audit": 7000728, "profile": "neglected", "dataset_version": "0.4.0"}, "reply": "{\"device\": \"legal-galaxy-14 - Android 16\", \"score\": {\"compliant\": 9, \"assessed\": 24, \"percent\": 38}, \"counts\": {\"Compliant\": 9, \"Non-Compliant\": 15, \"NotApplicable\": 2, \"Pending\": 4, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"malware.antivirus\", \"name\": \"Google Play Protect\", \"risk\": \"High\", \"found\": \"Play Protect scanning off\"}, {\"check_id\": \"mobile.jailbreak_root\", \"name\": \"Not rooted\", \"risk\": \"High\", \"found\": \"rooted or bootloader unlocked\"}, {\"check_id\": \"gdpr.auto_updates\", \"name\": \"Automatic system updates\", \"risk\": \"High\", \"found\": \"manual\"}, {\"check_id\": \"org.processor_agreements\", \"name\": \"Data processing agreements\", \"risk\": \"High\", \"found\": \"no\"}, {\"check_id\": \"screen_lock.enabled\", \"name\": \"Screen lock\", \"risk\": \"Medium\", \"found\": \"no screen lock (Swipe/None)\"}], \"summary\": \"legal-galaxy-14 meets 9 of 24 assessed checks (38%). The most serious gaps are Google Play Protect, Not rooted and Automatic system updates. 4 items are pending.\", \"next_steps\": [\"Google Play Protect: Play Store › profile picture › Play Protect › Settings: turn on 'Scan apps with Play Protect'.\", \"Not rooted: Remove root and re-lock the bootloader by installing the phone maker's official firmware, or stop using the phone for work.\", \"Automatic system updates: Settings › System › Software updates: turn on automatic download (names vary by phone maker).\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "macos", "audit": 7001397, "profile": "typical", "dataset_version": "0.4.0"}, "reply": "{\"tools\": [{\"tool\": \"LM Studio\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No transfer to a provider; check model licences and whether its local server is exposed.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Jan\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Check whether remote API providers are configured; if so, the cloud provider rules apply.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"2 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: LM Studio, Jan.\"}"}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "audit", "dataset_version": "0.4.0"}, "reply": "Your audit found Known vulnerabilities in iOS: 158 critical/high. Installed software versions with published critical or high vulnerabilities give attackers a ready-made way in. To fix it [1]:\n1. Update or remove each listed software package to a version without the listed vulnerabilities; where no fix exists yet, apply the vendor's workaround or restrict the software's use.\n2. Settings › General › Software Update: install the newest iOS version; if the iPhone cannot run a version without the listed vulnerabilities, replace it.\n\nThen run the audit again to confirm."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "control", "dataset_version": "0.4.0"}, "reply": "Art. 26 (Obligations of deployers of high-risk AI systems):\n- Deployers must use high-risk AI as instructed, assign human oversight, monitor it, keep logs and inform affected people.\n- An auditor looks for: An AI register; Use according to instructions; Monitoring and log retention. On devices: The AI software inventory is the starting point for these duties. [4]"}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "fix", "dataset_version": "0.4.0"}, "reply": "Official app stores review apps for malware; apps from other sources skip those checks. To fix it on Android [1]:\n1. Settings › Apps › Special app access › Install unknown apps: set every app to Not allowed; uninstall apps that did not come from Google Play.\n\nTo check it worked: Re-run the phone check; apps should come only from the official store (or the employer)."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "tool", "dataset_version": "0.4.0"}, "reply": "Meta AI is a cloud ai assistant from Meta (US); data goes to: provider cloud outside the eea [1]. For general office use its default EU AI Act risk class is minimal. GDPR: Consumer service with no business data processing terms; do not share work or customer data in chats with Meta AI.\n\nWhether it is allowed depends on your organisation's approved AI tools list and on what you use it for: some purposes (for example screening job applicants) make any AI tool high-risk."}
+{"task": "chat", "meta": {"task": "chat", "os": "linux", "status": "verify", "dataset_version": "0.4.0"}, "reply": "Re-run the audit; Signed-in user account type should read Standard. [4]"}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "why", "dataset_version": "0.4.0"}, "reply": "Previews show message and email content, often personal data, to anyone who sees the locked phone. If it is missing, the risk is low: Personal data in notifications can be read without unlocking the phone. [1]"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000922, "profile": "neglected", "dataset_version": "0.4.0", "check_id": "malware.signatures", "status": "Compliant"}, "reply": "{\"check_id\": \"malware.signatures\", \"status\": \"Compliant\", \"title\": \"Malware signatures is compliant\", \"finding\": \"The device reports 3 days old, which meets the requirement (<= 3 days old).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000974, "profile": "typical", "dataset_version": "0.4.0", "check_id": "firewall.outbound", "status": "Error"}, "reply": "{\"check_id\": \"firewall.outbound\", \"status\": \"Error\", \"title\": \"Firewall outbound policy: could not be checked\", \"finding\": \"This check returned an error: Requires root: run the collector with sudo. Compliance cannot be confirmed.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.20\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; the outbound policy should read allow.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000496, "profile": "typical", "dataset_version": "0.4.0", "check_id": "malware.tamper", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"malware.tamper\", \"status\": \"Non-Compliant\", \"title\": \"Tamper protection is non-compliant\", \"finding\": \"The device reports off, but the baseline requires on. Tamper protection stops malware or users switching off Defender.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Attackers commonly disable antivirus before deploying ransomware.\"}, \"recommendation\": [\"Turn on Tamper Protection in Windows Security > Virus & threat protection settings, or centrally through Microsoft Intune / Defender for Endpoint (it cannot be set with PowerShell).\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Tamper protection should be on.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001334, "profile": "typical", "dataset_version": "0.4.0", "check_id": "aiact.os_ai_features", "status": "NotApplicable"}, "reply": "{\"check_id\": \"aiact.os_ai_features\", \"status\": \"NotApplicable\", \"title\": \"Operating system AI features restricted: not assessed on this device\", \"finding\": \"This check does not apply: Linux distributions ship no built-in AI assistant.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.5.34\", \"GDPR Art. 5(1)(c)\", \"GDPR Art. 25\", \"EU AI Act Art. 26\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7001113, "profile": "neglected", "dataset_version": "0.4.0", "check_id": "org.human_oversight", "status": "Pending"}, "reply": "{\"check_id\": \"org.human_oversight\", \"status\": \"Pending\", \"title\": \"Human oversight for high-risk AI: decision pending\", \"finding\": \"Current state: not answered. Answered once by the organisation (organisational.conf); not part of the phone self-check.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: High-risk AI without oversight can harm people without anyone noticing.\"}, \"recommendation\": [\"For each high-risk AI system, name a trained person responsible for oversight; answer n/a if no high-risk AI is used.\"], \"references\": [\"EU AI Act Art. 14\", \"EU AI Act Art. 26\"], \"verification\": \"Answer ORG_HUMAN_OVERSIGHT=yes (or n/a) in organisational.conf.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "macos", "audit": 7001352, "profile": "typical", "dataset_version": "0.4.0"}, "reply": "{\"device\": \"HR-MacBook-08 - macOS 26.0.1\", \"score\": {\"compliant\": 34, \"assessed\": 48, \"percent\": 71}, \"counts\": {\"Compliant\": 34, \"Non-Compliant\": 14, \"NotApplicable\": 4, \"Pending\": 4, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"firewall.inbound\", \"name\": \"Firewall inbound policy\", \"risk\": \"High\", \"found\": \"firewall on, stealth mode off\"}, {\"check_id\": \"vuln.pending_updates\", \"name\": \"Pending security updates\", \"risk\": \"High\", \"found\": \"1 pending\"}, {\"check_id\": \"vuln.known_vulnerabilities\", \"name\": \"Known vulnerabilities in installed software\", \"risk\": \"High\", \"found\": \"57 critical/high\"}, {\"check_id\": \"gdpr.auto_updates\", \"name\": \"Automatic security updates\", \"risk\": \"High\", \"found\": \"check=1 download=1 security=1 macOS-install=0\"}, {\"check_id\": \"gdpr.remote_access\", \"name\": \"Remote access services restricted\", \"risk\": \"High\", \"found\": \"ssh, anydesk\"}], \"summary\": \"HR-MacBook-08 meets 34 of 48 assessed checks (71%). The most serious gaps are Firewall inbound policy, Pending security updates and Known vulnerabilities in installed software. 4 items are pending.\", \"next_steps\": [\"Re-run the audit as administrator/root so that every setting can be changed.\", \"Firewall inbound policy: Turn on stealth mode: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on.\", \"Pending security updates: Install the pending updates: System Settings > General > Software Update, or softwareupdate -ia, then restart if asked.\", \"Known vulnerabilities in installed software: Update or remove each listed software package to a version without the listed vulnerabilities; where no fix exists yet, apply the vendor's workaround or restrict the software's use.\", \"Answer the 2 open organisational questions in organisational.conf.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "android", "audit": 7001492, "profile": "typical", "dataset_version": "0.4.0"}, "reply": "{\"tools\": [{\"tool\": \"DeepSeek\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No EU adequacy decision for China and no business data processing terms; EU data protection authorities have restricted or investigated it. Do not use with work or personal data.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"1 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: DeepSeek.\"}"}
+{"task": "chat", "meta": {"task": "chat", "os": "linux", "status": "audit", "dataset_version": "0.4.0"}, "reply": "Your audit found 15 gaps. Start with Minimum password length (found: 6). Short passwords can be guessed or cracked quickly; length is the strongest single factor in password strength. To fix it [3]:\n1. Install pam_pwquality (Debian/Ubuntu: apt install libpam-pwquality) and make sure it is listed in the PAM password stack.\n2. Set minlen = 14 in /etc/security/pwquality.conf.\n\nThen look at: Minimum password age, Malware signatures, On-access malware protection."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "fix", "dataset_version": "0.4.0"}, "reply": "Everyday user accounts with administrator rights let malware and mistakes change anything on the device. To fix it on macOS [4]:\n1. Demote the listed accounts: sudo dseditgroup -o edit -d <account> -t user admin.\n\nTo check it worked: Re-run the audit; Unauthorized administrator accounts should read none."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "tool", "dataset_version": "0.4.0"}, "reply": "Ollama is a local model runner from Open source (runs locally); data goes to: on the device; nothing leaves without a cloud model selected [1]. For general office use its default EU AI Act risk class is minimal. GDPR: No transfer to a provider, but check each model's licence and keep the local API (port 11434) closed to the network.\n\nWhether it is allowed depends on your organisation's approved AI tools list and on what you use it for: some purposes (for example screening job applicants) make any AI tool high-risk."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "why", "dataset_version": "0.4.0"}, "reply": "Accurate clocks are needed to put events in the right order during an investigation. If it is missing, the risk is low: Wrong timestamps make incident timelines unreliable. [1]"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001273, "profile": "hardened", "dataset_version": "0.4.0", "check_id": "user.account_type", "status": "Compliant"}, "reply": "{\"check_id\": \"user.account_type\", \"status\": \"Compliant\", \"title\": \"Signed-in user account type is compliant\", \"finding\": \"The device reports Standard (tnguyen), which meets the requirement (Standard).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.2\", \"ISO 27001:2022 A.5.15\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001457, "profile": "typical", "dataset_version": "0.4.0", "check_id": "firewall.outbound", "status": "Error"}, "reply": "{\"check_id\": \"firewall.outbound\", \"status\": \"Error\", \"title\": \"Firewall outbound policy: could not be checked\", \"finding\": \"This check returned an error: Requires root: run the collector with sudo. Compliance cannot be confirmed.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.20\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; the outbound policy should read allow.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7001028, "profile": "neglected", "dataset_version": "0.4.0", "check_id": "password.min_length", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"password.min_length\", \"status\": \"Non-Compliant\", \"title\": \"Minimum password length is non-compliant\", \"finding\": \"The device reports 10, but the baseline requires >= 14. Short passwords can be guessed or cracked quickly; length is the strongest single factor in password strength.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Weak passwords make account takeover through guessing or credential stuffing easier.\"}, \"recommendation\": [\"Set Group Policy: Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy > Minimum password length = 14 (or the Intune equivalent).\", \"For a stand-alone device: net accounts /minpwlen:14\"], \"references\": [\"ISO 27001:2022 A.5.17\", \"ISO 27001:2022 A.8.5\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Minimum password length should read 14 or more.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000554, "profile": "typical", "dataset_version": "0.4.0", "check_id": "aiact.risk_classification", "status": "NotApplicable"}, "reply": "{\"check_id\": \"aiact.risk_classification\", \"status\": \"NotApplicable\", \"title\": \"AI system risk classification: not applicable\", \"finding\": \"This check does not apply: no AI tools found.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.5.9\", \"EU AI Act Art. 5\", \"EU AI Act Art. 6\", \"EU AI Act Annex III\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7001101, "profile": "neglected", "dataset_version": "0.4.0", "check_id": "aiact.log_retention", "status": "Pending"}, "reply": "{\"check_id\": \"aiact.log_retention\", \"status\": \"Pending\", \"title\": \"AI usage log retention: decision pending\", \"finding\": \"Current state: depends on classification. Required only if a tool is classified high-risk.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Until resolved: Missing logs prevent monitoring and investigation of high-risk AI use.\"}, \"recommendation\": [\"If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months.\"], \"references\": [\"ISO 27001:2022 A.8.15\", \"EU AI Act Art. 26(6)\"], \"verification\": \"Log retention is documented for each high-risk AI system.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "linux", "audit": 7000305, "profile": "hardened", "dataset_version": "0.4.0"}, "reply": "{\"device\": \"legal-ws-79 - Debian GNU/Linux 13 (trixie) 13\", \"score\": {\"compliant\": 44, \"assessed\": 48, \"percent\": 92}, \"counts\": {\"Compliant\": 44, \"Non-Compliant\": 4, \"NotApplicable\": 2, \"Pending\": 5, \"Error\": 1}, \"top_gaps\": [{\"check_id\": \"malware.antivirus\", \"name\": \"Antivirus\", \"risk\": \"High\", \"found\": \"none running\"}, {\"check_id\": \"malware.service\", \"name\": \"ClamAV malware protection service\", \"risk\": \"High\", \"found\": \"not running\"}, {\"check_id\": \"aiact.unapproved\", \"name\": \"Unapproved AI tools (shadow AI)\", \"risk\": \"Medium\", \"found\": \"Ollama, LM Studio\"}, {\"check_id\": \"lockout.duration\", \"name\": \"Account lockout duration\", \"risk\": \"Low\", \"found\": \"10 minutes\"}], \"summary\": \"legal-ws-79 meets 44 of 48 assessed checks (92%). The most serious gaps are Antivirus and ClamAV malware protection service. 1 checks could not be read. 5 items are pending.\", \"next_steps\": [\"Re-run the audit as administrator/root so that every check can be read.\", \"Antivirus: Install an endpoint protection product, or ClamAV: apt install clamav clamav-daemon (RHEL: dnf install clamav clamd), then systemctl enable --now clamav-daemon.\", \"ClamAV malware protection service: systemctl enable --now clamav-daemon (RHEL: clamd@scan).\", \"Unapproved AI tools (shadow AI): Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it.\", \"Answer the 2 open organisational questions in organisational.conf.\"]}"}

training/eval/v0.5.jsonl

@@ -0,0 +1,60 @@
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7000189, "profile": "hardened", "dataset_version": "0.5.0"}, "reply": "{\"tools\": [{\"tool\": \"ChatGPT\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Needs a business plan with a data processing agreement and a transfer basis (Art. 28, Art. 44); consumer accounts may use prompts for training unless opted out.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Microsoft Copilot\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Use the Microsoft 365 work account version covered by the organisation's Microsoft data processing terms; consumer Copilot is not covered.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"2 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: ChatGPT, Microsoft Copilot.\"}"}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "audit", "dataset_version": "0.5.0"}, "reply": "Your audit found Google Play Protect: Play Protect scanning off. Anti-malware software detects and blocks known malicious files and behaviour. To fix it [1]:\n1. Play Store › profile picture › Play Protect › Settings: turn on 'Scan apps with Play Protect'.\n\nThen run the audit again to confirm."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "control", "dataset_version": "0.5.0"}, "reply": "Art. 25 (Data protection by design and by default): Build data protection into systems and use privacy-friendly settings by default. [1]\n\nAn auditor looks for:\n- Privacy-protective default settings on devices and software\n\nOn devices: Telemetry and AI data-collection features should be off unless needed."}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "device", "dataset_version": "0.5.0"}, "reply": "This browser reports Windows 11 on a Windows PC (x86-64), using Chrome 152. That is all a web page can see: it can't read security settings such as encryption, the firewall or the screen lock. To check those, run an audit with the free Devseis desktop app [3]."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "faq", "dataset_version": "0.5.0"}, "reply": "I don't have reliable information about that in my knowledge base, so I won't guess. I cover security settings on Windows, macOS, Linux, iPhone and Android, ISO 27001, GDPR and the EU AI Act."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "fix", "dataset_version": "0.5.0"}, "reply": "Go to Settings › Google › All services › Usage & diagnostics (also check the phone maker's diagnostics option) [1]"}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "noaudit", "dataset_version": "0.5.0"}, "reply": "I can't see your device from here, so I can't tell you yet. Run an audit with the free Devseis desktop app: it reads the settings, shows you every step and changes nothing [3]. Then ask me again and I will answer from your real results."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.5.0"}, "reply": "I can only help with device security, ISO 27001, GDPR and the EU AI Act, so I can't answer that. Ask me, for example, how to turn on disk encryption, whether an AI tool is OK for work, or run an audit of this device."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "phone", "dataset_version": "0.5.0"}, "reply": "Go to Settings › Google › All services › Find My Device (called Find Hub on newer phones) [1]"}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "refs", "dataset_version": "0.5.0"}, "reply": "Antivirus relates to ISO 27001:2022 A.8.7, GDPR Art. 32(1)(b) and EU AI Act Art. 5, Art. 6, Annex III [1]. Meeting the setting is evidence for these controls; it is not a certification on its own."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "status", "dataset_version": "0.5.0"}, "reply": "I don't have reliable information about that in my knowledge base, so I won't guess. I cover security settings on Windows, macOS, Linux, iPhone and Android, ISO 27001, GDPR and the EU AI Act."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "tool", "dataset_version": "0.5.0"}, "reply": "Jan is a local model runner from Open source (runs locally); data goes to: on the device unless a cloud model is connected [4]. For general office use its default EU AI Act risk class is minimal. GDPR: Check whether remote API providers are configured; if so, the cloud provider rules apply.\n\nWhether it is allowed depends on your organisation's approved AI tools list and on what you use it for: some purposes (for example screening job applicants) make any AI tool high-risk."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.5.0"}, "reply": "I don't have reliable information about that in my knowledge base, so I won't guess. I cover security settings on Windows, macOS, Linux, iPhone and Android, ISO 27001, GDPR and the EU AI Act."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "verify", "dataset_version": "0.5.0"}, "reply": "Re-run the audit; Screen lock should be on. [1]"}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "why", "dataset_version": "0.5.0"}, "reply": "The baseline fixes the default outbound policy so that it is consistent across devices. If it is missing, the risk is low: A different outbound policy either breaks applications or deviates from the agreed design. [4]"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001397, "profile": "typical", "dataset_version": "0.5.0", "check_id": "gdpr.backup_configured", "status": "Compliant"}, "reply": "{\"check_id\": \"gdpr.backup_configured\", \"status\": \"Compliant\", \"title\": \"Backup configured matches the required setting\", \"finding\": \"The device reports bzserv, which meets the requirement (backup configured).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.13\", \"GDPR Art. 32(1)(c)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000666, "profile": "typical", "dataset_version": "0.5.0", "check_id": "vuln.pending_updates", "status": "Error"}, "reply": "{\"check_id\": \"vuln.pending_updates\", \"status\": \"Error\", \"title\": \"Pending security updates: could not be checked\", \"finding\": \"No evidence was collected for this check (Value could not be read.); its status is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\", \"GDPR Art. 32(1)(d)\"], \"verification\": \"Re-run the audit; pending security updates should be 0 or fewer.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000306, "profile": "typical", "dataset_version": "0.5.0", "check_id": "aiact.unapproved", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"aiact.unapproved\", \"status\": \"Non-Compliant\", \"title\": \"Unapproved AI tools (shadow AI): does not meet the baseline\", \"finding\": \"Found: Ollama. Required: only: none. AI tools used without approval may send work and personal data to providers without contracts or a transfer basis.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Shadow AI can leak confidential or personal data and creates unassessed AI Act and GDPR obligations.\"}, \"recommendation\": [\"Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it.\", \"Publish an AI acceptable-use policy so staff know which tools are allowed.\", \"Remove unapproved apps (Settings > Apps) or block them with AppLocker / Intune app control.\"], \"references\": [\"ISO 27001:2022 A.5.9\", \"ISO 27001:2022 A.8.19\", \"GDPR Art. 28\", \"GDPR Art. 44\", \"EU AI Act Art. 26\"], \"verification\": \"Re-run the audit; Unapproved AI tools should read none.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001395, "profile": "neglected", "dataset_version": "0.5.0", "check_id": "malware.on_access", "status": "NotApplicable"}, "reply": "{\"check_id\": \"malware.on_access\", \"status\": \"NotApplicable\", \"title\": \"On-access malware protection: not assessed on this device\", \"finding\": \"This check does not apply: XProtect scans at launch and download; macOS has no built-in on-access scanning.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7000452, "profile": "typical", "dataset_version": "0.5.0", "check_id": "org.processor_agreements", "status": "Pending"}, "reply": "{\"check_id\": \"org.processor_agreements\", \"status\": \"Pending\", \"title\": \"Data processing agreements is pending\", \"finding\": \"Answered once by the organisation (organisational.conf); not part of the phone self-check. Current state: not answered.\", \"risk\": {\"level\": \"High\", \"reason\": \"Until resolved: Sharing personal data with a processor without an agreement breaches GDPR.\"}, \"recommendation\": [\"List all processors (including AI services used by staff) and sign a data processing agreement with each; check the transfer basis for non-EEA providers.\"], \"references\": [\"ISO 27001:2022 A.5.20\", \"GDPR Art. 28\"], \"verification\": \"Answer ORG_PROCESSOR_AGREEMENTS=yes once all agreements are in place.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "windows", "audit": 7000904, "profile": "neglected", "dataset_version": "0.5.0"}, "reply": "{\"device\": \"LAPTOP-UOJGQGE - Microsoft Windows 11 Pro 10.0.26100\", \"score\": {\"compliant\": 15, \"assessed\": 53, \"percent\": 28}, \"counts\": {\"Compliant\": 15, \"Non-Compliant\": 38, \"NotApplicable\": 6, \"Pending\": 5, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"firewall.domain.enabled\", \"name\": \"Domain firewall\", \"risk\": \"High\", \"found\": \"off\"}, {\"check_id\": \"firewall.domain.inbound\", \"name\": \"Domain inbound\", \"risk\": \"High\", \"found\": \"allow\"}, {\"check_id\": \"firewall.public.enabled\", \"name\": \"Public firewall\", \"risk\": \"High\", \"found\": \"off\"}, {\"check_id\": \"firewall.public.inbound\", \"name\": \"Public inbound\", \"risk\": \"High\", \"found\": \"allow\"}, {\"check_id\": \"admin.unauthorized\", \"name\": \"Unauthorized employee local administrator accounts\", \"risk\": \"High\", \"found\": \"LAPTOP-UOJGQGE\\\\ewagner\"}], \"summary\": \"LAPTOP-UOJGQGE meets 15 of 53 assessed checks (28%). The most serious gaps are Domain firewall, Domain inbound and Public firewall. 5 items are pending.\", \"next_steps\": [\"Domain firewall: Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True, or enforce it with Group Policy/Intune.\", \"Domain inbound: Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultInboundAction Block.\", \"Public firewall: Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True, or enforce it with Group Policy/Intune.\", \"Answer the 1 open organisational questions in organisational.conf.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "macos", "audit": 7001033, "profile": "hardened", "dataset_version": "0.5.0"}, "reply": "{\"tools\": [{\"tool\": \"Perplexity\", \"kind\": \"Cloud AI search assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Needs an enterprise agreement and a transfer basis before work or personal data is entered.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Jan\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Check whether remote API providers are configured; if so, the cloud provider rules apply.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Claude\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Needs a commercial plan with a data processing agreement and a transfer basis (Art. 28, Art. 44).\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"3 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: Perplexity, Jan, Claude.\"}"}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "audit", "dataset_version": "0.5.0"}, "reply": "Your audit found 5 gaps. Start with Screen lock password requirement (found: password after 900 seconds). Unlocking the screen must require the user's password, so fix it now: (1) System Settings > Lock Screen > 'Require password after screen saver begins or display is turned off' = Immediately (askForPasswordDelay = 0 by profile)."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "control", "dataset_version": "0.5.0"}, "reply": "A.5.34 (Privacy and protection of PII): Meet the legal and contractual requirements for protecting personal data. [3]\n\nAn auditor looks for:\n- Links between the ISMS and GDPR compliance\n- Minimised collection and sharing of personal data\n\nOn devices: Diagnostic data sharing and OS AI features can send personal data off the device."}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "fix", "dataset_version": "0.5.0"}, "reply": "An idle device should lock itself so nobody can use it while the owner is away. To fix it on Windows [1]:\n1. Set Group Policy: Local Policies > Security Options > Interactive logon: Machine inactivity limit = 300 seconds, or enforce a password-protected screen saver.\n\nTo check it worked: Re-run the audit; Screen lock should be on."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "noaudit", "dataset_version": "0.5.0"}, "reply": "I can't see your device from here, so I can't tell you yet. Run an audit with the free Devseis desktop app: it reads the settings, changes nothing, and takes about 5 to 15 minutes [3]. Then ask me again and I will answer from your real results."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.5.0"}, "reply": "I can only help with device security, ISO 27001, GDPR and the EU AI Act, so I can't answer that. Ask me, for example, how to turn on disk encryption, whether an AI tool is OK for work, or run an audit of this device."}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "phone", "dataset_version": "0.5.0"}, "reply": "Go to Settings › Privacy & Security › Analytics & Improvements [4]"}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "refs", "dataset_version": "0.5.0"}, "reply": "Supported operating system version relates to ISO 27001:2022 A.8.8, GDPR Art. 32(1)(b), Security of processing: confidentiality, integrity, availability and resilience [4]. Meeting the setting is evidence for these controls; it is not a certification on its own."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "tool", "dataset_version": "0.5.0"}, "reply": "Character.AI is a ai companion chatbot from Character Technologies (US); data goes to: provider cloud outside the eea [4]. For general office use its default EU AI Act risk class is limited. GDPR: Consumer entertainment chatbot; not suitable for work use. Users must be told they are talking to an AI (AI Act Art. 50).\n\nWhether it is allowed depends on your organisation's approved AI tools list and on what you use it for: some purposes (for example screening job applicants) make any AI tool high-risk."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.5.0"}, "reply": "I don't have reliable information about that in my knowledge base, so I won't guess. I cover security settings on Windows, macOS, Linux, iPhone and Android, ISO 27001, GDPR and the EU AI Act."}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "why", "dataset_version": "0.5.0"}, "reply": "The shorter the idle time before locking, the smaller the window for misuse. If it is missing, the risk is medium: A long or missing timeout leaves unattended devices open. [2]"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000195, "profile": "typical", "dataset_version": "0.5.0", "check_id": "gdpr.auto_updates", "status": "Compliant"}, "reply": "{\"check_id\": \"gdpr.auto_updates\", \"status\": \"Compliant\", \"title\": \"Automatic security updates matches the required setting\", \"finding\": \"The device reports Windows default (automatic), which meets the requirement (automatic).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000482, "profile": "typical", "dataset_version": "0.5.0", "check_id": "encryption.protection", "status": "Error"}, "reply": "{\"check_id\": \"encryption.protection\", \"status\": \"Error\", \"title\": \"BitLocker protection: could not be checked\", \"finding\": \"No evidence was collected for this check (Requires an elevated (administrator) PowerShell.); its status is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.24\", \"GDPR Art. 32(1)(a)\"], \"verification\": \"Re-run the audit; Disk encryption protection should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7001109, "profile": "typical", "dataset_version": "0.5.0", "check_id": "malware.antivirus", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"malware.antivirus\", \"status\": \"Non-Compliant\", \"title\": \"Google Play Protect is non-compliant\", \"finding\": \"The user reports Play Protect scanning off, but the baseline requires on. Anti-malware software detects and blocks known malicious files and behaviour.\", \"risk\": {\"level\": \"High\", \"reason\": \"Without working anti-malware, ransomware and info-stealers can run unchallenged.\"}, \"recommendation\": [\"Play Store › profile picture › Play Protect › Settings: turn on 'Scan apps with Play Protect'.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Antivirus should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001023, "profile": "neglected", "dataset_version": "0.5.0", "check_id": "aiact.log_retention", "status": "NotApplicable"}, "reply": "{\"check_id\": \"aiact.log_retention\", \"status\": \"NotApplicable\", \"title\": \"AI usage log retention: not assessed on this device\", \"finding\": \"This check does not apply: no AI tools found.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.8.15\", \"EU AI Act Art. 26(6)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7001281, "profile": "neglected", "dataset_version": "0.5.0", "check_id": "org.breach_procedure", "status": "Pending"}, "reply": "{\"check_id\": \"org.breach_procedure\", \"status\": \"Pending\", \"title\": \"Breach response procedure: decision pending\", \"finding\": \"Answered once by the organisation (organisational.conf); not part of the phone self-check. Current state: not answered.\", \"risk\": {\"level\": \"High\", \"reason\": \"Until resolved: Without a tested procedure, the 72-hour deadline is easily missed.\"}, \"recommendation\": [\"Write a breach procedure (detection, assessment, 72-hour notification to the CNPD or your authority, informing people, breach log) and test it with an exercise.\"], \"references\": [\"ISO 27001:2022 A.5.24\", \"ISO 27001:2022 A.5.26\", \"GDPR Art. 33\", \"GDPR Art. 34\"], \"verification\": \"Answer ORG_BREACH_PROCEDURE=yes once the procedure is written and tested.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "ios", "audit": 7000872, "profile": "typical", "dataset_version": "0.5.0"}, "reply": "{\"device\": \"LEGAL-iPhone-54 - iOS 27.0\", \"score\": {\"compliant\": 13, \"assessed\": 19, \"percent\": 68}, \"counts\": {\"Compliant\": 13, \"Non-Compliant\": 6, \"NotApplicable\": 0, \"Pending\": 10, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"gdpr.auto_updates\", \"name\": \"Automatic iOS updates\", \"risk\": \"High\", \"found\": \"off\"}, {\"check_id\": \"gdpr.backup_configured\", \"name\": \"iCloud Backup\", \"risk\": \"High\", \"found\": \"no backup\"}, {\"check_id\": \"mobile.passcode_strength\", \"name\": \"Passcode strength\", \"risk\": \"Medium\", \"found\": \"4-digit code\"}, {\"check_id\": \"aiact.unapproved\", \"name\": \"Unapproved AI tools (shadow AI)\", \"risk\": \"Medium\", \"found\": \"ChatGPT, Gemini, Microsoft Copilot\"}, {\"check_id\": \"aiact.os_ai_features\", \"name\": \"Apple Intelligence external integrations restricted\", \"risk\": \"Medium\", \"found\": \"ChatGPT extension on\"}], \"summary\": \"LEGAL-iPhone-54 meets 13 of 19 assessed checks (68%). The most serious gaps are Automatic iOS updates and iCloud Backup. 10 items are pending. 16 results are self-reported by the user and were not verified on the device.\", \"next_steps\": [\"Automatic iOS updates: Settings › General › Software Update › Automatic Updates: turn on iOS Updates Download and Install, and Security Responses & System Files.\", \"iCloud Backup: Settings › [your name] › iCloud › iCloud Backup: turn on, or use the employer's approved backup; keep work data only in company-approved apps.\", \"Passcode strength: Settings › Face ID & Passcode › Change Passcode › Passcode Options: choose a 6-digit, custom numeric (7+ digits) or alphanumeric code.\", \"Answer the 1 open organisational questions in organisational.conf.\", \"Classify the AI tools found on this device and record them in the AI register.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "linux", "audit": 7000087, "profile": "typical", "dataset_version": "0.5.0"}, "reply": "{\"tools\": [{\"tool\": \"LM Studio\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No transfer to a provider; check model licences and whether its local server is exposed.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"GPT4All\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Keep the optional data lake sharing switched off.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Alpaca (Ollama client)\", \"kind\": \"Desktop client for local models\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No transfer to a provider; check model licences.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"3 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: LM Studio, GPT4All, Alpaca (Ollama client).\"}"}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "audit", "dataset_version": "0.5.0"}, "reply": "Your audit found 9 gaps. Start with Auto-Lock (found: Auto-Lock Never). The shorter the idle time before locking, the smaller the window for misuse. To fix it [3]:\n1. Settings › Display & Brightness › Auto-Lock: choose 5 minutes or less (not Never).\n\nThen look at: Find My iPhone, iOS security updates, Known vulnerabilities in iOS."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "control", "dataset_version": "0.5.0"}, "reply": "A.5.17 (Authentication information): Passwords and other secrets are allocated, managed and protected under clear rules. [4]\n\nAn auditor looks for:\n- A password rule set (length, reuse, change) enforced by the system\n- Users told how to protect their passwords\n\nOn devices: The device's password policy is the technical enforcement of these rules."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "fix", "dataset_version": "0.5.0"}, "reply": "USB debugging lets a connected computer install apps and read data without the usual checks. To fix it on Android [1]:\n1. Settings › System › Developer options: turn off USB debugging, or turn off Developer options completely.\n\nTo check it worked: Re-run the phone check; USB debugging should be off."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "noaudit", "dataset_version": "0.5.0"}, "reply": "I can't see your device from here, so I can't tell you yet. Run an audit with the free Devseis desktop app: it reads the security settings, changes nothing, and takes about 5 to 15 minutes [3]. Then ask me again and I will answer from your real results."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.5.0"}, "reply": "I don't have reliable information about that in my knowledge base, so I won't guess. I cover security settings on Windows, macOS, Linux, iPhone and Android, ISO 27001, GDPR and the EU AI Act."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "phone", "dataset_version": "0.5.0"}, "reply": "Go to Settings › About phone › Android version › Android security update (or Settings › Security & privacy › Updates) [4]"}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.5.0"}, "reply": "I don't have reliable information about that in my knowledge base, so I won't guess. I cover security settings on Windows, macOS, Linux, iPhone and Android, ISO 27001, GDPR and the EU AI Act."}
+{"task": "chat", "meta": {"task": "chat", "os": "linux", "status": "why", "dataset_version": "0.5.0"}, "reply": "Personal data copied to removable media must be encrypted, or copying must be blocked. If it is missing, the risk is medium: A lost unencrypted USB drive with personal data is a reportable breach. [4]"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000096, "profile": "hardened", "dataset_version": "0.5.0", "check_id": "org.ropa", "status": "Compliant"}, "reply": "{\"check_id\": \"org.ropa\", \"status\": \"Compliant\", \"title\": \"Record of processing activities matches the required setting\", \"finding\": \"Found: yes. This satisfies the baseline requirement of yes.\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.5.34\", \"GDPR Art. 30\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000666, "profile": "typical", "dataset_version": "0.5.0", "check_id": "screen_lock.enabled", "status": "Error"}, "reply": "{\"check_id\": \"screen_lock.enabled\", \"status\": \"Error\", \"title\": \"Screen lock: could not be checked\", \"finding\": \"No evidence was collected for this check (Value could not be read.); its status is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.1\", \"ISO 27001:2022 A.7.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Screen lock should be on.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7000872, "profile": "typical", "dataset_version": "0.5.0", "check_id": "aiact.unapproved", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"aiact.unapproved\", \"status\": \"Non-Compliant\", \"title\": \"Unapproved AI tools (shadow AI): does not meet the baseline\", \"finding\": \"Found: ChatGPT, Gemini, Microsoft Copilot. Required: only: none. AI tools used without approval may send work and personal data to providers without contracts or a transfer basis.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Shadow AI can leak confidential or personal data and creates unassessed AI Act and GDPR obligations.\"}, \"recommendation\": [\"Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it.\", \"Publish an AI acceptable-use policy so staff know which tools are allowed.\"], \"references\": [\"ISO 27001:2022 A.5.9\", \"ISO 27001:2022 A.8.19\", \"GDPR Art. 28\", \"GDPR Art. 44\", \"EU AI Act Art. 26\"], \"verification\": \"Re-run the audit; Unapproved AI tools should read none.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000590, "profile": "hardened", "dataset_version": "0.5.0", "check_id": "screen_lock.timeout", "status": "NotApplicable"}, "reply": "{\"check_id\": \"screen_lock.timeout\", \"status\": \"NotApplicable\", \"title\": \"Screen lock timeout: not assessed on this device\", \"finding\": \"This check does not apply: No graphical desktop settings found.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.8.1\", \"ISO 27001:2022 A.7.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000909, "profile": "typical", "dataset_version": "0.5.0", "check_id": "org.processor_agreements", "status": "Pending"}, "reply": "{\"check_id\": \"org.processor_agreements\", \"status\": \"Pending\", \"title\": \"Data processing agreements is pending\", \"finding\": \"Answer ORG_PROCESSOR_AGREEMENTS in organisational.conf. Current state: not answered.\", \"risk\": {\"level\": \"High\", \"reason\": \"Until resolved: Sharing personal data with a processor without an agreement breaches GDPR.\"}, \"recommendation\": [\"List all processors (including AI services used by staff) and sign a data processing agreement with each; check the transfer basis for non-EEA providers.\"], \"references\": [\"ISO 27001:2022 A.5.20\", \"GDPR Art. 28\"], \"verification\": \"Answer ORG_PROCESSOR_AGREEMENTS=yes once all agreements are in place.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "android", "audit": 7000707, "profile": "typical", "dataset_version": "0.5.0"}, "reply": "{\"device\": \"legal-galaxy-01 - Android 15\", \"score\": {\"compliant\": 15, \"assessed\": 20, \"percent\": 75}, \"counts\": {\"Compliant\": 15, \"Non-Compliant\": 5, \"NotApplicable\": 2, \"Pending\": 8, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"mobile.app_sources\", \"name\": \"Install unknown apps blocked\", \"risk\": \"High\", \"found\": \"unknown apps allowed for at least one app\"}, {\"check_id\": \"screen_lock.timeout\", \"name\": \"Screen timeout\", \"risk\": \"Medium\", \"found\": \"Screen timeout 10 minutes\"}, {\"check_id\": \"mobile.find_my_device\", \"name\": \"Find My Device\", \"risk\": \"Medium\", \"found\": \"off\"}, {\"check_id\": \"vuln.outdated_apps\", \"name\": \"App updates\", \"risk\": \"Medium\", \"found\": \"automatic app updates off\"}, {\"check_id\": \"aiact.os_ai_features\", \"name\": \"AI assistant access restricted\", \"risk\": \"Medium\", \"found\": \"assistant screen access on\"}], \"summary\": \"legal-galaxy-01 meets 15 of 20 assessed checks (75%). The most serious gaps are Install unknown apps blocked, Screen timeout and Find My Device. 8 items are pending. 19 results are self-reported by the user and were not verified on the device.\", \"next_steps\": [\"Install unknown apps blocked: Settings › Apps › Special app access › Install unknown apps: set every app to Not allowed; uninstall apps that did not come from Google Play.\", \"Screen timeout: Settings › Display › Screen timeout: choose 5 minutes or less, and set 'Lock after screen timeout' to Immediately where the phone offers it.\", \"Find My Device: Settings › Google › All services › Find My Device (Find Hub): turn on, and make sure Location is on.\", \"Answer the 8 open organisational questions in organisational.conf.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7001244, "profile": "typical", "dataset_version": "0.5.0"}, "reply": "{\"tools\": [{\"tool\": \"ChatGPT\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Needs a business plan with a data processing agreement and a transfer basis (Art. 28, Art. 44); consumer accounts may use prompts for training unless opted out.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Claude\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Needs a commercial plan with a data processing agreement and a transfer basis (Art. 28, Art. 44).\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"DeepSeek\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No EU adequacy decision for China and no business data processing terms; EU data protection authorities have restricted or investigated it. Do not use with work or personal data.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"3 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: ChatGPT, Claude, DeepSeek.\"}"}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "audit", "dataset_version": "0.5.0"}, "reply": "Your audit found 16 gaps. Start with Account lockout duration (found: 5 minutes). The lockout must last long enough to slow down repeated guessing. To fix it [4]:\n1. Set Group Policy: Account Lockout Policy > Account lockout duration = 15 minutes or more.\n2. For a stand-alone device: net accounts /lockoutduration:15\n\nThen look at: Private inbound, Screen lock timeout, Too long or off for."}
+{"task": "chat", "meta": {"task": "chat", "os": "linux", "status": "fix", "dataset_version": "0.5.0"}, "reply": "Accurate clocks are needed to put events in the right order during an investigation. To fix it on Linux [4]:\n1. timedatectl set-ntp true (or enable chronyd).\n\nTo check it worked: Re-run the audit; Time synchronisation should be Compliant."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.5.0"}, "reply": "I can only help with device security, ISO 27001, GDPR and the EU AI Act, so I can't answer that. Ask me, for example, how to turn on disk encryption, whether an AI tool is OK for work, or run an audit of this device."}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "phone", "dataset_version": "0.5.0"}, "reply": "Go to Settings › App Store › App Updates [1]"}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.5.0"}, "reply": "I don't have reliable information about that in my knowledge base, so I won't guess. I cover security settings on Windows, macOS, Linux, iPhone and Android, ISO 27001, GDPR and the EU AI Act."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "why", "dataset_version": "0.5.0"}, "reply": "A minimum age stops users cycling through passwords immediately to get back to an old one. If it is missing, the risk is low: Without it, the password history rule can be bypassed. [1]"}

training/eval/v0.6-4bit.jsonl

@@ -0,0 +1,60 @@
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7000189, "profile": "hardened", "dataset_version": "0.5.0"}, "reply": "{\"tools\": [{\"tool\": \"ChatGPT\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Needs a business plan with a data processing agreement and a transfer basis (Art. 28, Art. 44); consumer accounts may use prompts for training unless opted out.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Microsoft Copilot\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Use the Microsoft 365 work account version covered by the organisation's Microsoft data processing terms; consumer Copilot is not covered.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"2 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: ChatGPT, Microsoft Copilot.\"}"}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "audit", "dataset_version": "0.5.0"}, "reply": "Your audit found Google Play Protect: Play Protect scanning off. Anti-malware software detects and blocks known malicious files and behaviour. To fix it [2]:\n1. Play Store › profile picture › Play Protect › Settings: turn on 'Scan apps with Play Protect'.\n\nThen run the audit again to confirm."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "control", "dataset_version": "0.5.0"}, "reply": "Under GDPR Art. 25 [1]:\n- Privacy-protective default settings on devices and software\n\nAn auditor looks for:\n- Privacy-protective default settings on devices and software\n\nOn devices: Telemetry and AI data-collection features should be off unless needed."}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "device", "dataset_version": "0.5.0"}, "reply": "This browser reports Windows 11 on a Windows PC (x86-64), using Chrome 152. That is all a web page can see: it can't read security settings such as encryption, the firewall or the screen lock. To check those, run an audit with the free Devseis desktop app [3]."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "faq", "dataset_version": "0.5.0"}, "reply": "I don't have reliable information about that in my knowledge base, so I won't guess. I cover security settings on Windows, macOS, Linux, iPhone and Android, ISO 27001, GDPR and the EU AI Act."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "fix", "dataset_version": "0.5.0"}, "reply": "Operating systems can send optional usage and diagnostic data, which may contain personal data, to the vendor. To fix it on Android [2]:\n1. Settings › Google › All services › Usage & diagnostics: turn off; also turn off the phone maker's diagnostics sharing.\n\nTo check it worked: Re-run the audit; Diagnostic data minimised should be Compliant."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "noaudit", "dataset_version": "0.5.0"}, "reply": "I can't see your device from here, so I can't tell you yet. Run an audit with the free Devseis desktop app: it reads the security settings, shows you right away if anything is missing, and changes nothing on its next run [3]. Then ask me again and I will answer from your real results."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.5.0"}, "reply": "I can only help with device security, ISO 27001, GDPR and the EU AI Act, so I can't answer that. Ask me, for example, how to turn on disk encryption, whether an AI tool is OK for work, or run an audit of this device."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "phone", "dataset_version": "0.5.0"}, "reply": "Go to Settings › Google › All services › Find My Device (called Find Hub on newer phones) [1]"}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "refs", "dataset_version": "0.5.0"}, "reply": "Antivirus relates to ISO 27001:2022 A.8.7, GDPR Art. 32(1)(b) [1]. Meeting the setting is evidence for these controls; it is not a certification on its own."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "status", "dataset_version": "0.5.0"}, "reply": "I can't see your device from here, so I can't tell you yet. Run an audit with my free trial: https://www.deviseis.com/free-trial [3]. Then ask me again and I will answer from your real results."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "tool", "dataset_version": "0.5.0"}, "reply": "Jan is a local model runner from Open source (runs locally) from [4]. According to the GDPR, it is allowed for general office use (minimum) if the following conditions are met:\n- Only read data from this device if a cloud model is connected.\n\nWhether it is allowed depends on your organisation's approved AI tools list and on what you use it for: some purposes (for example screening job applicants) make any AI tool high-risk."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.5.0"}, "reply": "I don't have reliable information about that in my knowledge base, so I won't guess. I cover security settings on Windows, macOS, Linux, iPhone and Android, ISO 27001, GDPR and the EU AI Act."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "verify", "dataset_version": "0.5.0"}, "reply": "Re-run the audit; Screen lock should be on. [1]"}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "why", "dataset_version": "0.5.0"}, "reply": "The baseline fixes the default outbound policy so that it is consistent across devices. If it is missing, the risk is low: A different outbound policy either breaks applications or deviates from the agreed design. [4]"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001397, "profile": "typical", "dataset_version": "0.5.0", "check_id": "gdpr.backup_configured", "status": "Compliant"}, "reply": "{\"check_id\": \"gdpr.backup_configured\", \"status\": \"Compliant\", \"title\": \"Backup configured matches the required setting\", \"finding\": \"Found: bzserv. This satisfies the baseline requirement of backup configured.\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.13\", \"GDPR Art. 32(1)(c)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000666, "profile": "typical", "dataset_version": "0.5.0", "check_id": "vuln.pending_updates", "status": "Error"}, "reply": "{\"check_id\": \"vuln.pending_updates\", \"status\": \"Error\", \"title\": \"Pending security updates: evidence missing\", \"finding\": \"No evidence was collected for this check (Value could not be read.); its status is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\", \"GDPR Art. 32(1)(d)\"], \"verification\": \"Re-run the audit; pending security updates should be 0 or fewer.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000306, "profile": "typical", "dataset_version": "0.5.0", "check_id": "aiact.unapproved", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"aiact.unapproved\", \"status\": \"Non-Compliant\", \"title\": \"Unapproved AI tools (shadow AI): does not meet the baseline\", \"finding\": \"Unapproved AI tools is Ollama instead of only: none. AI tools used without approval may send work and personal data to providers without contracts or a transfer basis.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Shadow AI can leak confidential or personal data and creates unassessed AI Act and GDPR obligations.\"}, \"recommendation\": [\"Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it.\"], \"references\": [\"ISO 27001:2022 A.5.9\", \"ISO 27001:2022 A.8.19\", \"GDPR Art. 28\", \"GDPR Art. 44\", \"EU AI Act Art. 26\"], \"verification\": \"Re-run the audit; Unapproved AI tools should read none.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7001395, "profile": "neglected", "dataset_version": "0.5.0", "check_id": "malware.on_access", "status": "NotApplicable"}, "reply": "{\"check_id\": \"malware.on_access\", \"status\": \"NotApplicable\", \"title\": \"On-access malware protection: not assessed on this device\", \"finding\": \"This check does not apply: XProtect scans at launch and download; macOS has no built-in on-access scanning.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7000452, "profile": "typical", "dataset_version": "0.5.0", "check_id": "org.processor_agreements", "status": "Pending"}, "reply": "{\"check_id\": \"org.processor_agreements\", \"status\": \"Pending\", \"title\": \"Data processing agreements is pending\", \"finding\": \"Found: not answered. Answered once by the organisation (organisational.conf); not part of the phone self-check.\", \"risk\": {\"level\": \"High\", \"reason\": \"Until resolved: Sharing personal data with a processor without an agreement breaches GDPR.\"}, \"recommendation\": [\"List all processors (including AI services used by staff) and sign a data processing agreement with each; check the transfer basis for non-EEA providers.\"], \"references\": [\"ISO 27001:2022 A.5.20\", \"GDPR Art. 28\"], \"verification\": \"Answer ORG_PROCESSOR_AGREEMENTS=yes once all agreements are in place.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "windows", "audit": 7000904, "profile": "neglected", "dataset_version": "0.5.0"}, "reply": "{\"device\": \"LAPTOP-UOJGQGE - Microsoft Windows 11 Pro 10.0.26100\", \"score\": {\"compliant\": 15, \"assessed\": 53, \"percent\": 28}, \"counts\": {\"Compliant\": 15, \"Non-Compliant\": 38, \"NotApplicable\": 6, \"Pending\": 5, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"firewall.domain.enabled\", \"name\": \"Domain firewall\", \"risk\": \"High\", \"found\": \"off\"}, {\"check_id\": \"firewall.domain.inbound\", \"name\": \"Domain inbound\", \"risk\": \"High\", \"found\": \"allow\"}, {\"check_id\": \"firewall.public.enabled\", \"name\": \"Public firewall\", \"risk\": \"High\", \"found\": \"off\"}, {\"check_id\": \"firewall.public.inbound\", \"name\": \"Public inbound\", \"risk\": \"High\", \"found\": \"allow\"}, {\"check_id\": \"admin.unauthorized\", \"name\": \"Unauthorized employee local administrator accounts\", \"risk\": \"High\", \"found\": \"LAPTOP-UOJGQGE\\\\ewagner\"}], \"summary\": \"LAPTOP-UOJGQGE meets 15 of 53 assessed checks (28%). The most serious gaps are Domain firewall, Domain inbound and Public firewall. 5 items are pending.\", \"next_steps\": [\"Domain firewall: Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True, or enforce it with Group Policy/Intune.\", \"Domain inbound: Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultInboundAction Block.\", \"Public firewall: Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True, or enforce it with Group Policy/Intune.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "macos", "audit": 7001033, "profile": "hardened", "dataset_version": "0.5.0"}, "reply": "{\"tools\": [{\"tool\": \"Perplexity\", \"kind\": \"Cloud AI search assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Needs an enterprise agreement and a transfer basis before work or personal data is entered.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Jan\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Check whether remote API providers are configured; if so, the cloud provider rules apply.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Claude\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Requires a commercial plan with a data processing agreement and a transfer basis (Art. 28, Art. 44).\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"3 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: Perplexity, Jan, Claude.\"}"}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "audit", "dataset_version": "0.5.0"}, "reply": "Your audit found 5 gaps. Start with Screen lock password requirement (found: password after 900 seconds). Unlocking the screen must require the user's password, so fix it now [4].\n\nThen look at: Known vulnerabilities in installed software, Unapproved AI tools (shadow AI), Data processing agreements."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "control", "dataset_version": "0.5.0"}, "reply": "A.5.34 (Privacy and protection of PII): Meet the legal and contractual requirements for protecting personal data. [3]\n\nAn auditor looks for:\n- Links between the ISMS and GDPR compliance\n- Minimised collection and sharing of personal data\n\nOn devices: Diagnostic data sharing and OS AI features can send personal data off the device."}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "fix", "dataset_version": "0.5.0"}, "reply": "An idle device should lock itself so nobody can use it while the owner is away. To fix it on Windows [1]:\n1. Set Group Policy: Local Policies > Security Options > Interactive logon: Machine inactivity limit = 300 seconds, or enforce a password-protected screen saver.\n\nTo check it worked: Re-run the audit; Screen lock should be on."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "noaudit", "dataset_version": "0.5.0"}, "reply": "I can't see your device from here, so I can't tell you yet. Run an audit with the free Devseis desktop app: it reads the settings, changes nothing, and takes about 5 to 15 minutes [3]. Then ask me again and I will answer from your real results."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.5.0"}, "reply": "I can only help with device security, ISO 27001, GDPR and the EU AI Act, so I can't answer that. Ask me, for example, how to turn on disk encryption, whether an AI tool is OK for work, or run an audit of this device."}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "phone", "dataset_version": "0.5.0"}, "reply": "Go to Settings › Privacy & Security › Analytics & Improvements [4]"}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "refs", "dataset_version": "0.5.0"}, "reply": "Supported operating system version relates to ISO 27001:2022 A.8.8, GDPR Art. 32(1)(b) [1]. Meeting the setting is evidence for these controls; it is not a certification on its own."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "tool", "dataset_version": "0.5.0"}, "reply": "Character.AI is a ai companion chatbot from Character Technologies (US); data goes to: provider cloud outside the eea [4]. For general office use its default EU AI Act risk class is limited. GDPR: Consumer entertainment chatbot; not suitable for work use. Users must be told they are talking to an AI (AI Act art. 50).\n\nWhether it is allowed depends on your organisation's approved AI tools list and on what you use it for: some purposes (for example screening job applicants) make any AI tool high-risk."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.5.0"}, "reply": "I don't have reliable information about that in my knowledge base, so I won't guess. I cover security settings on Windows, macOS, Linux, iPhone and Android, ISO 27001, GDPR and the EU AI Act."}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "why", "dataset_version": "0.5.0"}, "reply": "The shorter the idle time before locking, the smaller the window for misuse. If it is missing, the risk is medium: A long or missing timeout leaves unattended devices open. [2]"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000195, "profile": "typical", "dataset_version": "0.5.0", "check_id": "gdpr.auto_updates", "status": "Compliant"}, "reply": "{\"check_id\": \"gdpr.auto_updates\", \"status\": \"Compliant\", \"title\": \"Automatic security updates matches the required setting\", \"finding\": \"The device reports Windows default (automatic), which meets the requirement (automatic).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.8.8\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000482, "profile": "typical", "dataset_version": "0.5.0", "check_id": "encryption.protection", "status": "Error"}, "reply": "{\"check_id\": \"encryption.protection\", \"status\": \"Error\", \"title\": \"BitLocker protection: evidence missing\", \"finding\": \"No evidence was collected for this check (Requires an elevated (administrator) PowerShell.); its status is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.24\", \"GDPR Art. 32(1)(a)\"], \"verification\": \"Re-run the audit; Disk encryption protection should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "android", "audit": 7001109, "profile": "typical", "dataset_version": "0.5.0", "check_id": "malware.antivirus", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"malware.antivirus\", \"status\": \"Non-Compliant\", \"title\": \"Google Play Protect is non-compliant\", \"finding\": \"The user reports Play Protect scanning off, but the baseline requires on. Anti-malware software detects and blocks known malicious files and behaviour.\", \"risk\": {\"level\": \"High\", \"reason\": \"Without working anti-malware, ransomware and info-stealers can run unchallenged.\"}, \"recommendation\": [\"Play Store › profile picture › Play Protect › Settings: turn on 'Scan apps with Play Protect'.\"], \"references\": [\"ISO 27001:2022 A.8.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Antivirus should be Compliant.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7001023, "profile": "neglected", "dataset_version": "0.5.0", "check_id": "aiact.log_retention", "status": "NotApplicable"}, "reply": "{\"check_id\": \"aiact.log_retention\", \"status\": \"NotApplicable\", \"title\": \"AI usage log retention: not assessed on this device\", \"finding\": \"This check does not apply: no AI tools found.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.8.15\", \"EU AI Act Art. 26(6)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7001281, "profile": "neglected", "dataset_version": "0.5.0", "check_id": "org.breach_procedure", "status": "Pending"}, "reply": "{\"check_id\": \"org.breach_procedure\", \"status\": \"Pending\", \"title\": \"Breach response procedure: decision pending\", \"finding\": \"Current state: not answered. Answered once by the organisation (organisational.conf); not part of the phone self-check.\", \"risk\": {\"level\": \"High\", \"reason\": \"Until resolved: Without a tested procedure, the 72-hour deadline is easily missed.\"}, \"recommendation\": [\"Write a breach procedure (detection, assessment, 72-hour notification to the CNPD or your authority, informing people, breach log) and test it with an exercise.\"], \"references\": [\"ISO 27001:2022 A.5.24\", \"ISO 27001:2022 A.5.26\", \"GDPR Art. 33\", \"GDPR Art. 34\"], \"verification\": \"Answer ORG_BREACH_PROCEDURE=yes once the procedure is written and tested.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "ios", "audit": 7000872, "profile": "typical", "dataset_version": "0.5.0"}, "reply": "{\"device\": \"LEGAL-iPhone-54 - iOS 27.0\", \"score\": {\"compliant\": 13, \"assessed\": 19, \"percent\": 68}, \"counts\": {\"Compliant\": 13, \"Non-Compliant\": 6, \"NotApplicable\": 0, \"Pending\": 10, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"gdpr.auto_updates\", \"name\": \"Automatic iOS updates\", \"risk\": \"High\", \"found\": \"off\"}, {\"check_id\": \"gdpr.backup_configured\", \"name\": \"iCloud Backup\", \"risk\": \"High\", \"found\": \"no backup\"}, {\"check_id\": \"mobile.passcode_strength\", \"name\": \"Passcode strength\", \"risk\": \"Medium\", \"found\": \"4-digit code\"}, {\"check_id\": \"aiact.unapproved\", \"name\": \"Unapproved AI tools (shadow AI)\", \"risk\": \"Medium\", \"found\": \"ChatGPT, Gemini, Microsoft Copilot\"}, {\"check_id\": \"aiact.os_ai_features\", \"name\": \"Apple Intelligence external integrations restricted\", \"risk\": \"Medium\", \"found\": \"ChatGPT extension on\"}], \"summary\": \"LEGAL-iPhone-54 meets 13 of 19 assessed checks (68%). The most serious gaps are Automatic iOS updates, iCloud Backup and Passcode strength. 10 items are pending.\", \"next_steps\": [\"Automatic iOS updates: Settings › General › Software Update › Automatic Updates: turn on iOS Updates Download and Install and Security Responses & System Files.\", \"iCloud Backup: Settings › [your name] › iCloud › iCloud Backup: turn on, or use the employer's approved backup; keep work data only in company-approved apps.\", \"Passcode strength: Settings › Face ID & Passcode › Change Passcode › Passcode Options: choose a 6-digit, custom numeric (7+ digits) or alphanumeric code.\", \"Answer the 1 open organisational questions in organisational.conf.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "linux", "audit": 7000087, "profile": "typical", "dataset_version": "0.5.0"}, "reply": "{\"tools\": [{\"tool\": \"LM Studio\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No transfer to a provider; check model licences and whether its local server is exposed.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"GPT4All\", \"kind\": \"Local model runner\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Keep the optional data lake sharing switched off.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Alpaca (Ollama client)\", \"kind\": \"Desktop client for local models\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No transfer to a provider; check model licences.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"3 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: LM Studio, GPT4All, Alpaca (Ollama client).\"}"}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "audit", "dataset_version": "0.5.0"}, "reply": "Your audit found 9 gaps. Start with Auto-Lock (found: Auto-Lock Never). The shorter the idle time before locking, the smaller the window for misuse. To fix it [3]:\n1. Settings › Display & Brightness › Auto-Lock: choose 5 minutes or less (not Never).\n\nThen look at: Find My iPhone, iOS security updates, Known vulnerabilities in iOS."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "control", "dataset_version": "0.5.0"}, "reply": "Under ISO 27001 A.5.17 [4]:\n- Passwords and other secrets are allocated, managed and protected under clear rules.\n- A password rule set (length, reuse, change) enforced by the system;\n- Users told how to protect their passwords."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "fix", "dataset_version": "0.5.0"}, "reply": "USB debugging lets a connected computer install apps and read data without the usual checks. To fix it on Android [1]:\n1. Settings › System › Developer options: turn off USB debugging, or turn off Developer options completely.\n\nTo check it worked: Re-run the phone check; USB debugging should be off."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "noaudit", "dataset_version": "0.5.0"}, "reply": "I can't see your device from here, so I can't tell you yet. Run an audit with the free Devseis desktop app: it reads the settings, changes nothing, and takes about 5 to 15 minutes [3]. Then ask me again and I will answer from your real results."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.5.0"}, "reply": "I can only help with device security, ISO 27001, GDPR and the EU AI Act, so I can't answer that. Ask me, for example, how to turn on disk encryption, whether an AI tool is OK for work, or run an audit of this device."}
+{"task": "chat", "meta": {"task": "chat", "os": "android", "status": "phone", "dataset_version": "0.5.0"}, "reply": "Go to Settings › About phone › Android version › Android security update (or Settings › Security & privacy › Updates) [4]"}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.5.0"}, "reply": "I don't have reliable information about that in my knowledge base, so I won't guess. I cover security settings on Windows, macOS, Linux, iPhone and Android, ISO 27001, GDPR and the EU AI Act."}
+{"task": "chat", "meta": {"task": "chat", "os": "linux", "status": "why", "dataset_version": "0.5.0"}, "reply": "Personal data copied to removable media must be encrypted, or copying must be blocked. If it is missing, the risk is medium: A lost unencrypted USB drive with personal data is a reportable breach. [4]"}
+{"task": "finding", "meta": {"task": "finding", "os": "windows", "audit": 7000096, "profile": "hardened", "dataset_version": "0.5.0", "check_id": "org.ropa", "status": "Compliant"}, "reply": "{\"check_id\": \"org.ropa\", \"status\": \"Compliant\", \"title\": \"Record of processing activities matches the required setting\", \"finding\": \"The device reports yes, which meets the requirement (yes).\", \"risk\": {\"level\": \"None\", \"reason\": \"The setting meets the baseline.\"}, \"recommendation\": [\"Keep the current setting and confirm it at the next audit.\"], \"references\": [\"ISO 27001:2022 A.5.34\", \"GDPR Art. 30\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "macos", "audit": 7000666, "profile": "typical", "dataset_version": "0.5.0", "check_id": "screen_lock.enabled", "status": "Error"}, "reply": "{\"check_id\": \"screen_lock.enabled\", \"status\": \"Error\", \"title\": \"Screen lock: evidence missing\", \"finding\": \"No evidence was collected for this check (Value could not be read.); its status is unknown.\", \"risk\": {\"level\": \"Unknown\", \"reason\": \"The setting could not be read.\"}, \"recommendation\": [\"The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence.\"], \"references\": [\"ISO 27001:2022 A.8.1\", \"ISO 27001:2022 A.7.7\", \"GDPR Art. 32(1)(b)\"], \"verification\": \"Re-run the audit; Screen lock should be on.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "ios", "audit": 7000872, "profile": "typical", "dataset_version": "0.5.0", "check_id": "aiact.unapproved", "status": "Non-Compliant"}, "reply": "{\"check_id\": \"aiact.unapproved\", \"status\": \"Non-Compliant\", \"title\": \"Unapproved AI tools (shadow AI): does not meet the baseline\", \"finding\": \"The user reports ChatGPT, Gemini, Microsoft Copilot but the baseline requires only: none.\", \"risk\": {\"level\": \"Medium\", \"reason\": \"Shadow AI can leak confidential or personal data and creates unassessed AI Act and GDPR obligations.\"}, \"recommendation\": [\"Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it.\"], \"references\": [\"ISO 27001:2022 A.5.9\", \"ISO 27001:2022 A.8.19\", \"GDPR Art. 28\", \"GDPR Art. 44\", \"EU AI Act Art. 26\"], \"verification\": \"Re-run the audit; Unapproved AI tools should read none.\"}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000590, "profile": "hardened", "dataset_version": "0.5.0", "check_id": "screen_lock.timeout", "status": "NotApplicable"}, "reply": "{\"check_id\": \"screen_lock.timeout\", \"status\": \"NotApplicable\", \"title\": \"Screen lock timeout: not assessed on this device\", \"finding\": \"This check does not apply: No graphical desktop settings found.\", \"risk\": {\"level\": \"None\", \"reason\": \"Not applicable to this device.\"}, \"recommendation\": [], \"references\": [\"ISO 27001:2022 A.8.1\", \"ISO 27001:2022 A.7.7\", \"GDPR Art. 32(1)(b)\"]}"}
+{"task": "finding", "meta": {"task": "finding", "os": "linux", "audit": 7000909, "profile": "typical", "dataset_version": "0.5.0", "check_id": "org.processor_agreements", "status": "Pending"}, "reply": "{\"check_id\": \"org.processor_agreements\", \"status\": \"Pending\", \"title\": \"Data processing agreements is pending\", \"finding\": \"Current state: not answered. Answer ORG_PROCESSOR_AGREEMENTS in organisational.conf.\", \"risk\": {\"level\": \"High\", \"reason\": \"Until resolved: Sharing personal data with a processor without an agreement breaches GDPR.\"}, \"recommendation\": [\"List all processors (including AI services used by staff) and sign a data processing agreement with each; check the transfer basis for non-EEA providers.\"], \"references\": [\"ISO 27001:2022 A.5.20\", \"GDPR Art. 28\"], \"verification\": \"Answer ORG_PROCESSOR_AGREEMENTS=yes once all agreements are in place.\"}"}
+{"task": "summary", "meta": {"task": "summary", "os": "android", "audit": 7000707, "profile": "typical", "dataset_version": "0.5.0"}, "reply": "{\"device\": \"legal-galaxy-01 - Android 15\", \"score\": {\"compliant\": 15, \"assessed\": 20, \"percent\": 75}, \"counts\": {\"Compliant\": 15, \"Non-Compliant\": 5, \"NotApplicable\": 2, \"Pending\": 8, \"Error\": 0}, \"top_gaps\": [{\"check_id\": \"mobile.app_sources\", \"name\": \"Install unknown apps blocked\", \"risk\": \"High\", \"found\": \"unknown apps allowed for at least one app\"}, {\"check_id\": \"screen_lock.timeout\", \"name\": \"Screen timeout\", \"risk\": \"Medium\", \"found\": \"Screen timeout 10 minutes\"}, {\"check_id\": \"mobile.find_my_device\", \"name\": \"Find My Device\", \"risk\": \"Medium\", \"found\": \"off\"}, {\"check_id\": \"vuln.outdated_apps\", \"name\": \"App updates\", \"risk\": \"Medium\", \"found\": \"automatic app updates off\"}, {\"check_id\": \"aiact.os_ai_features\", \"name\": \"AI assistant access restricted\", \"risk\": \"Medium\", \"found\": \"assistant screen access on\"}], \"summary\": \"legal-galaxy-01 meets 15 of 20 assessed checks (75%). The most serious gaps are Install unknown apps blocked, Screen timeout and Find My Device. 8 items are pending.\", \"next_steps\": [\"Install unknown apps blocked: Settings › Apps › Special app access › Install unknown apps: set every app to Not allowed; uninstall apps that did not come from Google Play.\", \"Screen timeout: Settings › Display › Screen timeout: choose 5 minutes or less, and set 'Lock after screen timeout' to Immediately where the phone offers it.\", \"Find My Device: Settings › Google › All services › Find My Device (Find Hub): turn on, and make sure Location is on.\", \"Answer the 8 open organisational questions in organisational.conf.\"]}"}
+{"task": "ai_classification", "meta": {"task": "ai_classification", "os": "ios", "audit": 7001244, "profile": "typical", "dataset_version": "0.5.0"}, "reply": "{\"tools\": [{\"tool\": \"ChatGPT\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"Needs a business plan with a data processing agreement and a transfer basis (Art. 28, Art. 44); consumer accounts may use prompts for training unless opted out.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"Claude\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No EU adequacy decision for China and no business data processing terms; EU data protection authorities have restricted or investigated it. Do not use with work or personal data.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}, {\"tool\": \"DeepSeek\", \"kind\": \"Cloud AI assistant\", \"approved\": false, \"default_risk_class\": \"minimal\", \"becomes_high_risk_if\": [\"Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions\", \"Assessing creditworthiness or credit scores of individuals\"], \"prohibited_if\": [\"Emotion recognition of employees or students (except for medical or safety reasons)\"], \"gdpr\": \"No EU adequacy decision for China and no business data processing terms; EU data protection authorities have restricted or investigated it. Do not use with work or personal data.\", \"action\": \"Review: not approved. Approve it after a data protection and AI Act review, or remove it.\"}], \"purpose_needed\": true, \"log_retention\": \"Required (at least six months) only if a tool is used for a high-risk purpose.\", \"summary\": \"3 AI tool(s) found; default risk class minimal for general office use. The class rises to high-risk if a tool is used for an Annex III purpose such as screening job applicants. Not approved: ChatGPT, Claude, DeepSeek.\"}"}
+{"task": "chat", "meta": {"task": "chat", "os": "windows", "status": "audit", "dataset_version": "0.5.0"}, "reply": "Your audit found 16 gaps. Start with Account lockout duration (found: 5 minutes). The lockout must last long enough to slow down repeated guessing. To fix it [4]:\n1. Set Group Policy: Account Lockout Policy > Account lockout duration = 15 minutes or more.\n2. For a stand-alone device: net accounts /lockoutduration:15\n\nThen look at: Private inbound, Screen lock timeout, Too long or off for."}
+{"task": "chat", "meta": {"task": "chat", "os": "linux", "status": "fix", "dataset_version": "0.5.0"}, "reply": "Accurate clocks are needed to put events in the right order during an investigation. To fix it on Linux [4]:\n1. timedatectl set-ntp true (or enable chronyd).\n\nTo check it worked: Re-run the audit; Time synchronisation should be Compliant."}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "oos", "dataset_version": "0.5.0"}, "reply": "I can only help with device security, ISO 27001, GDPR and the EU AI Act, so I can't answer that. Ask me, for example, how to turn on disk encryption, whether an AI tool is OK for work, or run an audit of this device."}
+{"task": "chat", "meta": {"task": "chat", "os": "ios", "status": "phone", "dataset_version": "0.5.0"}, "reply": "Go to Settings › App Store › App Updates [1]"}
+{"task": "chat", "meta": {"task": "chat", "os": "any", "status": "unknown", "dataset_version": "0.5.0"}, "reply": "I don't have reliable information about that in my knowledge base, so I won't guess. I cover security settings on Windows, macOS, Linux, iPhone and Android, ISO 27001, GDPR and the EU AI Act."}
+{"task": "chat", "meta": {"task": "chat", "os": "macos", "status": "why", "dataset_version": "0.5.0"}, "reply": "A minimum age stops users cycling through passwords immediately to get back to an old one. If it is missing, the risk is low: Without it, the password history rule can be bypassed. [1]"}

training/eval/v0.6-on-v0.3test-4bit.log

@@ -0,0 +1,74 @@
+Weights rounded as in the 4-bit browser build (q4f16_1)
+/Users/umer/Documents/6 - mix/endpoint-audit/training/.venv/lib/python3.11/site-packages/transformers/generation/configuration_utils.py:590: UserWarning: `do_sample` is set to `False`. However, `temperature` is set to `0.7` -- this flag is only used in sample-based generation modes. You should set `do_sample=True` or unset `temperature`.
+  warnings.warn(
+/Users/umer/Documents/6 - mix/endpoint-audit/training/.venv/lib/python3.11/site-packages/transformers/generation/configuration_utils.py:595: UserWarning: `do_sample` is set to `False`. However, `top_p` is set to `0.8` -- this flag is only used in sample-based generation modes. You should set `do_sample=True` or unset `top_p`.
+  warnings.warn(
+/Users/umer/Documents/6 - mix/endpoint-audit/training/.venv/lib/python3.11/site-packages/transformers/generation/configuration_utils.py:612: UserWarning: `do_sample` is set to `False`. However, `top_k` is set to `20` -- this flag is only used in sample-based generation modes. You should set `do_sample=True` or unset `top_k`.
+  warnings.warn(
+The attention mask is not set and cannot be inferred from input because pad token is same as eos token. As a consequence, you may observe unexpected behavior. Please pass your input's `attention_mask` to obtain reliable results.
+[1/60] ai_classification      42s
+[2/60] finding                73s
+[3/60] finding               120s
+[4/60] finding               166s
+[5/60] finding               199s
+[6/60] finding               236s
+[7/60] summary               342s
+[8/60] ai_classification     431s
+[9/60] finding               449s
+[10/60] finding               485s
+[11/60] finding               533s
+[12/60] finding               553s
+[13/60] finding               579s
+[14/60] summary               692s
+[15/60] ai_classification     777s
+[16/60] finding               797s
+[17/60] finding               819s
+[18/60] finding               850s
+[19/60] finding               865s
+[20/60] finding               887s
+[21/60] summary               973s
+[22/60] ai_classification    1039s
+[23/60] finding              1061s
+[24/60] finding              1083s
+[25/60] finding              1105s
+[26/60] finding              1128s
+[27/60] finding              1148s
+[28/60] summary              1273s
+[29/60] ai_classification    1301s
+[30/60] finding              1321s
+[31/60] finding              1354s
+[32/60] finding              1392s
+[33/60] finding              1414s
+[34/60] finding              1436s
+[35/60] summary              1521s
+[36/60] ai_classification    1575s
+[37/60] finding              1604s
+[38/60] finding              1640s
+[39/60] finding              1672s
+[40/60] finding              1686s
+[41/60] finding              1703s
+[42/60] summary              1793s
+[43/60] ai_classification    1816s
+[44/60] finding              1830s
+[45/60] finding              1849s
+[46/60] finding              1871s
+[47/60] finding              1886s
+[48/60] finding              1903s
+[49/60] summary              1994s
+[50/60] ai_classification    2075s
+[51/60] finding              2095s
+[52/60] finding              2120s
+[53/60] finding              2146s
+[54/60] finding              2163s
+[55/60] finding              2186s
+[56/60] summary              2297s
+[57/60] ai_classification    2347s
+[58/60] finding              2362s
+[59/60] finding              2381s
+[60/60] finding              2414s
+
+Results for adapter training/models/auditor-lora-v0.6/final on 60 test examples:
+task                 n  valid JSON  grounded  fields match
+ai_classification    9       100%      100%          100%
+finding             43       100%      100%          100%
+summary              8        88%       75%           62%

training/eval/v0.6-on-v0.3test-full.log

@@ -0,0 +1,73 @@
+/Users/umer/Documents/6 - mix/endpoint-audit/training/.venv/lib/python3.11/site-packages/transformers/generation/configuration_utils.py:590: UserWarning: `do_sample` is set to `False`. However, `temperature` is set to `0.7` -- this flag is only used in sample-based generation modes. You should set `do_sample=True` or unset `temperature`.
+  warnings.warn(
+/Users/umer/Documents/6 - mix/endpoint-audit/training/.venv/lib/python3.11/site-packages/transformers/generation/configuration_utils.py:595: UserWarning: `do_sample` is set to `False`. However, `top_p` is set to `0.8` -- this flag is only used in sample-based generation modes. You should set `do_sample=True` or unset `top_p`.
+  warnings.warn(
+/Users/umer/Documents/6 - mix/endpoint-audit/training/.venv/lib/python3.11/site-packages/transformers/generation/configuration_utils.py:612: UserWarning: `do_sample` is set to `False`. However, `top_k` is set to `20` -- this flag is only used in sample-based generation modes. You should set `do_sample=True` or unset `top_k`.
+  warnings.warn(
+The attention mask is not set and cannot be inferred from input because pad token is same as eos token. As a consequence, you may observe unexpected behavior. Please pass your input's `attention_mask` to obtain reliable results.
+[1/60] ai_classification      26s
+[2/60] finding                40s
+[3/60] finding                62s
+[4/60] finding                93s
+[5/60] finding               115s
+[6/60] finding               157s
+[7/60] summary               232s
+[8/60] ai_classification     285s
+[9/60] finding               299s
+[10/60] finding               319s
+[11/60] finding               345s
+[12/60] finding               363s
+[13/60] finding               383s
+[14/60] summary               530s
+[15/60] ai_classification     652s
+[16/60] finding               669s
+[17/60] finding               687s
+[18/60] finding               711s
+[19/60] finding               732s
+[20/60] finding               767s
+[21/60] summary               864s
+[22/60] ai_classification     909s
+[23/60] finding               927s
+[24/60] finding               946s
+[25/60] finding               974s
+[26/60] finding              1001s
+[27/60] finding              1023s
+[28/60] summary              1105s
+[29/60] ai_classification    1135s
+[30/60] finding              1154s
+[31/60] finding              1190s
+[32/60] finding              1215s
+[33/60] finding              1231s
+[34/60] finding              1251s
+[35/60] summary              1377s
+[36/60] ai_classification    1408s
+[37/60] finding              1426s
+[38/60] finding              1446s
+[39/60] finding              1484s
+[40/60] finding              1499s
+[41/60] finding              1521s
+[42/60] summary              1644s
+[43/60] ai_classification    1678s
+[44/60] finding              1698s
+[45/60] finding              1721s
+[46/60] finding              1751s
+[47/60] finding              1776s
+[48/60] finding              1798s
+[49/60] summary              1899s
+[50/60] ai_classification    2008s
+[51/60] finding              2025s
+[52/60] finding              2058s
+[53/60] finding              2088s
+[54/60] finding              2104s
+[55/60] finding              2127s
+[56/60] summary              2222s
+[57/60] ai_classification    2298s
+[58/60] finding              2325s
+[59/60] finding              2356s
+[60/60] finding              2415s
+
+Results for adapter training/models/auditor-lora-v0.6/final on 60 test examples:
+task                 n  valid JSON  grounded  fields match
+ai_classification    9       100%      100%          100%
+finding             43       100%      100%          100%
+summary              8        75%       62%           62%

training/eval/webllm-v0.4-compare.log

@@ -0,0 +1,26 @@
+### v0.4-1.5b-q4f32_1
+loaded {"quant":"q4f32_1","url":"http://127.0.0.1:8765/training/models/mlc-serve/resolve/v0.4-1.5b-q4f32_1/"}
+finding            230s  grounded  | {"check_id": "vuln.outdated_apps", "status": "Non-Compliant", "title": "Gap: App updates", "finding": "The use
+finding              0s  NOT grounded: engine error: Grammar matcher rejected the newly sampled token.  | 
+finding              0s  NOT grounded: engine error: Grammar matcher rejected the newly sampled token.  | 
+summary              0s  NOT grounded: engine error: Grammar matcher rejected the newly sampled token.  | 
+ai_classification    0s  NOT grounded: engine error: Grammar matcher rejected the newly sampled token.  | 
+chat                 8s  grounded  |  location location location location location location location location location location location location l
+chat                 7s  grounded  |  location location location location location location location location location location location location l
+chat                 7s  grounded  |  location location location location location location location location location location location location l
+chat                 7s  grounded  |  location location location location location location location location location location location location l
+chat                 7s  grounded  |  location location location location location location location location location location location location l
+RESULT 6/10 grounded
+### ref-1.5b-q4f16_1
+loaded {"quant":"q4f16_1","url":"http://127.0.0.1:8765/training/models/mlc-serve/resolve/ref-1.5b-q4f16_1/"}
+finding            214s  NOT grounded: wrong check id; unknown reference ISO 27001:2022 - A.8.8 Management of Technical Vulnerabilities  | { "check_id": "App updates [vuln.outdated_apps]", "status": "
+finding              0s  NOT grounded: engine error: Grammar matcher rejected the newly sampled token.  | 
+finding              0s  NOT grounded: engine error: Grammar matcher rejected the newly sampled token.  | 
+summary              0s  NOT grounded: engine error: Grammar matcher rejected the newly sampled token.  | 
+ai_classification    0s  NOT grounded: engine error: Grammar matcher rejected the newly sampled token.  | 
+chat                 8s  grounded  |  warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warm
+chat                 8s  grounded  |  warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warm
+chat                 7s  grounded  |  warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warm
+chat                 7s  grounded  |  warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warm
+chat                 7s  grounded  |  warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warmth warm
+RESULT 5/10 grounded

training/eval/webllm-v0.4-ctx8192.log

@@ -0,0 +1,12 @@
+loaded {"quant":"q4f16_1","url":"http://127.0.0.1:8765/training/models/mlc-serve/resolve/v0.4-1.5b-q4f16_1/"}
+finding            184s  grounded  | {"check_id": "vuln.outdated_apps", "status": "Non-Compliant", "title": "Gap: App updates", "finding": "The use
+finding              0s  NOT grounded: engine error: Grammar matcher rejected the newly sampled token.  | 
+finding              0s  NOT grounded: engine error: Grammar matcher rejected the newly sampled token.  | 
+summary              0s  NOT grounded: engine error: Grammar matcher rejected the newly sampled token.  | 
+ai_classification    0s  NOT grounded: engine error: Grammar matcher rejected the newly sampled token.  | 
+chat                 7s  grounded  | QUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQU
+chat                 8s  grounded  | QUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQU
+chat                 8s  grounded  | QUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQU
+chat                 8s  grounded  | QUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQU
+chat                 7s  grounded  | QUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQUITQU
+RESULT 6/10 grounded

training/eval/webllm-v0.4-q4f16.log

@@ -0,0 +1,12 @@
+loaded {"quant":"q4f16_1","url":"http://127.0.0.1:8765/training/models/mlc-serve/resolve/v0.4-1.5b-q4f16_1/"}
+finding            172s  grounded  | {"check_id": "vuln.outdated_apps", "status": "Non-Compliant", "title": "Gap: App updates", "finding": "The use
+finding            165s  grounded  | {"check_id": "gdpr.backup_configured", "status": "Non-Compliant", "title": "Google backup: does not meet the b
+finding              0s  NOT grounded: engine error: Grammar matcher rejected the newly sampled token.  | 
+summary              0s  NOT grounded: engine error: Grammar matcher rejected the newly sampled token.  | 
+ai_classification    0s  NOT grounded: engine error: Grammar matcher rejected the newly sampled token.  | 
+chat                 8s  grounded  | _gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate
+chat                 7s  grounded  | _gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate
+chat                 9s  grounded  | _gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate
+chat                 9s  grounded  | _gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate
+chat                 9s  grounded  | _gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate_gate
+RESULT 7/10 grounded