サプライチェーン強化に向けたセキュリティ対策評価制度（★3・★4）完全ガイド 高額な専用機器のリースに頼らず、実質的な26要件で取引先からの信頼と安全を守る実践手順

#![forbid(unsafe_code)]

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct TenantSecurityPosture {
    pub exposed_tcp_ports: Vec<u16>,
    pub total_active_users: u32,
    pub mfa_enforced_users: u32,
    pub dormant_accounts_over_90d: u32,
    pub latest_immutable_snapshot_age_hours: u32,
    pub zfs_hold_active: bool,
    pub dmarc_policy_enforced: bool,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum ScsFinding {
    DangerousPortExposed(u16),
    MfaCoverageIncomplete { enforced: u32, total: u32 },
    DormantAccountsRemaining(u32),
    ImmutableBackupStaleOrUnlocked { age_hours: u32, zfs_hold: bool },
    DmarcNotEnforced,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum ScsStar3Verdict {
    Compliant,
    NonCompliant(Vec<ScsFinding>),
}

const FORBIDDEN_WAN_PORTS: [u16; 5] = [21, 23, 445, 1433, 3389]; — FTP, Telnet, SMB, MSSQL, RDP

pub fn evaluate_scs_star3_posture(posture: &TenantSecurityPosture) -> ScsStar3Verdict {
    let mut findings = Vec::new();

    // 1. 境界防御：危険ポート（RDP/SMB等）のWAN直接公開禁止
    for &port in &posture.exposed_tcp_ports {
        if FORBIDDEN_WAN_PORTS.contains(&port) {
            findings.push(ScsFinding::DangerousPortExposed(port));
        }
    }

    // 2. ID・認証：全アクティブユーザーへの多要素認証（MFA）100%強制
    if posture.total_active_users == 0 || posture.mfa_enforced_users < posture.total_active_users {
        findings.push(ScsFinding::MfaCoverageIncomplete {
            enforced: posture.mfa_enforced_users,
            total: posture.total_active_users,
        });
    }

    // 3. アカウント棚卸：90日以上未利用の放置アカウントゼロ
    if posture.dormant_accounts_over_90d > 0 {
        findings.push(ScsFinding::DormantAccountsRemaining(
            posture.dormant_accounts_over_90d,
        ));
    }

    // 4. 復旧性：24時間以内の不変スナップショット＋OpenZFS zfs hold ロック
    if !posture.zfs_hold_active || posture.latest_immutable_snapshot_age_hours > 24 {
        findings.push(ScsFinding::ImmutableBackupStaleOrUnlocked {
            age_hours: posture.latest_immutable_snapshot_age_hours,
            zfs_hold: posture.zfs_hold_active,
        });
    }

    // 5. メールなりすまし対策：DMARC検証
    if !posture.dmarc_policy_enforced {
        findings.push(ScsFinding::DmarcNotEnforced);
    }

    if findings.is_empty() {
        ScsStar3Verdict::Compliant
    } else {
        ScsStar3Verdict::NonCompliant(findings)
    }
}

CREATE TABLE IF NOT EXISTS scs_compliance_evidence_ledger (
    evidence_id        UUID PRIMARY KEY DEFAULT uuidv7(),
    tenant_id          UUID NOT NULL,
    evaluation_date    DATE NOT NULL,
    target_tier        TEXT NOT NULL CHECK (target_tier IN ('STAR3', 'STAR4')),
    passed_controls    INT  NOT NULL CHECK (passed_controls BETWEEN 0 AND 26),
    zfs_merkle_root    TEXT NOT NULL,
    posture_jsonb      JSONB NOT NULL,
    blake3_signature   TEXT NOT NULL,
    recorded_at        TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
    UNIQUE (tenant_id, evaluation_date, target_tier)
);

ALTER TABLE scs_compliance_evidence_ledger ENABLE ROW LEVEL SECURITY;
ALTER TABLE scs_compliance_evidence_ledger FORCE ROW LEVEL SECURITY;

CREATE POLICY scs_ledger_tenant_isolation ON scs_compliance_evidence_ledger
    USING (tenant_id = (SELECT sovereign_auth.current_tenant_id()));

-- PostgreSQL 19 ネイティブJSONストリーミングによる取引先提出用監査レポート出力
COPY (
    SELECT evidence_id, evaluation_date, target_tier, passed_controls,
           zfs_merkle_root, posture_jsonb, blake3_signature, recorded_at
    FROM scs_compliance_evidence_ledger
    WHERE tenant_id = (SELECT sovereign_auth.current_tenant_id())
    ORDER BY evaluation_date DESC
    LIMIT 90
) TO STDOUT WITH (FORMAT JSON);