テスト・セキュリティのスキル

Maakt regelrecht-scenario's vindbaar en hun norm-ketens leesbaar/geassert. Aan de invoerkant — vertaal een platte lijst leaf-parameters naar benoemde casus-assen + een herbruikbare persona-bibliotheek, met een reverse-lookup casus-matrix. Aan de uitvoerkant — maak de norm-keten zichtbaar via keten-checkpoints (assert elke knoop op het kritieke pad, niet alleen de endpoint) en golden-trace-snapshots + branch-coverage. Gebruik dit bij het schrijven of opschonen van scenario-/feature-files, het terugvinden of ontwerpen van een specifieke casus in een grote variabelenlijst, het reviewen van engine-traces, of het regressie-bestendig maken van cross-law-ketens zodat een ketenfout niet stil achter een correcte endpoint verdwijnt. Dossier-agnostisch; de regelrecht-methode is de vaste taal. Haakt aan op regelrecht-stelselanalyse (engine-tests / meta-check) en regelrecht-audit-products (testcase-scenario's).

日本語の概要は準備中です。原文の説明を表示しています。

Bouwt de audit- en workshop-producten waarmee juridische experts een machine-leesbare (regelrecht-YAML) vertaling van wet- en regelgeving valideren in een live sessie. Gebruik dit bij het voorbereiden van een expert-workshop of validatie-sessie over een dossier, het maken van een scope-/stelselanalyse, per-artikel audit-checklists, facilitator-materiaal, testcase-scenario's, of sessie-verslagen (intern + extern). Dossier-agnostisch; de regelrecht-methode (YAML, formules, untranslatables, source/override, legal_basis, engine-trace) is de vaste taal. Voor analytische desk-review van een corpus zonder live sessie (wetgevings-/stelselfouten, coverage, multi-agent review): zie de zusterskill regelrecht-stelselanalyse.

日本語の概要は準備中です。原文の説明を表示しています。

在实现任何功能或修复 bug 时使用，在编写实现代码之前

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NIST SP 800-37 Revision 2, the Risk Management Framework (RMF) for information systems and organizations. Use for the seven RMF steps (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) and their tasks; the three-tier organization-wide risk model; authorization boundaries; the requirements-to-controls relationship; security categorization (FIPS 199/200 high-water mark) and control selection/tailoring (SP 800-53/53B baselines); assessment, the authorization decision and risk acceptance, continuous monitoring and ongoing authorization; the security/privacy distinction; and supply chain risk management. This is the security-and-privacy-risk-governance edge of systems engineering — it governs how much protection and whether to accept residual risk, complementing the disciplines that decide how protection is built. Does NOT reproduce the SP 800-53 control catalog or its baselines, the FIPS impact tables, or the ISO/IEC/IEEE 15288 process text; it names and routes to them rather than restating them.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the NIST/SEMATECH e-Handbook of Statistical Methods (NIST HB 151) — the practical statistics reference for engineering, metrology, and quality. Use for: exploratory data analysis and the four univariate assumptions (4-plot); measurement process characterization including bias/precision, calibration designs, gauge R&R, and ISO/GUM uncertainty budgets; production process characterization (stability vs. capability); process modeling and regression (LS/WLS/NLS/LOESS); design of experiments (screening, fractional/factorial, response-surface, Taguchi); statistical process control (Shewhart/CUSUM/EWMA charts, capability indices, acceptance sampling); product/process comparisons (hypothesis tests and confidence intervals for 1/2/3+ groups, ANOVA, multiple comparisons); and reliability (lifetime & repair-rate models, accelerated testing, reliability growth). Scope limits: this is applied frequentist statistics for measurement and quality — it does NOT reproduce the per-distribution formula galleries, worked case studies, datasets, plot images, or Dataplot/R code of the original web Handbook (those are described, not copied); it is thin on modern machine learning, Bayesian methods beyond conjugate reliability priors, time-series/forecasting, and Bayesian experimental design.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NIST Cybersecurity Framework (CSF) 2.0. Use for cybersecurity risk management, GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER, Organizational Profiles, CSF Tiers, supply chain risk, enterprise risk management, incident response. Covers the CSF 2.0 document only; does not cover specific SP 800-53 controls, NIST RMF system authorization steps, or sector-specific regulations.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NIST SP 800-160 Vol 1 (Engineering Trustworthy Secure Systems) and Vol 2 (Developing Cyber-Resilient Systems). Use for systems security engineering (SSE): the three SSE framework contexts (problem/solution/trustworthiness), the 30+ design principles for trustworthy secure design, trustworthiness and assurance/assurance cases, security across the ISO/IEC/IEEE 15288 life-cycle process groups, and the Vol 2 cyber-resiliency engineering framework — 4 goals (anticipate/withstand/recover/adapt), objectives, 14 techniques, implementation approaches, and design principles for the APT/adverse-conditions threat model. Bridges systems engineering and the NIST security cluster (CSF/SSDF/RMF). Does not reproduce ISO/IEC/IEEE 15288 process text, nor cover SP 800-53 control catalogs in depth.

日本語の概要は準備中です。原文の説明を表示しています。

Synthesized reference notes from three US Government vehicle-safety sources: NHTSA Cybersecurity Best Practices for the Safety of Modern Vehicles (updated 2022, final), NHTSA Automated Driving Systems 2.0: A Vision for Safety (2017), and a 16-section selection of 49 CFR Part 571 (FMVSS) pinned at eCFR versioner date 2025-01-01. Use for voluntary vehicle cybersecurity practices, the ADS 2.0 twelve priority safety design elements, and FMVSS occupant protection, brakes/stability/lighting, and fuel/EV integrity requirements. Not ISO 26262, not ASPICE, not ISO/SAE 21434, not UNECE R155/R156, not SAE J3016, and not the full Part 571; the FMVSS material is a selection of vehicle-level minimum performance standards, not a process standard.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the NIST Framework for Cyber-Physical Systems (SP 1500-201/202/203, v1.0, 2017). Use for engineering and analyzing cyber-physical systems (CPS) and IoT: the CPS Framework's aspect × facet grid (nine aspects of concern examined through conceptualization, realization, and assurance facets), cross-property trustworthiness risk management (safety/security/privacy/reliability/resilience together), data interoperability (syntactical/semantic/contextual, canonical models, identifiers, provenance), the timing aspect (time-interval classes, time domains, time-aware networking) and secure/resilient time (GNSS jamming/spoofing, PTP/NTP attacks, holdover, the clock-error model and Allan/MTIE metrics), plus the use-case requirements method. Bridges IT and OT under a clock. Scope limits: a 2017 living/draft document, thin on post-2017 standards and on detailed control catalogs; it names but does not reproduce ISO/IEC/IEEE 42010 and 15288 process text or permission-licensed third-party figures.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NIST Secure Software Development Framework (SSDF) v1.1 (SP 800-218). Use for secure software development practices, SDLC security integration, software supply chain security, vulnerability disclosure, SBOM, threat modelling, secure coding, build hardening, EO 14028 compliance. Covers the four SSDF practice groups (PO, PS, PW, RV) only; does not cover NIST CSF, SP 800-53 controls, or cloud-specific security frameworks in depth.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NIST SP 800-61 Rev. 3 (Incident Response Recommendations for Cybersecurity Risk Management). Use for CSF 2.0-aligned incident response life cycles, IR roles, Community Profile priorities for DE/RS/RC and preparation, playbooks, coordination, and continuous improvement. Covers 800-61r3 only; does not replace CSF 2.0 full text, SP 800-61r2 tactical playbooks, or sector-specific breach-notification law.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the OUSD(R&E) guidebook Implementing a MOSA in DoD Programs (Feb 2025). Use for the Modular Open Systems Approach as a DoD acquisition + design discipline: the statutory/regulatory basis (10 U.S.C. 4401–4403, FY2017/FY2021 NDAA, DFARS), the five OUSD(R&E) pillars, the plan→modularize→identify→define→standardize interface lifecycle, technical levers (WBS/MIL-STD-881F taxonomy, standards profiling, API-first software, COTS/cybersecurity), MOSA assessment metrics and tools (PART/OAAT/KOSS/SEAM/MAUT), technology-change and DMSMS management, roadmaps, MOSA across the six AAF pathways, and contracting/IP/data-rights mechanics. SCOPE LIMITS: this is U.S. DoD weapon-system acquisition policy, not a general open-architecture or interface-standards reference — it names standards (FACE, OMS, DISR) without reproducing them, is light on detailed engineering of any specific standard, and does not cover the underlying SE processes (use dau-se-guidebook / nasa-npr-7123) or general systems-engineering theory (use sebok).

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NASA Human Systems Integration (HSI) Practitioner's Guide (NASA/SP-2015-3709). Use for HSI process implementation, lifecycle phase activities, function allocation, ConOps development, HSI Plan writing, HSI metrics (MOE/MOP/TPM/KPP), HITL testing strategy, HSI team organisation, scaling/tailoring for program size, and V&V planning. Does not cover the specific human engineering design standards (NASA-STD-3001 content) or detailed HFE methods beyond what the guide itself provides.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the DoD Manufacturing Readiness Level (MRL) Deskbook (Version 2022, OSD ManTech / Joint Service–Industry MRL Working Group). Use for assessing and managing manufacturing maturity and producibility risk in defense acquisition: the 10-level MRL scale and its non-linear, target-not-grade nature; the five demonstration environments (laboratory → production-relevant → production-representative → pilot line → production line); the nine manufacturing-risk threads and sub-threads; how MRL targets map onto Adaptive Acquisition Framework milestones (MRL 4/6/7/8/9); conducting an MRL Assessment; building a Manufacturing Maturation Plan; putting MRL maturity into contract language (Section L/M, SOW, AS6500A, DIDs); tailoring criteria for S&T, single-system, ship, sustainment, and industry contexts; and screening operational-technology cybersecurity. Manufacturing-readiness focused — it measures producibility risk and frames mitigation; it is NOT a technology-readiness (TRL) guide, a full systems-engineering process model, a cost-estimating or schedule guide, or a deep cybersecurity audit method (see sibling packs for those).

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from CISA Cross-Sector Cybersecurity Performance Goals 2.0. Use for prioritized IT/OT baseline cyber goals aligned to NIST CSF 2.0 (including GOVERN), critical-infrastructure hygiene, MSP/supply-chain expectations, and board-friendly outcome language. Covers CPG 2.0 goals only; does not replace full CSF programs, sector-specific goals (SSGs), or CSET tooling detail.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the Expanded Guidance for NASA Systems Engineering (NASA/SP-2016-6105-SUPPL, Volume 1, March 2016) — the practitioner-depth supplement to the NASA SE Handbook. Use for the load-bearing mechanics the handbook compresses: the SE Engine's per-phase cadence and the iterative-vs-recursive distinction, the AS9100 crosswalk, life-cycle tailoring vs. customization and the Compliance Matrix, the recursive system-design consistency loop (ConOps vs. Operations Concept, requirement flow/type/ownership, successive refinement), product realization (verify/qualify/accept/certify cardinality, protoflight, 'test the way we fly' coverage, two-form transition), and the crosscutting technical-management procedures (six-step scheduling, cost-estimating method selection, JCL, interface document family, RIDM/CRM, CM baselines, EVM arithmetic, MOE/MOP/KPP/TPM, the three required leading indicators, and the decision-analysis method catalog). This is the DEPTH layer — it deliberately does NOT restate the base definitions; pair it with the nasa-se-handbook pack. Scope: NASA space-flight SE practice (Vol 1 Practices); thin on the Vol 2 process-appendix detail, on non-NASA/commercial life cycles, and on software-engineering methodology.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from MIL-HDBK-61B, the DoD Configuration Management (CM) guidance handbook (7 April 2020, cataloged with Change 1, 2025). Use for defense CM across the acquisition and sustainment life cycle: the five CM functions (planning, identification, control/change management, status accounting, verification & audit), the three configuration baselines (FBL/ABL/PBL) and FCD→ACD→PCD documentation, configuration items (CIs/HWCI/CSCI), change instruments (ECP/NOR/RFV), the CCB and Class I/II classification, CDCA/AA authority, FCA/PCA audits, data management and data rights (CDRL/DID, DFARS rights ladder, master/authoritative source), and tailoring CM by phase (EIA-649-1 R/T/NR matrix, Appendix C templates), plus digital-era CM (digital twin, viewpoints, MOSA). NOTE: 61B is advisory guidance that adopts and points to the SAE EIA-649 / EIA-649-1 / GEIA-HB-649 suite for the authoritative CM requirements — this pack names and describes that suite but does not reproduce its copyrighted requirement text. Thin on: the EIA-649 requirement clauses themselves, form-level detail (DD-form field instructions, full DID content), and non-DoD/commercial CM frameworks.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the DoD Test & Evaluation Enterprise Guidebook (August 2022 edition 8.02) with DOT&E-facing enterprise emphasis. Use for T&E enterprise roles (DOT&E vs USD(R&E)), DT&E/OT&E/LFT&E, cybersecurity T&E, MOSA/automation/digital enablers, suitability/reliability growth, and TEMP/Strategy/STE planning. Distinct routing from dod-te-guidebook (same guidebook family, pathway-deep pack). Guidance only—defer to DoDI 5000.89 and Title 10 for binding requirements.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the FAA Human Factors Design Standard (HF-STD-001B, 2016) — the FAA's consolidated human-factors / human-systems-integration design criteria for systems it manages, operates, or maintains. Use for requirement-level design rules on: general human-factors design principles; automation and function allocation; designing equipment for maintenance; displays, controls, and visual indicators; alarms, audio, and voice communications; the computer-human interface (information presentation, coding, interaction styles, windows, dialogue); keyboards, input devices, and workstation/workplace ergonomics; system security, personnel safety, environment, anthropometry, and user documentation; plus intended-use and tailoring guidance. It is a quantified, source-attributed synthesis (heavily citing MIL-STD-1472G, MIL-HDBK-759C, DOD-HFDG-ATCCS, NUREG-0700, NASA-STD-3000, ANSI, OSHA, ISO 9241). Complements nasa-hsi as a parallel HSI tradition from the civil-aviation domain. Scope limits: it is design criteria, NOT an HSI lifecycle/process model (use nasa-hsi, nasa-npr-7123, or dau-se-guidebook for process); it does NOT reproduce the third-party standards it cites; it is FAA-acquisition-oriented (ATC, towers, TRACONs, airway facilities), not a general consumer-UX guide; and it is thin on modern touchscreen/mobile, web, and AI-driven interface patterns and on quantitative human-reliability analysis.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the DoD Digital Engineering Strategy (2018, OUSD/ODASD(SE)). Use for the Department of Defense's five digital engineering goals — (1) formalize the development, integration, and use of models; (2) provide an enduring authoritative source of truth; (3) incorporate technological innovation; (4) establish supporting infrastructure and environments; (5) transform the culture and workforce — plus their focus areas, the document-to-model and design-build-test→model-analyze-build shifts, model formalisms/provenance, governance and access control of the authoritative source of truth, and the coordinate→plan→pilot→sustain rollout. A vision-and-policy strategy, deliberately non-prescriptive. Does NOT provide a how-to method, tool tutorials, MBSE/SysML mechanics, or implementation-plan content; thin on metrics, acquisition-policy detail, and step-by-step procedure. Excludes the CAC-gated Digital Engineering Body of Knowledge (DEBoK).

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the NASA Schedule Management Handbook (2024 edition, Revision 2). Use for program/project schedule management of aerospace and large engineering efforts: the five sub-functions (Planning, Development, Assessment & Analysis, Maintenance & Control, Documentation & Communication); the Integrated Master Schedule (IMS) and the WBS/OBS/CBS breakdown structures; the Schedule Management Plan (SMP) and Basis of Estimate (BoE); Critical Path Method, logic, durations, float and margin; tiered schedule assessment (Requirements/Health/Basis checks, the Shock Test) and the Dimensions of Schedule Reliability; Schedule Risk Analysis (SRA), Integrated Cost-Schedule Risk Analysis (ICSRA), Monte Carlo, correlation, merge bias, and the Joint Confidence Level (JCL); baselining, replan vs. rebaseline, EVM schedule metrics (SPI, BEI, CEI, HMI, Earned Schedule, CPLI), and status/progress/forecast reporting. This is NASA's scheduling doctrine grounded in NPR 7120.5 and the GAO Schedule Assessment Guide. Thin on the underlying mechanics of CPM, statistics, and EVM (it points to companion handbooks); aerospace/space-flight-centric; anchored to the 2024 second edition.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the FAA AMS Lifecycle V&V Guidelines (verification and validation), Version 3.0, dated April 2017. Use for applying verification and validation across the FAA Acquisition Management System (AMS) lifecycle: the verify-vs-validate distinction (built right vs. right thing), the work-product/component/product tiers, the nine V&V planning elements, the four method catalogs (Appendix C), decision-point-gated V&V (SASP, CRD, Investment Analysis, Solution Implementation, In-Service Management), the Appendix B document checklists (PRD/APB/ISPD/PMP), and the DT/OT/IOA test triad. Scope limits: this is an FAA acquisition-V&V doctrine, NOT a general SE process model, requirements-engineering manual, or test-design textbook. It borrows its core V&V definitions from CMMI v1.2 (SEI, paraphrased) and presumes the surrounding AMS lifecycle (see the FAA SEM pack); its phase tables are policy snapshots as of April 2017 and it is thin on detailed test methods, tool specifics, and anything outside FAA acquisition governance.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the GAO Cost Estimating and Assessment Guide (GAO-20-195G). Use for program cost estimating: the four characteristics of a reliable estimate (comprehensive, well documented, accurate, credible) and the 18 best practices; the 12-step cost estimating process (purpose, plan, technical baseline, WBS, ground rules and assumptions, data, point estimate, sensitivity, risk/uncertainty, document, present, update); estimating methods (analogy, parametric, engineering build-up, learning curves); Monte Carlo risk/uncertainty analysis, confidence levels and contingency; auditing and validating an estimate against the characteristics; earned value management (EIA-748, BCWS/BCWP/ACWP, CPI/SPI/TCPI, EAC, PMB, IBR); and specialized techniques (software cost estimating, learning curves, Analysis of Alternatives, WBS templates, the Green Book internal-control framework). This is the cost-estimating companion to the GAO Schedule and Technology Readiness Assessment guides. Does not cover schedule estimating/risk in depth (see the GAO Schedule Assessment Guide), agency-specific cost models, or the full text of referenced standards (EIA-748, MIL-STD-881D, the Green Book) — these are named, not reproduced.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NASA NPR 7150.2D — NASA Software Engineering Requirements. Use for NASA's Agency-wide software-engineering requirements: the software classification scheme (Classes A–F), the Requirements Mapping Matrix and class-driven applicability, tailoring and Technical Authority governance, the SWE-### 'shall' requirements across software management (Ch 3) and the engineering life cycle (Ch 4), the supporting disciplines (configuration management, risk, peer reviews/inspections, measurement, non-conformance — Ch 5), safety-critical and cybersecurity requirements, IV&V applicability, traceability, and the Appendix A definitions. Does not cover detailed software-assurance/safety procedures (see NASA-STD-8739.8), implementation how-to and document content (see NASA-HDBK-2203), the systems-engineering process framework (see NPR 7123.1), or program/project management (see NPR 7120.5).

日本語の概要は準備中です。原文の説明を表示しています。