{
  "tool_id": "art-145-nis2-ict-supply-chain-diligence-scorer",
  "note": "golden_hash empty until first `node golden-parity.test.mjs --update`.",
  "vectors": [
    {
      "name": "good-vendor-all-controls-pass-low-risk",
      "policy_parameters": {
        "vendor_iso27001_certified": true,
        "vendor_incident_history_12mo": 0,
        "audit_clause_in_contract": true,
        "breach_notification_sla_hours": 24,
        "data_residency_eu_only": true,
        "sub_contractor_count": 2,
        "service_availability_pct": 99.9
      },
      "output_payload": {
        "risk_score": 0,
        "risk_tier": "low",
        "active_risk_flags": [],
        "remediation_checklist": [],
        "enisa_control_coverage_pct": 100,
        "vendor_incident_history_12mo": 0
      },
      "golden_hash": "99146bb4c945037805964a2c6eb56d268ad925ef7dc364b561dd732632b1c549"
    },
    {
      "name": "empty-input-critical-risk",
      "policy_parameters": {},
      "output_payload": {
        "risk_score": 95,
        "risk_tier": "critical",
        "active_risk_flags": [
          "no_iso27001",
          "no_audit_clause",
          "slow_breach_notification",
          "non_eu_data_residency",
          "low_availability_sla"
        ],
        "remediation_checklist": [
          "remediate_no_iso27001",
          "remediate_no_audit_clause",
          "remediate_slow_breach_notification",
          "remediate_non_eu_data_residency",
          "remediate_low_availability_sla"
        ],
        "enisa_control_coverage_pct": 29,
        "vendor_incident_history_12mo": 0
      },
      "golden_hash": "8af78116c8719665c0fad0be63772df396ed7d5ca121bda01ec448cc7a249a97"
    }
  ]
}