[aafeher]

What & why

Community framework library for the Hungarian NIS2 protective-measures catalogue: 7/2024. (VI. 24.) MK rendelet annex 2 (19 families, 914 measures, security classes Alap / Jelentős / Magas) and annex 3 (47 threats), extended with the audit annexes of 1/2025. (I. 31.) SZTFH rendelet: the annex 6 audit metadata in the annotations and the 2,148 "elemi követelmény" (elementary requirements) of annex 7 as an opt-in third level.

Implementation groups combine the security class with the annex 6 nature of each measure (organisational level / per system): A-SZ, A-EIR, J-SZ, J-EIR, M-SZ, M-EIR, O (measures required in no class) and AE-SZ … ME-EIR for the elementary requirements, so organisational and system audits can be created separately, as the decree requires. Structure, counts and the usage patterns are described in tools/excel/hu-7-2024-mk-rendelet/README.md (Hungarian and English).

Files: the Excel source under tools/excel/hu-7-2024-mk-rendelet/, the converted YAML under backend/library/libraries/, the README, and the entry in the community contributions list of the root README. URN prefix urn:aafeher:…, locale hu. Hungarian legal texts are not subject to copyright (Act LXXVI of 1999, Section 1(4)); the published wording is kept and its typos are flagged in the annotations.

Test plan

• tools/check_library_v2.py on the workbook reports no warning; tools/convert_library_v2.py produces the committed YAML.
• Loaded into CISO Assistant 4.1.1 (docker compose): the Excel source passes the in-app conversion (dry run), the YAML loads (3,081 requirement nodes, 13 implementation groups, 47 threats).
• Audits created with each implementation-group selection show the expected requirement trees (for example M-SZ 132, M-EIR 253, M-SZ + M-EIR 385, all four Magas groups 2,533, A-EIR + M-SZ 214, no selection 3,062 assessable nodes); a system audit created with the organisational audit as its baseline receives the results recorded there.

Checklist

• PR title follows Conventional Commits
• One focused change, branched off main
• CLA accepted (first contribution only)

Other — libraries, CI, infra

• Library changes built via the tools/ script

Tests & documentation — definition of done

• No tests or docs needed for this change — why: data-only library contribution (Excel source, generated YAML, README); no application code or product-docs changes.

Summary by CodeRabbit

• Documentation
  • Added the Hungarian NIS2 protective-measures catalogue to the community-contributed frameworks list, covering the 7/2024 MK decree and audit requirements from the 1/2025 SZTFH decree.
  • Added Hungarian and English documentation describing the catalogue’s measures, elementary requirements, threats, security classes, implementation groups, annotations, and verification counts.
  • Clarified how organisational and system-level measures are assessed for audits, how groups can be combined, and that audit results are not combined into a single score.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[coderabbitai]

Important

Review skipped

We couldn't safely recover the incremental review. No full review was started, and the last reviewed checkpoint was preserved. Retry later, or explicitly request a full review by commenting @coderabbitai full review.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 07a0a763-5f4a-47d3-a041-0e367a7a87d6

📥 Commits

Reviewing files that changed from the base of the PR and between bb4fffe and a2f4b64.

⛔ Files ignored due to path filters (1)

• tools/excel/hu-7-2024-mk-rendelet/hu-7-2024-mk-rendelet.xlsx is excluded by !**/*.xlsx

📒 Files selected for processing (3)

• README.md
• backend/library/libraries/hu-7-2024-mk-rendelet.yaml
• tools/excel/hu-7-2024-mk-rendelet/README.md

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Walkthrough

The repository README now lists the Hungarian NIS2 protective-measures catalogue. A bilingual README describes its contents, structure, implementation groups, audit use, and verification counts.

Changes: Hungarian NIS2 catalogue

Layer / File(s)	Summary
Catalogue listing and usage documentation README.md, tools/excel/hu-7-2024-mk-rendelet/README.md	The repository README lists the catalogue and its related decrees. The bilingual README documents the measures, hierarchy, group selection, audit use, annotations, exclusions, and validation counts.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Feature

Suggested reviewers: ab-smith

Merge Risk: ⚪ Minimal · up to a2f4b

The catalogue documentation and checked-in data are consistent on the inspected counts and group-selection guidance. No actionable merge risk remains; the reported application load is not independently verified here.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title follows Conventional Commits and clearly identifies the main change: adding the Hungarian NIS2 framework with SZTFH audit requirements.
Description check		The description is complete and directly aligned with the pull request. It explains the framework scope, implementation details, files changed, test plan, and checklist status. The reported validation…

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[aafeher]

I have read the CLA Document and I hereby sign the CLA.

[aafeher]

I have read the CLA Document and I hereby sign the CLA

[ab-smith]

Hello,
Thank you for your contribution, the review is scheduled this week.
Regards

[ab-smith]

hello @aafeher,
Thanks again for the contribution. After a first review, we could optimize the structure of the framework, as multiple nodes can be marked as not assessable since their children are. Also, we can slightly improve the implementation groups. I've pushed a restructured version.
Regards