CV-2: Capability Taxonomy

A hierarchy of capabilities, specifies all the capabilities that are referenced throughout one or more architectures.

ビューポイント: Capability Viewpoint · https://mithril.fund/ontology/dm2/2.02/views#CV-2

このモデルでの Mithril

CapabilityType exposure management
- Capability continuous external attack-surface and asset inventory
- Capability reachable attack-path identification
- Capability asset context (public routes, dependencies, owner)
- Capability exposure events fed to the VM ledger
CapabilityType dynamic testing
- Capability dynamic probing of running applications
- Capability probing with authenticated scenarios
- Capability runtime vulnerability detection as findings
CapabilityType static analysis
- Capability static source-code analysis
- Capability taint / data-flow inspection
- Capability code findings with file and line
- Capability dependency-manifest inspection, emitting dependency notes
CapabilityType spear phishing detection
- Capability header verification on received mail (SPF / DKIM / DMARC alignment)
- Capability domain-normalisation comparison (punycode / homoglyph / added-character lookalike detection)
- Capability URL rewrite target vs sender mismatch detection
- Capability targeted-mail findings with header, domain and URL evidence
CapabilityType vulnerability management
- Capability finding deduplication (asset × vulnerability key)
- Capability reachability × exploitability scoring
- Capability vulnerability ledger keyed by CPE/CVE
- Capability remediation lifecycle (detected → in progress → verified → closed)
- Capability CVE/CPE feed intake
CapabilityType governance
- Capability CSF 2.0 organizational-profile current → target gaps, summarised per function
- Capability risk-register scoring (5×5), appetite check, missing-owner detection
- Capability supplier criticality tiers and missing contract, assessment and exit requirements
CapabilityType incident response
- Capability categorisation, priority (P1–P4) and escalation
- Capability a playbook with RS subcategories (containment and eradication by category)
- Capability notification deadlines (APPI, GDPR, NIS2, with primary sources)
- Capability recovery-start criteria (RS.MA-05) and hand-off to DR
CapabilityType recovery
- Capability dependency-ordered restore waves (a cycle is refused)
- Capability RPO, restore-test freshness and 3-2-1-1-0 checks
- Capability restore verification and end-of-recovery criteria
- Capability stakeholder and public communication milestones

Mithril に実例がある概念

概念	コード	件数	例
`Activity`	n	558	契約審査ライフサイクルインシデントエスカレーションライフサイクル法人設立・組織変更請求・支払ライフサイクルアクセス権プロビジョニングライフサイクル入退社ライフサイクル契約書ドラフト作成法務・条項審査財務条件審査 CEO 契約承認契約締結契約書保管ほか 546 件（すべては JSON-LD に）
`Capability`	n	31	continuous external attack-surface and asset inventory reachable attack-path identification asset context (public routes, dependencies, owner) exposure events fed to the VM ledger dynamic probing of running applications probing with authenticated scenarios runtime vulnerability detection as findings static source-code analysis taint / data-flow inspection code findings with file and line dependency-manifest inspection, emitting dependency notes header verification on received mail (SPF / DKIM / DMARC alignment) ほか 19 件（すべては JSON-LD に）
`CapabilityType`	n	8	exposure management dynamic testing static analysis spear phishing detection vulnerability management governance incident response recovery
`GeoPoliticalExtent`	df	2	European Economic Area European Union
`Guidance`	df	106	DE.AE-02 — Potentially adverse events are analyzed to better understand associated activities DE.AE-03 — Information is correlated from multiple sources DE.AE-04 — The estimated impact and scope of adverse events are understood DE.AE-06 — Information on adverse events is provided to authorized staff and tools DE.AE-07 — Cyber threat intelligence and other contextual information are integrated into the analysis DE.AE-08 — Incidents are declared when adverse events meet the defined incident criteria DE.CM-01 — Networks and network services are monitored to find potentially adverse events DE.CM-02 — The physical environment is monitored to find potentially adverse events DE.CM-03 — Personnel activity and technology usage are monitored to find potentially adverse events DE.CM-06 — External service provider activities and services are monitored to find potentially adverse events DE.CM-09 — Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events GV.OC-01 — The organizational mission is understood and informs cybersecurity risk management ほか 94 件（すべては JSON-LD に）
`Information`	dfo	19	EUR-Lex — EU 官報・連合法源ポータル CourtListener / RECAP — US 連邦裁判例・ドocket コーパス CanLII — カナダ判例・法源コーパス AustLII — オーストラリア法情報研究所 (判例・法源コーパス) Canada Justice Laws Website (カナダ連邦法令ポータル) NZLII — ニュージーランド法情報研究所 (判例・法源コーパス) Singapore Statutes Online — シンガポール法令公式ポータル (AGC Legislation Division 運営) HUDOC — 欧州人権裁判所 (ECtHR) 判例データベース Singapore Law Watch — 判例・法務ポータル (Singapore Academy of Law 運営) US Treasury OFAC SDN List UN Security Council Consolidated List EU Financial Sanctions Database ほか 7 件（すべては JSON-LD に）
`Location`	dfo	1	Cloudflare global edge
`PedigreeInformation`	dfo	8	Pedigree of VC fund catalog — 8 funds each with source-url (8 primary-fetched); 6 companies with sourced rounds Pedigree of Compliance standards catalog — 16 of 16 frameworks with source-url Pedigree of Sanctions watchlist catalog — 9 source lists with issuing authority and URL (6 declared-2026-03, 3 primary-fetched) Pedigree of Legal data catalog — 52 records each with source-url (37 primary-fetched, 15 secondary-reported) Pedigree of Public security knowledge — every claim carries prov:wasDerivedFrom one of 7 archived sources (CISA, MITRE, NIST, OTRF, OTRF, joshhighet/ransomwatch, Kotoba); snapshot baguqeera6fji5y3mgsvalio2cz7ca6kxlhojidwtsuqwx6klgf3wycr2gpca, 2026-09-13T23:53:34.337Z Pedigree of Enterprise digital twin — every instance cites an in-repo source (2026-09-18T00:00:00+09:00) Pedigree of orgbrain reference organization — kotoba-lang/kyber@055c94b00d71, 7 files pinned by sha256 Pedigree of NIST CSF 2.0 catalog — 106 subcategories from NIST CSWP 29 (2024-02-26, https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf)
`PersonRoleType`	o	12	owner admin member billing CEO CFO COO CTO HR Manager Finance Staff IT Admin board
`Rule`	dfo	21	approve-spend sign-contract hire fire compliance it-admin SUPPORT_RATE_LIMIT 10/min per client address (503 by name on miss) POST /v1/invoke verifies Biscuits against pinned root public key; absent key refuses every invocation by name GDPR (EU 2016/679) CCPA / CPRA (Cal. Civ. Code 1798) FedRAMP (NIST SP 800-53 Rev.5 baseline) HIPAA Security Rule (45 CFR 164 Subpart C) ほか 9 件（すべては JSON-LD に）
`Service`	o	10	CTEM DAST SAST SPECT VM GRC IR DR Stripe (live billing, AWAI account) Cloudflare Workers / R2 / DO / custom domains
`ServiceDescription`	o	8	CTEM — /security/services/ DAST — /security/services/ SAST — /security/services/ SPECT — /security/services/ VM — /security/services/ GRC — /security/services/ IR — /security/services/ DR — /security/services/
`Standard`	df	9	ISO/IEC 27001:2022 SOC 2 (Type I / Type II) PCI DSS 4.0 NIST Cybersecurity Framework 2.0 CIS Controls v8.1 ISO/IEC 27701:2019 (privacy extension) CSA Cloud Controls Matrix v4 NIST Cybersecurity Framework 2.0 SCAP — 構成・脆弱性情報を交換する仕様群
`System`	o	396	Mithril (mithril.fund) kotoba-cloud-control-plane kotoba-identity-authority kotoba-research-authority kotoba-cloud-database kotobase-authn R2 kotobase-graph-database-production (PUBLIC_BLOCKS) R2 internal-security-nvd (NVD_BLOCKS, read-only allow-listed keys) Durable Object PqKeyRegistry (SQLite, post-quantum key registry) Durable Object BillingAccount (SQLite) EDR / XDR CMDB / 資産台帳ほか 384 件（すべては JSON-LD に）
`SystemType`	o	45	Vulnerability Assessment / VM Attack Surface Management / EASM Patch Management Penetration Testing / PTaaS Bug Bounty / Crowdsourced Testing EDR / XDR NDR / Network Detection SIEM / Log Analytics SOAR / Orchestration Threat Intelligence SBOM / VEX AppSec (SAST/DAST/SCA) ほか 33 件（すべては JSON-LD に）

関係

概念	コード	件数	例
`WholePartType`	ifo	164	契約審査ライフサイクル → 契約書ドラフト作成契約審査ライフサイクル → 法務・条項審査契約審査ライフサイクル → 財務条件審査契約審査ライフサイクル → CEO 契約承認契約審査ライフサイクル → 契約締結契約審査ライフサイクル → 契約書保管インシデントエスカレーションライフサイクル → インシデント検知・トリアージインシデントエスカレーションライフサイクル → 指揮本部設立・指揮官任命ほか 156 件（すべては JSON-LD に）
`couple`	if	657	CTEM → VM (site:feedsFindingsTo) DAST → VM (site:feedsFindingsTo) SAST → VM (site:feedsFindingsTo) SPECT → VM (site:feedsFindingsTo) IR → DR (site:handsOffTo) CTEM → Threat Intelligence (site:coversCategory) CTEM → CSPM / CNAPP (site:coversCategory) CTEM → Vulnerability Assessment / VM (site:coversCategory) ほか 649 件（すべては JSON-LD に）
`describedBy`	dfo	69	CTEM → CTEM — /security/services/ DAST → DAST — /security/services/ SAST → SAST — /security/services/ SPECT → SPECT — /security/services/ VM → VM — /security/services/ GRC → GRC — /security/services/ IR → IR — /security/services/ DR → DR — /security/services/ ほか 61 件（すべては JSON-LD に）
`personRoleTypePartOfPerformer`	o	12	Mithril organization account → owner Mithril organization account → admin Mithril organization account → member Mithril organization account → billing orgbrain reference organization → CEO orgbrain reference organization → CFO orgbrain reference organization → COO orgbrain reference organization → CTO ほか 4 件（すべては JSON-LD に）
`ruleConstrainsActivity`	o	37	契約書ドラフト作成 → sign-contract 法務・条項審査 → sign-contract 財務条件審査 → sign-contract CEO 契約承認 → sign-contract 契約締結 → sign-contract 契約書保管 → sign-contract 指揮本部設立・指揮官任命 → compliance 封じ込め措置 → it-admin ほか 29 件（すべては JSON-LD に）
`servicePortDescribedBy`	o	3	POST /v1/security/govern → GRC — /security/services/ POST /v1/security/respond → IR — /security/services/ POST /v1/security/recover → DR — /security/services/
`typeInstance`	ifo	891	exposure management → continuous external attack-surface and asset inventory exposure management → reachable attack-path identification exposure management → asset context (public routes, dependencies, owner) exposure management → exposure events fed to the VM ledger dynamic testing → dynamic probing of running applications dynamic testing → probing with authenticated scenarios dynamic testing → runtime vulnerability detection as findings static analysis → static source-code analysis ほか 883 件（すべては JSON-LD に）

Mithril に実例がない概念 (129)

ActivityType o
AdaptabilityMeasure o
AdaptabilityMeasureType o
BeforeAfterType dfo
Condition n
ConditionType o
CoupleType if
DescriptionScheme dfo
DomainInformation o
DomainInformationType o
EndBoundaryType dfo
FunctionalStandard o
FunctionalStandardType o
GeoPoliticalExtentType df
GeoPoliticalExtentTypeType df
GuidanceType df
Individual if
IndividualPerformer dfo
IndividualPersonRole o
IndividualResource df
IndividualType if
IndividualTypeType if
InformationType dfo
LocationType dfo
LocationTypeType dfo
MaintainabilityMeasure o
MaintainabilityMeasureType o
Measure dfo
MeasureOfDesire n
MeasureOfDesireType o
MeasureOfEffect n
MeasureOfEffectType o
MeasureType dfo
MeasureTypeUnitsOfMeasure dfo
MeasureableSkill o
MeasureableSkillType o
Name np
NameType df
NamingScheme np
NeedsSatisfactionMeasure o
NeedsSatisfactionMeasureType o
OrganizationalMeasure o
OrganizationalMeasureType o
OverlapType dfo
PedigreeInformationType dfo
PerformanceMeasure o
PerformanceMeasureType o
Performer dfo
PerformerType dfo
PersonRoleTypeType o
PhysicalMeasure o
PhysicalMeasureType o
Powertype if
Property df
PropertyType df
RealProperty df
RealPropertyType df
RealPropertyTypeType df
Representation dfo
RepresentationScheme dfo
RepresentationType df
Resource dfo
ResourceType dfo
RuleType dfo
SecurityAttributesGroup s
SecurityAttributesGroupType s
ServiceDescriptionType o
ServiceLevel dfo
ServiceLevelType dfo
ServiceType o
Sign df
SignType df
SignTypeType df
SingletonActivity o
SingletonIndividualType df
SingletonResource dfo
Skill o
SkillType o
StandardType df
StartBoundaryType dfo
TechnicalStandard o
TechnicalStandardType o
TemporalBoundaryType dfo
TemporalMeasure o
TemporalMeasureType o
TemporalWholePartType dfo
Thing ifo
TupleType if
Type if
activityMapsToCapabilityType n
activityPartOfCapability n
activityPerformableUnderCondition n
beforeAfter dfo
descriptionSchemeInstance dfo
desireMeasure o
desiredEffect n
desiredEffectDirectsActivity o
desiredEffectOfCapability n
effectMeasure n
endBoundary dfo
individualPersonRolePartOfIndividualPerformer o
measureOfIndividual df
measureOfIndividualEndBoundary dfo
measureOfIndividualStartBoundary dfo
measureOfType df
measureOfTypeActivity o
measureOfTypeCondition n
measureOfTypeEndBoundaryType dfo
measureOfTypeStartBoundaryType dfo
measureOfTypeWholePartType n
measureTypeApplicableToActivity n
measureableSkillOfPersonRoleType o
namedBy dfo
namingSchemeInstance dfo
overlap dfo
powertypeInstance if
propertyOfIndividual df
propertyOfType df
representationSchemeInstance dfo
representedBy dfo
rulePartOfMeasureType o
serviceEnablesAccessToResource o
skillOfPersonRoleType o
startBoundary dfo
superSubType ifo
temporalBoundary dfo
temporalWholePart dfo
tuple if
wholePart ifo

モデルの概念コード（o・n・np・s・df・dfo・if・ifo）は DoD のワークブックに凡例が公開されていないため、そのまま表示し、意味づけはしていません。