INSERT INTO Components (name) VALUES ('Identify'), ('Protect'), ('Detect'), ('Respond'), ('Recover');

INSERT INTO Categories (component_id, name) VALUES
(1, 'Asset Management'),
(1, 'Business Environment'),
(1, 'Governance'),
(1, 'Risk Assessment'),
(1, 'Risk Management Strategy'),
(1, 'Supply Chain Risk Management'),
(2, 'Identity Management, Authentication and Access Control'),
(2, 'Awareness and Training'),
(2, 'Data Security'),
(2, 'Information Protection Processes and Procedures'),
(2, 'Maintenance'),
(2, 'Protective Technology'),
(3, 'Anomalies and Events'),
(3, 'Security Continuous Monitoring'),
(3, 'Detection Processes'),
(4, 'Response Planning'),
(4, 'Respond Communications'),
(4, 'Analysis'),
(4, 'Mitigation'),
(4, 'Respond Improvements'),
(5, 'Recovery Planning'),
(5, 'Recover Improvements'),
(5, 'Recover Communications');


INSERT INTO QuestionSets (user_type, user_role, name) VALUES ('CIO', NULL, 'CIO Questions');
INSERT INTO QuestionSets (user_type, user_role, name) VALUES ('ISO', NULL, 'ISO Questions');

INSERT INTO QuestionSets (user_type, user_role, name) VALUES ('TECH', NULL, 'TECHNICAL Questions');

-- Identify subcategories
INSERT INTO Subcategories (component_id, category_id, name) VALUES
(1, (SELECT id FROM Categories WHERE name = 'Asset Management'), 'ID.AM-01'),
(1, (SELECT id FROM Categories WHERE name = 'Asset Management'), 'ID.AM-02'),
(1, (SELECT id FROM Categories WHERE name = 'Asset Management'), 'ID.AM-03'),
(1, (SELECT id FROM Categories WHERE name = 'Asset Management'), 'ID.AM-04'),
(1, (SELECT id FROM Categories WHERE name = 'Asset Management'), 'ID.AM-05'),
(1, (SELECT id FROM Categories WHERE name = 'Asset Management'), 'ID.AM-06'),
(1, (SELECT id FROM Categories WHERE name = 'Business Environment'), 'ID.BE-01'),
(1, (SELECT id FROM Categories WHERE name = 'Business Environment'), 'ID.BE-02'),
(1, (SELECT id FROM Categories WHERE name = 'Business Environment'), 'ID.BE-03'),
(1, (SELECT id FROM Categories WHERE name = 'Business Environment'), 'ID.BE-04'),
(1, (SELECT id FROM Categories WHERE name = 'Business Environment'), 'ID.BE-05'),
(1, (SELECT id FROM Categories WHERE name = 'Governance'), 'ID.GV-01'),
(1, (SELECT id FROM Categories WHERE name = 'Governance'), 'ID.GV-02'),
(1, (SELECT id FROM Categories WHERE name = 'Governance'), 'ID.GV-03'),
(1, (SELECT id FROM Categories WHERE name = 'Governance'), 'ID.GV-04'),
(1, (SELECT id FROM Categories WHERE name = 'Risk Assessment'), 'ID.RA-01'),
(1, (SELECT id FROM Categories WHERE name = 'Risk Assessment'), 'ID.RA-02'),
(1, (SELECT id FROM Categories WHERE name = 'Risk Assessment'), 'ID.RA-03'),
(1, (SELECT id FROM Categories WHERE name = 'Risk Assessment'), 'ID.RA-04'),
(1, (SELECT id FROM Categories WHERE name = 'Risk Assessment'), 'ID.RA-05'),
(1, (SELECT id FROM Categories WHERE name = 'Risk Assessment'), 'ID.RA-06'),
(1, (SELECT id FROM Categories WHERE name = 'Risk Management Strategy'), 'ID.RM-01'),
(1, (SELECT id FROM Categories WHERE name = 'Risk Management Strategy'), 'ID.RM-02'),
(1, (SELECT id FROM Categories WHERE name = 'Risk Management Strategy'), 'ID.RM-03'),
(1, (SELECT id FROM Categories WHERE name = 'Supply Chain Risk Management'), 'ID.SC-01'),
(1, (SELECT id FROM Categories WHERE name = 'Supply Chain Risk Management'), 'ID.SC-02'),
(1, (SELECT id FROM Categories WHERE name = 'Supply Chain Risk Management'), 'ID.SC-03'),
(1, (SELECT id FROM Categories WHERE name = 'Supply Chain Risk Management'), 'ID.SC-04'),
(1, (SELECT id FROM Categories WHERE name = 'Supply Chain Risk Management'), 'ID.SC-05');

-- Protect subcategories
INSERT INTO Subcategories (component_id, category_id, name) VALUES
(2, (SELECT id FROM Categories WHERE name = 'Identity Management, Authentication and Access Control'), 'PR.AC-01'),
(2, (SELECT id FROM Categories WHERE name = 'Identity Management, Authentication and Access Control'), 'PR.AC-02'),
(2, (SELECT id FROM Categories WHERE name = 'Identity Management, Authentication and Access Control'), 'PR.AC-03'),
(2, (SELECT id FROM Categories WHERE name = 'Identity Management, Authentication and Access Control'), 'PR.AC-04'),
(2, (SELECT id FROM Categories WHERE name = 'Identity Management, Authentication and Access Control'), 'PR.AC-05'),
(2, (SELECT id FROM Categories WHERE name = 'Identity Management, Authentication and Access Control'), 'PR.AC-06'),
(2, (SELECT id FROM Categories WHERE name = 'Identity Management, Authentication and Access Control'), 'PR.AC-07'),
(2, (SELECT id FROM Categories WHERE name = 'Awareness and Training'), 'PR.AT-01'),
(2, (SELECT id FROM Categories WHERE name = 'Awareness and Training'), 'PR.AT-02'),
(2, (SELECT id FROM Categories WHERE name = 'Awareness and Training'), 'PR.AT-03'),
(2, (SELECT id FROM Categories WHERE name = 'Awareness and Training'), 'PR.AT-04'),
(2, (SELECT id FROM Categories WHERE name = 'Awareness and Training'), 'PR.AT-05'),
(2, (SELECT id FROM Categories WHERE name = 'Data Security'), 'PR.DS-01'),
(2, (SELECT id FROM Categories WHERE name = 'Data Security'), 'PR.DS-02'),
(2, (SELECT id FROM Categories WHERE name = 'Data Security'), 'PR.DS-03'),
(2, (SELECT id FROM Categories WHERE name = 'Data Security'), 'PR.DS-04'),
(2, (SELECT id FROM Categories WHERE name = 'Data Security'), 'PR.DS-05'),
(2, (SELECT id FROM Categories WHERE name = 'Data Security'), 'PR.DS-06'),
(2, (SELECT id FROM Categories WHERE name = 'Data Security'), 'PR.DS-07'),
(2, (SELECT id FROM Categories WHERE name = 'Data Security'), 'PR.DS-08'),
(2, (SELECT id FROM Categories WHERE name = 'Information Protection Processes and Procedures'), 'PR.IP-01'),
(2, (SELECT id FROM Categories WHERE name = 'Information Protection Processes and Procedures'), 'PR.IP-02'),
(2, (SELECT id FROM Categories WHERE name = 'Information Protection Processes and Procedures'), 'PR.IP-03'),
(2, (SELECT id FROM Categories WHERE name = 'Information Protection Processes and Procedures'), 'PR.IP-04'),
(2, (SELECT id FROM Categories WHERE name = 'Information Protection Processes and Procedures'), 'PR.IP-05'),
(2, (SELECT id FROM Categories WHERE name = 'Information Protection Processes and Procedures'), 'PR.IP-06'),
(2, (SELECT id FROM Categories WHERE name = 'Information Protection Processes and Procedures'), 'PR.IP-07'),
(2, (SELECT id FROM Categories WHERE name = 'Information Protection Processes and Procedures'), 'PR.IP-08'),
(2, (SELECT id FROM Categories WHERE name = 'Information Protection Processes and Procedures'), 'PR.IP-09'),
(2, (SELECT id FROM Categories WHERE name = 'Information Protection Processes and Procedures'), 'PR.IP-10'),
(2, (SELECT id FROM Categories WHERE name = 'Information Protection Processes and Procedures'), 'PR.IP-11'),
(2, (SELECT id FROM Categories WHERE name = 'Information Protection Processes and Procedures'), 'PR.IP-12'),
(2, (SELECT id FROM Categories WHERE name = 'Maintenance'), 'PR.MA-01'),
(2, (SELECT id FROM Categories WHERE name = 'Maintenance'), 'PR.MA-02'),
(2, (SELECT id FROM Categories WHERE name = 'Maintenance'), 'PR.MA-03'),
(2, (SELECT id FROM Categories WHERE name = 'Protective Technology'), 'PR.PT-01'),
(2, (SELECT id FROM Categories WHERE name = 'Protective Technology'), 'PR.PT-02'),
(2, (SELECT id FROM Categories WHERE name = 'Protective Technology'), 'PR.PT-03'),
(2, (SELECT id FROM Categories WHERE name = 'Protective Technology'), 'PR.PT-04'),
(2, (SELECT id FROM Categories WHERE name = 'Protective Technology'), 'PR.PT-05');

-- Detect subcategories
INSERT INTO Subcategories (component_id, category_id, name) VALUES
(3, (SELECT id FROM Categories WHERE name = 'Anomalies and Events'), 'DE.AE-01'),
(3, (SELECT id FROM Categories WHERE name = 'Anomalies and Events'), 'DE.AE-02'),
(3, (SELECT id FROM Categories WHERE name = 'Anomalies and Events'), 'DE.AE-03'),
(3, (SELECT id FROM Categories WHERE name = 'Anomalies and Events'), 'DE.AE-04'),
(3, (SELECT id FROM Categories WHERE name = 'Anomalies and Events'), 'DE.AE-05'),
(3, (SELECT id FROM Categories WHERE name = 'Security Continuous Monitoring'), 'DE.CM-01'),
(3, (SELECT id FROM Categories WHERE name = 'Security Continuous Monitoring'), 'DE.CM-02'),
(3, (SELECT id FROM Categories WHERE name = 'Security Continuous Monitoring'), 'DE.CM-03'),
(3, (SELECT id FROM Categories WHERE name = 'Security Continuous Monitoring'), 'DE.CM-04'),
(3, (SELECT id FROM Categories WHERE name = 'Security Continuous Monitoring'), 'DE.CM-05'),
(3, (SELECT id FROM Categories WHERE name = 'Security Continuous Monitoring'), 'DE.CM-06'),
(3, (SELECT id FROM Categories WHERE name = 'Security Continuous Monitoring'), 'DE.CM-07'),
(3, (SELECT id FROM Categories WHERE name = 'Security Continuous Monitoring'), 'DE.CM-08'),
(3, (SELECT id FROM Categories WHERE name = 'Detection Processes'), 'DE.DP-01'),
(3, (SELECT id FROM Categories WHERE name = 'Detection Processes'), 'DE.DP-02'),
(3, (SELECT id FROM Categories WHERE name = 'Detection Processes'), 'DE.DP-03'),
(3, (SELECT id FROM Categories WHERE name = 'Detection Processes'), 'DE.DP-04'),
(3, (SELECT id FROM Categories WHERE name = 'Detection Processes'), 'DE.DP-05');

-- Respond subcategories
INSERT INTO Subcategories (component_id, category_id, name) VALUES
(4, (SELECT id FROM Categories WHERE name = 'Response Planning'), 'RS.RP-01'),
(4, (SELECT id FROM Categories WHERE name = 'Response Planning'), 'RS.RP-02'),
(4, (SELECT id FROM Categories WHERE name = 'Response Planning'), 'RS.RP-03'),
(4, (SELECT id FROM Categories WHERE name = 'Response Communications'), 'RS.CO-01'),
(4, (SELECT id FROM Categories WHERE name = 'Response Communications'), 'RS.CO-02'),
(4, (SELECT id FROM Categories WHERE name = 'Response Communications'), 'RS.CO-03'),
(4, (SELECT id FROM Categories WHERE name = 'Response Communications'), 'RS.CO-04'),
(4, (SELECT id FROM Categories WHERE name = 'Response Communications'), 'RS.CO-05'),
(4, (SELECT id FROM Categories WHERE name = 'Response Analysis'), 'RS.AN-01'),
(4, (SELECT id FROM Categories WHERE name = 'Response Analysis'), 'RS.AN-02'),
(4, (SELECT id FROM Categories WHERE name = 'Response Analysis'), 'RS.AN-03'),
(4, (SELECT id FROM Categories WHERE name = 'Response Analysis'), 'RS.AN-04'),
(4, (SELECT id FROM Categories WHERE name = 'Response Analysis'), 'RS.AN-05'),
(4, (SELECT id FROM Categories WHERE name = 'Response Mitigation'), 'RS.MI-01'),
(4, (SELECT id FROM Categories WHERE name = 'Response Mitigation'), 'RS.MI-02'),
(4, (SELECT id FROM Categories WHERE name = 'Response Mitigation'), 'RS.MI-03'),
(4, (SELECT id FROM Categories WHERE name = 'Response Improvements'), 'RS.IM-01'),
(4, (SELECT id FROM Categories WHERE name = 'Response Improvements'), 'RS.IM-02'),
(4, (SELECT id FROM Categories WHERE name = 'Response Improvements'), 'RS.IM-03');

-- Recover subcategories
INSERT INTO Subcategories (component_id, category_id, name) VALUES
(5, (SELECT id FROM Categories WHERE name = 'Recovery Planning'), 'RC.RP-01'),
(5, (SELECT id FROM Categories WHERE name = 'Recover Improvements'), 'RC.IM-01'),
(5, (SELECT id FROM Categories WHERE name = 'Recover Improvements'), 'RC.IM-02'),
(5, (SELECT id FROM Categories WHERE name = 'Recover Communications'), 'RC.CO-01'),
(5, (SELECT id FROM Categories WHERE name = 'Recover Communications'), 'RC.CO-02'),
(5, (SELECT id FROM Categories WHERE name = 'Recover Communications'), 'RC.CO-03');


INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(1, 'CIO', 'To what extent has your organization identified and documented assets that support critical functions?', 
 (SELECT id FROM Subcategories WHERE name = 'ID.AM-01'), 
 (SELECT id FROM Categories WHERE name = 'Asset Management'), 
 (SELECT id FROM Components WHERE name = 'Identify'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(1, 'CIO', 'How comprehensively has your organization implemented risk assessment processes that address cybersecurity risks to operations?', 
 (SELECT id FROM Subcategories WHERE name = 'ID.RA-01'), 
 (SELECT id FROM Categories WHERE name = 'Risk Assessment'), 
 (SELECT id FROM Components WHERE name = 'Identify'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(1, 'CIO', 'To what degree has your organization implemented and maintained identity management and access control systems?', 
 (SELECT id FROM Subcategories WHERE name = 'PR.AC-01'), 
 (SELECT id FROM Categories WHERE name = 'Identity Management, Authentication and Access Control'), 
 (SELECT id FROM Components WHERE name = 'Protect'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(1, 'CIO', 'How well-established are your organization''s data security policies and procedures to protect the confidentiality, integrity, and availability of information?', 
 (SELECT id FROM Subcategories WHERE name = 'PR.DS-01'), 
 (SELECT id FROM Categories WHERE name = 'Data Security'), 
 (SELECT id FROM Components WHERE name = 'Protect'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(1, 'CIO', 'To what extent has your organization implemented continuous security monitoring to detect cybersecurity events?', 
 (SELECT id FROM Subcategories WHERE name = 'DE.CM-01'), 
 (SELECT id FROM Categories WHERE name = 'Security Continuous Monitoring'), 
 (SELECT id FROM Components WHERE name = 'Detect'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(1, 'CIO', 'How well-defined and tested are your organization''s incident response processes and procedures?', 
 (SELECT id FROM Subcategories WHERE name = 'RS.RP-01'), 
 (SELECT id FROM Categories WHERE name = 'Response Planning'), 
 (SELECT id FROM Components WHERE name = 'Respond'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(1, 'CIO', 'To what degree has your organization established and tested communication protocols for coordinating response activities with internal and external stakeholders?', 
 (SELECT id FROM Subcategories WHERE name = 'RS.CO-01'), 
 (SELECT id FROM Categories WHERE name = 'Respond Communications'), 
 (SELECT id FROM Components WHERE name = 'Respond'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(1, 'CIO', 'How comprehensive are your organization''s recovery planning processes to restore systems or assets affected by cybersecurity incidents?', 
 (SELECT id FROM Subcategories WHERE name = 'RC.RP-01'), 
 (SELECT id FROM Categories WHERE name = 'Recovery Planning'), 
 (SELECT id FROM Components WHERE name = 'Recover'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(1, 'CIO', 'To what extent does your organization conduct post-incident reviews and incorporate lessons learned into future response strategies?', 
 (SELECT id FROM Subcategories WHERE name = 'RS.IM-01'), 
 (SELECT id FROM Categories WHERE name = 'Respond Improvements'), 
 (SELECT id FROM Components WHERE name = 'Respond'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(1, 'CIO', 'How effectively does your organization manage relationships with and requirements for third-party providers and partners?', 
 (SELECT id FROM Subcategories WHERE name = 'ID.SC-01'), 
 (SELECT id FROM Categories WHERE name = 'Supply Chain Risk Management'), 
 (SELECT id FROM Components WHERE name = 'Identify'));

-- iso
-- Asset Management
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How is the inventory of all IT assets maintained and updated?', 
    (SELECT id FROM Subcategories WHERE name = 'ID.AM-01'), 
    (SELECT id FROM Categories WHERE name = 'Asset Management'), 
    (SELECT id FROM Components WHERE name = 'Identify'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are critical assets identified and documented?', 
    (SELECT id FROM Subcategories WHERE name = 'ID.AM-02'), 
    (SELECT id FROM Categories WHERE name = 'Asset Management'), 
    (SELECT id FROM Components WHERE name = 'Identify'));

-- Business Environment
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How does the organization assess its business environment for cybersecurity risks?', 
    (SELECT id FROM Subcategories WHERE name = 'ID.BE-01'), 
    (SELECT id FROM Categories WHERE name = 'Business Environment'), 
    (SELECT id FROM Components WHERE name = 'Identify'));

-- Governance
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Is there a governance framework for managing cybersecurity risks?', 
    (SELECT id FROM Subcategories WHERE name = 'ID.GV-01'), 
    (SELECT id FROM Categories WHERE name = 'Governance'), 
    (SELECT id FROM Components WHERE name = 'Identify'));

-- Risk Assessment
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How are cybersecurity risks identified and documented?', 
    (SELECT id FROM Subcategories WHERE name = 'ID.RA-01'), 
    (SELECT id FROM Categories WHERE name = 'Risk Assessment'), 
    (SELECT id FROM Components WHERE name = 'Identify'));

-- Risk Management Strategy
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'What strategies are in place to manage identified risks?', 
    (SELECT id FROM Subcategories WHERE name = 'ID.RM-01'), 
    (SELECT id FROM Categories WHERE name = 'Risk Management Strategy'), 
    (SELECT id FROM Components WHERE name = 'Identify'));

-- Supply Chain Risk Management
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How are third-party risks assessed and managed?', 
    (SELECT id FROM Subcategories WHERE name = 'ID.SC-01'), 
    (SELECT id FROM Categories WHERE name = 'Supply Chain Risk Management'), 
    (SELECT id FROM Components WHERE name = 'Identify'));

-- Identity Management, Authentication and Access Control
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How is access to sensitive systems controlled?', 
    (SELECT id FROM Subcategories WHERE name = 'PR.AC-01'), 
    (SELECT id FROM Categories WHERE name = 'Identity Management, Authentication and Access Control'), 
    (SELECT id FROM Components WHERE name = 'Protect'));

-- Awareness and Training
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'What training programs are in place to enhance cybersecurity awareness?', 
    (SELECT id FROM Subcategories WHERE name = 'PR.AT-01'), 
    (SELECT id FROM Categories WHERE name = 'Awareness and Training'), 
    (SELECT id FROM Components WHERE name = 'Protect'));

-- Data Security
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are data protection policies aligned with regulatory requirements?', 
    (SELECT id FROM Subcategories WHERE name = 'PR.DS-04'), 
    (SELECT id FROM Categories WHERE name = 'Data Security'), 
    (SELECT id FROM Components WHERE name = 'Protect'));

-- Information Protection Processes and Procedures
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are information protection processes documented and enforced?', 
    (SELECT id FROM Subcategories WHERE name = 'PR.IP-01'), 
    (SELECT id FROM Categories WHERE name = 'Information Protection Processes and Procedures'), 
    (SELECT id FROM Components WHERE name = 'Protect'));

-- Maintenance
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How are maintenance activities scheduled and documented?', 
    (SELECT id FROM Subcategories WHERE name = 'PR.MA-01'), 
    (SELECT id FROM Categories WHERE name = 'Maintenance'), 
    (SELECT id FROM Components WHERE name = 'Protect'));

-- Protective Technology
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'What technologies are in place to protect against cybersecurity threats?', 
    (SELECT id FROM Subcategories WHERE name = 'PR.PT-01'), 
    (SELECT id FROM Categories WHERE name = 'Protective Technology'), 
    (SELECT id FROM Components WHERE name = 'Protect'));

-- Anomalies and Events
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How are anomalies and events detected and documented?', 
    (SELECT id FROM Subcategories WHERE name = 'DE.AE-01'), 
    (SELECT id FROM Categories WHERE name = 'Anomalies and Events'), 
    (SELECT id FROM Components WHERE name = 'Detect'));

-- Security Continuous Monitoring
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How is continuous monitoring implemented to detect security events?', 
    (SELECT id FROM Subcategories WHERE name = 'DE.CM-01'), 
    (SELECT id FROM Categories WHERE name = 'Security Continuous Monitoring'), 
    (SELECT id FROM Components WHERE name = 'Detect'));

-- Detection Processes
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'What processes are in place for detecting cybersecurity incidents?', 
    (SELECT id FROM Subcategories WHERE name = 'DE.DP-01'), 
    (SELECT id FROM Categories WHERE name = 'Detection Processes'), 
    (SELECT id FROM Components WHERE name = 'Detect'));

-- Response Planning
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How is the incident response plan developed and maintained?', 
    (SELECT id FROM Subcategories WHERE name = 'RS.RP-01'), 
    (SELECT id FROM Categories WHERE name = 'Response Planning'), 
    (SELECT id FROM Components WHERE name = 'Respond'));

-- Respond Communications
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How are communication protocols established for incident response?', 
    (SELECT id FROM Subcategories WHERE name = 'RS.CO-01'), 
    (SELECT id FROM Categories WHERE name = 'Respond Communications'), 
    (SELECT id FROM Components WHERE name = 'Respond'));

-- Analysis
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How are incidents analyzed to determine root causes?', 
    (SELECT id FROM Subcategories WHERE name = 'RS.AN-01'), 
    (SELECT id FROM Categories WHERE name = 'Analysis'), 
    (SELECT id FROM Components WHERE name = 'Respond'));

-- Mitigation
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'What strategies are in place to mitigate the impact of incidents?', 
    (SELECT id FROM Subcategories WHERE name = 'RS.MI-01'), 
    (SELECT id FROM Categories WHERE name = 'Mitigation'), 
    (SELECT id FROM Components WHERE name = 'Respond'));

-- Respond Improvements
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How are lessons learned from incidents integrated into response plans?', 
    (SELECT id FROM Subcategories WHERE name = 'RS.IM-01'), 
    (SELECT id FROM Categories WHERE name = 'Respond Improvements'), 
    (SELECT id FROM Components WHERE name = 'Respond'));

-- Recovery Planning
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How is the recovery plan developed and maintained?', 
    (SELECT id FROM Subcategories WHERE name = 'RC.RP-01'), 
    (SELECT id FROM Categories WHERE name = 'Recovery Planning'), 
    (SELECT id FROM Components WHERE name = 'Recover'));

-- Recover Improvements
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How are recovery processes improved based on past incidents?', 
    (SELECT id FROM Subcategories WHERE name = 'RC.IM-01'), 
    (SELECT id FROM Categories WHERE name = 'Recover Improvements'), 
    (SELECT id FROM Components WHERE name = 'Recover'));

-- Recover Communications
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How are communication protocols established for recovery activities?', 
    (SELECT id FROM Subcategories WHERE name = 'RC.CO-01'), 
    (SELECT id FROM Categories WHERE name = 'Recover Communications'), 
    (SELECT id FROM Components WHERE name = 'Recover'));

-- Business Environment
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are business priorities and objectives aligned with cybersecurity strategies?', 
    (SELECT id FROM Subcategories WHERE name = 'ID.BE-02'), 
    (SELECT id FROM Categories WHERE name = 'Business Environment'), 
    (SELECT id FROM Components WHERE name = 'Identify'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How does the organization monitor changes in the business environment that may impact cybersecurity?', 
    (SELECT id FROM Subcategories WHERE name = 'ID.BE-03'), 
    (SELECT id FROM Categories WHERE name = 'Business Environment'), 
    (SELECT id FROM Components WHERE name = 'Identify'));

-- Governance
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Is there an executive or board-level oversight committee for information security?', 
    (SELECT id FROM Subcategories WHERE name = 'ID.GV-03'), 
    (SELECT id FROM Categories WHERE name = 'Governance'), 
    (SELECT id FROM Components WHERE name = 'Identify'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How is accountability for cybersecurity risks established within the organization?', 
    (SELECT id FROM Subcategories WHERE name = 'ID.GV-04'), 
    (SELECT id FROM Categories WHERE name = 'Governance'), 
    (SELECT id FROM Components WHERE name = 'Identify'));

-- Risk Assessment
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are risk assessments conducted regularly and documented?', 
    (SELECT id FROM Subcategories WHERE name = 'ID.RA-03'), 
    (SELECT id FROM Categories WHERE name = 'Risk Assessment'), 
    (SELECT id FROM Components WHERE name = 'Identify'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How are risk assessment results communicated to stakeholders?', 
    (SELECT id FROM Subcategories WHERE name = 'ID.RA-04'), 
    (SELECT id FROM Categories WHERE name = 'Risk Assessment'), 
    (SELECT id FROM Components WHERE name = 'Identify'));

-- Risk Management Strategy
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are risk management strategies reviewed and updated regularly?', 
    (SELECT id FROM Subcategories WHERE name = 'ID.RM-04'), 
    (SELECT id FROM Categories WHERE name = 'Risk Management Strategy'), 
    (SELECT id FROM Components WHERE name = 'Identify'));

-- Supply Chain Risk Management
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How are supply chain risks communicated to stakeholders?', 
    (SELECT id FROM Subcategories WHERE name = 'ID.SC-04'), 
    (SELECT id FROM Categories WHERE name = 'Supply Chain Risk Management'), 
    (SELECT id FROM Components WHERE name = 'Identify'));

-- Identity Management, Authentication and Access Control
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are access control policies aligned with organizational requirements?', 
    (SELECT id FROM Subcategories WHERE name = 'PR.AC-06'), 
    (SELECT id FROM Categories WHERE name = 'Identity Management, Authentication and Access Control'), 
    (SELECT id FROM Components WHERE name = 'Protect'));

-- Awareness and Training
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are training effectiveness evaluations conducted regularly?', 
    (SELECT id FROM Subcategories WHERE name = 'PR.AT-03'), 
    (SELECT id FROM Categories WHERE name = 'Awareness and Training'), 
    (SELECT id FROM Components WHERE name = 'Protect'));

-- Data Security
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How is data integrity ensured across all systems?', 
    (SELECT id FROM Subcategories WHERE name = 'PR.DS-05'), 
    (SELECT id FROM Categories WHERE name = 'Data Security'), 
    (SELECT id FROM Components WHERE name = 'Protect'));

-- Information Protection Processes and Procedures
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are information protection procedures tested regularly?', 
    (SELECT id FROM Subcategories WHERE name = 'PR.IP-04'), 
    (SELECT id FROM Categories WHERE name = 'Information Protection Processes and Procedures'), 
    (SELECT id FROM Components WHERE name = 'Protect'));

-- Maintenance
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How are maintenance records maintained and reviewed?', 
    (SELECT id FROM Subcategories WHERE name = 'PR.MA-03'), 
    (SELECT id FROM Categories WHERE name = 'Maintenance'), 
    (SELECT id FROM Components WHERE name = 'Protect'));

-- Protective Technology
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are protective technologies updated to address new threats?', 
    (SELECT id FROM Subcategories WHERE name = 'PR.PT-04'), 
    (SELECT id FROM Categories WHERE name = 'Protective Technology'), 
    (SELECT id FROM Components WHERE name = 'Protect'));

-- Anomalies and Events
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are anomaly detection processes reviewed and updated regularly?', 
    (SELECT id FROM Subcategories WHERE name = 'DE.AE-04'), 
    (SELECT id FROM Categories WHERE name = 'Anomalies and Events'), 
    (SELECT id FROM Components WHERE name = 'Detect'));

-- Security Continuous Monitoring
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are monitoring results communicated to relevant stakeholders?', 
    (SELECT id FROM Subcategories WHERE name = 'DE.CM-04'), 
    (SELECT id FROM Categories WHERE name = 'Security Continuous Monitoring'), 
    (SELECT id FROM Components WHERE name = 'Detect'));

-- Detection Processes
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How are detection processes tested for effectiveness?', 
    (SELECT id FROM Subcategories WHERE name = 'DE.DP-04'), 
    (SELECT id FROM Categories WHERE name = 'Detection Processes'), 
    (SELECT id FROM Components WHERE name = 'Detect'));

-- Response Planning
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How are response plans communicated to stakeholders?', 
    (SELECT id FROM Subcategories WHERE name = 'RS.RP-04'), 
    (SELECT id FROM Categories WHERE name = 'Response Planning'), 
    (SELECT id FROM Components WHERE name = 'Respond'));

-- Respond Communications
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are communication plans aligned with organizational policies?', 
    (SELECT id FROM Subcategories WHERE name = 'RS.CO-04'), 
    (SELECT id FROM Categories WHERE name = 'Respond Communications'), 
    (SELECT id FROM Components WHERE name = 'Respond'));

-- Analysis
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'How is the effectiveness of analysis processes evaluated?', 
    (SELECT id FROM Subcategories WHERE name = 'RS.AN-04'), 
    (SELECT id FROM Categories WHERE name = 'Analysis'), 
    (SELECT id FROM Components WHERE name = 'Respond'));

-- Mitigation
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are mitigation strategies tested for effectiveness?', 
    (SELECT id FROM Subcategories WHERE name = 'RS.MI-03'), 
    (SELECT id FROM Categories WHERE name = 'Mitigation'), 
    (SELECT id FROM Components WHERE name = 'Respond'));

-- Respond Improvements
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are lessons learned from incidents communicated to stakeholders?', 
    (SELECT id FROM Subcategories WHERE name = 'RS.IM-03'), 
    (SELECT id FROM Categories WHERE name = 'Response Improvements'), 
    (SELECT id FROM Components WHERE name = 'Respond'));

-- Recovery Planning
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are recovery plans tested and updated regularly?', 
    (SELECT id FROM Subcategories WHERE name = 'RC.RP-01'), 
    (SELECT id FROM Categories WHERE name = 'Recovery Planning'), 
    (SELECT id FROM Components WHERE name = 'Recover'));

-- Recover Improvements
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are improvement plans documented and reviewed?', 
    (SELECT id FROM Subcategories WHERE name = 'RC.IM-02'), 
    (SELECT id FROM Categories WHERE name = 'Recover Improvements'), 
    (SELECT id FROM Components WHERE name = 'Recover'));

-- Recover Communications
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(2, 'ISO', 'Are recovery communication plans aligned with organizational policies?', 
    (SELECT id FROM Subcategories WHERE name = 'RC.CO-02'), 
    (SELECT id FROM Categories WHERE name = 'Recover Communications'), 
    (SELECT id FROM Components WHERE name = 'Recover'));


INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(3, 'Tech', 'Are all physical devices and systems in your department regularly inventoried and documented? How often is this inventory updated?',
    (SELECT id FROM Subcategories WHERE name = 'ID.AM-01'),
    (SELECT id FROM Categories WHERE name = 'Asset Management'),
    (SELECT id FROM Components WHERE name = 'Identify'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(3, 'Tech', 'What procedures are in place to verify that software platforms and applications are accurately inventoried? How do you ensure no unauthorized software is present?',
 (SELECT id FROM Subcategories WHERE name = 'ID.AM-02'),
 (SELECT id FROM Categories WHERE name = 'Asset Management'),
 (SELECT id FROM Components WHERE name = 'Identify'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(3, 'Tech', 'How are resources prioritized based on their classification, criticality, and business value? Can you give an example of a prioritization process?',
    (SELECT id FROM Subcategories WHERE name = 'ID.AM-05'),
    (SELECT id FROM Categories WHERE name = 'Asset Management'),
    (SELECT id FROM Components WHERE name = 'Identify'));

-- Business Environment Questions
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(3, 'Tech', 'How are resilience requirements for critical services integrated into your daily operations? What backup measures are in place to support these services?',
 (SELECT id FROM Subcategories WHERE name = 'ID.BE-05'),
 (SELECT id FROM Categories WHERE name = 'Business Environment'),
 (SELECT id FROM Components WHERE name = 'Identify'));

-- Governance Questions
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(3, 'Tech', 'How familiar are you with the entity''s information security policy? How do you ensure compliance in your role?',
 (SELECT id FROM Subcategories WHERE name = 'ID.GV-01'),
 (SELECT id FROM Categories WHERE name = 'Governance'),
 (SELECT id FROM Components WHERE name = 'Identify'));


INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(3, 'Tech', 'How are information security roles and responsibilities coordinated with your team and external partners?',
 (SELECT id FROM Subcategories WHERE name = 'ID.GV-02'),
 (SELECT id FROM Categories WHERE name = 'Governance'),
 (SELECT id FROM Components WHERE name = 'Identify'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES
(3, 'Tech', 'What governance and risk management processes are followed to address cybersecurity risks in your operations?',
 (SELECT id FROM Subcategories WHERE name = 'ID.GV-04'),
 (SELECT id FROM Categories WHERE name = 'Governance'),
 (SELECT id FROM Components WHERE name = 'Identify'));

-- Risk Assessment Questions
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'What methods do you use to identify and document asset vulnerabilities? How often are vulnerabilities reassessed?',
 (SELECT id FROM Subcategories WHERE name = 'ID.RA-01'),
 (SELECT id FROM Categories WHERE name = 'Risk Assessment'),
 (SELECT id FROM Components WHERE name = 'Identify'));

-- Access Control Questions
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'Describe how identities and credentials are managed for devices and users in your scope. What steps are taken to prevent unauthorized access?',
 (SELECT id FROM Subcategories WHERE name = 'PR.AC-01'),
 (SELECT id FROM Categories WHERE name = 'Access Control'),
 (SELECT id FROM Components WHERE name = 'Protect'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'How is physical access to assets managed and monitored? Are there restrictions in place to control who can access these assets?',
 (SELECT id FROM Subcategories WHERE name = 'PR.AC-02'),
 (SELECT id FROM Categories WHERE name = 'Access Control'),
 (SELECT id FROM Components WHERE name = 'Protect'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'What protocols are followed to manage remote access? How do you ensure the security of remote access connections?',
 (SELECT id FROM Subcategories WHERE name = 'PR.AC-03'),
 (SELECT id FROM Categories WHERE name = 'Access Control'),
 (SELECT id FROM Components WHERE name = 'Protect'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'How is network integrity maintained? Are there segmentation practices to protect sensitive areas?',
 (SELECT id FROM Subcategories WHERE name = 'PR.AC-05'),
 (SELECT id FROM Categories WHERE name = 'Access Control'),
 (SELECT id FROM Components WHERE name = 'Protect'));

-- Awareness and Training Questions
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'How frequently are you trained on cybersecurity best practices? How do you apply this training in your daily work?',
 (SELECT id FROM Subcategories WHERE name = 'PR.AT-01'),
 (SELECT id FROM Categories WHERE name = 'Awareness and Training'),
 (SELECT id FROM Components WHERE name = 'Protect'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'What unique responsibilities do privileged users have, and how are these roles clarified and reinforced through training?',
 (SELECT id FROM Subcategories WHERE name = 'PR.AT-02'),
 (SELECT id FROM Categories WHERE name = 'Awareness and Training'),
 (SELECT id FROM Components WHERE name = 'Protect'));

-- Anomalies and Events Questions
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'How is event data aggregated and correlated from various sources? Are there specific tools used to analyze this data?',
 (SELECT id FROM Subcategories WHERE name = 'DE.AE-03'),
 (SELECT id FROM Categories WHERE name = 'Anomalies and Events'),
 (SELECT id FROM Components WHERE name = 'Detect'));

-- Security Continuous Monitoring Questions
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'Describe the tools and methods you use to monitor network traffic for potential cybersecurity threats.',
 (SELECT id FROM Subcategories WHERE name = 'DE.CM-01'),
 (SELECT id FROM Categories WHERE name = 'Security Continuous Monitoring'),
 (SELECT id FROM Components WHERE name = 'Detect'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'How do you detect and respond to malicious code on the network?',
 (SELECT id FROM Subcategories WHERE name = 'DE.CM-04'),
 (SELECT id FROM Categories WHERE name = 'Security Continuous Monitoring'),
 (SELECT id FROM Components WHERE name = 'Detect'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'How frequently are vulnerability scans conducted? Describe the steps taken to mitigate vulnerabilities identified in scans.',
 (SELECT id FROM Subcategories WHERE name = 'DE.CM-08'),
 (SELECT id FROM Categories WHERE name = 'Security Continuous Monitoring'),
 (SELECT id FROM Components WHERE name = 'Detect'));

-- Detection Processes Questions
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'What are your responsibilities in detection processes, and how are they tracked to ensure accountability?',
 (SELECT id FROM Subcategories WHERE name = 'DE.DP-01'),
 (SELECT id FROM Categories WHERE name = 'Detection Processes'),
 (SELECT id FROM Components WHERE name = 'Detect'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'How are detection processes tested in your team? How do you incorporate feedback from these tests?',
 (SELECT id FROM Subcategories WHERE name = 'DE.DP-03'),
 (SELECT id FROM Categories WHERE name = 'Detection Processes'),
 (SELECT id FROM Components WHERE name = 'Detect'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'Describe the process for communicating detected events to appropriate parties. How is information prioritized and shared?',
 (SELECT id FROM Subcategories WHERE name = 'DE.DP-04'),
 (SELECT id FROM Categories WHERE name = 'Detection Processes'),
 (SELECT id FROM Components WHERE name = 'Detect'));

-- Response Planning Questions
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'How is the response plan executed during an event in your team? Can you provide an example of a recent response and lessons learned?',
 (SELECT id FROM Subcategories WHERE name = 'RS.RP-01'),
 (SELECT id FROM Categories WHERE name = 'Response Planning'),
 (SELECT id FROM Components WHERE name = 'Respond'));

-- Communications Questions
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'Do you understand your role and the required order of operations when responding to an incident?',
 (SELECT id FROM Subcategories WHERE name = 'RS.CO-01'),
 (SELECT id FROM Categories WHERE name = 'Respond Communications'),
 (SELECT id FROM Components WHERE name = 'Respond'));

INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'How do you ensure that events are reported according to the established criteria? What challenges have you faced in this process?',
 (SELECT id FROM Subcategories WHERE name = 'RS.CO-02'),
 (SELECT id FROM Categories WHERE name = 'Respond Communications'),
 (SELECT id FROM Components WHERE name = 'Respond'));

-- Analysis Questions
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'How are notifications from detection systems investigated? Describe a recent example of an investigation you were part of.',
 (SELECT id FROM Subcategories WHERE name = 'RS.AN-01'),
 (SELECT id FROM Categories WHERE name = 'Analysis'),
 (SELECT id FROM Components WHERE name = 'Respond'));

-- Recovery Planning Questions
INSERT INTO Questions (set_id, user_type, question, subcategory_id, category_id, component_id) VALUES(3, 'Tech', 'Describe the steps taken to execute the recovery plan after an incident. How are restored systems tested to confirm full recovery?',
 (SELECT id FROM Subcategories WHERE name = 'RC.RP-01'),
 (SELECT id FROM Categories WHERE name = 'Recovery Planning'),
 (SELECT id FROM Components WHERE name = 'Recover'));



INSERT INTO
    `PCI_compliance_statuses`
VALUES (1, 'Non-Compliant'),
    (2, 'Non-Compliant'),
    (3, 'Non-Compliant'),
    (4, 'Non-Compliant'),
    (5, 'Compliant'),
    (6, 'Compliant'),
    (7, 'Compliant'),
    (8, 'Compliant'),
    (9, 'Compliant'),
    (10, 'Compliant'),
    (11, 'Compliant'),
    (12, 'Compliant');


INSERT INTO
    `PCI_questions`
VALUES (
        1,
        1,
        'Are firewall and router configuration standards established and implemented to include a formal process for approving and testing network connections and firewall/router configuration changes?',
        1,
        NULL
    ),
    (
        2,
        1,
        'Is there a current network diagram that documents all connections between the cardholder data environment and other networks?',
        1,
        NULL
    ),
    (
        3,
        1,
        'Is there a current diagram that shows all cardholder data flows across systems and networks?',
        1,
        NULL
    ),
    (
        4,
        1,
        'Is a firewall required and implemented at each Internet connection and between any demilitarized zone (DMZ) and the internal network zone?',
        1,
        NULL
    ),
    (
        5,
        1,
        'Are groups, roles, and responsibilities for logical management of network components documented in the firewall and router configuration standards?',
        1,
        NULL
    ),
    (
        6,
        1,
        'Are firewall and router configuration standards reviewed every six months?',
        1,
        NULL
    ),
    (
        7,
        1,
        'Do firewall configurations restrict connections between untrusted networks and the cardholder data environment?',
        1,
        NULL
    ),
    (
        8,
        1,
        'Are router configuration files secured from unauthorized access?',
        1,
        NULL
    ),
    (
        9,
        1,
        'Are perimeter firewalls installed between all wireless networks and the cardholder data environment?',
        1,
        NULL
    ),
    (
        10,
        2,
        'Are vendor-supplied defaults changed on all system components before installation on the network?',
        1,
        NULL
    ),
    (
        11,
        2,
        'Are unnecessary default accounts removed or disabled?',
        1,
        NULL
    ),
    (
        12,
        2,
        'For wireless environments, are wireless vendor defaults changed upon installation, including encryption keys and SNMP community strings?',
        1,
        NULL
    ),
    (
        13,
        2,
        'Are configuration standards developed for all system components based on industry-accepted system hardening standards?',
        1,
        NULL
    ),
    (
        14,
        2,
        'Are system configuration standards updated as new vulnerability issues are identified?',
        1,
        NULL
    ),
    (
        15,
        2,
        'Do system configuration standards require only one primary function per server to prevent functions that require different security levels from co-existing?',
        1,
        NULL
    ),
    (
        16,
        2,
        'Are system configuration standards applied to prevent unauthorized services, protocols, and daemons?',
        1,
        NULL
    ),
    (
        17,
        2,
        'Is non-console administrative access encrypted?',
        1,
        NULL
    ),
    (
        18,
        2,
        'Is an inventory of all system components within PCI DSS scope maintained and kept current?',
        1,
        NULL
    ),
    (
        19,
        3,
        'Are data-retention and disposal policies and procedures in place to limit data storage amounts and retention time to that required for legal, regulatory, and/or business requirements?',
        1,
        NULL
    ),
    (
        20,
        3,
        'Is sensitive authentication data deleted upon completion of the authorization process?',
        1,
        NULL
    ),
    (
        21,
        3,
        'Is cardholder data stored securely by using cryptographic mechanisms like one-way hashes, truncation, or strong cryptography?',
        1,
        NULL
    ),
    (
        22,
        3,
        'Are cryptographic keys used for encryption of stored cardholder data protected against disclosure and misuse?',
        1,
        NULL
    ),
    (
        23,
        3,
        'Are access to cryptographic keys restricted to the fewest number of custodians necessary?',
        1,
        NULL
    ),
    (
        24,
        3,
        'Are all key-management processes and procedures fully documented and implemented?',
        1,
        NULL
    ),
    (
        25,
        4,
        'Are strong cryptography and security protocols used to safeguard sensitive cardholder data during transmission over open, public networks?',
        1,
        NULL
    ),
    (
        26,
        4,
        'Are only trusted keys and/or certificates accepted for secure transmissions?',
        1,
        NULL
    ),
    (
        27,
        4,
        'Are security protocols implemented to use only secure configurations, and do they not support insecure versions or configurations?',
        1,
        NULL
    ),
    (
        28,
        4,
        'For TLS implementations, is TLS enabled whenever cardholder data is transmitted or received?',
        1,
        NULL
    ),
    (
        29,
        4,
        'Are policies in place to prohibit the sending of unprotected PANs via end-user messaging technologies?',
        1,
        NULL
    ),
    (
        30,
        5,
        'Is anti-virus software deployed on all systems commonly affected by malicious software?',
        1,
        NULL
    ),
    (
        31,
        5,
        'Are all anti-virus programs capable of detecting, removing, and protecting against all known types of malicious software?',
        1,
        NULL
    ),
    (
        32,
        5,
        'Are all anti-virus mechanisms updated with current definitions and set to perform periodic scans?',
        1,
        NULL
    ),
    (
        33,
        5,
        'Are all anti-virus mechanisms generating audit logs, and are logs retained according to PCI DSS requirements?',
        1,
        NULL
    ),
    (
        34,
        6,
        'Are system components and software protected from known vulnerabilities by applying vendor-supplied security patches?',
        1,
        NULL
    ),
    (
        35,
        6,
        'Are software development processes based on industry standards for secure coding practices?',
        1,
        NULL
    ),
    (
        36,
        6,
        'Are custom code and application changes reviewed prior to production release to identify any security vulnerabilities?',
        1,
        NULL
    ),
    (
        37,
        6,
        'Are change control processes and procedures followed for all changes to system components?',
        1,
        NULL
    ),
    (
        38,
        7,
        'Are access rights based on job role, ensuring that access is restricted by business need to know?',
        1,
        NULL
    ),
    (
        39,
        7,
        'Are access controls in place to enforce this need-to-know policy across all systems?',
        1,
        NULL
    ),
    (
        40,
        7,
        'Are user access roles reviewed periodically to confirm that users have the appropriate level of access?',
        1,
        NULL
    ),
    (
        41,
        8,
        'Are user accounts unique and traceable to individual users?',
        1,
        NULL
    ),
    (
        42,
        8,
        'Are users assigned unique user IDs and are passwords complex and updated regularly?',
        1,
        NULL
    ),
    (
        43,
        8,
        'Are multi-factor authentication methods used for all remote access to the cardholder data environment?',
        1,
        NULL
    ),
    (
        44,
        8,
        'Are inactive accounts removed or disabled promptly?',
        1,
        NULL
    ),
    (
        45,
        9,
        'Are physical security controls in place to restrict access to the cardholder data environment?',
        1,
        NULL
    ),
    (
        46,
        9,
        'Is access to sensitive areas logged and reviewed regularly?',
        1,
        NULL
    ),
    (
        47,
        9,
        'Are media containing cardholder data physically secure?',
        1,
        NULL
    ),
    (
        48,
        9,
        'Are policies and procedures established for the secure disposal of media containing cardholder data?',
        1,
        NULL
    ),
    (
        49,
        10,
        'Are audit trails maintained for all system components to track all user activities, including access to cardholder data?',
        1,
        NULL
    ),
    (
        50,
        10,
        'Are logs for system components reviewed regularly?',
        1,
        NULL
    ),
    (
        51,
        10,
        'Are security policies established for the retention and management of log data?',
        1,
        NULL
    ),
    (
        52,
        10,
        'Is access to log files restricted to prevent unauthorized modifications?',
        1,
        NULL
    ),
    (
        53,
        11,
        'Are internal and external vulnerability scans conducted quarterly and after any significant changes?',
        1,
        NULL
    ),
    (
        54,
        11,
        'Are intrusion detection systems in place to detect and alert on unauthorized network access?',
        1,
        NULL
    ),
    (
        55,
        11,
        'Are penetration tests performed annually and after significant network or application changes?',
        1,
        NULL
    ),
    (
        56,
        11,
        'Are file integrity monitoring systems configured to alert personnel to unauthorized modifications?',
        1,
        NULL
    ),
    (
        57,
        12,
        'Is there a formal information security policy that addresses PCI DSS compliance and cardholder data protection?',
        1,
        NULL
    ),
    (
        58,
        12,
        'Are policies and procedures implemented to manage and control service providers with access to the cardholder data environment?',
        1,
        NULL
    ),
    (
        59,
        12,
        'Are information security policies and procedures reviewed annually and updated as necessary?',
        1,
        NULL
    ),
    (
        60,
        12,
        'Are employees trained in security policies and procedures, including recognizing and responding to security incidents?',
        1,
        NULL
    );
--


INSERT INTO
    `PCI_requirements`
VALUES (
        1,
        'Install and maintain a firewall configuration to protect cardholder data.',
        'Establish and implement firewall and router configuration standards.',
        'high',
        1
    ),
    (
        2,
        'Do not use vendor-supplied defaults for system passwords and other security parameters.',
        'Ensure vendor-supplied defaults are changed to increase security.',
        'high',
        1
    ),
    (
        3,
        'Protect stored cardholder data.',
        'Implement strong protection measures for stored cardholder data.',
        'high',
        2
    ),
    (
        4,
        'Encrypt transmission of cardholder data across open, public networks.',
        'Use encryption to secure cardholder data during transmission.',
        'high',
        2
    ),
    (
        5,
        'Use and regularly update anti-virus software or programs.',
        'Deploy anti-virus software and keep it updated.',
        'medium',
        3
    ),
    (
        6,
        'Develop and maintain secure systems and applications.',
        'Secure system development processes and apply patches.',
        'high',
        3
    ),
    (
        7,
        'Restrict access to cardholder data by business requirements.',
        'Limit access to cardholder data to those who need it.',
        'high',
        4
    ),
    (
        8,
        'Assign a unique ID to each person with computer access.',
        'Identify and authenticate users accessing system components.',
        'high',
        4
    ),
    (
        9,
        'Restrict physical access to cardholder data.',
        'Implement physical security controls for cardholder data.',
        'medium',
        4
    ),
    (
        10,
        'Track and monitor all access to network resources and cardholder data.',
        'Maintain audit trails and review logs regularly.',
        'high',
        5
    ),
    (
        11,
        'Regularly test security systems and processes.',
        'Conduct regular testing and monitoring of security systems.',
        'high',
        5
    ),
    (
        12,
        'Maintain a policy that addresses information security for all personnel.',
        'Establish a comprehensive information security policy.',
        'high',
        6
    );


INSERT INTO `owasp_categories` VALUES (1,'A01:2021 – Broken Access Control','Broken Access Control occurs when an application fails to properly enforce restrictions on authenticated users, allowing them to access unauthorized data or functionality. It is ranked as the #1 security risk in the OWASP Top 10 for 2021, moving up from position #5 in 2017. 94% of applications tested had some form of broken access control. There were 318,000 occurrences in OWASP’s 2021 data set.'),(2,'A02:2021 – Cryptographic Failures','Failures in protecting data through cryptographic means. This includes insufficient encryption, improper use of cryptographic algorithms, and weak key management, exposing sensitive data to theft or tampering.'),(3,'A03:2021 – Injection','Occurs when an attacker can send untrusted input into a web application, tricking it into executing unintended commands or accessing data without proper authorization. Common types include SQL, NoSQL, and OS command injections.'),(4,'A04:2021 – Insecure Design','Focuses on the lack of security considerations during the design phase. This category emphasizes creating secure systems from the ground up, rather than just implementing security as an afterthought.'),(5,'A05:2021 – Security Misconfiguration','Inadequate security settings or failing to keep software up to date. Misconfigurations can occur at any level of the application stack, such as servers, frameworks, or APIs.'),(6,'A06:2021 – Vulnerable and Outdated Components','Using software components with known vulnerabilities or outdated versions. This is often due to poor management of software dependencies.'),(7,'A07:2021 – Identification and Authentication Failures','Issues with identity management, such as weak passwords, improper session management, or flaws in authentication mechanisms, allowing attackers to impersonate users.'),(8,'A08:2021 – Software and Data Integrity Failures','Concerns the lack of integrity checks for software and data. This includes insecure deserialization, lack of code signing, and dependency hijacking.'),(9,'A09:2021 – Security Logging and Monitoring Failures','The lack of adequate logging and monitoring capabilities, which hinders the ability to detect and respond to security breaches in a timely manner.'),(10,'A10:2021 – Server-Side Request Forgery (SSRF)','Occurs when an application fetches a remote resource without validating the URL provided by the user, allowing attackers to send requests to unintended internal or external services.');


INSERT INTO `owasp_category_scores` VALUES (1,7,2,5,10,'Applicable','2024-11-21 23:09:57','2024-11-21 23:09:57'),(2,6,5,8,40,'Applicable','2024-11-21 23:25:47','2024-11-21 23:25:47'),(3,1,6,9,54,'Applicable','2024-11-21 23:36:39','2024-11-21 23:36:39'),(4,1,6,8,48,'Applicable','2024-11-22 18:10:17','2024-11-22 18:10:17'),(5,2,6,9,54,'Applicable','2024-11-22 18:10:17','2024-11-22 18:10:17'),(6,1,6,8,48,'Applicable','2024-11-22 18:15:45','2024-11-22 18:15:45'),(7,2,6,9,54,'Applicable','2024-11-22 18:15:45','2024-11-22 18:15:45'),(8,1,7,7,49,'Applicable','2024-11-22 18:16:13','2024-11-22 18:16:13'),(9,1,8,9,72,'Applicable','2024-11-22 18:17:00','2024-11-22 18:17:00'),(10,1,NULL,5,25,'Applicable','2024-11-22 18:30:26','2024-11-22 18:30:26'),(11,2,NULL,9,54,'Applicable','2024-11-22 18:30:26','2024-11-22 18:30:26'),(12,1,NULL,9,63,'Applicable','2024-11-22 18:33:05','2024-11-22 18:33:05'),(13,1,8,9,72,'Applicable','2024-11-22 18:45:40','2024-11-22 18:45:40'),(14,1,8,5,40,'Applicable','2024-11-22 19:20:24','2024-11-22 19:20:24');

INSERT INTO `owasp_questions` VALUES (1,1,'Does your application enforce access controls based on user roles (e.g., admin, user, guest)?'),(2,1,'Are users only granted the minimum privileges necessary to perform their tasks?'),(3,1,'Does your application deny access to all resources by default unless explicitly allowed?'),(4,1,'Does your application validate that a user accessing a resource is its rightful owner?'),(5,1,'Does your application prevent unauthorized access via API parameter manipulation (e.g., modifying an ID to access another user’s data)?'),(6,1,'Does your application log access control failures (e.g., unauthorized access attempts)?'),(7,1,'Are API requests rate-limited to reduce the risk of brute-force or automated attacks?'),(8,2,'Does your application enforce access controls based on user roles (e.g., admin, user, guest)?'),(9,2,'Are users only granted the minimum privileges necessary to perform their tasks?'),(10,3,'Does your application enforce access controls based on user roles (e.g., admin, user, guest)?'),(11,3,'Are users only granted the minimum privileges necessary to perform their tasks?'),(12,4,'Does your application enforce access controls based on user roles (e.g., admin, user, guest)?'),(13,4,'Are users only granted the minimum privileges necessary to perform their tasks?'),(14,5,'Does your application enforce access controls based on user roles (e.g., admin, user, guest)?'),(15,5,'Are users only granted the minimum privileges necessary to perform their tasks?'),(16,6,'Does your application enforce access controls based on user roles (e.g., admin, user, guest)?'),(17,6,'Are users only granted the minimum privileges necessary to perform their tasks?'),(18,7,'Does your application enforce access controls based on user roles (e.g., admin, user, guest)?'),(19,7,'Are users only granted the minimum privileges necessary to perform their tasks?'),(20,8,'Does your application enforce access controls based on user roles (e.g., admin, user, guest)?'),(21,8,'Are users only granted the minimum privileges necessary to perform their tasks?'),(22,9,'Does your application enforce access controls based on user roles (e.g., admin, user, guest)?'),(23,9,'Are users only granted the minimum privileges necessary to perform their tasks?'),(24,10,'Does your application enforce access controls based on user roles (e.g., admin, user, guest)?'),(25,10,'Are users only granted the minimum privileges necessary to perform their tasks?');

