/**
 * NCSC Cyber Assessment Framework (CAF) Compliance Pack
 *
 * Framework:
 *   National Cyber Security Centre — Cyber Assessment Framework (CAF)
 *   v3.x. The UK's cyber-resilience assessment framework for operators
 *   of essential services (OES) under the Network and Information
 *   Systems Regulations 2018 (UK NIS Regs), and increasingly mandated
 *   for central government (GovAssure programme since 2023).
 *
 *   Distinct from Cyber Essentials (NCSC's lighter-weight 5-control
 *   self-assessment for SMEs and most NHS suppliers). CAF is the heavier,
 *   outcome-based assessment for operators of CNI and large public-
 *   sector estates.
 *
 *   CAF organises 14 cyber-security and resilience principles into four
 *   objectives:
 *     A. Managing security risk          (4 principles A1–A4)
 *     B. Protecting against cyber attack (5 principles B1–B5)
 *     C. Detecting cyber security events (2 principles C1–C2)
 *     D. Minimising the impact of cyber security incidents (2 principles D1–D2)
 *   Plus a fifth implicit objective via embedded indicators of good
 *   practice (IGPs) that map to the 14 principles.
 *
 * Jurisdiction: GB (United Kingdom)
 * Authority: NCSC (National Cyber Security Centre, part of GCHQ)
 * Companion regulators (sectoral CAF profiles):
 *   - Ofcom (telecoms)
 *   - Ofgem (energy)
 *   - DfT + ORR (transport / rail)
 *   - PSR + FCA (financial services CNI overlap)
 *   - DHSC + NHS England (health CNI)
 *   - DSIT (digital infrastructure / cloud / IaaS — newest CAF additions)
 *
 * Why this pack:
 *   - CAF is the assessment framework an OES customer's CISO is asked to
 *     pass under UK NIS Regs Reg 11/12. Distinct from CE; CAF customers
 *     usually also hold CE+ but for CAF the audit is outcome-based not
 *     control-checklist.
 *   - GovAssure (Cabinet Office programme) made CAF mandatory for
 *     central-government departments in 2023 — every Critical Service
 *     in scope is assessed against CAF.
 *   - Pairs with `uk-nis-regs` pack (forthcoming, this session) which
 *     captures the statutory side; CAF is the operational evidence
 *     framework the regulators use against NIS-scope entities.
 *
 * Out of scope:
 *   - Cyber Essentials self-assessment (covered by `cyber-essentials` pack)
 *   - UK NIS Regs 2018 statutory side (separate pack: `uk-nis-regs`,
 *     forthcoming)
 *   - EU NIS2 (separate pack: `nis2`, already shipped)
 *   - General UK GDPR personal-data handling (separate pack: `uk-gdpr`)
 *
 * @connexum/ai-governance
 */
import { CompliancePack } from './index';
import { CategoryClassifiers } from '../classification/pack-driven-classifier';
export declare const NCSC_CAF_CATEGORY_CLASSIFIERS: CategoryClassifiers;
export declare const NCSC_CAF_PACK: CompliancePack & {
    categoryClassifiers: CategoryClassifiers;
};
//# sourceMappingURL=ncsc-caf.d.ts.map