"use strict";
/**
 * NCSC Guidelines for Secure AI System Development Compliance Pack
 *
 * Framework:
 *   NCSC (National Cyber Security Centre, UK) — "Guidelines for secure AI
 *   system development" (2024), co-authored with CISA (US), ACSC (AU),
 *   CCCS (CA), BSI (DE), ANSSI (FR) and 11 further international partners.
 *   Not legally binding legislation but referenced by UK public-sector
 *   procurement (Crown Commercial Service frameworks, Cyber Essentials Plus
 *   supplier tiers) and incorporated by reference into Cabinet Office
 *   AI procurement guidance.
 *
 *   The guidelines are structured across four sequential phases that mirror
 *   an AI system's lifecycle:
 *     Phase 1 — Secure design
 *       (threat modelling, supply-chain risk, attack-surface minimisation)
 *     Phase 2 — Secure development
 *       (dependency integrity, model provenance, secure coding for AI)
 *     Phase 3 — Secure deployment
 *       (infrastructure hardening, access controls, deployment records)
 *     Phase 4 — Secure operation and maintenance
 *       (monitoring, incident response, vulnerability disclosure, red-teaming)
 *
 * Jurisdiction: GB (United Kingdom)
 * Authority: NCSC (National Cyber Security Centre, part of GCHQ)
 *   Joint with: CISA, ACSC, CCCS, BSI, ANSSI + 11 international partners.
 *   UK procurement references: Crown Commercial Service, Cabinet Office,
 *   Cyber Essentials Plus supplier requirements.
 *
 * Relation to other packs:
 *   - Pairs with `cyber-essentials` (foundational UK cyber hygiene baseline)
 *   - Pairs with `ncsc-caf` (heavier outcome-based assessment for CNI operators)
 *   - Pairs with `uk-ai-framework` (UK crossgov AI principles)
 *   - Distinct from ISO 42001 (management-system certification) — this pack
 *     focuses on engineering-phase secure-by-design controls for AI, not on
 *     the management system layer.
 *
 * Why this pack:
 *   - Crown Commercial Service and GDS increasingly require suppliers to
 *     evidence adherence to these guidelines for AI system procurement.
 *   - The supply-chain and model-provenance requirements have direct
 *     enforcement hooks (AI_SUPPLY_CHAIN_RISK, AI_THREAT_MODEL elements).
 *   - Red team findings and vulnerability reports (MODEL_VULNERABILITY_REPORT,
 *     RED_TEAM_FINDING) are increasingly mandated as pre-procurement evidence.
 *   - AI-specific incident response distinguishes this pack from generic
 *     incident-response frameworks.
 *
 * Retention: 7 years — aligned with public-sector procurement record-keeping
 *   standards (Cabinet Office guidance) and NCSC recommended evidence
 *   retention for AI security assessments.
 *
 * Source citation: NCSC Guidelines for secure AI system development (2024),
 *   National Cyber Security Centre. Crown copyright; freely distributable.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.NCSC_AI_SECURITY_PACK = exports.NCSC_AI_SECURITY_CATEGORY_CLASSIFIERS = void 0;
/**
 * NCSC AI Security category classifiers.
 *
 * Each classifier targets a distinct data element from the four phases
 * of the NCSC Guidelines for secure AI system development (2024).
 */
exports.NCSC_AI_SECURITY_CATEGORY_CLASSIFIERS = {
    /**
     * Phase 1 — Secure design: threat model for an AI system.
     * Covers STRIDE-for-AI, adversarial input paths, model inversion
     * risk, data poisoning threat scenarios, and architectural attack-
     * surface analysis documents.
     */
    AI_THREAT_MODEL: {
        references: [
            'NCSC Guidelines for secure AI system development (2024) — Phase 1: Secure design',
            'NCSC: threat modelling for AI systems; adversarial ML attack surface',
        ],
        classifier: (input) => {
            if (/\b(?:ai\s+threat\s+model(?:ling)?|adversarial\s+(?:ml|ai)\s+threat)\b/i.test(input))
                return true;
            if (/\b(?:data\s+poisoning\s+(?:risk|threat|scenario)|model\s+inversion\s+(?:risk|attack))\b/i.test(input))
                return true;
            if (/\b(?:attack\s+surface\s+analysis\s+(?:ai|ml)|prompt\s+injection\s+threat\s+model)\b/i.test(input))
                return true;
            if (/\b(?:evasion\s+attack\s+(?:scenario|model)|membership\s+inference\s+threat)\b/i.test(input))
                return true;
            if (/\b(?:ncsc\s+secure\s+ai\s+design|ai\s+secure\s+design\s+(?:review|record))\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * Phase 1 / Phase 2 — Supply-chain risk for AI: model provenance,
     * dataset lineage, third-party component integrity, sub-processor
     * AI risk attestation.
     */
    AI_SUPPLY_CHAIN_RISK: {
        references: [
            'NCSC Guidelines for secure AI system development (2024) — Phase 1: Supply-chain risk / Phase 2: Dependency integrity',
            'NCSC: model provenance; dataset lineage; third-party AI component integrity',
        ],
        classifier: (input) => {
            if (/\b(?:model\s+provenance|dataset\s+lineage|training\s+data\s+provenance)\b/i.test(input))
                return true;
            if (/\b(?:ai\s+supply\s+chain\s+(?:risk|assessment|attestation))\b/i.test(input))
                return true;
            if (/\b(?:third[\s-]?party\s+model\s+(?:risk|integrity|attestation))\b/i.test(input))
                return true;
            if (/\b(?:model\s+weight\s+(?:integrity|hash|checksum|signature))\b/i.test(input))
                return true;
            if (/\b(?:sbom.*ai|ai.*sbom|software\s+bill\s+of\s+materials.*(?:model|dataset))\b/i.test(input))
                return true;
            if (/\b(?:dependency\s+integrity\s+(?:ai|ml)|sub[\s-]?processor\s+ai\s+(?:risk|attestation))\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * Phase 4 — Secure operation: vulnerability reports against AI components,
     * covering model-level weaknesses (e.g. adversarial robustness gaps),
     * plugin / tool-call injection vulnerabilities, and responsible disclosure
     * records.
     */
    MODEL_VULNERABILITY_REPORT: {
        references: [
            'NCSC Guidelines for secure AI system development (2024) — Phase 4: Secure operation & maintenance',
            'NCSC: vulnerability disclosure for AI; responsible disclosure of model weaknesses',
        ],
        classifier: (input) => {
            if (/\b(?:model\s+vulnerability\s+(?:report|disclosure|finding))\b/i.test(input))
                return true;
            if (/\b(?:ai\s+(?:cve|vulnerability)\s+(?:report|finding|disclosure))\b/i.test(input))
                return true;
            if (/\b(?:adversarial\s+robustness\s+(?:gap|finding|assessment))\b/i.test(input))
                return true;
            if (/\b(?:responsible\s+disclosure.*(?:model|ai|ml))\b/i.test(input))
                return true;
            if (/\b(?:plugin\s+injection\s+(?:finding|report|vulnerability)|tool[\s-]?call\s+injection\s+vuln)\b/i.test(input))
                return true;
            if (/\b(?:coordinated\s+vulnerability\s+disclosure.*ai)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * Phase 4 — Secure operation: red-team exercise records, adversarial
     * testing reports, purple-team outcomes, safety evaluation findings
     * (including AISI / DSIT AI safety evaluations cited by NCSC).
     */
    RED_TEAM_FINDING: {
        references: [
            'NCSC Guidelines for secure AI system development (2024) — Phase 4: Secure operation & maintenance',
            'NCSC: red-teaming AI systems; DSIT AI Safety Institute evaluation framework',
        ],
        classifier: (input) => {
            if (/\b(?:red[\s-]?team(?:ing)?\s+(?:finding|report|result|exercise))\b/i.test(input))
                return true;
            if (/\b(?:ai\s+red[\s-]?team|adversarial\s+testing\s+(?:report|finding))\b/i.test(input))
                return true;
            if (/\b(?:purple[\s-]?team\s+(?:outcome|finding|exercise))\b/i.test(input))
                return true;
            if (/\b(?:aisi\s+(?:evaluation|finding)|ai\s+safety\s+institute\s+evaluation)\b/i.test(input))
                return true;
            if (/\b(?:safety\s+evaluation\s+(?:report|finding)\s+(?:ai|model|dsit))\b/i.test(input))
                return true;
            if (/\b(?:pen[\s-]?test.*(?:ai|llm|model)|llm\s+pen[\s-]?test\s+(?:report|finding))\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * Phase 3 — Secure deployment: deployment records documenting that
     * an AI system was deployed through a change-controlled, audited
     * process with infrastructure hardening evidence.
     */
    SECURE_DEPLOYMENT_RECORD: {
        references: [
            'NCSC Guidelines for secure AI system development (2024) — Phase 3: Secure deployment',
            'NCSC: deployment integrity; infrastructure hardening for AI; access control evidence for AI deployment',
        ],
        classifier: (input) => {
            if (/\b(?:secure\s+deployment\s+(?:record|evidence|attestation))\b/i.test(input))
                return true;
            if (/\b(?:ai\s+deployment\s+(?:review|record|sign[\s-]?off|approval))\b/i.test(input))
                return true;
            if (/\b(?:model\s+release\s+(?:record|approval|gate|checklist))\b/i.test(input))
                return true;
            if (/\b(?:deployment\s+hardening\s+(?:checklist|evidence|record))\b/i.test(input))
                return true;
            if (/\b(?:infrastructure\s+hardening.*ai\s+deploy|ai\s+deploy.*infrastructure\s+hardening)\b/i.test(input))
                return true;
            if (/\b(?:model\s+version\s+(?:registry|provenance\s+record|release\s+note))\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * Phase 4 — Secure operation: AI-specific incident response records —
     * incidents where an AI component was the attack vector, target, or
     * amplifier (e.g. prompt-injection attack, model exfiltration, data-
     * poisoning incident, adversarial input incident).
     */
    INCIDENT_RESPONSE_AI: {
        references: [
            'NCSC Guidelines for secure AI system development (2024) — Phase 4: Secure operation & maintenance',
            'NCSC: AI-specific incident response; prompt-injection incidents; model exfiltration events',
        ],
        classifier: (input) => {
            if (/\b(?:ai\s+(?:security\s+)?incident\s+(?:report|response|record))\b/i.test(input))
                return true;
            if (/\b(?:prompt[\s-]?injection\s+incident|prompt[\s-]?injection\s+attack\s+(?:report|log))\b/i.test(input))
                return true;
            if (/\b(?:model\s+exfiltration\s+(?:incident|event|report))\b/i.test(input))
                return true;
            if (/\b(?:data\s+poisoning\s+incident\s+(?:report|record|response))\b/i.test(input))
                return true;
            if (/\b(?:adversarial\s+input\s+incident|evasion\s+attack\s+incident\s+report)\b/i.test(input))
                return true;
            if (/\b(?:ai\s+(?:misuse|abuse)\s+incident\s+(?:report|log))\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety — NCSC artefacts must not embed credentials'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.NCSC_AI_SECURITY_PACK = {
    categoryClassifiers: exports.NCSC_AI_SECURITY_CATEGORY_CLASSIFIERS,
    id: 'ncsc-ai-security',
    aliases: [
        'ncsc-ai-security-guidelines',
        'ncsc-secure-ai',
        'ncsc-ai-guidelines-2024',
        'secure-ai-system-development',
        'cisa-ncsc-ai-security',
        'joint-guidelines-ai-security',
    ],
    name: 'NCSC Guidelines for Secure AI System Development (2024)',
    version: '1.0.0',
    description: 'NCSC (UK) and international partner guidelines covering four phases of secure AI system development: ' +
        'Phase 1 — secure design (threat modelling, supply-chain risk, attack-surface minimisation); ' +
        'Phase 2 — secure development (dependency integrity, model provenance, secure coding for AI); ' +
        'Phase 3 — secure deployment (infrastructure hardening, access controls, deployment records); ' +
        'Phase 4 — secure operation and maintenance (monitoring, incident response, vulnerability disclosure, red-teaming). ' +
        'Not legally binding but referenced by UK Crown Commercial Service procurement frameworks and ' +
        'Cabinet Office AI procurement guidance. Co-authored with CISA, ACSC, CCCS, BSI, ANSSI and ' +
        '11 international partners. Source: NCSC Guidelines for secure AI system development (2024).',
    authority: 'NCSC (National Cyber Security Centre, part of GCHQ) + CISA (US) + ACSC (AU) + CCCS (CA) + BSI (DE) + ANSSI (FR) + ' +
        'Crown Commercial Service / Cabinet Office (UK procurement references)',
    industries: [
        'technology',
        'public-sector',
        'financial-services',
        'healthcare',
        'defense',
        'critical-national-infrastructure',
        'professional-services',
        'education',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Phase 1 secure-design gate: default-deny on AI agent actions lacking a threat-model approval record; ' +
                'Phase 3 deployment gate: block unauthorised model-weight deployments.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 1: Secure design; Phase 3: Secure deployment',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Phase 3 access-control enforcement: MFA, least privilege, and separation of duties for AI deployment ' +
                'pipelines and model-serving infrastructure; joiner-mover-leaver workflow for AI system operators.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 3: Secure deployment — access controls',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit chain across all four phases: threat-model approvals (Phase 1), dependency ' +
                'integrity records (Phase 2), deployment sign-off records (Phase 3), incident and red-team ' +
                'records (Phase 4). Required for Crown Commercial Service procurement evidence.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — all four phases; CCS procurement evidence',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Phase 2 model-provenance attestation (dataset lineage, weight integrity hashes, SBOM-for-AI); ' +
                'Phase 4 red-team exercise completion attestation; periodic secure-design review cadence tracking.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 2: model provenance; Phase 4: red-teaming cadence',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Phase 4 monitoring: real-time routing of AI-specific security events (adversarial input detected, ' +
                'model-weight integrity failure, prompt-injection attempt, data-poisoning signal) to security operations.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 4: Monitoring for adversarial events',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify the six NCSC AI security data elements (AI_THREAT_MODEL, AI_SUPPLY_CHAIN_RISK, ' +
                'MODEL_VULNERABILITY_REPORT, RED_TEAM_FINDING, SECURE_DEPLOYMENT_RECORD, INCIDENT_RESPONSE_AI) ' +
                'across all agent artefacts; block credentials from evidence records.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — data element classification across all phases',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Phase 3 infrastructure hardening: NCSC-recommended cipher / TLS profiles for AI-serving endpoints; ' +
                'encryption of model weights at rest and in transit to prevent exfiltration.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 3: Infrastructure hardening; NCSC TLS guidance',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: '7-year retention of all phase records (threat models, deployment records, red-team findings, ' +
                'incident records) per public-sector procurement standards aligned with Cabinet Office guidance.',
            reference: 'Cabinet Office AI procurement record-keeping guidance; NCSC evidence retention for AI security assessments',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Phase 1 and Phase 2 supply-chain risk management: model-provenance tracking, dataset-lineage ' +
                'records, third-party AI component integrity (SBOM-for-AI), sub-processor AI risk attestation.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 1: Supply-chain risk; Phase 2: Dependency integrity',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'T2 review gate for model swaps: any change to model weights requires a Tier-2 human reviewer ' +
                'to approve based on updated threat model, provenance attestation, and deployment record. ' +
                'Phase 3: deployment approval gate.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 3: Secure deployment approval; model swap governance',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            ncscAiSecureDesignGateRequired: true,
            blockUnauthorisedModelWeightChanges: true,
            defaultDenyOnMissingThreatModel: true,
        },
        'agent-auth': {
            mfaRequired: true,
            leastPrivilegeRequired: true,
            separationOfDutiesRequired: true,
            jmlWorkflowRequired: true,
            aiDeploymentPipelineAccessControlRequired: true,
        },
        'audit-integrity': {
            tamperEvidentRequired: true,
            allFourPhaseRecordsRequired: true,
            ncscAiEvidenceChainRequired: true,
        },
        'attestation-manager': {
            modelProvenanceAttestationRequired: true,
            datasetLineageRequired: true,
            modelWeightIntegrityHashRequired: true,
            redTeamCadenceTracked: true,
            retentionYearsForEvidence: 7,
        },
        'event-bus': {
            adversarialInputDetectionRequired: true,
            modelWeightIntegrityMonitoringRequired: true,
            promptInjectionAlertingRequired: true,
            dataPoisoningSignalRequired: true,
            aiSecurityIncidentRoutingRequired: true,
        },
        'data-classifier': {
            enabledCategories: [
                'AI_THREAT_MODEL',
                'AI_SUPPLY_CHAIN_RISK',
                'MODEL_VULNERABILITY_REPORT',
                'RED_TEAM_FINDING',
                'SECURE_DEPLOYMENT_RECORD',
                'INCIDENT_RESPONSE_AI',
                'CREDENTIALS',
            ],
            credentialsAction: 'BLOCK',
            // AI_THREAT_MODEL updates require human review (REVIEWED ruling)
            aiThreatModelAction: 'REVIEWED',
            // Unauthorised model-weight changes are blocked
            modelWeightChangeAction: 'BLOCK',
            // Routine secure-deployment records are allowed through
            secureDeploymentRecordAction: 'ALLOW',
        },
        'encryption-layer': {
            algorithm: 'aes-256-gcm',
            tlsMinVersion: '1.2',
            modelWeightEncryptionRequired: true,
            aiEndpointEncryptionRequired: true,
        },
        'session-persistence': {
            retentionDaysMinimum: 2555, // 7 years (365 * 7)
        },
        'supply-chain': {
            modelProvenanceRequired: true,
            datasetLineageRequired: true,
            sbomForAiRequired: true,
            subProcessorAiRiskAttestationRequired: true,
        },
        'approval-queue': {
            modelSwapApprovalRequired: true,
            reviewTier: 'T2',
            deploymentApprovalRequired: true,
            threatModelUpdateReviewRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: [
            'DATA-RESIDENCY-UK',
            'PROCESSOR-CONTRACT',
            'MODEL-PROVENANCE-ATTESTATION',
            'NCSC-AI-SECURITY-COMPATIBLE',
        ],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law jurisdiction. NCSC AI supply-chain risk guidelines require ' +
                'full provenance attestation; PRC-domiciled model providers cannot satisfy UK public-sector ' +
                'procurement supply-chain evidence requirements.',
            baidu: 'PRC jurisdiction. NCSC AI supply-chain risk and model-provenance requirements cannot be ' +
                'satisfied by PRC-domiciled providers for UK public-sector AI deployments.',
            alibaba: 'PRC jurisdiction. Incompatible with NCSC AI supply-chain integrity requirements and ' +
                'UK Crown Commercial Service data-residency expectations.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'AI_THREAT_MODEL',
            'AI_SUPPLY_CHAIN_RISK',
            'MODEL_VULNERABILITY_REPORT',
            'RED_TEAM_FINDING',
            'SECURE_DEPLOYMENT_RECORD',
            'INCIDENT_RESPONSE_AI',
            'CREDENTIALS',
        ],
        categoryActions: {
            // Threat model updates require a review gate before processing
            AI_THREAT_MODEL: 'WARN',
            // Supply-chain risk records require tracking; warn for visibility
            AI_SUPPLY_CHAIN_RISK: 'WARN',
            // Vulnerability reports require controlled handling
            MODEL_VULNERABILITY_REPORT: 'WARN',
            // Red-team findings require controlled handling; route to security
            RED_TEAM_FINDING: 'WARN',
            // Routine deployment records are allowed through
            SECURE_DEPLOYMENT_RECORD: 'ALLOW',
            // AI incident response records require controlled routing
            INCIDENT_RESPONSE_AI: 'WARN',
            // Credentials are always blocked
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // 7 years — aligned with public-sector procurement record-keeping
        // (Cabinet Office guidance) and NCSC recommended evidence retention
        // for AI security assessments supplied to Crown Commercial Service.
        auditLogRetentionDays: 2555, // 7 years
        sessionRetentionDays: 2555,
        incidentRetentionDays: 3650, // 10 years for AI-specific incident records
        reference: 'Cabinet Office AI procurement record-keeping guidance; NCSC Guidelines for secure AI system ' +
            'development (2024) — evidence retention for Crown Commercial Service AI supplier assessments',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb', 'eu'],
    },
    incidentPolicy: {
        // NCSC recommends notifying within 72 hours for significant cyber incidents;
        // AI-specific incidents follow the same 72-hour window with the added
        // requirement that the AI component role (vector / target / amplifier)
        // be documented in the initial notification.
        notificationDeadlineHours: 72,
        reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 4: Incident response; ' +
            'NCSC Cyber Incident Signalling and Warning (CISW) 72-hour notification; ' +
            'UK GDPR Art. 33 when personal data involved',
        requiredRecipients: ['ncsc', 'ciso', 'security-operations', 'ai-system-owner'],
        formalNotificationRequired: true,
    },
    validators: [
        // Phase 1 — Secure design
        {
            id: 'behavioralValidator_ncsc_secure_design_threat_model_present',
            description: 'Phase 1 secure design: a current AI threat model (covering adversarial input paths, ' +
                'data poisoning, model inversion, supply-chain threats) is present and approved for ' +
                'each AI system deployment. NCSC requires threat modelling before deployment.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 1: Secure design',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ncsc-ai-supply-chain-provenance',
            description: 'Phase 1 / Phase 2: model provenance (dataset lineage, weight-integrity hash, SBOM-for-AI) ' +
                'documented and attested for every AI component in the deployment. ' +
                'Third-party model and dataset supply-chain risk assessed.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 1: Supply-chain risk; Phase 2: Dependency integrity',
            check: 'subservice_registry_active',
            failSeverity: 'CRITICAL',
        },
        // Phase 2 — Secure development
        {
            id: 'behavioralValidator_ncsc_secure_development_dependency_integrity',
            description: 'Phase 2 secure development: dependency integrity verification active for AI framework ' +
                'dependencies (version pinning, hash verification, SBOM generation). Unverified ' +
                'dependencies in AI model serving stacks are blocked.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 2: Secure development',
            check: 'governance_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ncsc-ai-model-weight-integrity',
            description: 'Phase 2 / Phase 3: model-weight integrity hash recorded at training time and verified ' +
                'at each deployment. Unauthorised model-weight changes (not approved via T2 Approval Queue) ' +
                'are blocked by the governance runtime.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 2: Model provenance; Phase 3: Deployment integrity',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        // Phase 3 — Secure deployment
        {
            id: 'behavioralValidator_ncsc_secure_deployment_record_present',
            description: 'Phase 3 secure deployment: a deployment record (infrastructure hardening checklist, ' +
                'access-control attestation, model-release approval) present for each AI system deployment. ' +
                'Deployment without a record is blocked.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 3: Secure deployment',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ncsc-ai-deployment-access-controls',
            description: 'Phase 3: MFA, least-privilege, and separation-of-duties enforced for AI deployment ' +
                'pipelines and model-serving infrastructure; JML workflow active for AI system operators.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 3: Access controls for AI deployment',
            check: 'rbac_active',
            failSeverity: 'CRITICAL',
        },
        // Phase 4 — Secure operation and maintenance
        {
            id: 'behavioralValidator_ncsc_secure_operation_monitoring_active',
            description: 'Phase 4 secure operation: adversarial-input detection, model-weight integrity monitoring, ' +
                'and prompt-injection alerting active in the production AI system; events routed to ' +
                'security operations within the 72-hour incident-notification window.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 4: Monitoring',
            check: 'monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ncsc-ai-red-team-cadence',
            description: 'Phase 4: red-team or adversarial testing exercise completed and findings recorded ' +
                'at least annually (or after material model changes); findings tracked to remediation.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 4: Red-teaming AI systems',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'behavioralValidator_ncsc_incident_response_ai_path_active',
            description: 'Phase 4: AI-specific incident response path active — events where an AI component ' +
                'is the attack vector, target, or amplifier are correctly classified and routed to NCSC ' +
                'and the AI system owner within 72 hours.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 4: Incident response',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ncsc-ai-vulnerability-disclosure-active',
            description: 'Phase 4: a responsible-disclosure process is in place for AI-specific vulnerabilities ' +
                '(model weaknesses, plugin injection flaws, adversarial robustness gaps); ' +
                'vulnerability reports are acknowledged and remediated within defined SLAs.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 4: Vulnerability disclosure',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        // Cross-cutting
        {
            id: 'ncsc-ai-credential-block',
            description: 'Credentials blocked from all NCSC AI security evidence artefacts (threat models, ' +
                'deployment records, vulnerability reports, incident reports). Aligns with NCSC ' +
                'secure-configuration guidance for AI systems.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — cross-cutting secure configuration; NCSC secrets management',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ncsc-ai-encryption-active',
            description: 'NCSC-recommended cipher / TLS profiles in use for AI-serving endpoints and model-weight ' +
                'storage; model weights encrypted at rest and in transit.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 3: Infrastructure hardening; NCSC TLS guidance',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ncsc-ai-audit-trail-tamper-evident',
            description: 'Tamper-evident audit trail covering all four NCSC AI security phases: threat-model ' +
                'approvals, dependency-integrity records, deployment sign-offs, incident and red-team ' +
                'records. 7-year retention per public-sector procurement standards.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — all phases; Cabinet Office record-keeping guidance',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'ncsc-ai-model-swap-t2-approval',
            description: 'T2 Approval Queue gate: any swap of model weights (version upgrade, fine-tune deployment, ' +
                'model replacement) requires a Tier-2 human reviewer to approve the updated threat model, ' +
                'provenance attestation, and deployment record before the change is permitted.',
            reference: 'NCSC Guidelines for secure AI system development (2024) — Phase 3: Deployment approval; Phase 1: Threat model currency',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ncsc-ai-7yr-retention-active',
            description: 'Session-persistence module enforcing minimum 2555-day (7-year) retention for all NCSC ' +
                'AI security evidence records, aligned with Cabinet Office AI procurement record-keeping.',
            reference: 'Cabinet Office AI procurement guidance; NCSC AI security evidence retention',
            check: 'governance_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=ncsc-ai-security.js.map