/**
 * AU APRA CPS 234 — Information Security
 *
 * Primary instrument: Prudential Standard CPS 234 Information Security
 * (effective 1 July 2019; reviewed 2022). Cross-referenced with CPS 230
 * Operational Risk (effective 1 July 2025).
 *
 * Entities covered: All APRA-regulated entities (AREs): ADIs (banks, credit
 * unions, building societies); general/life/private health insurers;
 * superannuation RSE licensees; foreign entities with AU branch. Extends to
 * material service providers and third-party suppliers in the ARE's information
 * asset supply chain.
 *
 * AI as information asset: AI systems, model-serving infrastructure, and data
 * pipelines used by AREs are information assets within scope — Para 17 requires
 * classification and registration.
 *
 * Key AI obligations:
 *   - Para 17: All information assets (incl. AI training data, models, inference
 *     endpoints) classified and registered.
 *   - Para 20: Third-party AI vendors assessed for security controls pre-engagement
 *     and annually. AI SaaS vendors squarely within scope.
 *   - Para 21: AI-specific monitoring required: model behaviour anomalies, data
 *     exfiltration via inference.
 *   - Para 23: APRA notification within 72 hours of material incident, externally-
 *     exploited incident, or material control weakness.
 *   - Para 24-26: Annual or risk-based testing; AI security vectors (adversarial,
 *     prompt injection, data poisoning) included.
 *
 * Cross-pack interactions:
 *   - au-cps234 + au-cps230: Complementary regimes. CPS 234 = info security;
 *     CPS 230 = operational resilience, service providers, business continuity.
 *     Both required for APRA-regulated entities. CPS 230 service-provider register
 *     integrates with CPS 234 third-party controls.
 *   - au-cps234 + au-privacy-act: APP 11 security obligation parallels CPS 234.
 *     CPS 234 sets higher technical bar; satisfying CPS 234 substantially satisfies
 *     APP 11 for AREs.
 *   - au-cps234 + au-soci-act: Banks/insurers that are SOCI SoNS operators face
 *     parallel incident-notification obligations. SOCI 12-hour clock may fire before
 *     CPS 234 72-hour deadline.
 *   - au-cps234 + soc2: SOC 2 useful but not sufficient; CPS 234 requires a
 *     contractual addendum covering AU-specific APRA obligations.
 *
 * Authority: Australian Prudential Regulation Authority (APRA)
 * Sovereignty: Australian Federal (APRA-regulated entities)
 *
 * @connexum/ai-governance
 */
import { CompliancePack } from './index';
import { CategoryClassifiers } from '../classification/pack-driven-classifier';
export declare const AU_CPS234_CATEGORY_CLASSIFIERS: CategoryClassifiers;
export declare const AU_CPS234_PACK: CompliancePack & {
    categoryClassifiers: CategoryClassifiers;
    subjectKeyedCategories: string[];
};
//# sourceMappingURL=au-cps234.d.ts.map