/**
 * CMMC 2.0 Compliance Pack
 *
 * Cybersecurity Maturity Model Certification 2.0.
 * Final Rule: 32 CFR Part 170, effective December 16, 2024.
 * DoD CUI Rule: 32 CFR Part 2002 (CUI Program).
 * DFARS clause 252.204-7012, 252.204-7019, 252.204-7020, 252.204-7021.
 *
 * CMMC 2.0 applies to all DoD contractors and subcontractors that
 * handle Controlled Unclassified Information (CUI) or Federal Contract
 * Information (FCI) in their unclassified systems. Three levels:
 *
 *   Level 1 (Foundational): FCI only. 17 practices from FAR 52.204-21.
 *     Annual self-assessment. No third-party certification.
 *
 *   Level 2 (Advanced): CUI. 110 practices from NIST SP 800-171 Rev 2.
 *     Triennial third-party assessment by C3PAO for critical programs;
 *     annual self-assessment for non-critical. POAM allowed with
 *     time-bound remediation for some controls.
 *
 *   Level 3 (Expert): CUI in critical programs. 134 practices (NIST
 *     SP 800-171 Rev 2 + selected NIST SP 800-172 enhanced practices).
 *     Triennial government-led assessment by DIBCAC. No POAM for
 *     critical deficiencies.
 *
 * AI-specific CMMC considerations (2024):
 *   - Any AI model that ingests CUI during training or inference is in
 *     scope. CMMC Level 2 minimum for DoD AI systems processing CUI.
 *   - Supply chain AI vendors (AI-as-a-service) are External Cloud
 *     Service Providers (CSPs) and must have FedRAMP Moderate ATO or
 *     equivalent (DFARS 252.239-7010).
 *   - Model weights containing derived CUI are themselves CUI.
 *   - AI inference logs that contain CUI are in scope for CMMC logging
 *     requirements (AU control family, NIST SP 800-171 Rev 2 3.3.x).
 *   - System Security Plan (SSP) must document AI system boundaries and
 *     data flows (NIST SP 800-171 Rev 2 3.12.4).
 *
 * Key control families (NIST SP 800-171 Rev 2) for AI:
 *   - AC (3.1.x): Access Control -- 22 practices
 *   - AT (3.2.x): Awareness and Training -- 3 practices
 *   - AU (3.3.x): Audit and Accountability -- 9 practices
 *   - CM (3.4.x): Configuration Management -- 9 practices
 *   - IA (3.5.x): Identification and Authentication -- 11 practices
 *   - IR (3.6.x): Incident Response -- 3 practices
 *   - MA (3.7.x): Maintenance -- 6 practices
 *   - MP (3.8.x): Media Protection -- 9 practices
 *   - PE (3.10.x): Physical Protection -- 6 practices
 *   - PS (3.9.x): Personnel Security -- 2 practices
 *   - RA (3.11.x): Risk Assessment -- 3 practices
 *   - CA (3.12.x): Security Assessment -- 4 practices
 *   - SC (3.13.x): System and Communications Protection -- 16 practices
 *   - SI (3.14.x): System and Information Integrity -- 7 practices
 *
 * Sovereignty: US Federal (DoD contractor supply chain).
 *
 * @connexum/ai-governance
 */
import { CompliancePack } from './index';
import { CategoryClassifiers } from '../classification/pack-driven-classifier';
/**
 * CMMC 2.0 (32 CFR Part 170) category classifiers.
 * Cybersecurity Maturity Model Certification for DoD contractors.
 * Protects CUI (Controlled Unclassified Information) and FCI (Federal Contract Information).
 */
export declare const CMMC2_CATEGORY_CLASSIFIERS: CategoryClassifiers;
export declare const CMMC2_PACK: CompliancePack & {
    categoryClassifiers: CategoryClassifiers;
};
//# sourceMappingURL=cmmc2.d.ts.map