/**
 * CMMC 2.0 Compliance Pack
 *
 * Cybersecurity Maturity Model Certification 2.0.
 * Final Rule: 32 CFR Part 170, effective December 16, 2024.
 * DoD CUI Rule: 32 CFR Part 2002 (CUI Program).
 * DFARS clause 252.204-7012, 252.204-7019, 252.204-7020, 252.204-7021.
 *
 * CMMC 2.0 applies to all DoD contractors and subcontractors that
 * handle Controlled Unclassified Information (CUI) or Federal Contract
 * Information (FCI) in their unclassified systems. Three levels:
 *
 *   Level 1 (Foundational): FCI only. 17 practices from FAR 52.204-21.
 *     Annual self-assessment. No third-party certification.
 *
 *   Level 2 (Advanced): CUI. 110 practices from NIST SP 800-171 Rev 2.
 *     Triennial third-party assessment by C3PAO for critical programs;
 *     annual self-assessment for non-critical. POAM allowed with
 *     time-bound remediation for some controls.
 *
 *   Level 3 (Expert): CUI in critical programs. 134 practices (NIST
 *     SP 800-171 Rev 2 + selected NIST SP 800-172 enhanced practices).
 *     Triennial government-led assessment by DIBCAC. No POAM for
 *     critical deficiencies.
 *
 * AI-specific CMMC considerations (2024):
 *   - Any AI model that ingests CUI during training or inference is in
 *     scope. CMMC Level 2 minimum for DoD AI systems processing CUI.
 *   - Supply chain AI vendors (AI-as-a-service) are External Cloud
 *     Service Providers (CSPs) and must have FedRAMP Moderate ATO or
 *     equivalent (DFARS 252.239-7010).
 *   - Model weights containing derived CUI are themselves CUI.
 *   - AI inference logs that contain CUI are in scope for CMMC logging
 *     requirements (AU control family, NIST SP 800-171 Rev 2 3.3.x).
 *   - System Security Plan (SSP) must document AI system boundaries and
 *     data flows (NIST SP 800-171 Rev 2 3.12.4).
 *
 * Key control families (NIST SP 800-171 Rev 2) for AI:
 *   - AC (3.1.x): Access Control -- 22 practices
 *   - AT (3.2.x): Awareness and Training -- 3 practices
 *   - AU (3.3.x): Audit and Accountability -- 9 practices
 *   - CM (3.4.x): Configuration Management -- 9 practices
 *   - IA (3.5.x): Identification and Authentication -- 11 practices
 *   - IR (3.6.x): Incident Response -- 3 practices
 *   - MA (3.7.x): Maintenance -- 6 practices
 *   - MP (3.8.x): Media Protection -- 9 practices
 *   - PE (3.10.x): Physical Protection -- 6 practices
 *   - PS (3.9.x): Personnel Security -- 2 practices
 *   - RA (3.11.x): Risk Assessment -- 3 practices
 *   - CA (3.12.x): Security Assessment -- 4 practices
 *   - SC (3.13.x): System and Communications Protection -- 16 practices
 *   - SI (3.14.x): System and Information Integrity -- 7 practices
 *
 * Sovereignty: US Federal (DoD contractor supply chain).
 *
 * @connexum/ai-governance
 */
/**
 * CMMC 2.0 (32 CFR Part 170) category classifiers.
 * Cybersecurity Maturity Model Certification for DoD contractors.
 * Protects CUI (Controlled Unclassified Information) and FCI (Federal Contract Information).
 */
export const CMMC2_CATEGORY_CLASSIFIERS = {
    CUI: {
        references: ['NIST SP 800-171 Rev 2 3.1.1 -- CUI access control; CMMC Level 2 practice AC.L2-3.1.1'],
        classifier: (input) => {
            if (/\b(?:CUI|controlled\s+unclassified\s+information|CUI\/\w+)\b/.test(input))
                return true;
            if (/\b(?:for\s+official\s+use\s+only|FOUO|sensitive\s+but\s+unclassified|SBU)\b/i.test(input))
                return true;
            return false;
        },
    },
    FCI: {
        references: ['FAR 52.204-21 -- Federal Contract Information; CMMC Level 1 FCI protection'],
        classifier: (input) => {
            if (/\b(?:FCI|federal\s+contract\s+information|government\s+contract\s+(?:data|record))\b/i.test(input))
                return true;
            if (/\b(?:contract\s+number|DFARS|prime\s+contractor|sub.?contractor)\b/i.test(input))
                return true;
            return false;
        },
    },
    CUI_EXPORT_CONTROLLED: {
        references: ['CMMC -- ITAR/EAR export controlled CUI; CUI//SP-EXPT'],
        classifier: (input) => {
            if (/\b(?:ITAR|EAR|export\s+controlled|export\s+control|CUI.{0,5}EXPT)\b/i.test(input))
                return true;
            if (/\b(?:22\s*CFR\s*(?:120|121)|15\s*CFR\s*(?:730|774))\b/.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['NIST SP 800-171 Rev 2 3.5.1 -- identification and authentication; PII in contractor systems'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['NIST SP 800-171 Rev 2 3.5 -- identification and authentication; credential protection'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const CMMC2_PACK = {
    categoryClassifiers: CMMC2_CATEGORY_CLASSIFIERS,
    id: 'cmmc2',
    name: 'CMMC 2.0 (Level 2)',
    version: '1.0.0',
    description: 'Cybersecurity Maturity Model Certification 2.0 Level 2 (32 CFR Part 170, effective Dec 2024) for DoD contractor AI systems handling Controlled Unclassified Information (CUI). Covers 110 NIST SP 800-171 Rev 2 practices: access control, audit logging, configuration management, MFA, incident response, CUI encryption, supply chain (AI-as-a-service CSP controls), System Security Plan boundary documentation, and AI model/inference-log CUI scope.',
    authority: 'US Department of Defense (DoD CMMC PMO); DIBCAC for Level 3',
    industries: ['defense', 'government-contractor', 'aerospace', 'manufacturing', 'research', 'govtech'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Access control (AC 3.1.x): 22 practices; least-privilege; CUI access policy; deny-by-default; SSP boundary documentation',
            reference: 'NIST SP 800-171 Rev 2 3.1.1-3.1.22 (Access Control); 3.12.4 (SSP)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Audit and accountability (AU 3.3.x): 9 practices; AI inference log retention; tamper-evident audit trail',
            reference: 'NIST SP 800-171 Rev 2 3.3.1-3.3.9 (Audit and Accountability)',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'FIPS 140-2/3 validated encryption for CUI at rest and in transit (SC 3.13.x); model weights containing derived CUI',
            reference: 'NIST SP 800-171 Rev 2 3.13.8, 3.13.10, 3.13.16; FIPS 140-2',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'CUI and FCI detection; prevent CUI leakage to non-authorised systems; AI inference output scanning',
            reference: 'NIST SP 800-171 Rev 2 3.1.3 (CUI flow enforcement); 32 CFR 2002',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'MFA for all CUI system access (IA 3.5.x): 11 practices; unique agent identification; password complexity',
            reference: 'NIST SP 800-171 Rev 2 3.5.3 (MFA); 3.5.1-3.5.11 (Identification and Authentication)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'External CSP AI-as-a-service must have FedRAMP Moderate ATO or equivalent; DFARS 252.239-7010; vendor SSP review',
            reference: 'NIST SP 800-171 Rev 2 3.12.1-3.12.4 (Security Assessment); DFARS 252.239-7010; DFARS 252.204-7012',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Incident response (IR 3.6.x): 3 practices; CUI breach notification; real-time monitoring for CUI exfiltration',
            reference: 'NIST SP 800-171 Rev 2 3.6.1-3.6.3 (Incident Response)',
        },
        {
            name: 'circuit-breaker',
            required: true,
            reason: 'Incident isolation (IR 3.6.2); system and information integrity (SI 3.14.x); malicious code protection',
            reference: 'NIST SP 800-171 Rev 2 3.6.2 (incident capability); 3.14.1-3.14.7 (SI)',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'System Security Plan (SSP) documentation; POAM management; Level 2 self-assessment or C3PAO assessment evidence',
            reference: 'NIST SP 800-171 Rev 2 3.12.4 (SSP); 32 CFR Part 170 (CMMC assessment requirements)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Configuration management (CM 3.4.x): 9 practices; change approval gate; software usage restriction review',
            reference: 'NIST SP 800-171 Rev 2 3.4.1-3.4.9 (Configuration Management)',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'CUI',
                'FCI',
                'CUI_EXPORT_CONTROLLED',
                'PII',
                'CREDENTIALS',
            ],
            cuiAction: 'BLOCK_UNLESS_CMMC_AUTHORISED',
            cuiExportControlledAction: 'BLOCK',
        },
        'encryption-layer': {
            fips140ValidatedRequired: true,
            cuiAtRestEncryptionRequired: true,
            cuiInTransitEncryptionRequired: true,
        },
        'agent-auth': {
            mfaForCuiSystemAccessRequired: true,
            passwordComplexityRequired: true,
            uniqueAgentIdentificationRequired: true,
        },
        'governance-runtime': {
            cuiAccessPolicyRequired: true,
            leastPrivilegeEnforced: true,
            cuiFlowEnforcementRequired: true,
            sspBoundaryDocumentationRequired: true,
        },
        'supply-chain': {
            externalCspFedrampModerateRequired: true,
            vendorSspReviewRequired: true,
            dfars252204_7012Required: true,
        },
        'event-bus': {
            cuiBreachNotificationRequired: true,
            cuiExfiltrationMonitoringRequired: true,
        },
        'attestation-manager': {
            sspDocumentationRequired: true,
            poamManagementRequired: true,
            cmmcSelfAssessmentOrC3paoRequired: true,
            assessmentCadenceDays: 1095,
        },
        'approval-queue': {
            configurationChangeApprovalRequired: true,
            softwareUsageRestrictionRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['FIPS-140-VALIDATED', 'DATA-RESIDENCY-US', 'FEDRAMP-MODERATE-OR-EQUIVALENT'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['CUI', 'FCI', 'CUI_EXPORT_CONTROLLED', 'PII', 'CREDENTIALS'],
        categoryActions: {
            CUI: 'BLOCK',
            FCI: 'WARN',
            CUI_EXPORT_CONTROLLED: 'BLOCK',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-FIPS',
        minimumClassification: 'CUI',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // NIST SP 800-171 Rev 2 3.3.1: audit log retention per organisational policy.
        // CMMC assessment evidence: retained for 3 years per assessment cycle.
        //
        // OPERATOR_VERIFICATION_REQUIRED (F-NEW-VERA-PACK-C5-03, 2026-05-03):
        // The default value of 1095 days (3 years) is derived from the CMMC
        // triennial assessment cycle and NIST SP 800-171 Rev 2 baseline. The
        // Final Rule (32 CFR Part 170, effective December 16, 2024) may specify
        // a different or supplementary retention period. Operators subject to
        // the CMMC Final Rule MUST verify the applicable retention requirement
        // with their legal counsel or CMMC Third-Party Assessment Organization
        // (C3PAO) before deployment. Override auditLogRetentionDays in your
        // organisation-specific pack configuration if a different period applies.
        auditLogRetentionDays: 1095,
        sessionRetentionDays: 1095,
        incidentRetentionDays: 1095,
        reference: 'NIST SP 800-171 Rev 2 3.3.1; CMMC assessment cycle (3 years); 32 CFR Part 170 (Final Rule, Dec 2024 -- verify retention period with counsel)',
    },
    incidentPolicy: {
        // DFARS 252.204-7012: report cyber incidents affecting CUI to DoD within 72 hours.
        notificationDeadlineHours: 72,
        reference: 'DFARS 252.204-7012 (72-hour cyber incident reporting to DoD); NIST SP 800-171 Rev 2 3.6.1-3.6.3',
        requiredRecipients: ['dod-cyber-crime-center-dc3', 'program-manager', 'contracting-officer'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'cmmc2-fips-encryption',
            description: 'FIPS 140-2/3 validated encryption active for CUI at rest and in transit',
            reference: 'NIST SP 800-171 Rev 2 3.13.8, 3.13.10, 3.13.16',
            check: 'encryption_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cmmc2-mfa',
            description: 'MFA active for all CUI system access',
            reference: 'NIST SP 800-171 Rev 2 3.5.3',
            check: 'cmmc2_mfa_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cmmc2-cui-classifier',
            description: 'CUI and FCI detected and flow-controlled; AI inference output scanned for CUI',
            reference: 'NIST SP 800-171 Rev 2 3.1.3 (CUI flow enforcement)',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cmmc2-audit-trail',
            description: 'All CUI system access logged in tamper-evident audit trail',
            reference: 'NIST SP 800-171 Rev 2 3.3.1-3.3.9',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cmmc2-dfars-incident',
            description: '72-hour cyber incident reporting to DoD configured',
            reference: 'DFARS 252.204-7012',
            check: 'cmmc2_dfars_incident_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cmmc2-csp-fedramp',
            description: 'External AI-as-a-service providers verified as FedRAMP Moderate or equivalent',
            reference: 'DFARS 252.239-7010; NIST SP 800-171 Rev 2 3.12.1',
            check: 'cmmc2_csp_fedramp_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cmmc2-ssp',
            description: 'System Security Plan (SSP) documenting AI system boundaries and CUI data flows',
            reference: 'NIST SP 800-171 Rev 2 3.12.4',
            check: 'cmmc2_ssp_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cmmc2-configuration-management',
            description: 'Configuration change approval gate active for AI system',
            reference: 'NIST SP 800-171 Rev 2 3.4.1-3.4.9',
            check: 'change_management_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cmmc2-least-privilege',
            description: 'Least-privilege access control enforced for all AI agent identities',
            reference: 'NIST SP 800-171 Rev 2 3.1.1-3.1.2',
            check: 'governance_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=cmmc2.js.map