/**
 * HITRUST Common Security Framework (CSF) Compliance Pack
 *
 * Framework: HITRUST CSF v11.x — a control framework that harmonises
 *   HIPAA, NIST CSF, NIST 800-53, ISO 27001, PCI DSS, GDPR, and
 *   sector-specific guidance into a single assessable framework.
 *   Widely adopted in US healthcare + healthcare-supplier contracts.
 *
 * Jurisdiction: US-origin, increasingly global (esp. healthcare).
 * Authority: HITRUST Alliance (private framework body) + adopting
 *   procurer / sectoral regulator.
 *
 * Three assessment levels:
 *   - **e1 (essentials)** — 44 controls, foundational cybersecurity
 *   - **i1 (implemented)** — 182 controls, threat-adapted
 *   - **r2 (risk-based)** — 200-2000+ controls, organization-specific
 *
 * 19 control categories across: Information Protection Program, Endpoint
 * Protection, Portable Media Security, Mobile Device Security, Wireless
 * Security, Configuration Management, Vulnerability Management, Network
 * Protection, Transmission Protection, Password Management, Access
 * Control, Audit Logging and Monitoring, Education Training and
 * Awareness, Third Party Assurance, Incident Management, Business
 * Continuity and Disaster Recovery, Risk Management, Physical and
 * Environmental Security, Data Protection and Privacy.
 *
 * Why this pack:
 *   - HITRUST is a common procurement requirement for US healthcare
 *     suppliers and BAAs frequently reference HITRUST certification.
 *   - Distinct from `hipaa` (statute) — HITRUST is the assessment
 *     framework that gives evidence-of-compliance for HIPAA + others.
 *
 * @connexum/ai-governance
 */
export const HITRUST_CSF_CATEGORY_CLASSIFIERS = {
    HITRUST_ASSESSMENT_LEVEL: {
        references: ['HITRUST CSF assessment levels e1 / i1 / r2'],
        classifier: (i) => /\b(?:hitrust\s+(?:e1|i1|r2)|hitrust\s+(?:csf|certification)\s+(?:essentials|implemented|risk-based))\b/i.test(i),
    },
    HITRUST_CONTROL_REFERENCE: {
        references: ['HITRUST CSF control references'],
        classifier: (i) => /\b(?:hitrust\s+control|csf\s+(?:0[0-9]|1[0-9])\.\w+|hitrust\s+(?:reference|requirement))\b/i.test(i),
    },
    MYCSF_REPORT: {
        references: ['HITRUST MyCSF assessment report'],
        classifier: (i) => /\b(?:mycsf|hitrust\s+(?:certification\s+report|assessment\s+report)|hitrust\s+letter)\b/i.test(i),
    },
    THIRD_PARTY_ASSURANCE: {
        references: ['HITRUST CSF Third Party Assurance category'],
        classifier: (i) => /\b(?:hitrust\s+(?:tpa|third[\s-]?party\s+assurance)|baa\s+hitrust|sub[\s-]?contractor\s+hitrust)\b/i.test(i),
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety'],
        classifier: (i) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(i))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(i))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(i))
                return true;
            return false;
        },
    },
};
export const HITRUST_CSF_PACK = {
    categoryClassifiers: HITRUST_CSF_CATEGORY_CLASSIFIERS,
    id: 'hitrust-csf',
    aliases: ['hitrust', 'hitrust-common-security-framework', 'hitrust-e1', 'hitrust-i1', 'hitrust-r2'],
    name: 'HITRUST Common Security Framework (CSF) v11',
    version: '1.0.0',
    description: 'HITRUST CSF v11 — control framework harmonising HIPAA, NIST CSF, NIST 800-53, ISO 27001, PCI DSS, GDPR, and sector-specific guidance into a single assessable framework. Three assessment levels: e1 (44 controls), i1 (182), r2 (200-2000+). 19 control categories. Widely adopted in US healthcare + healthcare-supplier contracts; commonly required by BAAs. Distinct from `hipaa` (statute) — HITRUST is the assessment framework providing evidence-of-compliance.',
    authority: 'HITRUST Alliance + adopting procurer / sectoral regulator',
    industries: ['healthcare', 'pharma', 'public-sector', 'cloud-infrastructure', 'financial-services'],
    requiredModules: [
        { name: 'attestation-manager', required: true, reason: 'Assessment level designation (e1/i1/r2); MyCSF report archived; per-control evidence; certification cycle tracked.', reference: 'HITRUST CSF assessment lifecycle' },
        { name: 'governance-runtime', required: true, reason: 'Information Protection Program gate; access control + endpoint protection + transmission protection enforcement.', reference: 'HITRUST 19 control categories' },
        { name: 'audit-integrity', required: true, reason: 'Audit Logging and Monitoring category — tamper-evident chain required for HITRUST assessor evidence.', reference: 'HITRUST Audit Logging category' },
        { name: 'event-bus', required: true, reason: 'Incident Management category routing; vulnerability-management telemetry.', reference: 'HITRUST Incident Management + Vulnerability Management' },
        { name: 'data-classifier', required: true, reason: 'Data Protection and Privacy category; surface assessment level + control references + MyCSF report.', reference: 'HITRUST Data Protection category' },
        { name: 'agent-auth', required: true, reason: 'Access Control + Password Management categories.', reference: 'HITRUST Access Control + Password Management' },
        { name: 'encryption-layer', required: true, reason: 'Transmission Protection + Mobile Device Security; encryption-at-rest evidence.', reference: 'HITRUST Transmission Protection' },
        { name: 'session-persistence', required: true, reason: 'HITRUST 2-year certification cycle + assessor evidence retention.', reference: 'HITRUST certification cycle' },
        { name: 'supply-chain', required: true, reason: 'Third Party Assurance category — sub-supplier HITRUST attestation captured.', reference: 'HITRUST Third Party Assurance' },
        { name: 'approval-queue', required: true, reason: 'Risk-acceptance decisions routed for senior approval; control-exception sign-off.', reference: 'HITRUST Risk Management' },
    ],
    moduleConfig: {
        'attestation-manager': { assessmentLevelTracked: true, mycsfReportArchived: true, certificationCycleTracked: true, perControlEvidenceTracked: true },
        'governance-runtime': { informationProtectionProgramGateRequired: true, endpointProtectionGateRequired: true },
        'audit-integrity': { hitrustAssessorEvidenceTrackingRequired: true },
        'event-bus': { incidentManagementRoutingRequired: true, vulnerabilityManagementTelemetryRequired: true },
        'data-classifier': { enabledCategories: ['HITRUST_ASSESSMENT_LEVEL', 'HITRUST_CONTROL_REFERENCE', 'MYCSF_REPORT', 'THIRD_PARTY_ASSURANCE', 'CREDENTIALS'], credentialsAction: 'BLOCK' },
        'agent-auth': { accessControlRequired: true, passwordManagementRequired: true },
        'encryption-layer': { algorithm: 'aes-256-gcm', transmissionProtectionRequired: true },
        'session-persistence': { retentionDaysMinimum: 730 },
        'supply-chain': { thirdPartyAssuranceRequired: true },
        'approval-queue': { reviewTier: 'T2' },
    },
    providerPolicy: { blockedProviders: [], requiredCapabilities: ['HITRUST-COMPATIBLE'], blockReasons: {} },
    dataPolicy: {
        scanCategories: ['HITRUST_ASSESSMENT_LEVEL', 'HITRUST_CONTROL_REFERENCE', 'MYCSF_REPORT', 'THIRD_PARTY_ASSURANCE', 'CREDENTIALS'],
        categoryActions: { HITRUST_ASSESSMENT_LEVEL: 'WARN', HITRUST_CONTROL_REFERENCE: 'WARN', MYCSF_REPORT: 'WARN', THIRD_PARTY_ASSURANCE: 'WARN', CREDENTIALS: 'BLOCK' },
        encryptionRequired: true, encryptionStandard: 'AES-256-GCM', minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: { auditLogRetentionDays: 730, sessionRetentionDays: 730, incidentRetentionDays: 1095, reference: 'HITRUST 2-year certification cycle + 3-year incident retention', forceDelete: false, requiresLegalHoldSupport: true, sovereignty: ['us', 'global'] },
    incidentPolicy: { notificationDeadlineHours: 24, reference: 'HITRUST Incident Management category', requiredRecipients: ['hitrust-program-officer', 'ciso', 'compliance-officer'], formalNotificationRequired: false },
    validators: [
        { id: 'hitrust-assessment-level', description: 'Assessment level (e1 / i1 / r2) designated; control set instantiated.', reference: 'HITRUST assessment levels', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'hitrust-mycsf-report', description: 'MyCSF assessment report archived; certification letter current.', reference: 'HITRUST MyCSF', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'hitrust-third-party-assurance', description: 'Third Party Assurance attestations captured for sub-suppliers / processors.', reference: 'HITRUST Third Party Assurance category', check: 'subservice_registry_active', failSeverity: 'HIGH' },
        { id: 'hitrust-access-control', description: 'Access Control + Password Management categories operative.', reference: 'HITRUST Access Control + Password Management', check: 'rbac_active', failSeverity: 'CRITICAL' },
        { id: 'hitrust-audit-logging', description: 'Audit Logging and Monitoring tamper-evident chain active.', reference: 'HITRUST Audit Logging', check: 'audit_trail_exists', failSeverity: 'CRITICAL' },
        { id: 'hitrust-incident-management', description: 'Incident Management workflow active; reporting + investigation captured.', reference: 'HITRUST Incident Management', check: 'monitoring_active', failSeverity: 'HIGH' },
        { id: 'hitrust-encryption', description: 'Transmission Protection + Mobile Device Security encryption active.', reference: 'HITRUST Transmission Protection', check: 'encryption_active', failSeverity: 'HIGH' },
        { id: 'hitrust-vulnerability-management', description: 'Vulnerability Management category active; patch cadence captured.', reference: 'HITRUST Vulnerability Management', check: 'monitoring_active', failSeverity: 'HIGH' },
        { id: 'hitrust-risk-management', description: 'Risk Management category active; risk-acceptance decisions reviewed.', reference: 'HITRUST Risk Management', check: 'governance_active', failSeverity: 'HIGH' },
        { id: 'hitrust-credential-block', description: 'Plaintext credentials blocked.', reference: 'HITRUST Password Management', check: 'data_classifier_active', failSeverity: 'CRITICAL' },
    ],
};
//# sourceMappingURL=hitrust-csf.js.map