/**
 * NIH IT Security Policy -- Pack
 *
 * Split notice: All four NIH policy instruments were previously bundled in
 * `src/packs/nih-data-sharing.ts`. Split per Thomas's 2026-04-24 principle:
 * one country, one regulation, one pack. Reference the original Vera brief at
 * `docs/compliance-research/2026-04-24-pack-brief-nih-data-sharing.md`
 * which documented all four instruments.
 *
 * Cross-pack interactions (all 4 NIH packs typically activate together):
 *   - us-nih-it-security provides the FISMA Moderate baseline required by
 *     both us-nih-gds (controlled-access genomic data systems) and
 *     us-nih-dms (systems processing controlled-access NIH data generally).
 *   - us-nih-coc requires FISMA Moderate or equivalent for systems
 *     processing CoC-protected identifiable data.
 *   - When all 4 packs are active, strictest-wins resolves conflicts.
 *     IT Security provides the infrastructure floor; DMS, GDS, and CoC
 *     add data-level controls above that floor.
 *
 * NIH IT Security Policy (NIH Manual Chapter 2800 series):
 * Governs IT systems handling NIH research data. FISMA Moderate baseline
 * generally required for systems processing controlled-access NIH data.
 * Aligns with FISMA (44 USC 3554) and NIST SP 800-53 Moderate control
 * baseline.
 *
 * @connexum/ai-governance
 */
/**
 * NIH IT Security category classifiers.
 * Identifies systems and data gaps that indicate FISMA Moderate baseline
 * requirements apply or are not being met.
 */
export const NIH_IT_SECURITY_CATEGORY_CLASSIFIERS = {
    NIH_IT_FISMA_BASELINE_GAP: {
        references: ['NIH Manual Chapter 2800 series -- NIH IT Security Policy; FISMA (44 USC 3554); NIST SP 800-53 Moderate'],
        classifier: (input) => {
            if (/\b(?:fisma.gap|fisma.baseline.gap|nih.it.security.gap|NIH_IT_FISMA_BASELINE_GAP|nist.800.53.moderate.gap)\b/i.test(input))
                return true;
            // Unencrypted controlled-access NIH data transmission
            if (/\b(?:unencrypted|plaintext)\b.*\b(?:nih.data|controlled.access|dbGaP|genomic)\b/i.test(input))
                return true;
            if (/\b(?:nih.data|controlled.access|dbGaP|genomic)\b.*\b(?:unencrypted|plaintext)\b/i.test(input))
                return true;
            return false;
        },
    },
    NIH_IT_BAA_EQUIVALENT_REQUIRED: {
        references: ['NIH Manual Chapter 2800 series -- vendor security requirements for NIH data; FISMA (44 USC 3554); DUA requirements'],
        classifier: (input) => {
            if (/\b(?:NIH_IT_BAA_EQUIVALENT_REQUIRED|nih.vendor.security|nih.dua.security.requirement|fisma.vendor.attestation)\b/i.test(input))
                return true;
            // Vendor processing NIH data without security attestation
            if (/\b(?:vendor|provider|third.party)\b.*\b(?:nih.research.data|controlled.access|dbGaP)\b.*\b(?:no.security|unattested|no.dua|no.fisma)\b/i.test(input))
                return true;
            return false;
        },
    },
};
export const NIH_IT_SECURITY_PACK = {
    categoryClassifiers: NIH_IT_SECURITY_CATEGORY_CLASSIFIERS,
    /** P3.5: IT security gaps are system-level findings, not subject-keyed. */
    subjectKeyedCategories: [],
    id: 'us-nih-it-security',
    name: 'NIH IT Security Policy (FISMA Moderate)',
    version: '1.0.0',
    description: 'NIH IT Security Policy (NIH Manual Chapter 2800 series). FISMA Moderate baseline (44 USC 3554; NIST SP 800-53 Moderate) required for systems processing controlled-access NIH research data. Covers encryption requirements, vendor security attestation, DUA security clauses, access controls, and audit logging. Activate alongside us-nih-dms, us-nih-gds, and us-nih-coc for complete NIH research compliance.',
    authority: 'National Institutes of Health (NIH), HHS; NIH Office of the Chief Information Officer (OCIO); FISMA (44 USC 3554)',
    industries: ['clinical-research', 'academic-research', 'genomics', 'biotech', 'federal-grantee', 'higher-education'],
    requiredModules: [
        {
            name: 'encryption-layer',
            required: true,
            reason: 'FISMA Moderate equivalent encryption for controlled-access NIH data; FIPS 140 validation for systems in scope',
            reference: 'NIH IT Security Policy (NIH Manual Chapter 2800 series); FISMA (44 USC 3554); FIPS 140-2',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'FISMA Moderate AU (Audit and Accountability) control family; tamper-evident audit log per NIST SP 800-53 AU-2, AU-3, AU-9',
            reference: 'NIH IT Security Policy; NIST SP 800-53 Moderate AU controls',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Identify FISMA baseline gaps and NIH IT security control deficiencies',
            reference: 'NIH Manual Chapter 2800 series; NIST SP 800-53 Moderate',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Vendor FISMA Moderate or FedRAMP Moderate attestation in DUA; security requirements for NIH data vendors',
            reference: 'NIH IT Security Policy; NIH GPS vendor security requirements (citation to verify)',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'FISMA security evidence documentation; security authorization (ATO equivalent) records',
            reference: 'FISMA (44 USC 3554); NIH Manual Chapter 2800 series',
        },
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Enforce FISMA Moderate access control (AC family) and identification/authentication (IA family) requirements',
            reference: 'NIST SP 800-53 Moderate AC/IA controls; NIH IT Security Policy',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'FISMA Moderate SI (System and Information Integrity) and IR (Incident Response) control family monitoring requirements',
            reference: 'NIST SP 800-53 Moderate SI/IR controls; NIH IT Security Policy',
        },
    ],
    moduleConfig: {
        'encryption-layer': {
            fismaModerateEncryptionRequired: true,
            fips140Required: true,
        },
        'data-classifier': {
            enabledCategories: ['NIH_IT_FISMA_BASELINE_GAP', 'NIH_IT_BAA_EQUIVALENT_REQUIRED'],
        },
        'supply-chain': {
            fismaModerateRequiredForControlledAccess: true,
            duaSecurityClauseRequired: true,
        },
        'attestation-manager': {
            nihAuditRightsAcknowledged: true,
            fismaAtoDocumentationRequired: true,
        },
        'anomaly-detector': {
            fismaIncidentResponseMonitoringActive: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [
            'FISMA-MODERATE-OR-FEDRAMP-MODERATE',
            'DATA-RESIDENCY-US',
            'FIPS-140-2-VALIDATED',
        ],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['NIH_IT_FISMA_BASELINE_GAP', 'NIH_IT_BAA_EQUIVALENT_REQUIRED'],
        categoryActions: {
            NIH_IT_FISMA_BASELINE_GAP: 'BLOCK',
            NIH_IT_BAA_EQUIVALENT_REQUIRED: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        auditLogRetentionDays: 2555, // 7 years (NIH clinical research standard; FISMA requires 3 years minimum)
        sessionRetentionDays: 2555,
        incidentRetentionDays: 2555,
        reference: 'NIH IT Security Policy (NIH Manual Chapter 2800 series); FISMA (44 USC 3554); NIST SP 800-53 AU-11 (audit log retention); NIH grant record retention 7 years',
    },
    incidentPolicy: {
        notificationDeadlineHours: 1, // FISMA major incident: within 1 hour to US-CERT
        reference: 'NIH IT Security Policy; FISMA (44 USC 3554) -- major incident 1-hour reporting to US-CERT; NIH OCIO incident response procedures; NIH Program Officer notification 72h',
        requiredRecipients: ['nih-ocio', 'us-cert', 'nih-program-officer', 'institution-research-compliance'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'nih-it-fisma-security-baseline',
            description: 'Provider demonstrates FISMA Moderate or FedRAMP Moderate for controlled-access data systems',
            reference: 'NIH IT Security Policy (NIH Manual Chapter 2800 series); FISMA (44 USC 3554)',
            check: 'nih_dms_fisma_security_baseline',
            failSeverity: 'HIGH',
        },
        {
            id: 'nih-it-encryption-required',
            description: 'FIPS 140-2 validated encryption for NIH controlled-access data at rest and in transit',
            reference: 'FIPS 140-2; NIH Manual Chapter 2800 series',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nih-it-audit-logging',
            description: 'NIST SP 800-53 Moderate AU controls: tamper-evident audit log for all system access',
            reference: 'NIST SP 800-53 Moderate AU-2, AU-3, AU-9; NIH IT Security Policy',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'nih-it-vendor-security-dua',
            description: 'DUA incorporates vendor FISMA security requirements',
            reference: 'NIH IT Security Policy; NIH GPS vendor security requirements',
            check: 'nih_dms_no_training_on_research_data',
            failSeverity: 'HIGH',
        },
        {
            id: 'nih-it-incident-response',
            description: 'FISMA major incident reporting to US-CERT within 1 hour',
            reference: 'FISMA (44 USC 3554); NIH OCIO incident response procedures',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=us-nih-it-security.js.map