/**
 * EU NIS2 Directive Compliance Pack
 *
 * Regulation: Directive (EU) 2022/2555 of the European Parliament and of the
 *             Council of 14 December 2022 on measures for a high common level
 *             of cybersecurity across the Union (NIS2 Directive)
 *
 * Jurisdiction: EU (European Union -- all member states)
 * Regulators: National competent authorities per Art. 8 (e.g., BSI in Germany,
 *             ANSSI in France, NCSC in Netherlands, ENISA as EU-level body);
 *             CSIRT network per Art. 11; cooperation group per Art. 14
 *
 * Effective dates:
 *   - 17 January 2023: entry into force
 *   - 17 October 2024: member state transposition deadline (Articles 41)
 *   - Note: Member state transposition quality varies; verify local law in
 *     each target jurisdiction before relying on national implementation.
 *
 * Scope -- Entity classification:
 *   ESSENTIAL ENTITIES (Annex I -- highest obligations):
 *     Energy (electricity, oil, gas, hydrogen, district heating), Transport
 *     (air, rail, water, road), Banking, Financial market infrastructure,
 *     Health (hospitals, EU reference labs, R&D, pharma), Drinking water,
 *     Wastewater, Digital infrastructure (IXPs, DNS, TLDs, cloud, data
 *     centres, CDNs, trust services, electronic comms), ICT service
 *     management (B2B MSPs, MSSPs), Public administration (central/regional),
 *     Space (ground-based infrastructure)
 *
 *   IMPORTANT ENTITIES (Annex II -- lower threshold, same 10 measures):
 *     Postal and courier services, Waste management, Manufacture of critical
 *     products (medical devices, computers/electronics, machinery, motor
 *     vehicles, other transport), Food production/processing/distribution,
 *     Digital providers (online marketplaces, search engines, social networks),
 *     Research organisations
 *
 * Key obligations (Art. 21 -- all entities):
 *   10 minimum cybersecurity risk-management measures:
 *   1. Incident handling
 *   2. Business continuity and crisis management (BCP)
 *   3. Supply chain security (including ICT supply chain)
 *   4. Network and information systems security
 *   5. Vulnerability handling and disclosure
 *   6. Basic cyber hygiene + cybersecurity training
 *   7. Multi-factor authentication + access control
 *   8. Cryptography / encryption
 *   9. Human resources security
 *   10. Asset management + appropriate physical security
 *
 * Incident reporting (Art. 23):
 *   - Significant incident: early warning within 24 hours of becoming aware
 *   - Formal notification within 72 hours
 *   - Final report within 1 month (initial) / 3 months (for ongoing incidents)
 *   - Significant incident defined: (a) caused or can cause severe operational
 *     disruption or financial losses; or (b) affected or can affect other
 *     natural or legal persons by causing considerable material or non-material
 *     damages.
 *
 * Distinction from DORA:
 *   DORA applies specifically to financial sector entities (credit institutions,
 *   investment firms, insurance, payment institutions, etc.) and includes more
 *   prescriptive requirements around ICT risk management and TLPT. NIS2 applies
 *   broadly across critical sectors. For financial sector entities, DORA
 *   satisfies NIS2 equivalence per Art. 1(2) NIS2. Both packs may be active
 *   if the entity is in scope of both (e.g., a bank providing critical
 *   infrastructure services).
 *
 * Penalties:
 *   Essential entities: up to EUR 10M or 2% of global annual turnover (whichever higher)
 *   Important entities: up to EUR 7M or 1.4% of global annual turnover (whichever higher)
 *   Personal liability of management bodies for non-compliance (Art. 20)
 *
 * @connexum/ai-governance
 */
export const NIS2_CATEGORY_CLASSIFIERS = {
    ESSENTIAL_ENTITY_DATA: {
        references: ['NIS2 Art. 3 -- essential entities; Annex I -- sectors of essential entities; Art. 21 -- security requirements'],
        classifier: (input) => {
            if (/\b(?:essential\s+entity|nis2\s+essential|annex\s+i\s+entity|critical\s+infrastructure\s+eu)\b/i.test(input))
                return true;
            if (/\b(?:energy\s+grid\s+data|hospital\s+network\s+data|banking\s+infrastructure|financial\s+market\s+infrastructure|dns\s+operator|isp\s+infrastructure)\b/i.test(input))
                return true;
            if (/\b(?:nis2\s+critical\s+sector|public\s+administration\s+cybersecurity|space\s+infrastructure\s+nis2)\b/i.test(input))
                return true;
            return false;
        },
    },
    IMPORTANT_ENTITY_DATA: {
        references: ['NIS2 Art. 3 -- important entities; Annex II -- sectors of important entities'],
        classifier: (input) => {
            if (/\b(?:important\s+entity|nis2\s+important|annex\s+ii\s+entity|nis2\s+digital\s+provider)\b/i.test(input))
                return true;
            if (/\b(?:online\s+marketplace\s+nis2|search\s+engine\s+nis2|social\s+network\s+nis2|food\s+sector\s+nis2)\b/i.test(input))
                return true;
            if (/\b(?:waste\s+management\s+nis2|postal\s+nis2|manufacturing\s+nis2)\b/i.test(input))
                return true;
            return false;
        },
    },
    SUPPLY_CHAIN_CYBERSECURITY_RECORD: {
        references: ['NIS2 Art. 21(2)(d) -- supply chain security; Art. 21(2)(j) -- supply chain security policies'],
        classifier: (input) => {
            if (/\b(?:supply\s+chain\s+security\s+nis2|ict\s+supply\s+chain|vendor\s+cybersecurity\s+assessment\s+nis2|third.party\s+cybersecurity\s+nis2)\b/i.test(input))
                return true;
            if (/\b(?:nis2\s+supply\s+chain\s+risk|software\s+supply\s+chain\s+nis2|managed\s+service\s+provider\s+nis2|msp\s+security\s+nis2)\b/i.test(input))
                return true;
            return false;
        },
    },
    INCIDENT_NOTIFICATION_RECORD: {
        references: ['NIS2 Art. 23 -- incident notification; 24-hour early warning; 72-hour formal notification; 1-month final report'],
        classifier: (input) => {
            if (/\b(?:nis2\s+incident|significant\s+incident\s+nis2|nis2\s+notification|csirt\s+notification|national\s+authority\s+notification\s+nis2)\b/i.test(input))
                return true;
            if (/\b(?:24.hour\s+early\s+warning\s+nis2|72.hour\s+nis2|nis2\s+final\s+report|operational\s+disruption\s+nis2)\b/i.test(input))
                return true;
            return false;
        },
    },
    VULNERABILITY_DISCLOSURE_RECORD: {
        references: ['NIS2 Art. 12 -- coordinated vulnerability disclosure; Art. 21(2)(e) -- vulnerability handling; Art. 25 -- ENISA vulnerability database'],
        classifier: (input) => {
            if (/\b(?:vulnerability\s+disclosure\s+nis2|coordinated\s+vulnerability|cvd\s+nis2|enisa\s+vulnerability|vulnerability\s+report\s+nis2)\b/i.test(input))
                return true;
            if (/\b(?:security\s+patch\s+record|vulnerability\s+management\s+nis2|zero.day\s+nis2|cve\s+nis2\s+report)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['GDPR Art. 4(1) -- personal data; NIS2 Art. 34 -- processing of personal data under NIS2'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:contact\s+person\s+nis2|management\s+body\s+member\s+data|ciso\s+personal\s+data|incident\s+reporter\s+pii)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['NIS2 Art. 21(2)(g) -- multi-factor authentication; Art. 21(2)(h) -- encryption; secure communications requirements'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const NIS2_PACK = {
    categoryClassifiers: NIS2_CATEGORY_CLASSIFIERS,
    id: 'nis2',
    name: 'EU NIS2 Directive (Directive 2022/2555)',
    version: '1.0.0',
    description: 'EU Directive 2022/2555 (NIS2) -- a high common level of cybersecurity across the EU. In force 17 January 2023; member state transposition deadline 17 October 2024. Covers Essential Entities (Annex I: energy, transport, banking, financial market infrastructure, healthcare, water, digital infrastructure, ICT service management, public administration, space) and Important Entities (Annex II: postal, waste, manufacturing, food, digital providers, research). Mandates 10 minimum cybersecurity risk-management measures (Art. 21) including MFA, encryption, supply chain security, BCP, vulnerability handling, and board cyber training. Incident reporting: 24-hour early warning + 72-hour formal notification + 1-month final report to national CSIRT. Distinct from DORA (financial sector; DORA satisfies NIS2 equivalence per Art. 1(2) NIS2). Penalties: up to EUR 10M / 2% global turnover for Essential Entities; EUR 7M / 1.4% for Important Entities.',
    authority: 'National competent authorities + ENISA (EU Agency for Cybersecurity) + CSIRT network',
    industries: ['energy', 'transport', 'banking', 'financial-services', 'healthcare', 'water-utilities', 'digital-infrastructure', 'telecommunications', 'managed-services', 'public-sector', 'manufacturing', 'food', 'logistics', 'technology'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Entity classification gate (Essential / Important per Annexes I and II); 10 minimum security measures enforcement per Art. 21; management body accountability and training (Art. 20)',
            reference: 'NIS2 Art. 3 -- entity classification; Art. 21 -- security requirements; Art. 20 -- management bodies accountability; Art. 21(2)(f) -- basic cyber hygiene',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify essential entity data, important entity data, supply chain cybersecurity records, incident notification records, and vulnerability disclosure records for appropriate handling and reporting',
            reference: 'NIS2 Art. 21(2) -- security requirements scope; Art. 23 -- incident notification data classification; Art. 12 -- vulnerability disclosure classification',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail for incident notification records, supply chain security assessments, vulnerability disclosures, and security measure compliance evidence; required for national competent authority audit',
            reference: 'NIS2 Art. 23 -- incident record-keeping; Art. 21 -- security measures documentation; Art. 32 -- supervisory and enforcement measures; Art. 33 -- competent authority inspections',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Multi-factor authentication enforcement per Art. 21(2)(g); access control for network and information systems; privileged access management; zero-trust architecture support',
            reference: 'NIS2 Art. 21(2)(g) -- multi-factor or continuous authentication; Art. 21(2)(i) -- human resources security; Art. 21(2)(j) -- access control policies',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Encryption of network communications and data at rest per Art. 21(2)(h); encrypted communications for incident coordination with CSIRT; secure channel for vulnerability disclosure',
            reference: 'NIS2 Art. 21(2)(h) -- encrypted communications; Art. 21(2)(g) -- secure voice/video/text communications; Art. 23(4) -- secure incident reporting channel',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Board-level approval for significant incident classification before CSIRT notification; management body sign-off on cybersecurity risk management measures per Art. 20; board cyber training completion verification',
            reference: 'NIS2 Art. 20 -- management body accountability; Art. 20(1) -- management bodies approve and oversee cybersecurity risk measures; Art. 20(2) -- management body cyber training',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Documentation of 10 minimum security measures per Art. 21; board cyber training records (annual); supply chain security assessment records; entity classification documentation; risk management records',
            reference: 'NIS2 Art. 21 -- security measures documentation; Art. 20(2) -- annual board cyber training; Art. 21(2)(d) -- supply chain security assessments; Art. 32 -- competent authority evidence requirements',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Significant incident cascade reporting: 24-hour early warning + 72-hour formal notification + 1-month final report to CSIRT; vulnerability disclosure event coordination; crisis communication bus',
            reference: 'NIS2 Art. 23(4)(a) -- 24-hour early warning; Art. 23(4)(b) -- 72-hour incident notification; Art. 23(4)(c) -- 1-month final report; Art. 23(1) -- notification to CSIRT or competent authority',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'ICT supply chain security assessment per Art. 21(2)(d); vendor cybersecurity due diligence; managed service provider accountability; Art. 22 coordinated security risk assessments of critical supply chains',
            reference: 'NIS2 Art. 21(2)(d) -- supply chain security policy; Art. 21(2)(j) -- security in network acquisition; Art. 22 -- EU-level coordinated supply chain risk assessments (ENISA/cooperation group)',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Incident records retained for at least 3 years per NIS2; risk management documentation retained while operating; vulnerability disclosure records continuity across sessions',
            reference: 'NIS2 Art. 23 -- incident records retention; Art. 21 -- ongoing risk management records; NIS2 implementation guidance -- minimum 3-year incident record retention',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Incident notification transparency to CSIRT and national authorities; vulnerability disclosure transparency per Art. 12; public communication of significant incidents when required by national authority',
            reference: 'NIS2 Art. 23 -- incident notification cascade; Art. 12 -- coordinated vulnerability disclosure; Art. 24(5) -- national authority may require public notification; Art. 23(6) -- CSIRT may share incident info',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Continuous monitoring for significant incidents per Art. 21(2)(a); threat detection for early warning activation; anomaly detection for supply chain compromise; vulnerability pattern monitoring',
            reference: 'NIS2 Art. 21(2)(a) -- incident handling; Art. 21(2)(e) -- vulnerability handling; Art. 21(2)(b) -- business continuity; Art. 23(1) -- awareness of significant incident trigger',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            entityClassificationRequired: true, // Essential / Important per Annexes I and II
            tenMinimumSecurityMeasuresEnforced: true,
            managementBodyAccountabilityRequired: true,
            boardCyberTrainingRequired: true,
            mfaRequired: true,
            aimsContextDefined: true,
        },
        'data-classifier': {
            enabledCategories: ['ESSENTIAL_ENTITY_DATA', 'IMPORTANT_ENTITY_DATA', 'SUPPLY_CHAIN_CYBERSECURITY_RECORD', 'INCIDENT_NOTIFICATION_RECORD', 'VULNERABILITY_DISCLOSURE_RECORD', 'PII', 'CREDENTIALS'],
            incidentNotificationRecordAction: 'WARN',
            credentialsAction: 'BLOCK',
        },
        'agent-auth': {
            mfaForPrivilegedAccess: true,
            mfaForRemoteAccess: true,
            advancedAuthenticationRequired: true,
        },
        'event-bus': {
            nis2EarlyWarningHours: 24,
            nis2FormalNotificationHours: 72,
            nis2FinalReportDays: 30,
            incidentCascadeReportingRequired: true,
        },
        'attestation-manager': {
            nis2SecurityMeasuresDocumentationRequired: true,
            boardCyberTrainingAnnualRequired: true,
            supplyChainAssessmentRequired: true,
        },
        'supply-chain': {
            ictSupplyChainSecurityRequired: true,
            vendorCybersecurityDueDiligenceRequired: true,
            registerOfInformationRequired: true,
        },
        'session-persistence': {
            incidentRecordRetentionYears: 3,
            riskManagementDocumentationRetentionRequired: true,
        },
        'anomaly-detector': {
            threatIntelligenceActive: true,
            robustnessMonitoringActive: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-EU', 'ISO27001-CERTIFIED', 'NIS2-COMPLIANT-SUPPLY-CHAIN'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law creates unacceptable supply chain cybersecurity risk under NIS2 Art. 21(2)(d) ICT supply chain security requirements; incompatible with EU data residency obligations for essential/important entity operational data.',
            baidu: 'PRC jurisdiction. No EU adequacy decision. Transfer of essential/important entity operational data to PRC violates NIS2 supply chain security requirements (Art. 21(2)(d)) and GDPR Art. 44.',
            alibaba: 'PRC jurisdiction. NIS2 Art. 21(2)(d) and Art. 22 EU coordinated supply chain risk assessments identify PRC-hosted services as elevated supply chain risk for critical infrastructure sectors.',
        },
    },
    dataPolicy: {
        scanCategories: ['ESSENTIAL_ENTITY_DATA', 'IMPORTANT_ENTITY_DATA', 'SUPPLY_CHAIN_CYBERSECURITY_RECORD', 'INCIDENT_NOTIFICATION_RECORD', 'VULNERABILITY_DISCLOSURE_RECORD', 'PII', 'CREDENTIALS'],
        categoryActions: {
            ESSENTIAL_ENTITY_DATA: 'WARN',
            IMPORTANT_ENTITY_DATA: 'WARN',
            SUPPLY_CHAIN_CYBERSECURITY_RECORD: 'WARN',
            INCIDENT_NOTIFICATION_RECORD: 'WARN',
            VULNERABILITY_DISCLOSURE_RECORD: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // NIS2 implementation guidance: incident records minimum 3 years.
        // Risk management documentation: indefinite while operating.
        // Using 3-year minimum as auditLogRetentionDays floor; session records follow same schedule.
        auditLogRetentionDays: 1095, // 3 years minimum (NIS2 incident record guidance)
        sessionRetentionDays: 1095, // 3 years for operational risk management records
        incidentRetentionDays: 1095, // 3 years for significant incident records and notification logs
        reference: 'NIS2 Art. 23 -- incident records; NIS2 implementation guidance -- 3-year minimum retention for incident documentation; ENISA NIS2 Implementation Guide; GDPR Art. 5(1)(e) -- storage limitation for personal data in incident records',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['eu'], // EU data residency for essential/important entity operational data
    },
    incidentPolicy: {
        // NIS2 Art. 23(4)(a): 24-hour early warning to CSIRT.
        // NIS2 Art. 23(4)(b): 72-hour formal notification.
        // NIS2 Art. 23(4)(c): 1-month final report.
        // Pack uses 24-hour as the primary clock; 72-hour for formal notification.
        notificationDeadlineHours: 24, // Art. 23(4)(a) early warning -- first mandatory deadline
        reference: 'NIS2 Art. 23(4)(a) -- 24-hour early warning to CSIRT/competent authority; Art. 23(4)(b) -- 72-hour formal incident notification; Art. 23(4)(c) -- 1-month final report; Art. 23(1) -- notification obligation',
        requiredRecipients: ['national-csirt', 'national-competent-authority', 'chief-information-security-officer', 'management-body'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'nis2-entity-classification',
            description: 'Entity classification active: deployment classified as Essential (Annex I) or Important (Annex II) per NIS2 Art. 3; classification drives applicable obligations and penalties',
            reference: 'NIS2 Art. 3 -- essential and important entities; Annex I -- essential entity sectors; Annex II -- important entity sectors; Art. 21 -- obligations apply equally to both tiers',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nis2-incident-cascade-24h',
            description: '24-hour early warning clock active; significant incident triggers immediate CSIRT notification within 24 hours of becoming aware; cascade reporting (24h / 72h / 1-month) wired',
            reference: 'NIS2 Art. 23(4)(a) -- early warning within 24 hours; Art. 23(1) -- notification to CSIRT or competent authority; Art. 23(2) -- significant incident definition',
            check: 'monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nis2-incident-cascade-72h',
            description: '72-hour formal incident notification clock active; formal notification to national CSIRT or competent authority within 72 hours; incident classification and impact assessment included',
            reference: 'NIS2 Art. 23(4)(b) -- incident notification within 72 hours; Art. 23(4) -- content requirements for notification; Art. 23(5) -- competent authority may request intermediate report',
            check: 'monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nis2-mfa-enforcement',
            description: 'Multi-factor authentication enforced for all privileged and remote access per Art. 21(2)(g); continuous authentication monitoring active',
            reference: 'NIS2 Art. 21(2)(g) -- multi-factor authentication or continuous authentication solutions; Art. 21(2)(g) -- secure voice/video/text communications',
            check: 'agent_auth_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nis2-encryption',
            description: 'Encryption of network communications and sensitive data at rest per Art. 21(2)(h); encrypted channel for CSIRT incident reporting',
            reference: 'NIS2 Art. 21(2)(h) -- encrypted communications (end-to-end encryption where appropriate); Art. 23(4) -- secure incident reporting channel',
            check: 'encryption_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nis2-supply-chain-security',
            description: 'ICT supply chain security assessment active; vendor cybersecurity due diligence enforced; managed service provider accountability documented per Art. 21(2)(d)',
            reference: 'NIS2 Art. 21(2)(d) -- supply chain security including relationships between each entity and its direct suppliers; Art. 22 -- EU coordinated supply chain security risk assessments',
            check: 'subservice_registry_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nis2-ten-security-measures',
            description: 'All 10 minimum cybersecurity risk-management measures implemented per Art. 21(2): incident handling, BCP, supply chain security, network security, vulnerability handling, cyber hygiene, MFA, encryption, HR security, asset management',
            reference: 'NIS2 Art. 21(2)(a)-(j) -- 10 minimum security measures; Art. 21(1) -- proportionate technical and organisational measures; Art. 21(4) -- ENISA implementing guidance',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nis2-board-accountability',
            description: 'Management body accountability active; board-level approval of cybersecurity measures documented; annual board cyber training records maintained',
            reference: 'NIS2 Art. 20(1) -- management bodies approve and oversee cybersecurity risk measures; Art. 20(2) -- management body cyber training (annual); Art. 20(3) -- personal liability',
            check: 'approval_queue_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nis2-vulnerability-handling',
            description: 'Vulnerability handling and coordinated disclosure process active; ENISA vulnerability database reporting available; zero-day and CVE tracking active',
            reference: 'NIS2 Art. 12 -- coordinated vulnerability disclosure; Art. 21(2)(e) -- vulnerability handling and disclosure; Art. 25 -- ENISA European vulnerability database',
            check: 'post_market_monitoring',
            failSeverity: 'HIGH',
        },
        {
            id: 'nis2-data-classifier',
            description: 'Essential/Important entity data, supply chain cybersecurity records, incident notification records, and vulnerability disclosures classified',
            reference: 'NIS2 Art. 21(2) -- security measure scope; Art. 23 -- incident notification data; Art. 12 -- vulnerability disclosure',
            check: 'data_classifier_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nis2-audit-trail',
            description: 'Tamper-evident audit trail active for security measures compliance, incident notifications, supply chain assessments, and board training records; minimum 3-year retention',
            reference: 'NIS2 Art. 23 -- incident records; Art. 21 -- security measure documentation; Art. 32 -- competent authority inspection; NIS2 implementation guidance -- 3-year minimum retention',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'nis2-incident-final-report',
            description: '1-month final incident report capability active; post-incident root cause analysis documented; corrective measures included in report',
            reference: 'NIS2 Art. 23(4)(c) -- final report within 1 month; Art. 23(4)(c)(i)-(iv) -- content: description, severity, impact, root cause, corrective measures',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nis2-incident-transparency',
            description: 'Incident notification transparency to CSIRT and competent authority active; public notification capability when required; vulnerability disclosure channel active',
            reference: 'NIS2 Art. 23 -- incident notification cascade; Art. 24(5) -- national authority may require public notification; Art. 23(6) -- CSIRT may share incident information',
            check: 'transparency_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=nis2.js.map