/**
 * AU APRA CPS 234 — Information Security
 *
 * Primary instrument: Prudential Standard CPS 234 Information Security
 * (effective 1 July 2019; reviewed 2022). Cross-referenced with CPS 230
 * Operational Risk (effective 1 July 2025).
 *
 * Entities covered: All APRA-regulated entities (AREs): ADIs (banks, credit
 * unions, building societies); general/life/private health insurers;
 * superannuation RSE licensees; foreign entities with AU branch. Extends to
 * material service providers and third-party suppliers in the ARE's information
 * asset supply chain.
 *
 * AI as information asset: AI systems, model-serving infrastructure, and data
 * pipelines used by AREs are information assets within scope — Para 17 requires
 * classification and registration.
 *
 * Key AI obligations:
 *   - Para 17: All information assets (incl. AI training data, models, inference
 *     endpoints) classified and registered.
 *   - Para 20: Third-party AI vendors assessed for security controls pre-engagement
 *     and annually. AI SaaS vendors squarely within scope.
 *   - Para 21: AI-specific monitoring required: model behaviour anomalies, data
 *     exfiltration via inference.
 *   - Para 23: APRA notification within 72 hours of material incident, externally-
 *     exploited incident, or material control weakness.
 *   - Para 24-26: Annual or risk-based testing; AI security vectors (adversarial,
 *     prompt injection, data poisoning) included.
 *
 * Cross-pack interactions:
 *   - au-cps234 + au-cps230: Complementary regimes. CPS 234 = info security;
 *     CPS 230 = operational resilience, service providers, business continuity.
 *     Both required for APRA-regulated entities. CPS 230 service-provider register
 *     integrates with CPS 234 third-party controls.
 *   - au-cps234 + au-privacy-act: APP 11 security obligation parallels CPS 234.
 *     CPS 234 sets higher technical bar; satisfying CPS 234 substantially satisfies
 *     APP 11 for AREs.
 *   - au-cps234 + au-soci-act: Banks/insurers that are SOCI SoNS operators face
 *     parallel incident-notification obligations. SOCI 12-hour clock may fire before
 *     CPS 234 72-hour deadline.
 *   - au-cps234 + soc2: SOC 2 useful but not sufficient; CPS 234 requires a
 *     contractual addendum covering AU-specific APRA obligations.
 *
 * Authority: Australian Prudential Regulation Authority (APRA)
 * Sovereignty: Australian Federal (APRA-regulated entities)
 *
 * @connexum/ai-governance
 */
export const AU_CPS234_CATEGORY_CLASSIFIERS = {
    AU_CPS234_INFO_ASSET: {
        references: ['CPS 234 Para 17 — information asset classification and registration'],
        classifier: (input) => {
            if (/\b(?:information\s+asset|are\s+asset|apra\s+(?:asset|system)|info(?:rmation)?\s+security\s+(?:asset|scope))/i.test(input))
                return true;
            return false;
        },
    },
    AU_CPS234_AI_ASSET: {
        references: ['CPS 234 Para 17 — AI model/pipeline as information asset; Para 16 AI governance'],
        classifier: (input) => {
            if (/\b(?:ai\s+(?:model|training\s+data|inference\s+endpoint|pipeline)\s+(?:asset|register)|model\s+(?:asset|classification).*(?:apra|are|cps\s*234))/i.test(input))
                return true;
            return false;
        },
    },
    AU_CPS234_THIRD_PARTY: {
        references: ['CPS 234 Para 20 — third-party provider assessment'],
        classifier: (input) => {
            if (/\b(?:third[_\-\s]?party.*(?:cps\s*234|apra\s+security)|ai\s+(?:saas|vendor|service\s+provider).*(?:are|apra|cps\s*234)|material\s+(?:service\s+)?provider.*(?:info|security))/i.test(input))
                return true;
            return false;
        },
    },
    AU_CPS234_INCIDENT: {
        references: ['CPS 234 Para 21/23 — incident detection, response, APRA notification 72h'],
        classifier: (input) => {
            if (/\bAPRA\s+CPS\s+234\b/i.test(input))
                return true;
            if (/\bCPS\s*234\b.*\b(?:cyber\s+)?incident\b/i.test(input))
                return true;
            if (/\b(?:cps[_\-\s]?234\s+incident|apra\s+(?:notification|notify|72[_\-\s]?hour|security\s+incident))\b/i.test(input))
                return true;
            if (/\b(?:information\s+security\s+incident)\b.*\b(?:notifiable|apra|material|breach)\b/i.test(input))
                return true;
            return false;
        },
    },
    AU_CPS234_CONTROL_WEAKNESS: {
        references: ['CPS 234 Para 23 — material control weakness notification to APRA'],
        classifier: (input) => {
            if (/\b(?:material\s+control\s+weakness|control\s+(?:gap|deficiency|weakness).*(?:apra|cps\s*234|are))/i.test(input))
                return true;
            return false;
        },
    },
    AU_CPS234_CUSTOMER_DATA: {
        references: ['CPS 234 Para 18-19 — customer financial data classification and controls'],
        classifier: (input) => {
            if (/\b(?:are\s+customer\s+(?:data|financial\s+data)|apra\s+(?:customer|member)\s+(?:data|records)|customer\s+financial.*(?:are|apra|cps))/i.test(input))
                return true;
            return false;
        },
    },
};
export const AU_CPS234_PACK = {
    categoryClassifiers: AU_CPS234_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: Customer data (AU_CPS234_CUSTOMER_DATA) is subject-keyed —
     * each access must carry a customer/member identifier for access-log
     * integrity per Para 23 audit requirements.
     * Asset and incident categories are system-level (non-subject-keyed).
     */
    subjectKeyedCategories: [
        'AU_CPS234_CUSTOMER_DATA',
    ],
    id: 'au-cps234',
    name: 'AU APRA CPS 234 — Information Security',
    version: '1.0.0',
    description: 'APRA Prudential Standard CPS 234 compliance for AI systems deployed in or for APRA-regulated entities (banks, insurers, superannuation funds). Enforces 72-hour APRA incident notification (Para 23), AI asset classification and registration (Para 17), third-party vendor security assessment (Para 20), material control weakness notification, and annual AI-specific security testing (adversarial, prompt injection, data poisoning) per Para 24-26.',
    authority: 'Australian Prudential Regulation Authority (APRA)',
    industries: [
        'banking', 'insurance', 'superannuation',
        'fintech', 'non-bank-lending', 'reinsurance',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Board-level information security capability (Para 16); 72-hour incident notification gate; material control weakness escalation (Para 23)',
            reference: 'CPS 234 Para 15-16, Para 23',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident access logs for ARE information assets; 7-year incident and testing records retention',
            reference: 'CPS 234 Para 23 (incident records); Para 24-26 (test records)',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Controls consistent with information asset classification (Para 18-19); encryption of classified AI assets',
            reference: 'CPS 234 Para 18-19',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Information asset classification (Para 17); AI model and pipeline asset classification and registry',
            reference: 'CPS 234 Para 17',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party AI vendor security assessment pre-engagement + annual review (Para 20)',
            reference: 'CPS 234 Para 20',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: '72-hour APRA notification workflow; material control weakness escalation; third-party engagement approval',
            reference: 'CPS 234 Para 20, Para 23',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'AI-specific monitoring: model behaviour anomalies, data exfiltration via inference, adversarial attack detection (Para 21)',
            reference: 'CPS 234 Para 21',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Incident event stream; control-weakness events; security testing results stream',
            reference: 'CPS 234 Para 21, Para 23',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'AU_CPS234_INFO_ASSET',
                'AU_CPS234_AI_ASSET',
                'AU_CPS234_THIRD_PARTY',
                'AU_CPS234_INCIDENT',
                'AU_CPS234_CONTROL_WEAKNESS',
                'AU_CPS234_CUSTOMER_DATA',
            ],
            apraNotification72hrEnabled: true,
            controlWeaknessNotifyEnabled: true,
            thirdPartyAssessmentRequired: true,
            assetRegisterAiScopeVerified: true,
            annualTestingScheduled: true,
            customerDataAccessLoggingActive: true,
        },
        'governance-runtime': {
            apraNotification72hrEnabled: true,
            controlWeaknessNotifyEnabled: true,
            thirdPartyAssessmentRequired: true,
            assetRegisterAiScopeVerified: true,
            annualTestingScheduled: true,
            customerDataAccessLoggingActive: true,
        },
        'supply-chain': {
            thirdPartyPreEngagementAssessmentRequired: true,
            annualVendorReviewRequired: true,
        },
        'approval-queue': {
            apra72hNotificationWorkflowRequired: true,
            controlWeaknessEscalationRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [
            'APRA-SECURITY-CONTROLS-ASSESSED',
            'INCIDENT-NOTIFICATION-CAPABLE',
            'AI-ADVERSARIAL-TESTING-EVIDENCE',
        ],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'AU_CPS234_INFO_ASSET',
            'AU_CPS234_AI_ASSET',
            'AU_CPS234_THIRD_PARTY',
            'AU_CPS234_INCIDENT',
            'AU_CPS234_CONTROL_WEAKNESS',
            'AU_CPS234_CUSTOMER_DATA',
        ],
        categoryActions: {
            AU_CPS234_INFO_ASSET: 'LOG',
            AU_CPS234_AI_ASSET: 'REQUIRE_APPROVAL',
            AU_CPS234_THIRD_PARTY: 'REQUIRE_APPROVAL',
            AU_CPS234_INCIDENT: 'REQUIRE_APPROVAL',
            AU_CPS234_CONTROL_WEAKNESS: 'REQUIRE_APPROVAL',
            AU_CPS234_CUSTOMER_DATA: 'LOG',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['AU'],
        auditLogRetentionDays: 2555, // 7 years (incident records, test records, third-party assessments)
        sessionRetentionDays: 2555,
        incidentRetentionDays: 2555,
        reference: 'CPS 234 Para 23 (incident records 7y); Para 24-26 (test records 7y); Para 20 (third-party 7y)',
    },
    incidentPolicy: {
        notificationDeadlineHours: 72, // Para 23: as soon as possible, no later than 72 hours
        reference: 'CPS 234 Para 23 — APRA notification within 72 hours of awareness of material incident',
        requiredRecipients: ['apra', 'board', 'information-security-lead'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'au-cps234-incident-72hr',
            description: 'APRA notified within 72 hours of awareness of material information security incident',
            reference: 'CPS 234 Para 23',
            check: 'au_cps234_incident_72hr_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-cps234-control-weakness-notify',
            description: 'Material control weakness in information security reported to APRA',
            reference: 'CPS 234 Para 23',
            check: 'au_cps234_control_weakness_notify_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-cps234-third-party-gate',
            description: 'Third-party AI vendors assessed for security controls before engagement',
            reference: 'CPS 234 Para 20',
            check: 'au_cps234_third_party_gate_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-cps234-asset-register-check',
            description: 'AI models, training data, and inference endpoints classified in information asset register',
            reference: 'CPS 234 Para 17',
            check: 'au_cps234_asset_register_check_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-cps234-annual-testing',
            description: 'Annual or risk-based security testing completed including AI-specific attack vectors',
            reference: 'CPS 234 Para 24-26',
            check: 'au_cps234_annual_testing_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-cps234-customer-data-log',
            description: 'Customer financial data access logged per access event with customer identifier',
            reference: 'CPS 234 Para 18-19',
            check: 'au_cps234_customer_data_log_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=au-cps234.js.map