/**
 * NIST SP 800-82 Rev 3 Operational Technology Security Compliance Pack
 *
 * NIST Special Publication 800-82 Revision 3 (September 2023) — "Guide to
 * Operational Technology (OT) Security." US federal guide for securing OT
 * environments including Industrial Control Systems (ICS), SCADA systems,
 * Distributed Control Systems (DCS), Programmable Logic Controllers (PLC),
 * Remote Terminal Units (RTU), building automation systems (BAS), transportation
 * control systems, and Industrial Internet of Things (IIoT).
 *
 * Standards and authorities referenced (citations only; no verbatim text):
 *   - NIST SP 800-82 Rev 3 (September 2023) — Guide to OT Security
 *   - NIST SP 800-53 Rev 5 — Security and Privacy Controls (parent catalog)
 *   - NIST SP 800-30 Rev 1 — Guide for Conducting Risk Assessments
 *   - NIST SP 800-39 — Managing Information Security Risk
 *   - NIST SP 800-92 — Guide to Computer Security Log Management (retention)
 *   - FIPS 199 — Standards for Security Categorization of Federal Information
 *   - FIPS 200 — Minimum Security Requirements for Federal Systems
 *   - FISMA — Federal Information Security Modernization Act (2014)
 *   - FAR 52.204-21 / DFARS 252.204-7012 — Federal procurement OT requirements
 *   - EO 14028 (2021) — Improving the Nation's Cybersecurity
 *   - CISA OT Cybersecurity Guidance (CISA 2022, 2023)
 *   - CIRCIA — Cyber Incident Reporting for Critical Infrastructure Act (2022)
 *   - NERC CIP standards (cross-reference for electric utilities)
 *   - IEC 62443 — International OT/IACS cybersecurity counterpart
 *   - IEC 61511 — Functional safety for process industries (SIS alignment)
 *   - IEC 61508 — Functional safety of E/E/PE systems (parent SIL standard)
 *
 * Impact Level Classification (FIPS 199 + NIST SP 800-82 §4.2):
 *   Impact levels follow FIPS 199 categorization adapted for OT environments.
 *   The potential impact is assessed for confidentiality, integrity, and
 *   availability, with OT systems typically prioritising availability and
 *   integrity (safety-instrumented systems require deterministic operation).
 *
 *   | Impact | Description                                                         |
 *   |--------|---------------------------------------------------------------------|
 *   | LOW    | Limited adverse effect — minor degradation of capability            |
 *   | MOD    | Serious adverse effect — significant degradation of primary mission |
 *   | HIGH   | Severe / catastrophic — loss of life, major financial damage,       |
 *   |        | long-term environmental contamination, infrastructure failure       |
 *
 *   Default when impact level not declared: MODERATE (conservative per FIPS 199
 *   guidance and NIST SP 800-82 §4.2 — when in doubt, classify higher).
 *
 * Purdue Enterprise Reference Architecture (NIST SP 800-82 §5.5):
 *   Level 0 — Physical process (sensors, actuators, physical systems)
 *   Level 1 — Intelligent devices (PLCs, RTUs, safety systems, drives)
 *   Level 2 — Control systems (SCADA, DCS, HMI, engineering workstations)
 *   Level 3 — Manufacturing operations (MES, historian, batch management)
 *   Level 3.5 — Industrial DMZ (boundary between OT and IT — CRITICAL zone)
 *   Level 4 — Enterprise (ERP, email, business intelligence)
 *   Level 5 — External network / Internet
 *
 * Key NIST 800-53 control families mapped to OT in SP 800-82 §6:
 *   AC  — Access Control (§6.2)
 *   AU  — Audit and Accountability (§6.3)
 *   AT  — Awareness and Training (§6.4)
 *   CA  — Assessment, Authorization, and Monitoring (§6.5)
 *   CM  — Configuration Management (§6.6)
 *   CP  — Contingency Planning (§6.7)
 *   IA  — Identification and Authentication (§6.8)
 *   IR  — Incident Response (§6.10)
 *   MA  — Maintenance (§6.11)
 *   MP  — Media Protection (§6.12)
 *   PE  — Physical and Environmental Protection (§6.13)
 *   PL  — Planning (§6.14)
 *   PM  — Program Management (§6.15)
 *   PS  — Personnel Security (§6.16)
 *   RA  — Risk Assessment (§6.17)
 *   SA  — System and Services Acquisition (§6.18 — supply chain)
 *   SC  — System and Communications Protection (§6.18 — network seg.)
 *   SI  — System and Information Integrity (§6.19)
 *   SR  — Supply Chain Risk Management (§6.20)
 *
 * Safety-Instrumented Systems (SIS) per NIST SP 800-82 §5.7:
 *   SIS are designed to bring a process to a safe state when predetermined
 *   conditions are violated (IEC 61511 / IEC 61508). SIS have separate
 *   network segments and must not be modified without formal management of
 *   change. AI-generated changes to SIS are an absolute block in this pack.
 *
 * Retention:
 *   NIST SP 800-92 + FISMA records management baseline: 7 years (2555 days).
 *   DoD / CMMC context may impose longer periods; this pack uses the
 *   7-year FISMA / NIST SP 800-92 federal records baseline.
 *
 * Sister standard: IEC 62443 (international OT/IACS counterpart). The two
 * are typically run together for US-multinational customers. Use `iec-62443`
 * pack in parallel when operating in both US-federal and international contexts.
 *
 * @connexum/ai-governance
 */
/**
 * NIST SP 800-82 category classifiers.
 *
 * Covers FIPS 199 impact-level declarations (LOW / MODERATE / HIGH),
 * Purdue model zone artefacts, OT cybersecurity program documents,
 * risk management records, and Safety-Instrumented System (SIS) records.
 */
export const NIST_SP_800_82_CATEGORY_CLASSIFIERS = {
    /**
     * HIGH_IMPACT — FIPS 199 HIGH impact OT system (NIST SP 800-82 §4.2).
     * Severe or catastrophic adverse effect: loss of life, major financial
     * damage, long-term environmental contamination, or infrastructure failure.
     * Unauthorised changes BLOCKED — requires full security impact analysis +
     * OT security lead + authorizing official sign-off before any action proceeds.
     */
    HIGH_IMPACT: {
        references: [
            'NIST SP 800-82 Rev 3 §4.2 — FIPS 199 HIGH impact OT categorisation',
            'FIPS 199 — Standards for Security Categorization of Federal Information',
        ],
        classifier: (input) => {
            if (/\b(?:high[_\s-]impact|impact[_\s-]level[_\s-]?high|fips199[_\s-]high|HIGH_IMPACT_OT|ot[_\s-]high)\b/i.test(input))
                return true;
            if (/\b(?:loss\s+of\s+life\s+(?:OT|ICS|SCADA|PLC|SIS)|catastrophic\s+(?:OT|ICS|industrial)\s+(?:failure|event))\b/i.test(input))
                return true;
            if (/\b(?:sis[_\s-]high|safety[_\s-]instrumented[_\s-]system[_\s-]high|critical\s+infrastructure\s+high\s+impact)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * MODERATE_IMPACT — FIPS 199 MODERATE impact OT system (NIST SP 800-82 §4.2).
     * Serious adverse effect: significant degradation of primary mission,
     * substantial financial damage, or significant harm without loss of life.
     * Default classification when impact level is not declared (conservative).
     * Changes require approval gate.
     */
    MODERATE_IMPACT: {
        references: [
            'NIST SP 800-82 Rev 3 §4.2 — FIPS 199 MODERATE impact OT categorisation',
            'FIPS 199 — Standards for Security Categorization of Federal Information',
        ],
        classifier: (input) => {
            if (/\b(?:moderate[_\s-]impact|impact[_\s-]level[_\s-]?moderate|fips199[_\s-]moderate|MODERATE_IMPACT_OT|ot[_\s-]moderate)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * LOW_IMPACT — FIPS 199 LOW impact OT system (NIST SP 800-82 §4.2).
     * Limited adverse effect: minor degradation of capability, minor financial
     * damage, or minor harm. LOG with audit record. Minimum OT process burden.
     */
    LOW_IMPACT: {
        references: [
            'NIST SP 800-82 Rev 3 §4.2 — FIPS 199 LOW impact OT categorisation',
            'FIPS 199 — Standards for Security Categorization of Federal Information',
        ],
        classifier: (input) => {
            if (/\b(?:low[_\s-]impact|impact[_\s-]level[_\s-]?low|fips199[_\s-]low|LOW_IMPACT_OT|ot[_\s-]low)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * PURDUE_ARTEFACT — Purdue model zone documentation (NIST SP 800-82 §5.5).
     * Foundational OT architecture artefact defining network segmentation by
     * Purdue levels (0-5). Zone boundary changes require security impact review.
     * Industrial DMZ (Level 3.5) is the highest-scrutiny boundary zone.
     */
    PURDUE_ARTEFACT: {
        references: [
            'NIST SP 800-82 Rev 3 §5.5 — Purdue Enterprise Reference Architecture',
            'NIST SP 800-82 Rev 3 §5.6 — Network segmentation and firewalls',
        ],
        classifier: (input) => {
            if (/\b(?:purdue[_\s-](?:model|level|zone|diagram|architecture)|purdue_(?:l[0-5]|dmz|industrial)|ot[_\s-]network[_\s-]segmentation)\b/i.test(input))
                return true;
            if (/\b(?:industrial[_\s-]dmz|idmz|level[_\s-]3\.5|ot[_\s-]it[_\s-]boundary)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * OT_PROGRAM_ARTEFACT — OT cybersecurity program documentation
     * (NIST SP 800-82 §3). Policy, workforce training, risk management
     * framework, and governance documents. Required of all OT system operators
     * subject to FISMA. Changes require management review.
     */
    OT_PROGRAM_ARTEFACT: {
        references: [
            'NIST SP 800-82 Rev 3 §3 — OT cybersecurity program',
            'NIST SP 800-82 Rev 3 §4 — OT risk management',
        ],
        classifier: (input) => {
            if (/\b(?:ot[_\s-]cybersecurity[_\s-]program|ot[_\s-]security[_\s-](?:policy|plan|program)|nist[_\s-]800[_\s-]82[_\s-]program)\b/i.test(input))
                return true;
            if (/\b(?:ot_program_(?:document|policy|procedure|review)|nist80082_(?:program|plan|policy))\b/.test(input))
                return true;
            return false;
        },
    },
    /**
     * SIS_ARTEFACT — Safety-Instrumented System (SIS) records and documentation
     * (NIST SP 800-82 §5.7 + IEC 61511 / IEC 61508 alignment). SIS bring
     * processes to a safe state when abnormal conditions occur. Changes to SIS
     * require formal management of change and SIL-certified engineer sign-off.
     * AI-generated modifications to SIS are an absolute block.
     */
    SIS_ARTEFACT: {
        references: [
            'NIST SP 800-82 Rev 3 §5.7 — Safety-Instrumented Systems',
            'IEC 61511:2016 — Functional safety for process industries (SIS)',
        ],
        classifier: (input) => {
            if (/\b(?:SIS|safety[_\s-]instrumented[_\s-]system|safety[_\s-]instrumented[_\s-]systems|SIL[_\s-](?:1|2|3|4)|safety[_\s-]integrity[_\s-]level)\b/i.test(input))
                return true;
            if (/\b(?:sis_(?:record|config|change|modification|update|artefact)|61511[_\s-]sis)\b/.test(input))
                return true;
            return false;
        },
    },
};
/**
 * NIST SP 800-82 Rev 3 Operational Technology Security Compliance Pack.
 *
 * Pack ID: 'nist-sp-800-82'
 * Jurisdiction: US federal (FISMA mandatory); widely adopted by NERC CIP
 *   (electric utilities), AWIA (water authorities), DoD industrial base
 *   (DFARS/CMMC), and federal building automation operators. Sister standard
 *   to IEC 62443 (international) — the two are typically run together for
 *   US-multinational customers.
 *
 * Guard-layer wiring:
 *   - G1-G4 (audit, logging, classification, session): always active
 *   - G5-G6 (supply-chain SR, approval-queue): MODERATE / HIGH impact
 *   - G7-G8 (attestation, anomaly-detection): HIGH impact + SIS
 *   - G9 (transparency): HIGH impact (maximum disclosure burden)
 *   - Approval Queue: always active (HIGH immediate; MODERATE closure)
 *
 * Human-in-loop tier:
 *   - T1: LOW / MODERATE (OT security engineer review)
 *   - T2: HIGH / SIS (NIST RMF Authorizing Official + CISSP-ICSE certified)
 */
export const NIST_SP_800_82_PACK = {
    categoryClassifiers: NIST_SP_800_82_CATEGORY_CLASSIFIERS,
    /**
     * HIGH impact and SIS artefacts are subject-keyed per OT system /
     * process zone — they must be traceable to specific OT assets under
     * NIST SP 800-82 §4 + §5.7 for authorizing official accountability.
     */
    subjectKeyedCategories: [
        'HIGH_IMPACT',
        'PURDUE_ARTEFACT',
        'SIS_ARTEFACT',
        'OT_PROGRAM_ARTEFACT',
    ],
    id: 'nist-sp-800-82',
    name: 'NIST SP 800-82 Rev 3 Operational Technology Security',
    version: '3.0.0',
    description: 'NIST SP 800-82 Rev 3 (September 2023) — US federal guide for securing Operational ' +
        'Technology (OT) environments including ICS, SCADA, DCS, PLC, RTU, building automation, ' +
        'transportation control, and Industrial IoT. Provides an OT-specific overlay on the NIST ' +
        'SP 800-53 Rev 5 control catalog with three FIPS 199 impact levels (LOW / MODERATE / HIGH; ' +
        'defaults to MODERATE). Purdue model segmentation (Levels 0-5 + industrial DMZ). Safety-' +
        'Instrumented System (SIS) protection per §5.7 + IEC 61511 alignment. Eight NIST 800-53 ' +
        'control family validators: AC, AU, CM, CP, IR, SC, SI, SR. 7-year retention (FISMA + ' +
        'SP 800-92; 2555 days). 24h CISA + EO 14028 incident notification. Reviewer tier: NIST RMF / ' +
        'FedRAMP / CISSP-ICSE certified. Mandatory for US federal OT via FISMA + FAR/DFARS. ' +
        'Cross-referenced by NERC CIP, EO 14028, CISA OT guidance. Sister standard: IEC 62443 ' +
        '(international) — typically run together for US-multinational customers.',
    authority: 'National Institute of Standards and Technology (NIST), U.S. Department of Commerce; ' +
        'mandated for federal OT via FISMA + FAR/DFARS; cross-referenced by NERC CIP, EO 14028, CISA OT guidance',
    industries: [
        'us-federal-contractor',
        'electric-utilities',
        'water-wastewater',
        'oil-and-gas',
        'manufacturing',
        'us-defense-industrial-base',
        'transportation-systems',
        'building-automation',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'FIPS 199 impact level (LOW / MODERATE / HIGH) tracking mandatory for every NIST ' +
                'SP 800-82 process gate. HIGH impact changes require blocking until full security ' +
                'impact analysis + OT security lead + authorizing official sign-off. MODERATE impact ' +
                'changes require approval gate. Governance runtime enforces Purdue model segmentation ' +
                'checks, FIPS 199 categorization, and NIST 800-53 control overlay before any OT ' +
                'software or configuration change proceeds. SIS modifications are an absolute block.',
            reference: 'NIST SP 800-82 Rev 3 §4.2 — FIPS 199 impact categorisation; §3 — OT cybersecurity program',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident records for OT security lifecycle artefacts: FIPS 199 categorization ' +
                'records, risk assessment documentation (SP 800-30), OT cybersecurity program documents ' +
                'per §3, Purdue model zone diagrams, NIST 800-53 control overlay evidence, SIS ' +
                'management-of-change records per §5.7, and incident records. Required for FISMA ' +
                'authorization packages, NIST RMF artifact submissions, CISA OT audit inspections, ' +
                'and NERC CIP compliance evidence (electric utility customers).',
            reference: 'NIST SP 800-82 Rev 3 §4 — risk management records; FISMA §3553 — audit requirements',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'FIPS 199 impact signal detection (LOW / MODERATE / HIGH) per OT zone and process; ' +
                'Purdue model artefact identification; OT cybersecurity program document categorisation; ' +
                'SIS record detection for absolute-block routing; NIST 800-53 control family evidence ' +
                'classification (AC, AU, CM, CP, IR, SC, SI, SR control families per §6).',
            reference: 'NIST SP 800-82 Rev 3 §4.2 — FIPS 199 classification; §6 — 800-53 control family overlay',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'NIST SP 800-53 SR (Supply Chain Risk Management) family controls applied to OT ' +
                'per SP 800-82 §6.20. OT component vendor evaluation; COTS PLC / RTU / SCADA ' +
                'component assessment; CMMC supply-chain requirements for DoD industrial base ' +
                'customers; EO 14028 software bill of materials (SBOM) requirements for OT. ' +
                'AI-generated OT code requires supply-chain evaluation for OT-specific safety and ' +
                'security impacts before outputs are accepted into the control system.',
            reference: 'NIST SP 800-82 Rev 3 §6.20 + SP 800-53 SR family; EO 14028 — SBOM for OT',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'HIGH impact change approval (OT security lead + authorizing official sign-off). ' +
                'MODERATE impact change approval gate. SIS modification absolute block pending formal ' +
                'management of change. All Purdue model zone boundary changes and OT program updates ' +
                'require human review before downstream OT configuration or code change proceeds. ' +
                'NIST 800-53 CM (Configuration Management) controls require formal approval of OT ' +
                'changes before deployment to production systems.',
            reference: 'NIST SP 800-82 Rev 3 §6.6 + SP 800-53 CM family; §5.7 — SIS management of change',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'FISMA authorization-to-operate (ATO) attestation for OT system operators; HIGH ' +
                'impact zone security assessment sign-off by NIST RMF-certified authorizing official; ' +
                'SIS engineering change attestation by SIL-certified engineer (IEC 61511 alignment); ' +
                'NIST 800-53 CA (Assessment, Authorization, Monitoring) control attestation. ' +
                'FedRAMP-authorized cloud services used in OT environments require additional ' +
                'attestation from the FedRAMP Program Management Office (PMO) liaison.',
            reference: 'NIST SP 800-82 Rev 3 §6.5 + SP 800-53 CA family; FISMA §3553 — ATO',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'NIST SP 800-82 OT security documentation and FISMA authorization records must ' +
                'persist for the full system lifecycle. 7-year FISMA / NIST SP 800-92 federal records ' +
                'baseline (2555 days). Continuity of FIPS 199 categorization, risk assessment, ' +
                'Purdue model diagrams, and incident records across sessions is mandatory for NIST RMF ' +
                'artifact submissions, FISMA Inspector General audits, CISA OT incident investigations, ' +
                'and NERC CIP compliance evidence retention (electric utility customers).',
            reference: 'NIST SP 800-82 Rev 3 §3 — program documentation; NIST SP 800-92 — federal records baseline',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Real-time detection of unverified changes to HIGH impact OT systems and SIS. ' +
                'Flags conditions requiring immediate OT security lead notification per CISA OT ' +
                'incident guidance and EO 14028. Detects HIGH impact OT software or configuration ' +
                'modifications without verification record — must block immediately. Detects SIS ' +
                'modifications requiring absolute block. MODERATE impact anomalies trigger approval- ' +
                'queue routing. NIST 800-53 IR and SI control families require continuous monitoring.',
            reference: 'NIST SP 800-82 Rev 3 §6.10 + SP 800-53 IR family; §6.19 + SP 800-53 SI family',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'AI-generated OT code or configuration provenance disclosure to OT security engineers, ' +
                'NIST RMF-certified authorizing officials, system security officers, and CISA liaisons. ' +
                'FIPS 199 impact level context disclosure on every AI output used in an OT task without ' +
                'independent manual verification. Required for FISMA accountability obligations and EO ' +
                '14028 software provenance requirements applied to OT environments.',
            reference: 'NIST SP 800-82 Rev 3 §3 — OT program accountability; EO 14028 — AI/software provenance',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'HIGH impact change event routing; Purdue model boundary update lifecycle events; ' +
                'OT cybersecurity program review milestone events; NIST 800-53 control gap notification; ' +
                'SIS management-of-change events requiring SIL-engineer sign-off; CISA + CIRCIA 24h ' +
                'incident notification deadline routing; NERC CIP compliance event submission for ' +
                'electric utility customers; FISMA continuous monitoring status events.',
            reference: 'NIST SP 800-82 Rev 3 §6.10 + SP 800-53 IR family; CIRCIA — 24h reporting trigger',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            impactLevelTrackingRequired: true,
            highImpactChangeApprovalRequired: true,
            moderateImpactChangeApprovalRequired: true,
            moderateImpactAnomalyClosureApprovalRequired: true,
            highImpactAnomalyImmediateEscalationRequired: true,
            purdueModelSegmentationRequired: true,
            fips199CategorizationRequired: true,
            nist80053ControlOverlayRequired: true,
            safetyInstrumentedSystemProtectionRequired: true,
            ciraReportingActive: true,
        },
        'approval-queue': {
            highImpactChangeApprovalRequired: true,
            moderateImpactChangeApprovalRequired: true,
            moderateImpactAnomalyClosureApprovalRequired: true,
            sisModificationAbsoluteBlockRequired: true,
            otSecurityEngineerReviewRequired: true,
            humanInLoopTierLowModerate: 'T1',
            humanInLoopTierHighSis: 'T2',
        },
        'attestation-manager': {
            fismaAtoAttestationRequired: true,
            highImpactZoneSecurityAssessmentSignOffRequired: true,
            sisEngineeringChangeAttestationRequired: true,
            nistRmfAuthorizingOfficialSignOffRequired: true,
            systemSecurityPlanAttestationRequired: true,
        },
        'supply-chain': {
            otComponentVendorEvaluationRequired: true,
            cmmcSupplyChainRequirementsRequired: true,
            eo14028SbomRequired: true,
            aiCodeGenToolOtEvaluationRequired: true,
            srControlFamilyInventoryRequired: true,
        },
        'anomaly-detector': {
            highImpactAnomalyImmediateEscalationRequired: true,
            sisModificationAbsoluteBlockRequired: true,
            unverifiedHighImpactChangeDetectionActive: true,
        },
        'transparency-injector': {
            aiGeneratedCodeProvenanceDisclosureRequired: true,
            fips199ImpactLevelContextDisclosureRequired: true,
        },
        'event-bus': {
            highImpactChangeEventsActive: true,
            purdueModelBoundaryUpdateEventsActive: true,
            otProgramReviewMilestoneEventsActive: true,
            sisManagementOfChangeEventsActive: true,
            cisaIncidentNotificationEventsActive: true,
            nercCipComplianceEventsActive: true,
            fismaMonitoringStatusEventsActive: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['NIST-800-82-READY', 'US-FEDERAL-OT-SECURITY'],
        blockReasons: {
            deepseek: 'PRC-jurisdiction LLM providers cannot meet US federal OT security requirements ' +
                '(FISMA + FedRAMP + CMMC + EO 14028 supply-chain provisions). NIST SP 800-82 OT ' +
                'security artefacts — FIPS 199 categorization records, Purdue model diagrams, SIS ' +
                'engineering records, and NIST 800-53 control evidence — for FISMA-covered systems ' +
                'must remain under US jurisdiction. PRC data localisation law (DSL + CSL) creates ' +
                'unresolvable conflict with FISMA § 3553, DFARS 252.204-7012, and EO 14028 OT ' +
                'supply-chain security requirements.',
            baidu: 'PRC-jurisdiction LLM; NIST SP 800-82 OT security program documentation, Purdue ' +
                'model zone artefacts, and FISMA authorization records for federal OT systems must ' +
                'remain under verifiable US jurisdiction per FISMA § 3553 and FAR 52.204-21. ' +
                'CMMC Level 2/3 requirements (DFARS 252.204-7012) applicable to DoD industrial base ' +
                'customers prohibit routing OT security data through PRC-jurisdiction services. PRC ' +
                'dual-use export controls on industrial control system security software create an ' +
                'unresolvable compliance conflict with US OT federal procurement requirements.',
            alibaba: 'PRC-jurisdiction LLM; HIGH impact OT system security lifecycle artefacts and SIS ' +
                'engineering records must remain outside PRC data jurisdiction per FISMA, DFARS, ' +
                'and EO 14028 supply-chain provisions. NERC CIP electric utility customers cannot ' +
                'route bulk electric system (BES) cyber system (BCS) data through PRC-jurisdiction ' +
                'services per NERC CIP-003-8 and CISA OT cybersecurity guidance. PRC CSL + DSL ' +
                'data-localisation obligations are incompatible with US federal OT data sovereignty ' +
                'requirements and CISA cross-sector OT incident sharing obligations.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'HIGH_IMPACT',
            'MODERATE_IMPACT',
            'LOW_IMPACT',
            'PURDUE_ARTEFACT',
            'OT_PROGRAM_ARTEFACT',
            'SIS_ARTEFACT',
        ],
        categoryActions: {
            // HIGH: unauthorised changes BLOCKED — OT security lead + authorizing official required
            HIGH_IMPACT: 'BLOCK',
            // MODERATE: changes enter approval queue for OT security engineer review
            MODERATE_IMPACT: 'REVIEWED',
            // LOW: logging sufficient for basic OT security audit
            LOW_IMPACT: 'LOG',
            // Purdue artefacts: REVIEWED — zone boundary changes affect all downstream security
            PURDUE_ARTEFACT: 'REVIEWED',
            // OT program documents: REVIEWED — policy changes require management approval
            OT_PROGRAM_ARTEFACT: 'REVIEWED',
            // SIS artefacts: BLOCK — absolute block; SIL-certified engineer sign-off required
            SIS_ARTEFACT: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        /**
         * NIST SP 800-92 + FISMA records management: 7-year federal records
         * baseline (2555 days). DoD / CMMC context may require longer retention;
         * apply the stricter requirement for DoD industrial base customers.
         */
        sovereignty: ['us'],
        auditLogRetentionDays: 2555, // 7 years — FISMA + NIST SP 800-92 federal records baseline
        sessionRetentionDays: 2555,
        incidentRetentionDays: 2555,
        reference: 'NIST SP 800-92 — Guide to Computer Security Log Management: federal retention baseline. ' +
            'FISMA 2014 § 3553 — OT security documentation retention for authorization packages. ' +
            'Common federal OT baseline: 7 years (2555 days). ' +
            'DoD / CMMC context (DFARS 252.204-7012) may impose longer periods — apply stricter requirement.',
    },
    incidentPolicy: {
        /**
         * CISA OT incident reporting baseline + EO 14028 + CIRCIA (2022):
         *   CIRCIA mandates 72h reporting to CISA for covered entities once enacted
         *   (rulemaking ongoing as of SP 800-82 Rev 3 publication).
         *   EO 14028 §6 and CISA OT guidance recommend 24h initial notification
         *   for significant OT incidents at federal and critical infrastructure sites.
         *   DoD / CMMC: 72h reporting under DFARS 252.204-7012 for cyber incidents.
         *   Conservative baseline for federal OT: 24h CISA + authorizing official.
         */
        notificationDeadlineHours: 24, // 24h — CISA + EO 14028 + conservative federal OT baseline
        reference: 'EO 14028 §6 — 24h significant incident notification for federal OT. ' +
            'CISA OT Cybersecurity Guidance — 24h initial OT incident reporting. ' +
            'CIRCIA 2022 — cyber incident reporting for critical infrastructure (rulemaking). ' +
            'DFARS 252.204-7012 — 72h DoD cyber incident reporting (DoD industrial base).',
        requiredRecipients: [
            'ciso',
            'system-security-officer',
            'ot-security-lead',
            'cisa-liaison',
            'authorizing-official',
            'nerc-cip-coordinator',
        ],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'nist80082-impact-level-assigned',
            description: 'FIPS 199 impact level (LOW / MODERATE / HIGH) assigned to every OT system ' +
                'and zone with documented rationale per NIST SP 800-82 §4.2. Impact categorization ' +
                'covers confidentiality, integrity, and availability, with OT typically prioritising ' +
                'availability and integrity (safety-critical deterministic operation). Default: ' +
                'MODERATE when categorization missing (governance-runtime conservative default ' +
                'per FIPS 199 guidance). Categorization must be traceable to a formal risk ' +
                'assessment per SP 800-30 and reviewed by the authorizing official.',
            reference: 'NIST SP 800-82 §4.2 + FIPS 199 (LOW/MODERATE/HIGH)',
            check: 'nist80082_impact_level_assigned',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nist80082-purdue-model-segmentation',
            description: 'Purdue Enterprise Reference Architecture (PERA) network segmentation on file per ' +
                'NIST SP 800-82 §5.5: OT assets assigned to Purdue levels (0-5); industrial DMZ ' +
                '(Level 3.5) deployed between OT and IT networks; firewall policies enforced at ' +
                'every zone boundary; Level 0-2 (PLC / SCADA / DCS) air-gapped or firewalled from ' +
                'Level 4+ (enterprise) traffic. All OT assets assigned to a Purdue level; unassigned ' +
                'assets are a CRITICAL finding. DMZ missing between Levels 3 and 4 is CRITICAL.',
            reference: 'NIST SP 800-82 §5.5 (Purdue Enterprise Reference Architecture)',
            check: 'nist80082_purdue_model_segmentation',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nist80082-cybersecurity-program',
            description: 'OT cybersecurity program established per NIST SP 800-82 §3: program charter and ' +
                'scope on file; OT security roles and responsibilities defined (CISO, system security ' +
                'officer, OT security lead, authorizing official); workforce training active; OT ' +
                'cybersecurity policies documented and approved by senior management; program ' +
                'reviewed annually. FISMA §3554 requires OT program documentation as part of the ' +
                'agency-wide information security program for federal OT operators.',
            reference: 'NIST SP 800-82 §3 (OT cybersecurity program)',
            check: 'nist80082_cybersecurity_program',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nist80082-risk-management',
            description: 'OT risk management process active per NIST SP 800-82 §4, adapted from SP 800-30 ' +
                'and SP 800-39: threat and vulnerability identification (NIST NVD + ICS-CERT ' +
                'advisories monitored); likelihood and impact analysis documented; risk response ' +
                'decisions recorded; residual risk accepted by authorizing official; risk register ' +
                'reviewed at least annually or after significant OT changes. FIPS 200 minimum ' +
                'security requirements applied as the control baseline floor.',
            reference: 'NIST SP 800-82 §4 + SP 800-30 + 800-39',
            check: 'nist80082_risk_management',
            failSeverity: 'HIGH',
        },
        {
            id: 'nist80082-ac-controls',
            description: 'Access Control (AC) family controls from NIST 800-53 Rev 5 applied to OT per ' +
                'SP 800-82 §6.2: role-based access control for OT operator / engineer / administrator ' +
                'roles; least privilege enforced on all OT system interfaces; account management ' +
                'procedures active (provisioning, deprovisioning, periodic review); remote access to ' +
                'OT systems restricted (jump server / VPN required); wireless access policies enforced. ' +
                'MODERATE and HIGH impact OT systems require MFA for remote access.',
            reference: 'NIST SP 800-82 §6.2 + SP 800-53 AC family (Access Control)',
            check: 'nist80082_ac_controls',
            failSeverity: 'HIGH',
        },
        {
            id: 'nist80082-au-controls',
            description: 'Audit and Accountability (AU) family controls from NIST 800-53 Rev 5 applied to OT ' +
                'per SP 800-82 §6.3: audit logging active on all OT system components where technically ' +
                'feasible; security-relevant events captured (login, configuration change, alarm, ' +
                'network access); centralized OT-specific SIEM or historian receiving logs; log ' +
                'integrity protection active; 7-year log retention (NIST SP 800-92 baseline). ' +
                'Compensating controls documented when OT devices do not support native logging.',
            reference: 'NIST SP 800-82 §6.3 + SP 800-53 AU family (Audit and Accountability)',
            check: 'nist80082_au_controls',
            failSeverity: 'HIGH',
        },
        {
            id: 'nist80082-cm-controls',
            description: 'Configuration Management (CM) family controls from NIST 800-53 Rev 5 applied to OT ' +
                'per SP 800-82 §6.6: OT baseline configurations established and documented for all PLCs, ' +
                'RTUs, HMIs, historians, and SCADA servers; configuration change control process active ' +
                '(formal approval before changes deployed to production OT); configuration inventory ' +
                'current; CM board or equivalent reviewing OT changes at MODERATE / HIGH impact systems; ' +
                'unauthorized software installation blocked on OT hosts.',
            reference: 'NIST SP 800-82 §6.6 + SP 800-53 CM family (Configuration Management)',
            check: 'nist80082_cm_controls',
            failSeverity: 'HIGH',
        },
        {
            id: 'nist80082-cp-controls',
            description: 'Contingency Planning (CP) family controls from NIST 800-53 Rev 5 applied to OT per ' +
                'SP 800-82 §6.7: OT contingency plan on file covering system backup, recovery, and ' +
                'reconstitution procedures; OT-specific recovery time objectives (RTO) and recovery ' +
                'point objectives (RPO) defined; backup of OT configurations and programs validated; ' +
                'contingency plan tested annually (tabletop or full exercise); off-site backup copies ' +
                'maintained for HIGH impact OT systems.',
            reference: 'NIST SP 800-82 §6.7 + SP 800-53 CP family (Contingency Planning)',
            check: 'nist80082_cp_controls',
            failSeverity: 'HIGH',
        },
        {
            id: 'nist80082-ir-controls',
            description: 'Incident Response (IR) family controls from NIST 800-53 Rev 5 applied to OT per ' +
                'SP 800-82 §6.10: OT-specific incident response plan on file; IR team with OT ' +
                'expertise defined; CISA OT incident reporting process integrated (24h notification); ' +
                'incident detection and analysis capabilities active on OT networks; lessons-learned ' +
                'process active; IR plan tested at least annually with OT-specific scenarios. ' +
                'CIRCIA reporting obligations for covered critical infrastructure entities integrated.',
            reference: 'NIST SP 800-82 §6.10 + SP 800-53 IR family (Incident Response)',
            check: 'nist80082_ir_controls',
            failSeverity: 'HIGH',
        },
        {
            id: 'nist80082-sc-controls',
            description: 'System and Communications Protection (SC) family controls from NIST 800-53 Rev 5 ' +
                'applied to OT per SP 800-82 §6.18: Purdue model network segmentation enforced; ' +
                'industrial DMZ (Level 3.5) deployed with OT-specific firewall / unidirectional ' +
                'gateway; encrypted communications on OT network segments where technically feasible ' +
                '(legacy protocols may use compensating controls); boundary protection at all OT-IT ' +
                'interfaces; wireless OT communications encrypted and authenticated.',
            reference: 'NIST SP 800-82 §6.18 + SP 800-53 SC family (System and Comms Protection)',
            check: 'nist80082_sc_controls',
            failSeverity: 'HIGH',
        },
        {
            id: 'nist80082-si-controls',
            description: 'System and Information Integrity (SI) family controls from NIST 800-53 Rev 5 applied ' +
                'to OT per SP 800-82 §6.19: malicious code protection active on OT hosts where ' +
                'vendor-supported; security alerts monitored via ICS-CERT / CISA advisories; ' +
                'OT software and firmware integrity verification active; security function verification ' +
                'on OT components at startup; spam and information input validation on OT application ' +
                'interfaces. Application allowlisting used instead of traditional AV where feasible.',
            reference: 'NIST SP 800-82 §6.19 + SP 800-53 SI family (System and Info Integrity)',
            check: 'nist80082_si_controls',
            failSeverity: 'HIGH',
        },
        {
            id: 'nist80082-sr-controls',
            description: 'Supply Chain Risk Management (SR) family controls from NIST 800-53 Rev 5 applied to ' +
                'OT per SP 800-82 §6.20: OT supplier risk assessment process active; SBOM (Software ' +
                'Bill of Materials) for OT software and firmware components maintained (EO 14028); ' +
                'COTS OT component evaluation for security vulnerabilities before procurement; OT ' +
                'vendor security requirements in procurement contracts; counterfeit component detection ' +
                'processes for PLCs, RTUs, and embedded OT hardware.',
            reference: 'NIST SP 800-82 §6.20 + SP 800-53 SR family (Supply Chain Risk Management)',
            check: 'nist80082_sr_controls',
            failSeverity: 'HIGH',
        },
        {
            id: 'nist80082-safety-instrumented-system',
            description: 'Safety-Instrumented System (SIS) protection active per NIST SP 800-82 §5.7: ' +
                'SIS on a separate network segment from BPCS (Basic Process Control System); ' +
                'SIS changes governed by formal management of change with SIL-certified engineer ' +
                'sign-off (IEC 61511 / IEC 61508 alignment); SIS software version control active; ' +
                'no AI-generated changes to SIS logic without human-in-loop review + sign-off; ' +
                'SIS cyber assessment performed before any network connection added. Missing SIS ' +
                'isolation is an absolute CRITICAL finding with no compensating control path.',
            reference: 'NIST SP 800-82 §5.7 + IEC 61511 alignment (SIS)',
            check: 'nist80082_safety_instrumented_system',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nist80082-cisa-incident-reporting',
            description: 'CISA OT incident reporting process active per NIST SP 800-82 §6.10 + CIRCIA + ' +
                'EO 14028: OT security incidents reported to CISA within 24 hours of discovery ' +
                '(EO 14028 + CISA OT guidance baseline); CIRCIA reporting for covered critical ' +
                'infrastructure entities wired (72h rulemaking target); NERC CIP incident reporting ' +
                'for electric utility OT (NERC CIP-008-6); CISA ICS-CERT coordination contacts ' +
                'maintained; incident records preserved 7 years. Formal notification required to ' +
                'CISO, system security officer, OT security lead, CISA liaison, and authorizing official.',
            reference: 'NIST SP 800-82 §6.10 + CIRCIA + EO 14028',
            check: 'nist80082_cisa_incident_reporting',
            failSeverity: 'HIGH',
        },
        {
            id: 'nist80082-behavioral-validator-high-impact-unverified-change',
            description: 'Behavioral validator: detects unverified software or configuration changes to ' +
                'HIGH impact OT systems or Safety-Instrumented Systems (SIS). Any AI-generated ' +
                'or agent-initiated modification to an OT control system element classified at ' +
                'FIPS 199 HIGH impact or categorized as SIS must be blocked pending full security ' +
                'impact analysis, Purdue model zone re-validation, OT security lead review, and ' +
                'authorizing official sign-off. No partial-pass path: HIGH impact and SIS unverified ' +
                'changes are an absolute block. HIGH impact violations escalated immediately to ' +
                'system security officer and authorizing official. SIS violations also escalate ' +
                'to the SIL-certified process safety engineer.',
            reference: 'NIST SP 800-82 §4.2 + §5.7 + FIPS 199 HIGH + IEC 61511 alignment',
            check: 'behavioralValidator_nist80082_high_impact_unverified_change',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=nist-sp-800-82.js.map