/**
 * ISO/IEC 80001 Medical IT Network Risk Management Compliance Pack
 *
 * ISO/IEC 80001 (multipart family) addresses the application of risk management
 * to IT-networks incorporating medical devices. This is distinct from IEC 62304
 * (which governs medical-device SOFTWARE DEVELOPMENT lifecycle) — 80001 governs
 * the DEPLOYMENT, OPERATION, and MAINTENANCE of medical devices on hospital and
 * health-system IT networks throughout their operational lifecycle.
 *
 * Multipart family structure:
 *   80001-1:2021  — General principles + risk management process (main part;
 *                   4th edition supersedes 80001-1:2010)
 *   80001-2-1:2012 — Step-by-step risk management application guide
 *   80001-2-2:2012 — Guidance for the communication of medical device security
 *                   needs, risks, and controls (SECURITY capabilities template)
 *   80001-2-3:2012 — Guidance for wireless networks
 *   80001-2-4:2015 — General implementation guidance for healthcare delivery
 *                   organizations
 *   80001-2-5:2014 — Application guidance — Guidance for distributed alarm
 *                   systems
 *   80001-2-6:2014 — Application guidance — Guidance for use of the IHE
 *                   Audit Trail and Node Authentication (ATNA) Profile
 *
 * Jointly published by ISO/IEC JTC 1 (Information technology) and IEC TC 62/SC 62A
 * (Common aspects of electrical equipment used in medical practice). Recognized by:
 *   - US FDA (Medical Device Cybersecurity guidance — aligns with 80001-2-2 SECURE)
 *   - MHRA (UK Medicines and Healthcare products Regulatory Agency)
 *   - Health Canada (Medical Devices Directorate)
 *   - TGA (Australian Therapeutic Goods Administration)
 *   - BSI (British Standards Institution)
 *   - National health-system regulators in EU/EFTA states (aligned with NIS2 for
 *     health sector)
 *
 * Alignment with sister standards:
 *   - ISO 14971:2019 — Medical devices: Application of risk management (the
 *     foundational medical device risk standard; 80001 extends 14971 from device-
 *     intrinsic risk to NETWORK-mediated risk)
 *   - ISO 27799:2016 — Health informatics: information security management
 *     (implements ISO/IEC 27002 in health context; pairs with 80001-2-2)
 *   - IEC 62304:2015 — Medical device software lifecycle (device-side software;
 *     complementary, not overlapping)
 *   - FDA 21 CFR 820 (QMSR) — quality system requirements for medical devices
 *   - HIPAA 45 CFR §164 — Protected Health Information (US context)
 *   - GDPR Art. 9 — special-category health data (EU context)
 *
 * THREE KEY PROPERTIES that risk management must preserve (§4.2):
 *   1. SAFETY       — protection from patient harm caused by network-mediated failure
 *   2. EFFECTIVENESS — medical purpose (device's intended function) still achieved
 *   3. DATA + SYSTEM SECURITY — integrity, availability, and confidentiality of
 *                    clinical data and system function (often abbreviated D&SS)
 *
 * Per the standard's core principle: every medical device added to the medical IT
 * network requires a formal risk assessment documenting the impact on all three KEY
 * PROPERTIES, residual risk documentation, and ongoing monitoring through the
 * device's operational lifecycle on the network.
 *
 * Roles defined in 80001-1:2021 §5:
 *   Responsible Organization (RO) — the health delivery organization (hospital /
 *     health system) that deploys and operates the medical IT network. Bears
 *     ultimate accountability for risk management.
 *   Medical IT-Network Risk Manager (MITN-RM) — designated individual within the
 *     RO who owns the risk management process and has documented authority over
 *     change management decisions. Required by §5.
 *   Medical Device Manufacturer — provides device-specific security capabilities
 *     documentation per 80001-2-2 (the MDS2 form / SECURE template).
 *   IT Operator — the IT department or MSP operating the network infrastructure.
 *
 * Responsibility Agreements (§6):
 *   Formal documented agreements between the RO, the medical device manufacturer,
 *   and the IT operator covering: risk ownership boundaries, security capabilities
 *   communication, change notification obligations, and incident notification.
 *
 * Patient-record retention:
 *   20-year baseline (7300 days) — medical-device network records must be retained
 *   for the lifetime of clinical decisions supported by devices on the network.
 *   Aligned with cross-jurisdictional medical record retention: US HIPAA/CMS
 *   (minimum 10 years; some state laws require 20 years for adult records);
 *   EU GDPR + national law (10-30 years for clinical records depending on
 *   jurisdiction — NHS England 20 years, Germany §630f BGB 10 years, France
 *   20 years); Australia Health Records Acts (7-10 years adults). Conservative
 *   20-year cross-jurisdictional baseline for health-system clinical-network records.
 *
 * Incident notification:
 *   72-hour baseline (3 days) — cross-jurisdictional most-restrictive baseline for
 *   medical-device network incidents: GDPR Art. 33 (72h supervisory authority
 *   breach notification for health data); HIPAA 45 CFR §164.412 (60 days but
 *   most state breach laws require 30-72h; FDA adverse event reporting
 *   MDR — 30-day routine / 5-day if immediately needs corrective action);
 *   NIS2 Art. 23 (24h early warning, 72h notification for health-sector incidents);
 *   ISO/IEC 80001-1:2021 §9 (incident management — notify medical device
 *   manufacturer + RO patient safety officer without undue delay). 72h is the
 *   most-restrictive cross-jurisdictional formal notification baseline.
 *
 * @connexum/ai-governance
 */
import { CompliancePack } from './index';
import { CategoryClassifiers } from '../classification/pack-driven-classifier';
/**
 * ISO/IEC 80001 Medical IT Network Risk Management category classifiers.
 *
 * Covers medical IT network risk management artefacts:
 *   - Key property impact events (safety / effectiveness / data+system security)
 *   - Medical device network change records requiring pre-change risk assessment
 *   - Responsibility Agreement records between RO, device manufacturer, IT operator
 *   - Medical device network incident records
 *   - Security capabilities (MDS2/SECURE template) records per 80001-2-2
 */
export declare const ISO_IEC_80001_CATEGORY_CLASSIFIERS: CategoryClassifiers;
/**
 * ISO/IEC 80001 Medical IT Network Risk Management Compliance Pack.
 *
 * Pack ID: 'iso-iec-80001'
 * Jurisdiction: International — ISO + IEC joint standard; recognized by FDA (US),
 *   MHRA (UK), Health Canada, TGA (AU), national health-system regulators (EU/EFTA).
 *   Aligned with ISO 14971 (medical-device risk), ISO 27799 (health informatics
 *   security), and NIST SP 800-82 (OT cybersecurity).
 *
 * Guard-layer wiring:
 *   - G1-G4 (audit, logging, classification, session): always active
 *   - G5 (supply-chain): always active — PRC provider blocks; medical device vendor
 *       qualification via Responsibility Agreements; network integrator qualification
 *   - G6 (approval-queue): always active — pre-change risk assessment approval;
 *       network change management gate (§8); key property impact resolution
 *       approval (MITN-RM + patient-safety-officer sign-off mandatory)
 *   - G7 (attestation): always active — MITN-RM attestation for change management
 *       decisions; medical device vendor attestation for security capabilities
 *       (80001-2-2 SECURE template); Responsibility Agreement counter-signatures
 *   - G8 (anomaly-detector): always active — key property impact detection
 *       (safety / effectiveness / security degradation signals); immediate CRITICAL
 *       escalation to patient-safety-officer when key property impact detected;
 *       network monitoring + event handling per §9 + 80001-2-2 §6
 *   - G9 (transparency): always active — AI-generated network risk assessments
 *       must be disclosed + reviewed by MITN-RM + biomedical-engineering-lead;
 *       AI-assisted distributed alarm system monitoring must disclose model
 *       provenance (80001-2-5 alignment)
 *
 * Human-in-loop tier:
 *   - T1: Routine network monitoring events, device inventory updates, standard
 *         risk register updates (MITN-RM + clinical-network-engineer review)
 *   - T2: Responsibility Agreement changes, security capability updates (80001-2-2),
 *         wireless network configuration changes (80001-2-3), new device classes
 *         (biomedical-engineering-lead + MITN-RM + cybersecurity-incident-coordinator)
 *   - T3: Key property impact events (any of safety / effectiveness / security
 *         degraded — immediate: MITN-RM + patient-safety-officer + hospital-cio +
 *         medical-device-vendor-liaison + cybersecurity-incident-coordinator)
 */
export declare const ISO_IEC_80001_PACK: CompliancePack & {
    categoryClassifiers: CategoryClassifiers;
    subjectKeyedCategories: string[];
};
//# sourceMappingURL=iso-iec-80001.d.ts.map