/**
 * DORA per-framework narrative prompt context.
 *
 * Declares section headings, evidence-linkage requirements, and required
 * control mappings for DORA compliance narratives.
 *
 * References:
 *   Regulation (EU) 2022/2554 -- Digital Operational Resilience Act (DORA)
 *   RTS on ICT risk management tools (ESAs joint consultation paper, 2023)
 *   EBA/ESMA/EIOPA DORA implementing technical standards (ITS), 2024
 *
 * Spec: P4-AIR-02 AC 4-6
 *
 * @connexum/ai-governance
 */
export const DORA_PROMPT_SPEC = {
    frameworkId: 'dora',
    frameworkName: 'DORA',
    version: 'Regulation (EU) 2022/2554 (applicable from 2025-01-17)',
    sections: [
        {
            sectionId: 'dora-art5-governance',
            heading: 'Article 5 ICT Risk Governance',
            regulatoryRef: 'DORA Article 5-6',
            requiredEventTypes: ['agent:registered', 'governance:verdict'],
            controlMappings: [
                'Art. 5(1) -- Management body responsibility for ICT risk framework',
                'Art. 5(2) -- Definition and approval of ICT risk strategy',
                'Art. 5(4) -- Allocation of ICT-related roles and responsibilities',
                'Art. 6(1) -- Documented ICT risk management framework',
                'Art. 6(4) -- ICT risk management strategy approved by management body',
            ],
            citationRequirement: 'optional',
            promptGuidance: 'Document ICT risk governance structure as applied to AI agent operations. ' +
                'Describe how the AI governance platform implements the documented risk management ' +
                'framework required by Art. 6(1). Cite agent registration events as evidence of ' +
                'structured ICT asset onboarding. Reference governance verdicts as evidence of ' +
                'systematic policy enforcement under the approved risk strategy.',
        },
        {
            sectionId: 'dora-art9-protection',
            heading: 'Article 9 Protection and Prevention',
            regulatoryRef: 'DORA Article 9',
            requiredEventTypes: ['governance:verdict', 'action:denied'],
            controlMappings: [
                'Art. 9(1) -- Continuous monitoring and control of ICT systems',
                'Art. 9(2) -- Dedicated ICT security policies (identity, access, encryption)',
                'Art. 9(3)(a) -- ICT asset inventory policies',
                'Art. 9(3)(b) -- Change management for ICT assets',
                'Art. 9(4) -- Policies for legitimate software use',
                'Art. 9(4)(a) -- Limitation of ICT access (least privilege)',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Provide evidence of protection and prevention controls meeting Art. 9. ' +
                'Cite governance verdict events as continuous monitoring evidence. ' +
                'Cite deny-decision events as evidence of least-privilege access enforcement (Art. 9(4)(a)). ' +
                'Quantify: total access decisions, denial rate, and policy enforcement events. ' +
                'Note agent registration as ICT asset inventory control (Art. 9(3)(a)).',
        },
        {
            sectionId: 'dora-art10-detection',
            heading: 'Article 10 Detection',
            regulatoryRef: 'DORA Article 10',
            requiredEventTypes: ['governance:verdict', 'incident:created'],
            controlMappings: [
                'Art. 10(1) -- Mechanisms to detect anomalous activities promptly',
                'Art. 10(2) -- Multiple layers of control including anomaly detection',
                'Art. 10(3) -- Alert systems for anomalous patterns',
                'Art. 10(4) -- ICT-related incident reporting processes',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Document detection capabilities under Art. 10. Describe anomaly detection events ' +
                '(circuit-breaker trips, threshold violations, unexpected behaviour flags) as evidence ' +
                'of the multi-layer detection requirement. For any incident events, document detection ' +
                'latency from first anomaly signal to incident classification. ' +
                'Quantify: anomalies detected, escalated incidents, and mean time to detect (MTTD).',
        },
        {
            sectionId: 'dora-art11-response-recovery',
            heading: 'Article 11 Response and Recovery',
            regulatoryRef: 'DORA Article 11',
            requiredEventTypes: ['incident:created'],
            controlMappings: [
                'Art. 11(1) -- ICT Business Continuity Policy',
                'Art. 11(2) -- ICT response and recovery plans and procedures',
                'Art. 11(3) -- Crisis communication plans for ICT incidents',
                'Art. 11(5) -- Post-incident review and lessons learned',
                'Art. 11(6) -- Activation of response plans with due care',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Document incident response and recovery activities for any ICT incidents. ' +
                'For each incident event, trace the response timeline: detection, containment, ' +
                'recovery, and post-incident review. If no qualifying incidents occurred, document ' +
                'the absence of incident events with chain evidence and describe the response ' +
                'readiness posture (plans tested, recovery time objectives defined).',
        },
        {
            sectionId: 'dora-art17-major-incident',
            heading: 'Article 17-23 ICT-Related Incident Reporting',
            regulatoryRef: 'DORA Article 17-23',
            requiredEventTypes: ['incident:created'],
            controlMappings: [
                'Art. 17 -- Classification of ICT-related incidents and cyber threats',
                'Art. 18 -- Classification criteria (impact on operations, data, reputation)',
                'Art. 19 -- Reporting of major ICT-related incidents to competent authorities',
                'Art. 20 -- Harmonised reporting templates (initial/intermediate/final)',
                'Art. 21 -- Centralised reporting hub (single integrated reporting)',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Assess major incident reporting obligations under DORA Art. 17-23. ' +
                'For any incident events, apply the Art. 18 classification criteria to determine ' +
                'whether they meet the "major incident" threshold. Document the notification timeline ' +
                'against the regulatory deadlines (initial report: 4 hours; intermediate: 72 hours; ' +
                'final: 1 month). If no major incidents occurred, document this with chain evidence.',
        },
    ],
};
//# sourceMappingURL=dora.js.map