/**
 * Cyber Essentials / Cyber Essentials Plus Compliance Pack
 *
 * Regulation:
 *   UK NCSC (National Cyber Security Centre) Cyber Essentials scheme,
 *   administered by IASME on behalf of NCSC.
 *   - Cyber Essentials (self-assessment, annual renewal)
 *   - Cyber Essentials Plus (independent technical verification on top of CE)
 *
 * Jurisdiction: GB (United Kingdom)
 * Regulator: NCSC + IASME (delivery partner) + sectoral procurers (NHS, MoD,
 *   Government Digital Service, Crown Commercial Service) that mandate CE/CE+
 *   as a contract precondition.
 *
 * Why this pack:
 *   - CE is mandatory for many NHS contracts, central government suppliers,
 *     and a growing list of MoD / public-sector frameworks.
 *   - Pairs with NHS DSPT (most NHS suppliers need both).
 *   - The five technical control families form a baseline that AI agents
 *     touching customer infrastructure must meet; this pack tracks the
 *     self-assessment evidence chain. CE+ adds independent technical
 *     verification (out of scope for the pack itself — the audit body
 *     performs the verification, the pack tracks attestation.)
 *
 * Five Cyber Essentials technical control families (current scheme,
 * "Montpellier" question set 2026):
 *   1. Firewalls and routers (boundary protection)
 *   2. Secure configuration (default-deny, hardening, no default creds)
 *   3. Security update management (patch SLAs: 14 days for critical/high)
 *   4. User access control (least privilege, MFA, separation of duties)
 *   5. Malware protection (one of: anti-malware, application allowlist,
 *      sandboxing)
 *
 * Out of scope for this pack (handled elsewhere):
 *   - DSPT clinical-data layer (separate pack: nhs-dspt)
 *   - UK GDPR Article 32 personal-data security (separate pack: uk-gdpr)
 *   - DCB0129/DCB0160 clinical safety (future Wave 1 Pack 7)
 *   - The CE+ technical verification itself (performed by IASME-licensed
 *     certifying body; pack records the resulting attestation only)
 *
 * Relation to ISO 27001 + NIS2:
 *   - CE is intentionally lighter-weight than ISO 27001. A customer with
 *     ISO 27001 already in place has substantially exceeded CE controls.
 *   - NIS2 (EU/national) and CE both require patch management + access
 *     control but with different reporting and scope. They co-exist.
 *
 * @connexum/ai-governance
 */
import { CompliancePack } from './index';
import { CategoryClassifiers } from '../classification/pack-driven-classifier';
/**
 * Cyber Essentials category classifiers.
 *
 * The pack scope is technical control evidence, not personal-data
 * classification. Most flagged content is operational metadata:
 * configuration baselines, patch records, access-rights events,
 * malware-protection telemetry, and CE/CE+ attestation artefacts.
 */
export declare const CYBER_ESSENTIALS_CATEGORY_CLASSIFIERS: CategoryClassifiers;
export declare const CYBER_ESSENTIALS_PACK: CompliancePack & {
    categoryClassifiers: CategoryClassifiers;
};
//# sourceMappingURL=cyber-essentials.d.ts.map