"use strict";
/**
 * Cyber Essentials / Cyber Essentials Plus Compliance Pack
 *
 * Regulation:
 *   UK NCSC (National Cyber Security Centre) Cyber Essentials scheme,
 *   administered by IASME on behalf of NCSC.
 *   - Cyber Essentials (self-assessment, annual renewal)
 *   - Cyber Essentials Plus (independent technical verification on top of CE)
 *
 * Jurisdiction: GB (United Kingdom)
 * Regulator: NCSC + IASME (delivery partner) + sectoral procurers (NHS, MoD,
 *   Government Digital Service, Crown Commercial Service) that mandate CE/CE+
 *   as a contract precondition.
 *
 * Why this pack:
 *   - CE is mandatory for many NHS contracts, central government suppliers,
 *     and a growing list of MoD / public-sector frameworks.
 *   - Pairs with NHS DSPT (most NHS suppliers need both).
 *   - The five technical control families form a baseline that AI agents
 *     touching customer infrastructure must meet; this pack tracks the
 *     self-assessment evidence chain. CE+ adds independent technical
 *     verification (out of scope for the pack itself — the audit body
 *     performs the verification, the pack tracks attestation.)
 *
 * Five Cyber Essentials technical control families (current scheme,
 * "Montpellier" question set 2026):
 *   1. Firewalls and routers (boundary protection)
 *   2. Secure configuration (default-deny, hardening, no default creds)
 *   3. Security update management (patch SLAs: 14 days for critical/high)
 *   4. User access control (least privilege, MFA, separation of duties)
 *   5. Malware protection (one of: anti-malware, application allowlist,
 *      sandboxing)
 *
 * Out of scope for this pack (handled elsewhere):
 *   - DSPT clinical-data layer (separate pack: nhs-dspt)
 *   - UK GDPR Article 32 personal-data security (separate pack: uk-gdpr)
 *   - DCB0129/DCB0160 clinical safety (future Wave 1 Pack 7)
 *   - The CE+ technical verification itself (performed by IASME-licensed
 *     certifying body; pack records the resulting attestation only)
 *
 * Relation to ISO 27001 + NIS2:
 *   - CE is intentionally lighter-weight than ISO 27001. A customer with
 *     ISO 27001 already in place has substantially exceeded CE controls.
 *   - NIS2 (EU/national) and CE both require patch management + access
 *     control but with different reporting and scope. They co-exist.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.CYBER_ESSENTIALS_PACK = exports.CYBER_ESSENTIALS_CATEGORY_CLASSIFIERS = void 0;
/**
 * Cyber Essentials category classifiers.
 *
 * The pack scope is technical control evidence, not personal-data
 * classification. Most flagged content is operational metadata:
 * configuration baselines, patch records, access-rights events,
 * malware-protection telemetry, and CE/CE+ attestation artefacts.
 */
exports.CYBER_ESSENTIALS_CATEGORY_CLASSIFIERS = {
    CE_ATTESTATION_ARTIFACT: {
        references: [
            'NCSC Cyber Essentials scheme requirements',
            'IASME Cyber Essentials assessment evidence',
            'Cyber Essentials Plus technical verification report',
        ],
        classifier: (input) => {
            if (/\b(?:cyber\s*essentials\s*(?:plus|certificate|attestation|assessment))\b/i.test(input))
                return true;
            if (/\b(?:ce\s+plus\s+report|ce\+\s+attestation|iasme\s+(?:assessment|verification))\b/i.test(input))
                return true;
            if (/\b(?:ncsc\s+attestation|ce\s+annual\s+renewal|ce\s+(?:self|self-)assessment)\b/i.test(input))
                return true;
            return false;
        },
    },
    PATCH_RECORD: {
        references: [
            'Cyber Essentials control: Security update management — 14-day SLA for critical/high CVE patches',
        ],
        classifier: (input) => {
            if (/\b(?:cve-\d{4}-\d{4,7})\b/i.test(input))
                return true;
            if (/\b(?:patch\s+(?:tuesday|sla|status|record)|hot[\s-]?fix\s+deployed|kb\s+\d{6,8}\s+applied)\b/i.test(input))
                return true;
            if (/\b(?:critical\s+vulnerability\s+patched|high[\s-]?severity\s+update|emergency\s+patch)\b/i.test(input))
                return true;
            return false;
        },
    },
    CONFIG_BASELINE: {
        references: [
            'Cyber Essentials control: Secure configuration — defaults-removed, hardening evidence',
        ],
        classifier: (input) => {
            if (/\b(?:cis\s+benchmark|stig|hardening\s+(?:profile|baseline|guide))\b/i.test(input))
                return true;
            if (/\b(?:default\s+(?:password|credential|account)\s+(?:removed|disabled)|root\s+login\s+disabled)\b/i.test(input))
                return true;
            if (/\b(?:secure\s+configuration\s+evidence|baseline\s+drift|config\s+attestation)\b/i.test(input))
                return true;
            return false;
        },
    },
    ACCESS_CONTROL_EVENT: {
        references: [
            'Cyber Essentials control: User access control — MFA, separation of duties',
        ],
        classifier: (input) => {
            if (/\b(?:mfa\s+(?:enrolled|enforced|disabled)|two[\s-]?factor\s+(?:authentication|enrolment))\b/i.test(input))
                return true;
            if (/\b(?:privileged\s+access\s+(?:granted|revoked|reviewed)|admin\s+account\s+(?:created|removed))\b/i.test(input))
                return true;
            if (/\b(?:joiner[\s-]?mover[\s-]?leaver|jml\s+(?:event|workflow)|access\s+rights\s+review)\b/i.test(input))
                return true;
            return false;
        },
    },
    MALWARE_PROTECTION_TELEMETRY: {
        references: [
            'Cyber Essentials control: Malware protection (one of anti-malware / allowlist / sandboxing)',
        ],
        classifier: (input) => {
            if (/\b(?:edr\s+alert|anti[\s-]?malware\s+(?:detection|signature|update)|application\s+(?:allowlist|whitelist))\b/i.test(input))
                return true;
            if (/\b(?:malicious\s+file\s+blocked|quarantine(?:d)?|sandbox\s+detonation)\b/i.test(input))
                return true;
            if (/\b(?:av\s+definitions?\s+updated|defender\s+(?:scan|alert|exclusion))\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Cyber Essentials secure configuration — credentials must not be in plaintext'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.CYBER_ESSENTIALS_PACK = {
    categoryClassifiers: exports.CYBER_ESSENTIALS_CATEGORY_CLASSIFIERS,
    id: 'cyber-essentials',
    aliases: ['cyber-essentials-plus', 'ce', 'ce-plus', 'ncsc-ce'],
    name: 'UK NCSC Cyber Essentials / Cyber Essentials Plus',
    version: '1.0.0',
    contentHash: '3dca6204105e96e4454e7ffb2d88b5b7d91766aadd8a7315d022a07e1c1793a9',
    description: 'UK NCSC Cyber Essentials scheme covering the five technical control families (firewalls, secure configuration, security update management, user access control, malware protection). Mandatory for many NHS, central government, and MoD supplier contracts. Pairs with NHS DSPT for NHS data partners. Tracks the self-assessment evidence chain plus the CE+ independent technical verification attestation. Annual renewal cadence; patch SLA enforcement (14 days for critical / high CVEs).',
    authority: 'NCSC (National Cyber Security Centre) + IASME (delivery partner) + Crown Commercial Service / NHS England / MoD (procurer mandates)',
    industries: ['technology', 'healthcare', 'public-sector', 'defense', 'financial-services', 'professional-services', 'manufacturing', 'education', 'charity'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Enforce default-deny on agent actions touching customer infrastructure; secure-configuration gate; CE control 2 hardening posture.',
            reference: 'Cyber Essentials control 2: Secure configuration; NCSC default-deny guidance',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Enforce MFA, least privilege, separation of duties, and joiner-mover-leaver workflow per CE control 4 user access control.',
            reference: 'Cyber Essentials control 4: User access control; NCSC MFA guidance',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit chain for access events, configuration changes, patch deployments, and malware-protection telemetry — required for IASME assessment + CE+ technical verification evidence.',
            reference: 'IASME assessment evidence requirements; CE+ technical verification scope',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Annual CE attestation tracking, CE+ verification report archival, patch SLA attestation, control-family evidence (firewall config, baseline configs, access-rights review).',
            reference: 'NCSC Cyber Essentials annual renewal requirement; IASME evidence retention',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Patch lifecycle events (CVE published → patch available → patch deployed) for CE control 3 SLA monitoring; access-control events; malware-protection alerts.',
            reference: 'Cyber Essentials control 3: Security update management — 14-day patch SLA',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Secret detection on every agent action (CE control 2 secure configuration prohibits credentials in artefacts); flag patch records, configuration baselines, access events for evidence collection.',
            reference: 'Cyber Essentials control 2: Secure configuration — no plaintext credentials',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Network and at-rest encryption for boundary devices and data stores; complements CE control 1 firewalls / routers boundary protection.',
            reference: 'Cyber Essentials control 1: Firewalls and routers; NCSC TLS / cipher guidance',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Retain assessment evidence for at least one full annual cycle plus a buffer year (2 years recommended) so an audit body can reconstruct the prior period.',
            reference: 'NCSC Cyber Essentials annual cycle; IASME audit evidence retention',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Sub-processor CE attestation tracking; sub-supplier flow-down where required by the customer (e.g. NHS suppliers must require CE from their own suppliers).',
            reference: 'NCSC Cyber Essentials supply chain guidance; NHS supplier flow-down expectations',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Privileged access grant approval; emergency patch deployment approval (CE control 3 14-day SLA may require change-control bypass); high-risk configuration changes.',
            reference: 'CE control 4 user access control; ITIL emergency change procedure overlay',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            defaultDenyForBoundaryActions: true,
            ceSecureConfigurationGateRequired: true,
            hardenedBaselineRequired: true,
        },
        'agent-auth': {
            mfaRequired: true,
            leastPrivilegeRequired: true,
            separationOfDutiesRequired: true,
            jmlWorkflowRequired: true,
            accessRightsReviewIntervalDays: 90,
        },
        'audit-integrity': {
            tamperEvidentRequired: true,
            controlFamilyEvidenceTrackingRequired: true,
        },
        'attestation-manager': {
            ceAnnualRenewalTracked: true,
            cePlusVerificationReportArchived: true,
            patchSlaAttestationRequired: true,
            retentionYearsForEvidence: 2,
        },
        'event-bus': {
            patchLifecycleEventsTracked: true,
            patchSlaCriticalDays: 14,
            patchSlaHighDays: 14,
            accessControlEventsTracked: true,
            malwareProtectionAlertsRouted: true,
        },
        'data-classifier': {
            enabledCategories: [
                'CE_ATTESTATION_ARTIFACT',
                'PATCH_RECORD',
                'CONFIG_BASELINE',
                'ACCESS_CONTROL_EVENT',
                'MALWARE_PROTECTION_TELEMETRY',
                'CREDENTIALS',
            ],
            credentialsAction: 'BLOCK',
            ceArtifactAction: 'WARN',
        },
        'encryption-layer': {
            algorithm: 'aes-256-gcm',
            tlsMinVersion: '1.2',
            boundaryEncryptionRequired: true,
        },
        'session-persistence': {
            retentionDaysMinimum: 730, // 2 years
        },
        'supply-chain': {
            processorCeAttestationRequired: true,
            subSupplierFlowDownRequired: true,
        },
        'approval-queue': {
            privilegedAccessGrantApprovalRequired: true,
            emergencyPatchApprovalRequired: true,
            reviewTier: 'T1',
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-UK-OR-EU', 'PROCESSOR-CONTRACT'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law jurisdiction. NHS / public-sector procurers mandating CE typically also forbid PRC routing for boundary-touching services.',
            baidu: 'PRC jurisdiction; not compatible with NHS / public-sector procurer expectations attached to CE certification.',
            alibaba: 'PRC jurisdiction; not compatible with NHS / public-sector procurer expectations attached to CE certification.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'CE_ATTESTATION_ARTIFACT',
            'PATCH_RECORD',
            'CONFIG_BASELINE',
            'ACCESS_CONTROL_EVENT',
            'MALWARE_PROTECTION_TELEMETRY',
            'CREDENTIALS',
        ],
        categoryActions: {
            CE_ATTESTATION_ARTIFACT: 'WARN',
            PATCH_RECORD: 'WARN',
            CONFIG_BASELINE: 'WARN',
            ACCESS_CONTROL_EVENT: 'WARN',
            MALWARE_PROTECTION_TELEMETRY: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'INTERNAL',
    },
    retentionPolicy: {
        // CE annual renewal cycle + audit evidence buffer year.
        auditLogRetentionDays: 730, // 2 years
        sessionRetentionDays: 730,
        incidentRetentionDays: 1095, // 3 years for incident records
        reference: 'NCSC Cyber Essentials annual renewal; IASME assessment evidence retention; CE+ verification report archival',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb', 'eu'],
    },
    incidentPolicy: {
        // CE itself does not mandate a specific notification window; aligning
        // with NIS2-harmonised 72-hour ICO notification when the incident also
        // involves personal data, and NHS England 72-hour near-miss reporting
        // when the customer is a NHS supplier under DSPT.
        notificationDeadlineHours: 72,
        reference: 'NCSC incident response guidance; UK GDPR Art. 33 (when personal data); NHS England Section 12 near-miss (NHS context)',
        requiredRecipients: ['ciso', 'security-operations', 'data-protection-officer'],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'ce-firewall-boundary-active',
            description: 'Boundary protection (firewalls / routers) configured with default-deny, no default credentials, and audit trail for rule changes — CE control 1.',
            reference: 'Cyber Essentials control 1: Firewalls and routers',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ce-secure-configuration',
            description: 'Hardened baseline configuration (CIS / STIG-equivalent) applied; default credentials removed; secure-configuration gate enforced.',
            reference: 'Cyber Essentials control 2: Secure configuration',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ce-patch-sla-14-day',
            description: 'Critical / high-severity CVE patches deployed within 14 days of vendor release; patch lifecycle events logged.',
            reference: 'Cyber Essentials control 3: Security update management — 14-day SLA',
            check: 'monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ce-mfa-enforced',
            description: 'Multi-factor authentication enforced on all administrative access; MFA enrolment audit trail maintained.',
            reference: 'Cyber Essentials control 4: User access control — MFA',
            check: 'rbac_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ce-malware-protection',
            description: 'At least one of: anti-malware product, application allowlist, or sandboxing active across all in-scope systems.',
            reference: 'Cyber Essentials control 5: Malware protection',
            check: 'monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ce-access-rights-review',
            description: 'Access rights reviewed at least every 90 days; joiner-mover-leaver events captured with audit trail.',
            reference: 'Cyber Essentials control 4: User access control — review cadence',
            check: 'rbac_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ce-attestation-current',
            description: 'CE / CE+ attestation current (within annual renewal window); next-renewal date tracked.',
            reference: 'NCSC Cyber Essentials annual renewal requirement',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ce-credential-block',
            description: 'Plaintext credentials blocked from agent artefacts and audit chain entries (secure-configuration overlay).',
            reference: 'Cyber Essentials control 2 + NCSC secrets management guidance',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ce-supplier-flow-down',
            description: 'Sub-processor CE attestation captured; supplier flow-down recorded where required by procurer.',
            reference: 'NCSC supply chain guidance; NHS supplier flow-down expectations',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ce-encryption-active',
            description: 'Boundary and at-rest encryption active to NCSC-recommended cipher / TLS versions.',
            reference: 'NCSC TLS configuration guidance; Cyber Essentials control 1 boundary protection',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ce-evidence-audit-trail',
            description: 'Tamper-evident audit trail covers CE control-family evidence: firewall changes, baseline configs, patch deployments, access events, malware alerts.',
            reference: 'IASME assessment evidence requirements; CE+ technical verification scope',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=cyber-essentials.js.map