/**
 * EU NIS2 Directive Compliance Pack
 *
 * Regulation: Directive (EU) 2022/2555 of the European Parliament and of the
 *             Council of 14 December 2022 on measures for a high common level
 *             of cybersecurity across the Union (NIS2 Directive)
 *
 * Jurisdiction: EU (European Union -- all member states)
 * Regulators: National competent authorities per Art. 8 (e.g., BSI in Germany,
 *             ANSSI in France, NCSC in Netherlands, ENISA as EU-level body);
 *             CSIRT network per Art. 11; cooperation group per Art. 14
 *
 * Effective dates:
 *   - 17 January 2023: entry into force
 *   - 17 October 2024: member state transposition deadline (Articles 41)
 *   - Note: Member state transposition quality varies; verify local law in
 *     each target jurisdiction before relying on national implementation.
 *
 * Scope -- Entity classification:
 *   ESSENTIAL ENTITIES (Annex I -- highest obligations):
 *     Energy (electricity, oil, gas, hydrogen, district heating), Transport
 *     (air, rail, water, road), Banking, Financial market infrastructure,
 *     Health (hospitals, EU reference labs, R&D, pharma), Drinking water,
 *     Wastewater, Digital infrastructure (IXPs, DNS, TLDs, cloud, data
 *     centres, CDNs, trust services, electronic comms), ICT service
 *     management (B2B MSPs, MSSPs), Public administration (central/regional),
 *     Space (ground-based infrastructure)
 *
 *   IMPORTANT ENTITIES (Annex II -- lower threshold, same 10 measures):
 *     Postal and courier services, Waste management, Manufacture of critical
 *     products (medical devices, computers/electronics, machinery, motor
 *     vehicles, other transport), Food production/processing/distribution,
 *     Digital providers (online marketplaces, search engines, social networks),
 *     Research organisations
 *
 * Key obligations (Art. 21 -- all entities):
 *   10 minimum cybersecurity risk-management measures:
 *   1. Incident handling
 *   2. Business continuity and crisis management (BCP)
 *   3. Supply chain security (including ICT supply chain)
 *   4. Network and information systems security
 *   5. Vulnerability handling and disclosure
 *   6. Basic cyber hygiene + cybersecurity training
 *   7. Multi-factor authentication + access control
 *   8. Cryptography / encryption
 *   9. Human resources security
 *   10. Asset management + appropriate physical security
 *
 * Incident reporting (Art. 23):
 *   - Significant incident: early warning within 24 hours of becoming aware
 *   - Formal notification within 72 hours
 *   - Final report within 1 month (initial) / 3 months (for ongoing incidents)
 *   - Significant incident defined: (a) caused or can cause severe operational
 *     disruption or financial losses; or (b) affected or can affect other
 *     natural or legal persons by causing considerable material or non-material
 *     damages.
 *
 * Distinction from DORA:
 *   DORA applies specifically to financial sector entities (credit institutions,
 *   investment firms, insurance, payment institutions, etc.) and includes more
 *   prescriptive requirements around ICT risk management and TLPT. NIS2 applies
 *   broadly across critical sectors. For financial sector entities, DORA
 *   satisfies NIS2 equivalence per Art. 1(2) NIS2. Both packs may be active
 *   if the entity is in scope of both (e.g., a bank providing critical
 *   infrastructure services).
 *
 * Penalties:
 *   Essential entities: up to EUR 10M or 2% of global annual turnover (whichever higher)
 *   Important entities: up to EUR 7M or 1.4% of global annual turnover (whichever higher)
 *   Personal liability of management bodies for non-compliance (Art. 20)
 *
 * @connexum/ai-governance
 */
import { CompliancePack } from './index';
import { CategoryClassifiers } from '../classification/pack-driven-classifier';
export declare const NIS2_CATEGORY_CLASSIFIERS: CategoryClassifiers;
export declare const NIS2_PACK: CompliancePack & {
    categoryClassifiers: CategoryClassifiers;
};
//# sourceMappingURL=nis2.d.ts.map