"use strict";
/**
 * NY DFS 23 NYCRR Part 500 Compliance Pack
 *
 * New York Department of Financial Services Cybersecurity Regulation
 * with Second Amendment (effective 1 Nov 2023, phased through April
 * 2025):
 *   - Class A tier for larger entities (2,000+ employees or $1B+ gross
 *     revenue averaged over 3 years)
 *   - 72-hour cybersecurity event notification (§500.17(a))
 *   - 24-hour ransomware payment notification + 30-day explanation
 *     (§500.17(c))
 *   - CISO board reporting annually
 *   - MFA expansion for all privileged / remote access
 *   - Encryption of NPI at rest and in transit
 *   - Annual pentest + bi-annual vuln scans (more for Class A)
 *   - Asset inventory + EOL tracking
 *   - AI-specific risk assessment requirement
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.NYDFS500_PACK = exports.NYDFS500_CATEGORY_CLASSIFIERS = void 0;
const _base_classifiers_1 = require("./_base-classifiers");
/**
 * NY DFS 500 (23 NYCRR Part 500 Cybersecurity Regulation) category classifiers.
 * Covers NPI of financial institution customers in New York.
 */
exports.NYDFS500_CATEGORY_CLASSIFIERS = {
    NPI: {
        references: ['23 NYCRR §500.2 -- nonpublic information; 500.6 audit trail'],
        classifier: (input) => {
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:account\s*(?:number|#|no\.?))[:\s]*\d{6,17}\b/i.test(input))
                return true;
            if (/\b(?:financial\s+(?:information|record|data)|nonpublic\s+(?:personal\s+)?information)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['23 NYCRR §500.2 -- private information of NY residents'],
        classifier: (input) => {
            if ((0, _base_classifiers_1.sharedPiiClassifier)(input))
                return true;
            if (/\b(?:date\s+of\s+birth|DOB|phone\s+number|home\s+address)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['23 NYCRR §500.7 -- access privileges and authentication; 500.12 MFA'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.NYDFS500_PACK = {
    categoryClassifiers: exports.NYDFS500_CATEGORY_CLASSIFIERS,
    /** P3.5: Non-Public Information is inherently subject-keyed per NY DFS Part 500 §500.1(f). */
    subjectKeyedCategories: ['NPI'],
    id: 'nydfs500',
    name: 'NY DFS Part 500',
    version: '1.0.0',
    contentHash: '39eb73ccdcf181e53ed11743af96cb809afc1e9fdb5322352adec4a4a4b83708',
    description: 'NY DFS 23 NYCRR Part 500 Cybersecurity Regulation with Second Amendment (Nov 2023, phased through April 2025). Class A tier + 72-hour cybersecurity event notice + 24-hour ransomware notice + CISO board reporting + MFA + encryption + AI-specific risk assessment.',
    authority: 'NY Department of Financial Services (NYDFS)',
    industries: ['banking', 'insurance', 'mortgage-lender', 'money-transmitter', 'virtual-currency', 'health-insurer', 'broker-dealer', 'investment-adviser'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'AI-specific risk assessment gate; Class A tier gating',
            reference: '23 NYCRR §500.9 (2023 amendment scope)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident record of cybersecurity events and ransomware payments',
            reference: '23 NYCRR §500.6, §500.13',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'NPI encrypted at rest and in transit over external networks',
            reference: '23 NYCRR §500.15',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'MFA for privileged and remote access',
            reference: '23 NYCRR §500.12(b) (as amended)',
        },
        {
            name: 'event-bus',
            required: true,
            reason: '72-hour notification clock + 24-hour ransomware clock',
            reference: '23 NYCRR §500.17(a), (c)',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Detect cybersecurity events triggering the 72-hour clock',
            reference: '23 NYCRR §500.16',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party service provider policy with due diligence + contractual cybersecurity',
            reference: '23 NYCRR §500.11',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'CISO designation + board report + pentest + vuln scan + training + AI risk assessment attestations',
            reference: '23 NYCRR §500.4, §500.5, §500.9, §500.14',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Ransomware-payment approval with 24-hour notification follow-up',
            reference: '23 NYCRR §500.17(c)',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect NPI for encryption and handling rules',
            reference: '23 NYCRR §500.1(k) (NPI definition)',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Asset inventory + EOL tracking + incident state across sessions',
            reference: '23 NYCRR §500.13(a) (as amended)',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            aiSpecificRiskAssessmentRequired: true,
            classATierSupport: true,
        },
        'agent-auth': {
            mfaRequired: true,
            mfaForPrivilegedAccess: true,
            mfaForRemoteAccess: true,
        },
        'attestation-manager': {
            cisoDesignationRequired: true,
            cisoBoardReportCadenceDays: 365,
            penetrationTestCadenceDays: 365,
            vulnerabilityScanCadenceDays: 182,
            riskAssessmentCadenceDays: 365,
            cybersecurityTrainingCadenceDays: 365,
        },
        'event-bus': {
            cybersecurityEventNotificationHours: 72,
            ransomwarePaymentNotificationHours: 24,
        },
        'supply-chain': {
            serviceProviderDueDiligenceRequired: true,
            contractualCybersecurityRequired: true,
            periodicReviewDays: 365,
        },
        'session-persistence': {
            assetInventoryRequired: true,
            eolTrackingRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['CYBERSECURITY-PROGRAM', 'NYDFS-READY'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['NPI', 'PII', 'CREDENTIALS'],
        categoryActions: {
            NPI: 'BLOCK',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['US-NY'],
        // 5 years default aligned with §500.6 / §500.13 retention
        auditLogRetentionDays: 1825,
        sessionRetentionDays: 365,
        incidentRetentionDays: 1825,
        reference: '23 NYCRR §500.6 audit trail + §500.13 records retention',
    },
    incidentPolicy: {
        // 72 hours for cybersecurity event (most stringent deadline controls)
        notificationDeadlineHours: 72,
        reference: '23 NYCRR §500.17(a) -- 72-hour cybersecurity event notice. §500.17(c) -- 24-hour ransomware payment notice with 30-day follow-up.',
        requiredRecipients: ['nydfs-superintendent', 'ciso', 'senior-management'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'nydfs500-ciso',
            description: 'CISO designated and reporting to board annually',
            reference: '23 NYCRR §500.4',
            check: 'nydfs500_ciso_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nydfs500-mfa',
            description: 'MFA enforced on privileged and remote access',
            reference: '23 NYCRR §500.12(b)',
            check: 'nydfs500_mfa_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nydfs500-encryption',
            description: 'NPI encrypted at rest and in transit',
            reference: '23 NYCRR §500.15',
            check: 'encryption_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nydfs500-72h',
            description: '72-hour cybersecurity event notification configured',
            reference: '23 NYCRR §500.17(a)',
            check: 'nydfs500_72h_notice_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nydfs500-24h-ransomware',
            description: '24-hour ransomware payment notification configured',
            reference: '23 NYCRR §500.17(c)',
            check: 'nydfs500_24h_ransomware_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nydfs500-risk-assessment',
            description: 'Annual risk assessment with AI-specific module',
            reference: '23 NYCRR §500.9',
            check: 'nydfs500_risk_assessment_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nydfs500-pentest',
            description: 'Annual penetration test + bi-annual vulnerability scan cadence',
            reference: '23 NYCRR §500.5',
            check: 'nydfs500_pentest_cadence_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nydfs500-supply-chain',
            description: 'Third-party service provider policy with periodic review',
            reference: '23 NYCRR §500.11',
            check: 'nydfs500_supply_chain_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nydfs500-asset-inventory',
            description: 'Asset inventory + EOL tracking maintained',
            reference: '23 NYCRR §500.13(a)',
            check: 'nydfs500_asset_inventory_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nydfs500-training',
            description: 'Cybersecurity awareness training including AI-specific risks',
            reference: '23 NYCRR §500.14',
            check: 'nydfs500_training_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'nydfs500-ai-risk',
            description: 'AI-specific risk assessment attested before AI system deployment',
            reference: '23 NYCRR §500.9 (2023 amendment AI scope)',
            check: 'nydfs500_ai_risk_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=nydfs500.js.map