/**
 * NAIC Model Data Law Compliance Pack
 *
 * National Association of Insurance Commissioners (NAIC) Insurance
 * Data Security Model Law (MDL-668), adopted 2017. As of 2026, 25+
 * US states have enacted MDL-668 or substantively equivalent statutes.
 * Key adopting states include: AL, AK, CT, DE, GA, HI, IA, ID, IL,
 * IN, KY, LA, ME, MI, MN, MS, MT, NH, NJ, NV, OH, OK, OR, RI, SC,
 * SD, TN, TX, VA, VT, WI.
 *
 * AI relevance: insurance AI systems (pricing models, fraud detection,
 * underwriting, claims processing, telematics) are explicitly in scope
 * as "information systems" that process nonpublic information (NPI).
 * The 2024 NAIC Model Bulletin on AI uses in Insurance adds algorithmic
 * accountability and bias monitoring obligations that layer on top of
 * MDL-668's data security requirements.
 *
 * Key MDL-668 obligations:
 *   - Section 4: Information Security Program (ISP) with written
 *     risk assessment
 *   - Section 5: Board oversight of ISP; annual certification
 *   - Section 6: Third-party service provider (TPSP) oversight
 *     with contractual safeguards
 *   - Section 7: Investigation and notification of cybersecurity events
 *     (72-hour notification to Commissioner; prompt notification to
 *     affected consumers where feasible)
 *   - Section 8: Annual certification to Commissioner by large licensees
 *   - 2024 Model Bulletin (AI): risk management, bias testing, adverse
 *     action explanation, vendor AI accountability
 *
 * Sovereignty: US (state-by-state adoption; no single federal statute).
 *
 * // TODO verify citation with Vera: confirm Section 7 notification
 * // deadline as 72 hours -- some state enactments vary (e.g., Ohio).
 *
 * @connexum/ai-governance
 */
/**
 * NAIC MDL-668 (Insurance Data Security Model Law) category classifiers.
 * Protects Nonpublic Information (NPI) of insurance customers:
 * health, financial, and personal NPI; biometric data.
 */
export const NAIC_MDL_CATEGORY_CLASSIFIERS = {
    NPI_HEALTH: {
        references: ['NAIC MDL-668 §3(J)(1) -- health information NPI'],
        classifier: (input) => {
            if (/\b(?:medical\s+(?:condition|history|record)|diagnosis|prescription|health\s+(?:status|information|data))\b/i.test(input))
                return true;
            if (/\b(?:claim\s+(?:history|record)|insurance\s+(?:claim|application))\b/i.test(input))
                return true;
            return false;
        },
    },
    NPI_FINANCIAL: {
        references: ['NAIC MDL-668 §3(J)(2) -- financial NPI in insurance context'],
        classifier: (input) => {
            if (/\b(?:account\s*(?:number|#|no\.?))[:\s]*\d{6,17}\b/i.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:premium\s+(?:amount|payment)|policy\s+(?:number|value)|beneficiary)\b/i.test(input))
                return true;
            return false;
        },
    },
    NPI_PERSONAL: {
        references: ['NAIC MDL-668 §3(J)(3) -- personal NPI (name + other identifier combination)'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b(?:insured\s+name|policyholder\s+(?:name|address)|date\s+of\s+birth)\b/i.test(input))
                return true;
            return false;
        },
    },
    BIOMETRIC: {
        references: ['NAIC MDL-668 §3(J) -- biometric data as NPI'],
        classifier: (input) => {
            if (/\b(?:fingerprint|retinal|iris|biometric|voiceprint|facial\s+recognition)\s*(?:data|id|hash|template|scan)?\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['NAIC MDL-668 §4 -- Information Security Program; credential protection'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const NAIC_MDL_PACK = {
    categoryClassifiers: NAIC_MDL_CATEGORY_CLASSIFIERS,
    /** P3.5: Insurance NPI categories are inherently subject-keyed per NAIC MDL-668 and GLBA/HIPAA intersection. */
    subjectKeyedCategories: ['NPI_HEALTH', 'NPI_FINANCIAL', 'NPI_PERSONAL'],
    id: 'naic-mdl',
    name: 'NAIC MDL-668 (Insurance Data Security)',
    version: '1.0.0',
    contentHash: '5d9caff0855e1860eae6950641351221bad6ac79117db2e5f08cf227843d15e9',
    description: 'NAIC Insurance Data Security Model Law (MDL-668) compliance for AI systems at insurance licensees. Covers Information Security Program, board oversight, third-party service provider due diligence, 72-hour cybersecurity event notification, annual Commissioner certification, and 2024 NAIC AI Model Bulletin obligations (bias testing, adverse action explanation, vendor accountability).',
    authority: 'National Association of Insurance Commissioners (NAIC); state insurance commissioners',
    industries: ['insurance', 'insurtech', 'health-insurance', 'property-casualty', 'life-insurance', 'reinsurance'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Information Security Program enforcement; access controls; deny-by-default for NPI; risk assessment process',
            reference: 'MDL-668 Section 4 (Information Security Program); Section 4(C) (risk assessment)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail of AI decisions affecting NPI; evidence for annual Commissioner certification',
            reference: 'MDL-668 Section 5 (Board oversight + certification); Section 8 (annual certification)',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Encryption of NPI at rest and in transit as part of the Information Security Program',
            reference: 'MDL-668 Section 4(C)(3) (encryption of nonpublic information)',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect and classify NPI (health data, financial data, personal identifiers); flag out-of-scope processing',
            reference: 'MDL-668 Section 2 (definitions of Nonpublic Information)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party service provider due diligence and contractual safeguards; vendor AI accountability per 2024 Bulletin',
            reference: 'MDL-668 Section 6 (Third-party service provider oversight); 2024 NAIC AI Model Bulletin',
        },
        {
            name: 'event-bus',
            required: true,
            reason: '72-hour cybersecurity event notification clock; incident detection and reporting stream',
            reference: 'MDL-668 Section 7 (Investigation and notification of cybersecurity events)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human review of adverse AI decisions; board-level oversight gate for ISP material changes',
            reference: 'MDL-668 Section 5; 2024 NAIC AI Model Bulletin (adverse action explanation)',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'Bias testing of AI pricing, underwriting, claims, and fraud detection models per 2024 NAIC AI Bulletin',
            reference: '2024 NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Annual board certification of ISP; annual Commissioner certification filing; written risk assessment on file',
            reference: 'MDL-668 Section 5(B) (Board approval + annual certification); Section 8',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Unique agent identification; multi-factor authentication for access to NPI systems',
            reference: 'MDL-668 Section 4(C)(3)(g) (multi-factor authentication)',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'NPI_HEALTH',
                'NPI_FINANCIAL',
                'NPI_PERSONAL',
                'BIOMETRIC',
                'CREDENTIALS',
            ],
            npiAction: 'BLOCK_UNLESS_ISP_AUTHORISED',
        },
        'event-bus': {
            cybersecurityEventNotificationHours: 72,
            consumerNotificationRequired: true,
        },
        'governance-runtime': {
            writtenRiskAssessmentRequired: true,
            informationSecurityProgramRequired: true,
            mfaForNpiAccessRequired: true,
        },
        'supply-chain': {
            tpspContractualSafeguardsRequired: true,
            vendorAiAccountabilityRequired: true,
            serviceProviderDueDiligenceRequired: true,
        },
        'attestation-manager': {
            boardAnnualCertificationRequired: true,
            commissionerAnnualCertificationRequired: true,
            writtenRiskAssessmentRequired: true,
        },
        'approval-queue': {
            adverseAiDecisionHumanReviewRequired: true,
        },
        'bias-monitor': {
            insuranceAiBiasTestingRequired: true,
            pricingModelFairnessRequired: true,
            underwritingModelFairnessRequired: true,
        },
        'agent-auth': {
            mfaForNpiAccess: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['DATA-RESIDENCY-US', 'ZERO-RETENTION'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['NPI_HEALTH', 'NPI_FINANCIAL', 'NPI_PERSONAL', 'BIOMETRIC', 'CREDENTIALS'],
        categoryActions: {
            NPI_HEALTH: 'BLOCK',
            NPI_FINANCIAL: 'BLOCK',
            // F-NEW-VERA-PACK-C2-10: elevated from WARN to BLOCK to align with
            // moduleConfig['data-classifier'].npiAction: 'BLOCK_UNLESS_ISP_AUTHORISED'
            // and MDL-668 §3(J)(3) NPI definition. Both signals must agree.
            NPI_PERSONAL: 'BLOCK',
            BIOMETRIC: 'BLOCK',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // MDL-668 Section 7: records related to cybersecurity events retained for investigation purposes.
        // General state insurance record retention: 5-7 years typical.
        auditLogRetentionDays: 2555,
        sessionRetentionDays: 1825,
        incidentRetentionDays: 2555,
        reference: 'MDL-668 Section 7 (cybersecurity event records); state insurance record retention rules (5-7 years)',
    },
    incidentPolicy: {
        notificationDeadlineHours: 72,
        reference: 'MDL-668 Section 7(B): notify Commissioner no later than 72 hours after discovery of a Cybersecurity Event',
        requiredRecipients: ['state-insurance-commissioner', 'board-of-directors', 'affected-consumers'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'naic-isp-active',
            description: 'Written Information Security Program active and board-approved',
            reference: 'MDL-668 Section 4 (ISP requirements); Section 5(B) (board approval)',
            check: 'naic_isp_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'naic-72h-notification',
            description: '72-hour cybersecurity event notification to Commissioner configured',
            reference: 'MDL-668 Section 7(B)',
            check: 'naic_72h_notification_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'naic-npi-encryption',
            description: 'NPI encrypted at rest and in transit',
            reference: 'MDL-668 Section 4(C)(3)(h) (encryption)',
            check: 'encryption_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'naic-tpsp-oversight',
            description: 'Third-party service provider contractual safeguards and due diligence active',
            reference: 'MDL-668 Section 6',
            check: 'service_provider_contracts_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'naic-board-cert',
            description: 'Annual board certification of Information Security Program scheduled',
            reference: 'MDL-668 Section 5(B); Section 8',
            check: 'naic_board_certification_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'naic-mfa',
            description: 'MFA enforced on all access to NPI systems',
            reference: 'MDL-668 Section 4(C)(3)(g)',
            check: 'naic_mfa_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'naic-ai-bias-testing',
            description: 'Bias testing active for AI pricing, underwriting, and claims models',
            reference: '2024 NAIC Model Bulletin on Use of Artificial Intelligence Systems by Insurers',
            check: 'naic_ai_bias_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'naic-adverse-action',
            description: 'Human review gate active for adverse AI decisions affecting policyholders',
            reference: '2024 NAIC Model Bulletin; state Unfair Trade Practices Acts',
            check: 'naic_adverse_action_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'naic-vendor-ai-accountability',
            description: 'Vendor AI accountability requirements in third-party contracts',
            reference: '2024 NAIC Model Bulletin on AI; MDL-668 Section 6',
            check: 'naic_vendor_ai_accountability_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=naic-mdl.js.map