"use strict";
/**
 * IEC 62443 Industrial Automation and Control Systems Security Compliance Pack
 *
 * IEC 62443 (formerly ISA-99) -- international multi-part standard family for
 * the cybersecurity of Industrial Automation and Control Systems (IACS).
 * 14 published parts spanning policy, procedures, system design, and product
 * requirements. The standard addresses asset owners, service providers,
 * system integrators, and product suppliers across all OT-connected sectors.
 *
 * Standards referenced (citations only; no verbatim text from the standard):
 *   - IEC 62443-1-1:2009 — Terminology, concepts and models
 *   - IEC 62443-2-1:2010 — Establishing an IACS security program (CSMS)
 *   - IEC 62443-2-2 (draft) — IACS security protection rating
 *   - IEC 62443-2-3:2015 — Patch management in the IACS environment
 *   - IEC 62443-2-4:2015+AMD1:2017 — Security program requirements for
 *     IACS service providers
 *   - IEC 62443-3-2:2020 — Security risk assessment for system design
 *     (zone and conduit model; Security Level Target assignment)
 *   - IEC 62443-3-3:2013 — System security requirements and security levels
 *     (7 Foundational Requirements; Security Level 1-4 controls)
 *   - IEC 62443-4-1:2018 — Secure product development lifecycle (SDL)
 *   - IEC 62443-4-2:2019 — Technical security requirements for IACS
 *     components (component-level security requirements)
 *   - ISA-99 (origin body; ISA/IEC joint sponsorship)
 *   - EU NIS2 Directive (EU) 2022/2555 — Operators of Essential Services (OES)
 *     and Digital Service Providers (DSPs); significant incident notification 24h
 *   - ENISA IACS/OT cybersecurity reference framework (2022)
 *   - NIST SP 800-82 Rev. 3 — Guide to OT Security (US sister standard)
 *   - IEC 61508 — Functional safety of E/E/PE systems (parent SIL standard)
 *   - IECEE CB scheme (product certifications against IEC 62443-4-2)
 *
 * Security Level Classification (IEC 62443-3-2 §5.4 + IEC 62443-3-3 §4):
 *   Security Level Target (SL-T) is assigned per zone/conduit following risk
 *   assessment. Process burden and required controls scale with SL.
 *
 *   | SL | Threat profile                                                   |
 *   |----|------------------------------------------------------------------|
 *   |  1 | Casual / coincidental violation; generic off-the-shelf scanning |
 *   |  2 | Intentional with simple means + low resources; generic IT tools  |
 *   |  3 | Intentional with sophisticated means + IACS skills; targeted OT  |
 *   |  4 | Nation-state actor; Stuxnet-class; extended resources + skills   |
 *
 *   Default when SL not declared: SL 2 (conservative per governance-runtime).
 *
 * Foundational Requirements (FR) — IEC 62443-3-3 §4:
 *   FR 1 — Identification and Authentication Control (IAC)
 *   FR 2 — Use Control (UC)
 *   FR 3 — System Integrity (SI)
 *   FR 4 — Data Confidentiality (DC)
 *   FR 5 — Restricted Data Flow (RDF) — zone + conduit segmentation
 *   FR 6 — Timely Response to Events (TRE)
 *   FR 7 — Resource Availability (RA)
 *
 * Zone and Conduit Model (IEC 62443-3-2 §5.5):
 *   IACS assets are grouped into security zones based on function, risk level,
 *   and required Security Level. Conduits are the controlled communication
 *   paths between zones. The zone/conduit model is the central architecture
 *   artefact for IEC 62443 system security.
 *
 * Key sectors and customers:
 *   Manufacturing — automotive plants, food & beverage, semiconductor fabs
 *   Oil & gas — upstream exploration, midstream pipelines, LNG terminals
 *   Electric utilities — generation, transmission, distribution, smart grid
 *   Water / wastewater — treatment plants, SCADA-controlled distribution
 *   Industrial IoT — connected sensors, edge controllers, OT gateways
 *   System integrators — Rockwell, Schneider Electric, Siemens, Honeywell,
 *                         ABB, Emerson, Yokogawa, Mitsubishi Electric
 *   Product suppliers — IACS component OEMs certifying to IEC 62443-4-2
 *
 * Retention:
 *   IEC 62443-2-1 CSMS documentation: common ICS asset-owner baseline is
 *   7 years (2555 days), aligned with NIS2 Directive records obligations
 *   for Operators of Essential Services (OES). Some sectors (nuclear,
 *   critical infrastructure) impose longer sector-specific periods; this
 *   pack uses the 7-year NIS2 / common ICS baseline.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.IEC_62443_PACK = exports.IEC_62443_CATEGORY_CLASSIFIERS = void 0;
/**
 * IEC 62443 category classifiers.
 *
 * Covers Security Level declarations (SL 1-4), zone and conduit model
 * artefacts, CSMS documentation, and Foundational Requirement control
 * records per IEC 62443-3-3.
 */
exports.IEC_62443_CATEGORY_CLASSIFIERS = {
    /**
     * SL4 — Security Level 4: nation-state threat (IEC 62443-3-2 §5.4).
     * Intentional violation using sophisticated means, extended resources,
     * and IACS-specific skills. Stuxnet-class adversaries. Unauthorized
     * changes BLOCKED — requires full security impact analysis + OT security
     * lead sign-off before any action is taken.
     */
    SL4: {
        references: [
            'IEC 62443-3-2:2020 §5.4 — Security Level Target assignment',
            'IEC 62443-3-3:2013 §4 — SL 4 system security requirements',
        ],
        classifier: (input) => {
            if (/\b(?:SL[_\s-]?4|security[_\s-]level[_\s-]?4|SL4|sl4_zone|sl_4)\b/i.test(input))
                return true;
            if (/\b(?:nation.?state\s+(?:ICS|OT|IACS|industrial)|stuxnet[_\s-]class|advanced\s+persistent\s+threat\s+(?:ICS|OT|IACS|SL4))\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * SL3 — Security Level 3: sophisticated targeted OT attacker (IEC 62443-3-2 §5.4).
     * Intentional violation with sophisticated means, moderate resources, and
     * IACS-specific knowledge. Examples: competitor industrial espionage,
     * hacktivist groups with OT expertise. Changes require approval gate.
     */
    SL3: {
        references: [
            'IEC 62443-3-2:2020 §5.4 — Security Level Target assignment',
            'IEC 62443-3-3:2013 §4 — SL 3 system security requirements',
        ],
        classifier: (input) => {
            if (/\b(?:SL[_\s-]?3|security[_\s-]level[_\s-]?3|SL3|sl3_zone|sl_3)\b/i.test(input))
                return true;
            if (/\b(?:sophisticated\s+(?:ICS|OT|IACS)\s+attacker|targeted\s+(?:industrial|OT|ICS)\s+attack\s+SL3)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * SL2 — Security Level 2: generic IT attacker with public tools (IEC 62443-3-2 §5.4).
     * Intentional violation with simple means, low resources; generic IT-style
     * tooling (Metasploit, Shodan scanning). Default classification when SL
     * is not declared. Anomaly closure requires approval.
     */
    SL2: {
        references: [
            'IEC 62443-3-2:2020 §5.4 — Security Level Target assignment',
            'IEC 62443-3-3:2013 §4 — SL 2 system security requirements',
        ],
        classifier: (input) => {
            if (/\b(?:SL[_\s-]?2|security[_\s-]level[_\s-]?2|SL2|sl2_zone|sl_2)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * SL1 — Security Level 1: casual / coincidental violation (IEC 62443-3-2 §5.4).
     * Unintentional or incidental threats; generic off-the-shelf scanning by
     * a curious operator. LOG with audit record. Minimum process burden.
     */
    SL1: {
        references: [
            'IEC 62443-3-2:2020 §5.4 — Security Level Target assignment',
            'IEC 62443-3-3:2013 §4 — SL 1 system security requirements',
        ],
        classifier: (input) => {
            if (/\b(?:SL[_\s-]?1|security[_\s-]level[_\s-]?1|SL1|sl1_zone|sl_1)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * ZONE_CONDUIT_ARTEFACT — Zone and conduit model documentation
     * (IEC 62443-3-2 §5.5). Foundational architecture artefact grouping
     * IACS assets into security zones and defining controlled conduits.
     * Changes require security impact review.
     */
    ZONE_CONDUIT_ARTEFACT: {
        references: [
            'IEC 62443-3-2:2020 §5.5 — Zone and conduit model',
            'IEC 62443-3-2:2020 §5.4 — Security Level Target per zone',
        ],
        classifier: (input) => {
            if (/\b(?:zone[_\s-]conduit|security\s+zone\s+(?:IEC.?62443|IACS|OT)|conduit\s+(?:IEC.?62443|IACS)|IACS\s+zone|OT\s+network\s+zone)\b/i.test(input))
                return true;
            if (/\b(?:zone_conduit_(?:model|map|design|record|diagram)|conduit_(?:security|model|62443))\b/.test(input))
                return true;
            return false;
        },
    },
    /**
     * CSMS_ARTEFACT — Cyber Security Management System documentation
     * (IEC 62443-2-1). Policy, procedures, and management framework for
     * IACS cybersecurity. Required of all asset owners. Changes require review.
     */
    CSMS_ARTEFACT: {
        references: [
            'IEC 62443-2-1:2010 — IACS security program / CSMS',
            'IEC 62443-2-4:2015 — IACS service provider security requirements',
        ],
        classifier: (input) => {
            if (/\b(?:CSMS|cyber\s+security\s+management\s+system\s+(?:IEC.?62443|IACS)|IACS\s+security\s+program|ISA.?99\s+CSMS)\b/i.test(input))
                return true;
            if (/\b(?:csms_(?:document|policy|procedure|record|review)|iec62443_2_1_program)\b/.test(input))
                return true;
            return false;
        },
    },
    /**
     * SDL_ARTEFACT — Secure Development Lifecycle records per IEC 62443-4-1.
     * Covers security requirements, design reviews, implementation, verification,
     * defect management, and end-of-life. Required for product suppliers.
     */
    SDL_ARTEFACT: {
        references: [
            'IEC 62443-4-1:2018 — Secure product development lifecycle requirements',
        ],
        classifier: (input) => {
            if (/\b(?:IEC.?62443[_\s-]4[_\s-]1|SDL\s+(?:IEC.?62443|IACS|OT)|secure\s+development\s+lifecycle\s+(?:IEC.?62443|IACS|OT))\b/i.test(input))
                return true;
            if (/\b(?:sdl_(?:iec62443|iacs|ot)|iec62443_sdl_(?:record|evidence|review))\b/.test(input))
                return true;
            return false;
        },
    },
};
/**
 * IEC 62443 Industrial Automation and Control Systems Security Compliance Pack.
 *
 * Pack ID: 'iec-62443'
 * Jurisdiction: International (IEC TC 65; ISA-99 origin; adopted by IECEE CB
 *   scheme, ENISA, NIS2 Directive sectoral guidance for OES/DSP, NIST SP 800-82
 *   US alignment, NERC CIP energy sector overlay, many national regulators).
 *
 * Guard-layer wiring:
 *   - G1-G4 (audit, logging, classification, session): always active
 *   - G5-G6 (supply-chain SDL, approval-queue): SL 2/3/4
 *   - G7-G8 (attestation, anomaly-detection): SL 3/4
 *   - G9 (transparency): SL 4 only (maximum disclosure burden)
 *   - Approval Queue: always active (SL 4/3 immediate; SL 2 anomaly closure)
 *
 * Human-in-loop tier:
 *   - T1: SL 1/2 (OT security engineer review)
 *   - T2: SL 3/4 (TÜV / ISA-certified OT cybersecurity professional)
 */
exports.IEC_62443_PACK = {
    categoryClassifiers: exports.IEC_62443_CATEGORY_CLASSIFIERS,
    /**
     * Zone/conduit artefacts and CSMS documents are subject-keyed per
     * zone / IACS asset — they must be traceable to specific system
     * segments under IEC 62443-3-2.
     */
    subjectKeyedCategories: [
        'SL4',
        'SL3',
        'ZONE_CONDUIT_ARTEFACT',
        'CSMS_ARTEFACT',
        'SDL_ARTEFACT',
    ],
    id: 'iec-62443',
    name: 'IEC 62443 Industrial Automation and Control Systems Security',
    version: '1.0.0',
    contentHash: '5aa182215a0a1259e406f5202b7fe2cfa457a3cf1097f73b0f03e1a009025b3b',
    description: 'IEC 62443 (formerly ISA-99) — international multi-part cybersecurity standard family for ' +
        'Industrial Automation and Control Systems (IACS). 14 published parts covering asset owners ' +
        '(62443-2-1 CSMS), service providers (62443-2-4), system design (62443-3-2 zone/conduit + ' +
        'SL assignment; 62443-3-3 system controls), and product suppliers (62443-4-1 SDL; 62443-4-2 ' +
        'component requirements). Four Security Levels (SL 1: casual — SL 4: nation-state/Stuxnet-class). ' +
        'Seven Foundational Requirements (FR1 IAC — FR7 RA) mapped to validators. SL 3/4 behavioral ' +
        'validator for unverified-change CRITICAL escalation. 7-year retention (NIS2 OES baseline). ' +
        '24h NIS2 + sectoral incident notification. Reviewer tier: TÜV / ISA-certified OT cybersecurity ' +
        'professional. Adopted across manufacturing, oil + gas, electric utilities, water/wastewater, ' +
        'industrial-IoT, and Tier-1 OT suppliers.',
    authority: 'IEC TC 65 (Industrial-process measurement, control and automation); ISA-99 origin; ' +
        'widely adopted by IECEE CB scheme, ENISA, NIS2 sectoral guidance',
    industries: [
        'manufacturing',
        'oil-and-gas',
        'electric-utilities',
        'water-wastewater',
        'industrial-iot',
        'tier-1-supplier',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Security Level (SL 1-4) tracking mandatory for every IEC 62443 process gate. ' +
                'SL 4 changes require blocking until full security impact analysis + OT security ' +
                'lead sign-off. SL 3 changes require approval gate. SL 2 anomaly closure requires ' +
                'approval. Governance runtime enforces zone/conduit model and CSMS prerequisite ' +
                'checks before any IACS software or configuration change proceeds.',
            reference: 'IEC 62443-3-2:2020 §5.4 — SL-T assignment; IEC 62443-2-1:2010 — CSMS',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident records for IACS security lifecycle artefacts: zone/conduit model, ' +
                'CSMS documentation, risk assessment records, SL justifications, Foundational ' +
                'Requirement control evidence, SDL artefacts (IEC 62443-4-1), component security ' +
                'requirement records (IEC 62443-4-2), patch management logs (IEC 62443-2-3), ' +
                'and incident management records per IEC 62443-2-1 §4.3.4.5. Required for NIS2 ' +
                'OES audit submissions and sectoral regulator inspections.',
            reference: 'IEC 62443-2-1:2010 — CSMS documentation; IEC 62443-3-2:2020 §5 — risk assessment records',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Security Level signal detection (SL 1-4) per zone/conduit; zone and conduit ' +
                'model artefact identification; CSMS document categorisation; SDL and component ' +
                'security requirement record scanning (IEC 62443-4-1 / 4-2); Foundational ' +
                'Requirement control evidence classification for FR1-FR7.',
            reference: 'IEC 62443-3-2:2020 §5.4 — SL classification; IEC 62443-3-3:2013 §4 — FR1-FR7',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Component security requirement inventory per IEC 62443-4-2; COTS OT component ' +
                'evaluation; service provider security program assessment per IEC 62443-2-4; ' +
                'SDL compliance verification for product suppliers (IEC 62443-4-1). AI-assisted ' +
                'code generation tools used in IACS environments require supply-chain evaluation ' +
                'for OT-specific safety and security impacts before outputs are accepted.',
            reference: 'IEC 62443-4-2:2019 — component-level CRs; IEC 62443-2-4:2015 — service provider program',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'SL 4 change approval (OT security lead + plant manager sign-off required). ' +
                'SL 3 change approval gate. SL 2 anomaly closure review. All zone/conduit model ' +
                'changes and CSMS updates require human review before downstream IACS configuration ' +
                'or code change proceeds. Component security requirement changes require OT security ' +
                'engineer approval before deployment to production IACS.',
            reference: 'IEC 62443-2-1:2010 §4.3.4.5 — change management; IEC 62443-3-2:2020 §5 — SL change review',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'CSMS attestation for asset owners; SL 3/4 zone security assessment sign-off; ' +
                'SDL compliance attestation for product suppliers (IEC 62443-4-1); component ' +
                'security requirement verification attestation (IEC 62443-4-2); IECEE CB scheme ' +
                'certification evidence management. OT cybersecurity professionals (TÜV / ISA- ' +
                'certified) sign the system security assessment at SL 3/4.',
            reference: 'IEC 62443-2-1:2010 — CSMS program attestation; IEC 62443-4-1:2018 — SDL attestation',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'IEC 62443 CSMS documentation and security assessment records must persist for ' +
                'the IACS asset operational lifetime. 7-year NIS2 OES records baseline (2555 days). ' +
                'Continuity of zone/conduit model, risk assessment, and incident records across ' +
                'sessions is mandatory for regulatory audit submissions, NIS2 significant incident ' +
                'reporting, and sectoral regulator inspections (ENTSO-E, NERC, WRC).',
            reference: 'IEC 62443-2-1:2010 — CSMS documentation retention; EU NIS2 Directive OES records',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Real-time detection of unverified changes to SL 3/4 IACS control system elements. ' +
                'Flags conditions that may require immediate OT security engineer notification. ' +
                'Detects SL 4 software or configuration modifications without verification record — ' +
                'must block immediately. Detects SL 3 anomalies requiring immediate escalation to ' +
                'OT security lead and plant manager. SL 2 anomaly triggers approval-queue routing.',
            reference: 'IEC 62443-3-2:2020 §5.4 — SL change detection; IEC 62443-2-1:2010 §4.3.4.5 — incident handling',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'AI-generated code or configuration provenance disclosure to OT security engineers, ' +
                'TÜV / ISA-certified assessors, plant managers, and regulatory-affairs teams. ' +
                'Security Level context disclosure on every AI output used in an IACS task without ' +
                'independent manual verification. Required for NIS2 OES accountability obligations.',
            reference: 'IEC 62443-2-4:2015 — service provider transparency; EU NIS2 Directive accountability',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'SL 3/4 change event routing; zone/conduit model update lifecycle events; CSMS ' +
                'review milestone events; Foundational Requirement control gap notification; patch ' +
                'management status events (IEC 62443-2-3); significant incident routing for NIS2 ' +
                '24h notification deadline; sectoral regulator submission milestone events.',
            reference: 'IEC 62443-2-1:2010 §4.3.4.5 — incident event handling; EU NIS2 Directive notification triggers',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            securityLevelTrackingRequired: true,
            sl3ChangeApprovalRequired: true,
            sl4ChangeApprovalRequired: true,
            sl2AnomalyClosureApprovalRequired: true,
            sl3AnomalyImmediateEscalationRequired: true,
            sl4AnomalyImmediateEscalationRequired: true,
            zoneConduitModelRequired: true,
            csmsCovered: true,
            iec62443Part33SystemControlsRequired: true,
            iec62443Part41SecureDevelopmentLifecycleRequired: true,
            iec62443Part42ComponentRequirementsRequired: true,
        },
        'approval-queue': {
            sl4ChangeApprovalRequired: true,
            sl3ChangeApprovalRequired: true,
            sl2AnomalyClosureApprovalRequired: true,
            otSecurityEngineerReviewRequired: true,
            humanInLoopTierSl12: 'T1',
            humanInLoopTierSl34: 'T2',
        },
        'attestation-manager': {
            csmsAttestationRequired: true,
            sl34ZoneSecurityAssessmentSignOffRequired: true,
            sdlComplianceAttestationRequired: true,
            componentSecurityRequirementVerificationRequired: true,
            systemSecurityAssessmentRequired: true,
        },
        'supply-chain': {
            componentSecurityRequirementInventoryRequired: true,
            iec62443Part42EvaluationRequired: true,
            serviceProviderSecurityProgramAssessmentRequired: true,
            sdlComplianceVerificationRequired: true,
            aiCodeGenToolOtEvaluationRequired: true,
        },
        'anomaly-detector': {
            sl4AnomalyImmediateEscalationRequired: true,
            sl3AnomalyImmediateEscalationRequired: true,
            unverifiedSl3Sl4ChangeDetectionActive: true,
        },
        'transparency-injector': {
            aiGeneratedCodeProvenanceDisclosureRequired: true,
            securityLevelContextDisclosureRequired: true,
        },
        'event-bus': {
            sl34ChangeEventsActive: true,
            zoneConduitModelUpdateEventsActive: true,
            csmsReviewMilestoneEventsActive: true,
            patchManagementStatusEventsActive: true,
            nis2IncidentNotificationEventsActive: true,
            sectoralRegulatorSubmissionEventsActive: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['IEC-62443-READY', 'OT-SECURITY-LIFECYCLE'],
        blockReasons: {
            deepseek: 'PRC-jurisdiction LLM providers cannot meet NIS2 Directive data-handling ' +
                'requirements for Operators of Essential Services (OES) processing IACS security ' +
                'artefacts. Zone/conduit models, CSMS documentation, and SL 3/4 risk assessment ' +
                'records require verifiable non-PRC jurisdiction under NIS2 Art. 21 + EU sectoral ' +
                'OT-cyber guidance (ENISA IACS framework 2022). PRC data localisation law (DSL + CSL) ' +
                'creates unresolvable conflict with OES data sovereignty obligations.',
            baidu: 'PRC-jurisdiction LLM; IEC 62443 CSMS documentation, zone/conduit security ' +
                'artefacts, and IACS incident records for NIS2 OES entities must remain under ' +
                'verifiable non-PRC jurisdiction per NIS2 Directive Art. 21 security measures ' +
                'and ENISA IACS cybersecurity framework. PRC dual-use export controls on ' +
                'industrial control system security software create unresolvable compliance conflict.',
            alibaba: 'PRC-jurisdiction LLM; SL 3/4 IACS security lifecycle artefacts must remain ' +
                'outside PRC data jurisdiction per NIS2 Directive OES data sovereignty requirements ' +
                'and sectoral OT-cyber regulations (NERC CIP, ENTSO-E, WRC). PRC CSL + DSL ' +
                'data-localisation obligations are incompatible with EU NIS2 cross-border incident ' +
                'reporting and ENISA threat intelligence sharing requirements for critical infrastructure.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'SL4',
            'SL3',
            'SL2',
            'SL1',
            'ZONE_CONDUIT_ARTEFACT',
            'CSMS_ARTEFACT',
            'SDL_ARTEFACT',
        ],
        categoryActions: {
            // SL 4: unauthorised changes BLOCKED — OT security lead + plant manager required
            SL4: 'BLOCK',
            // SL 3: changes enter approval queue for OT security engineer review
            SL3: 'REVIEWED',
            // SL 2: anomaly closure requires approval; changes logged
            SL2: 'REVIEWED',
            // SL 1: logging sufficient for basic OT security audit
            SL1: 'LOG',
            // Zone/conduit artefacts: REVIEWED — changes affect all downstream security
            ZONE_CONDUIT_ARTEFACT: 'REVIEWED',
            // CSMS artefacts: REVIEWED — policy changes require management approval
            CSMS_ARTEFACT: 'REVIEWED',
            // SDL artefacts: REVIEWED — changes require product security engineer review
            SDL_ARTEFACT: 'REVIEWED',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        /**
         * IEC 62443-2-1 CSMS documentation retention baseline is 7 years (2555 days),
         * aligned with NIS2 Directive (EU) 2022/2555 records obligations for Operators
         * of Essential Services (OES). Some sectors (nuclear under IAEA/ENSREG,
         * pipelines under TSA directives) impose longer sector-specific periods;
         * this pack uses the 7-year NIS2 / common ICS asset-owner baseline.
         */
        sovereignty: ['international'],
        auditLogRetentionDays: 2555, // 7 years — NIS2 OES records + common ICS asset-owner baseline
        sessionRetentionDays: 2555,
        incidentRetentionDays: 2555,
        reference: 'IEC 62443-2-1:2010 — CSMS documentation retention for IACS operational lifetime. ' +
            'EU NIS2 Directive (EU) 2022/2555 — OES records retention obligations. ' +
            'Common ICS asset-owner baseline: 7 years (2555 days). ' +
            'Sector-specific periods (nuclear, pipeline) may be longer — apply the stricter requirement.',
    },
    incidentPolicy: {
        /**
         * EU NIS2 Directive (EU) 2022/2555 Art. 23:
         *   OES must notify the competent authority or CSIRT within 24 hours of
         *   becoming aware of a significant incident (early warning).
         *   Full notification within 72 hours. Final report within 1 month.
         *   IEC 62443-2-1 §4.3.4.5 CSMS incident handling aligns with the
         *   24h NIS2 early-warning trigger for critical infrastructure OT incidents.
         *   Using 24h as the baseline notification deadline (NIS2 early warning).
         */
        notificationDeadlineHours: 24, // 24h — NIS2 Art. 23 early warning + IEC 62443-2-1 §4.3.4.5
        reference: 'EU NIS2 Directive (EU) 2022/2555 Art. 23 — 24h early warning for significant incidents. ' +
            'IEC 62443-2-1:2010 §4.3.4.5 — CSMS incident management and notification. ' +
            'NIS2 Art. 23(4) — 72h full notification + 1-month final report. ' +
            'Baseline: 24h early warning to competent authority / CSIRT.',
        requiredRecipients: [
            'ciso',
            'plant-manager',
            'ot-security-lead',
            'regulatory-affairs',
            'crown-jewel-system-owner',
        ],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'iec62443-security-level-assigned',
            description: 'Security Level Target (SL-T: 1-4) assigned to every IACS zone and conduit ' +
                'with documented rationale from the risk assessment per IEC 62443-3-2 §5.4. ' +
                'Default: SL 2 when classification missing (governance-runtime conservative default). ' +
                'SL selection must be traceable to threat profile, vulnerability assessment, and ' +
                'consequence analysis for each zone.',
            reference: 'IEC 62443-3-2:2020 §5.4 — Security Level Target (SL-T) assignment',
            check: 'iec62443_security_level_assigned',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iec62443-zone-conduit-model',
            description: 'Zone and conduit model on file per IEC 62443-3-2 §5.5: IACS assets grouped ' +
                'into security zones based on function and required SL; conduits defined as ' +
                'controlled communication paths between zones; zone/conduit diagram current and ' +
                'approved. All assets assigned to a zone; orphaned assets are a CRITICAL finding.',
            reference: 'IEC 62443-3-2:2020 §5.5 — Zone and conduit model',
            check: 'iec62443_zone_conduit_model_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iec62443-cyber-security-management-system',
            description: 'Cyber Security Management System (CSMS) established per IEC 62443-2-1: ' +
                'scope and policy on file; security risk assessment process documented; ' +
                'security program organisational responsibilities defined; CSMS reviewed and ' +
                'approved by senior management. Asset owner CSMS is the root of all IEC 62443 ' +
                'conformance — no zone/conduit model or SL controls are valid without it.',
            reference: 'IEC 62443-2-1:2010 — Establishing an IACS security program (CSMS)',
            check: 'iec62443_csms_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iec62443-iac-controls',
            description: 'Identification and Authentication Control (FR 1) requirements implemented ' +
                'per IEC 62443-3-3 §SR 1.x: unique identifiers for all IACS users, software ' +
                'processes, and devices; multi-factor authentication for SL 2+; password policy ' +
                'enforced; PKI or equivalent for SL 3/4 device authentication. All FR 1 ' +
                'System Requirements (SR) met at or above the zone SL target.',
            reference: 'IEC 62443-3-3:2013 FR1 (Identification & Auth Control) — SR 1.1-SR 1.13',
            check: 'iec62443_iac_controls_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62443-uc-controls',
            description: 'Use Control (FR 2) requirements implemented per IEC 62443-3-3 §SR 2.x: ' +
                'role-based access control for IACS functions; enforcement of wireless policies; ' +
                'mobile code usage policies enforced; use control audit log active. Least-privilege ' +
                'principle applied to all operator, engineer, and remote-access roles at zone SL.',
            reference: 'IEC 62443-3-3:2013 FR2 (Use Control) — SR 2.1-SR 2.12',
            check: 'iec62443_uc_controls_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62443-si-controls',
            description: 'System Integrity (FR 3) requirements implemented per IEC 62443-3-3 §SR 3.x: ' +
                'communications integrity mechanisms (message authentication, checksums); ' +
                'malicious code protection active on IACS hosts where feasible; input validation ' +
                'on all IACS application interfaces; software and firmware integrity verification ' +
                'at SL 3/4. All FR 3 SRs met at or above zone SL target.',
            reference: 'IEC 62443-3-3:2013 FR3 (System Integrity) — SR 3.1-SR 3.9',
            check: 'iec62443_si_controls_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62443-dc-controls',
            description: 'Data Confidentiality (FR 4) requirements implemented per IEC 62443-3-3 §SR 4.x: ' +
                'information confidentiality at rest and in transit enforced for SL 2+; encryption ' +
                'applied to sensitive IACS data at SL 3/4; information leakage prevention active; ' +
                'network and security configuration information protected from unauthorized disclosure.',
            reference: 'IEC 62443-3-3:2013 FR4 (Data Confidentiality) — SR 4.1-SR 4.3',
            check: 'iec62443_dc_controls_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62443-rdf-controls',
            description: 'Restricted Data Flow (FR 5) requirements implemented per IEC 62443-3-3 §SR 5.x: ' +
                'zone segmentation enforced at conduits; network traffic restricted to approved ' +
                'flows only; connection policies applied at all zone boundaries; industrial DMZ ' +
                'deployed for any external-facing IACS conduits. Zone/conduit model is the ' +
                'governing architecture document for all FR 5 controls.',
            reference: 'IEC 62443-3-3:2013 FR5 (Restricted Data Flow) — SR 5.1-SR 5.4',
            check: 'iec62443_rdf_controls_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62443-tre-controls',
            description: 'Timely Response to Events (FR 6) requirements implemented per IEC 62443-3-3 ' +
                '§SR 6.x: audit log active with all security-relevant events captured; automated ' +
                'monitoring and alarming on anomalous IACS conditions; CSIRT contact defined; ' +
                'incident response plan tested at least annually. NIS2 24h early-warning process ' +
                'integrated with FR 6 monitoring controls.',
            reference: 'IEC 62443-3-3:2013 FR6 (Timely Response to Events) — SR 6.1-SR 6.2',
            check: 'iec62443_tre_controls_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62443-ra-controls',
            description: 'Resource Availability (FR 7) requirements implemented per IEC 62443-3-3 §SR 7.x: ' +
                'DoS protection mechanisms active at IACS network boundaries; backup and restore ' +
                'procedures validated; emergency power provisions documented; redundant IACS ' +
                'functions at SL 3/4 for crown-jewel systems. Availability requirements aligned ' +
                'with process safety and production continuity objectives.',
            reference: 'IEC 62443-3-3:2013 FR7 (Resource Availability) — SR 7.1-SR 7.8',
            check: 'iec62443_ra_controls_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62443-secure-development-lifecycle',
            description: 'Secure Development Lifecycle (SDL) process active per IEC 62443-4-1: security ' +
                'requirements captured; security architecture and design review performed; ' +
                'implementation guidelines enforced (secure coding, MISRA/CERT-C equivalent); ' +
                'security verification and validation evidence on file; defect management process ' +
                'active; end-of-life security disclosure policy documented. Required for all ' +
                'product suppliers targeting IEC 62443-4-2 component certification.',
            reference: 'IEC 62443-4-1:2018 SDL — full lifecycle: requirements through end-of-life',
            check: 'iec62443_sdl_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62443-component-security-requirements',
            description: 'Component-level security requirements (CR) met per IEC 62443-4-2: software ' +
                'application, embedded device, host device, and network device CRs satisfied at ' +
                'or above the component SL target; CR evidence on file; IECEE CB scheme ' +
                'certification records available where applicable. AI-generated IACS component ' +
                'code must pass CR verification before deployment to production zones.',
            reference: 'IEC 62443-4-2:2019 — Technical security requirements for IACS components (CRs)',
            check: 'iec62443_component_security_requirements_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62443-patch-management',
            description: 'Patch management process active per IEC 62443-2-3: patch notification monitoring ' +
                'from IACS vendors operational; patch evaluation and testing procedure documented; ' +
                'patch deployment schedule defined and followed; compensating controls in place for ' +
                'patches not yet applied; patch records retained. OT patch cycles typically longer ' +
                'than IT — compensating control documentation is mandatory when patches are deferred.',
            reference: 'IEC 62443-2-3:2015 — Patch management in the IACS environment',
            check: 'iec62443_patch_management_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'iec62443-incident-management',
            description: 'Incident management process active per IEC 62443-2-1 §4.3.4.5: IACS security ' +
                'incident detection, classification, and response procedures documented; incident ' +
                'response team with OT security expertise defined; lessons-learned process active; ' +
                'NIS2 24h early-warning notification process integrated; incident records retained ' +
                '7 years (NIS2 OES baseline). At SL 3/4 incidents must trigger immediate escalation ' +
                'to OT security lead, plant manager, and crown-jewel system owner.',
            reference: 'IEC 62443-2-1:2010 §4.3.4.5 — CSMS incident handling',
            check: 'iec62443_incident_management_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62443-behavioral-validator-sl3-sl4-unverified-change',
            description: 'Behavioral validator: detects unverified software or configuration changes to ' +
                'SL 3 or SL 4 IACS zones. Any AI-generated or agent-initiated modification to ' +
                'an IACS control system element classified at SL 3 or SL 4 must be blocked ' +
                'pending full security impact analysis, zone/conduit model re-validation, and ' +
                'OT security lead sign-off. No partial-pass path: SL 3/4 unverified changes are ' +
                'an absolute block. SL 4 violations are escalated immediately to plant manager ' +
                'and crown-jewel system owner.',
            reference: 'IEC 62443-3-2:2020 §5.4 — SL-T; IEC 62443-3-3:2013 §4 — SL 3/4 controls; IEC 62443-2-1:2010 §4.3.4.5',
            check: 'behavioralValidator_iec62443_sl3_sl4_unverified_change',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=iec-62443.js.map