/**
 * NCSC Cyber Assessment Framework (CAF) Compliance Pack
 *
 * Framework:
 *   National Cyber Security Centre — Cyber Assessment Framework (CAF)
 *   v3.x. The UK's cyber-resilience assessment framework for operators
 *   of essential services (OES) under the Network and Information
 *   Systems Regulations 2018 (UK NIS Regs), and increasingly mandated
 *   for central government (GovAssure programme since 2023).
 *
 *   Distinct from Cyber Essentials (NCSC's lighter-weight 5-control
 *   self-assessment for SMEs and most NHS suppliers). CAF is the heavier,
 *   outcome-based assessment for operators of CNI and large public-
 *   sector estates.
 *
 *   CAF organises 14 cyber-security and resilience principles into four
 *   objectives:
 *     A. Managing security risk          (4 principles A1–A4)
 *     B. Protecting against cyber attack (5 principles B1–B5)
 *     C. Detecting cyber security events (2 principles C1–C2)
 *     D. Minimising the impact of cyber security incidents (2 principles D1–D2)
 *   Plus a fifth implicit objective via embedded indicators of good
 *   practice (IGPs) that map to the 14 principles.
 *
 * Jurisdiction: GB (United Kingdom)
 * Authority: NCSC (National Cyber Security Centre, part of GCHQ)
 * Companion regulators (sectoral CAF profiles):
 *   - Ofcom (telecoms)
 *   - Ofgem (energy)
 *   - DfT + ORR (transport / rail)
 *   - PSR + FCA (financial services CNI overlap)
 *   - DHSC + NHS England (health CNI)
 *   - DSIT (digital infrastructure / cloud / IaaS — newest CAF additions)
 *
 * Why this pack:
 *   - CAF is the assessment framework an OES customer's CISO is asked to
 *     pass under UK NIS Regs Reg 11/12. Distinct from CE; CAF customers
 *     usually also hold CE+ but for CAF the audit is outcome-based not
 *     control-checklist.
 *   - GovAssure (Cabinet Office programme) made CAF mandatory for
 *     central-government departments in 2023 — every Critical Service
 *     in scope is assessed against CAF.
 *   - Pairs with `uk-nis-regs` pack (forthcoming, this session) which
 *     captures the statutory side; CAF is the operational evidence
 *     framework the regulators use against NIS-scope entities.
 *
 * Out of scope:
 *   - Cyber Essentials self-assessment (covered by `cyber-essentials` pack)
 *   - UK NIS Regs 2018 statutory side (separate pack: `uk-nis-regs`,
 *     forthcoming)
 *   - EU NIS2 (separate pack: `nis2`, already shipped)
 *   - General UK GDPR personal-data handling (separate pack: `uk-gdpr`)
 *
 * @connexum/ai-governance
 */
export const NCSC_CAF_CATEGORY_CLASSIFIERS = {
    CAF_PRINCIPLE_EVIDENCE: {
        references: [
            'NCSC CAF v3.x — 14 principles across objectives A/B/C/D',
        ],
        classifier: (input) => {
            if (/\b(?:caf\s+(?:principle|outcome|igp|assessment)|cyber\s+assessment\s+framework)\b/i.test(input))
                return true;
            if (/\b(?:caf\s+(?:a[1-4]|b[1-5]|c[1-2]|d[1-2])|principle\s+[abcd][1-5])\b/i.test(input))
                return true;
            if (/\b(?:govassure\s+(?:assessment|evidence|outcome))\b/i.test(input))
                return true;
            return false;
        },
    },
    RISK_GOVERNANCE_RECORD: {
        references: [
            'CAF Objective A: Managing security risk — A1 governance, A2 risk management, A3 asset management, A4 supply chain',
        ],
        classifier: (input) => {
            if (/\b(?:cyber\s+risk\s+(?:register|appetite\s+statement|board\s+report)|caf\s+a1\s+governance)\b/i.test(input))
                return true;
            if (/\b(?:asset\s+(?:inventory|register)\s+(?:essential|caf)|critical\s+asset\s+catalogue)\b/i.test(input))
                return true;
            if (/\b(?:supply\s+chain\s+cyber\s+(?:assessment|attestation)|sub-supplier\s+caf\s+evidence)\b/i.test(input))
                return true;
            return false;
        },
    },
    PROTECT_CONTROL_EVIDENCE: {
        references: [
            'CAF Objective B: Protecting against cyber attack — B1 service protection, B2 identity, B3 data security, B4 system security, B5 resilient networks',
        ],
        classifier: (input) => {
            if (/\b(?:network\s+segmentation\s+evidence|zero\s+trust\s+architecture\s+caf|secure\s+by\s+design\s+caf)\b/i.test(input))
                return true;
            if (/\b(?:identity\s+lifecycle\s+caf|privileged\s+access\s+management\s+caf|jit\s+access\s+evidence)\b/i.test(input))
                return true;
            if (/\b(?:data\s+at\s+rest\s+caf|data\s+in\s+transit\s+caf|key\s+management\s+caf)\b/i.test(input))
                return true;
            return false;
        },
    },
    DETECT_TELEMETRY: {
        references: [
            'CAF Objective C: Detecting cyber security events — C1 security monitoring, C2 proactive event discovery',
        ],
        classifier: (input) => {
            if (/\b(?:security\s+monitoring\s+(?:caf|coverage)|siem\s+caf\s+evidence|soc\s+caf\s+attestation)\b/i.test(input))
                return true;
            if (/\b(?:threat\s+hunting\s+(?:cadence|report)|proactive\s+detection\s+caf|caf\s+c2\s+discovery)\b/i.test(input))
                return true;
            return false;
        },
    },
    RESPOND_RECOVER_RECORD: {
        references: [
            'CAF Objective D: Minimising the impact of cyber security incidents — D1 response and recovery planning, D2 lessons learned',
        ],
        classifier: (input) => {
            if (/\b(?:incident\s+response\s+(?:plan|playbook)\s+caf|exercise\s+report\s+caf|tabletop\s+caf)\b/i.test(input))
                return true;
            if (/\b(?:lessons\s+learned\s+(?:caf|cni)|post[\s-]?incident\s+review\s+caf)\b/i.test(input))
                return true;
            if (/\b(?:business\s+continuity\s+plan\s+(?:caf|cni)|disaster\s+recovery\s+exercise\s+caf)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety; CAF artefacts must not embed credentials'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const NCSC_CAF_PACK = {
    categoryClassifiers: NCSC_CAF_CATEGORY_CLASSIFIERS,
    id: 'ncsc-caf',
    aliases: [
        'caf',
        'ncsc-cyber-assessment-framework',
        'cyber-assessment-framework',
        'govassure',
        'caf-v3',
    ],
    name: 'NCSC Cyber Assessment Framework (CAF)',
    version: '1.0.0',
    contentHash: '45f06c2a75891befca37735139c9632e046645a9ad8fa161ed011928dbf4ce25',
    description: 'NCSC Cyber Assessment Framework v3.x covering 14 principles across four objectives (A: Managing security risk, B: Protecting against cyber attack, C: Detecting cyber security events, D: Minimising the impact of cyber security incidents). Required for operators of essential services under UK NIS Regs 2018 and central-government departments under GovAssure (Cabinet Office, 2023). Outcome-based assessment, distinct from Cyber Essentials (`cyber-essentials` pack — control-checklist self-assessment). Sectoral profiles: Ofcom (telecoms), Ofgem (energy), DfT + ORR (transport), PSR + FCA (finance CNI overlap), DHSC + NHS England (health CNI), DSIT (digital infrastructure).',
    authority: 'NCSC (National Cyber Security Centre) + sectoral regulators (Ofcom / Ofgem / DfT / ORR / PSR / FCA / DHSC / NHS England / DSIT) + Cabinet Office GovAssure programme',
    industries: ['public-sector', 'critical-national-infrastructure', 'energy', 'telecoms', 'transport', 'financial-services', 'healthcare', 'defense', 'cloud-infrastructure'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'CAF Objective A1 governance + B1 service protection: default-deny on uncovered service paths; cyber-risk-register-driven gate for AI agent actions touching CNI services.',
            reference: 'CAF Principles A1, A2, B1',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'CAF Objective B2 identity + privileged access management: MFA, least privilege, just-in-time elevation, identity-lifecycle attestation.',
            reference: 'CAF Principles B2',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit chain for CAF principle evidence + IGP outcomes; CAF assessor inspection evidence requirements.',
            reference: 'CAF Objective A3 asset management; assessor evidence chain',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Per-principle CAF posture (achieved / partially achieved / not achieved) tracked over assessment cycles; GovAssure submission attestation for central-government departments.',
            reference: 'CAF v3.x principle outcomes; GovAssure assessment cycle',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'CAF Objective C1 + C2 security monitoring + proactive detection telemetry; D1 incident response routing.',
            reference: 'CAF Objectives C and D',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Surface CAF evidence categories (principle evidence, risk governance, protect controls, detect telemetry, respond/recover records) for the assessor and the dashboard.',
            reference: 'CAF assessor evidence categorisation',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'CAF Principle B3 data security: NCSC-recommended cipher / TLS profiles; key-management evidence; cryptographic agility planning.',
            reference: 'CAF Principle B3; NCSC cryptographic guidance',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'CAF assessment evidence retention across the full assessment cycle (typically 3 years between full reassessments) plus a buffer year for the assessor handover.',
            reference: 'CAF assessment cycle; GovAssure evidence retention',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'CAF Principle A4 supply chain: sub-supplier CAF evidence flow-down; cyber-risk-attestation across the supply chain.',
            reference: 'CAF Principle A4',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'CAF D2 lessons learned: post-incident review approval gate; emergency change approval where the patch SLA window forces a bypass of standard change-control.',
            reference: 'CAF Principle D2; ITIL emergency change overlay',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            cafA1GovernanceGateRequired: true,
            cafB1ServiceProtectionGateRequired: true,
            defaultDenyOnUncoveredCniService: true,
        },
        'agent-auth': {
            cafB2MfaRequired: true,
            cafB2PrivilegedAccessManagementRequired: true,
            cafB2JitElevationRequired: true,
        },
        'attestation-manager': {
            cafPerPrincipleOutcomeTracked: true,
            govAssureSubmissionTracked: true,
            retentionYearsForAssessmentEvidence: 4,
        },
        'event-bus': {
            cafC1SecurityMonitoringRequired: true,
            cafC2ProactiveDetectionRequired: true,
            cafD1IncidentResponseRoutingRequired: true,
        },
        'data-classifier': {
            enabledCategories: [
                'CAF_PRINCIPLE_EVIDENCE',
                'RISK_GOVERNANCE_RECORD',
                'PROTECT_CONTROL_EVIDENCE',
                'DETECT_TELEMETRY',
                'RESPOND_RECOVER_RECORD',
                'CREDENTIALS',
            ],
            credentialsAction: 'BLOCK',
        },
        'encryption-layer': {
            algorithm: 'aes-256-gcm',
            tlsMinVersion: '1.2',
            cafB3DataSecurityRequired: true,
        },
        'session-persistence': {
            retentionDaysMinimum: 1460, // 4 years (assessment cycle + buffer)
        },
        'supply-chain': {
            cafA4SubSupplierAttestationRequired: true,
        },
        'approval-queue': {
            cafD2LessonsLearnedApprovalRequired: true,
            reviewTier: 'T2',
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-UK', 'PROCESSOR-CONTRACT', 'NCSC-CAF-COMPATIBLE'],
        blockReasons: {
            deepseek: 'PRC jurisdiction. CAF Principle B3 data security and A4 supply chain attestations exclude PRC routing for CNI services.',
            baidu: 'PRC jurisdiction. CAF supply-chain attestation cannot route through PRC infrastructure.',
            alibaba: 'PRC jurisdiction. CAF supply-chain attestation cannot route through PRC infrastructure.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'CAF_PRINCIPLE_EVIDENCE',
            'RISK_GOVERNANCE_RECORD',
            'PROTECT_CONTROL_EVIDENCE',
            'DETECT_TELEMETRY',
            'RESPOND_RECOVER_RECORD',
            'CREDENTIALS',
        ],
        categoryActions: {
            CAF_PRINCIPLE_EVIDENCE: 'WARN',
            RISK_GOVERNANCE_RECORD: 'WARN',
            PROTECT_CONTROL_EVIDENCE: 'WARN',
            DETECT_TELEMETRY: 'WARN',
            RESPOND_RECOVER_RECORD: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        auditLogRetentionDays: 1460, // 4 years
        sessionRetentionDays: 1460,
        incidentRetentionDays: 2190, // 6 years for CNI incident records
        reference: 'NCSC CAF assessment cycle; GovAssure evidence retention; UK NIS Regs 2018 Reg 11 incident records',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb'],
    },
    incidentPolicy: {
        notificationDeadlineHours: 72,
        reference: 'UK NIS Regs 2018 Reg 11 — incident notification to competent authority within 72 hours; NCSC CAF Objective D incident response',
        requiredRecipients: ['ncsc', 'sectoral-competent-authority', 'ciso', 'cni-board-sponsor'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'ncsc-caf-objective-a-governance',
            description: 'CAF Objective A (Managing security risk) — A1–A4 outcomes assessed and current; cyber-risk register live.',
            reference: 'CAF v3.x Principles A1–A4',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ncsc-caf-objective-b-protect',
            description: 'CAF Objective B (Protecting against cyber attack) — B1–B5 outcomes assessed; MFA + segmentation + key management evidence current.',
            reference: 'CAF v3.x Principles B1–B5',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ncsc-caf-objective-c-detect',
            description: 'CAF Objective C (Detecting cyber security events) — C1 monitoring coverage + C2 proactive detection cadence captured.',
            reference: 'CAF v3.x Principles C1–C2',
            check: 'monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ncsc-caf-objective-d-respond',
            description: 'CAF Objective D (Minimising the impact of cyber security incidents) — D1 response plan exercised + D2 lessons-learned cycle captured.',
            reference: 'CAF v3.x Principles D1–D2',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ncsc-caf-supply-chain',
            description: 'Sub-supplier CAF attestations captured; supply-chain cyber-risk inheritance documented.',
            reference: 'CAF Principle A4 supply chain',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ncsc-caf-incident-72h',
            description: 'UK NIS Regs incident notification path active to NCSC + sectoral competent authority within 72 hours.',
            reference: 'UK NIS Regs 2018 Reg 11',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ncsc-caf-assessment-current',
            description: 'CAF self-assessment / external assessment current within the regulator-mandated cycle (typically 3 years).',
            reference: 'CAF assessment cycle; GovAssure',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ncsc-caf-evidence-audit-trail',
            description: 'Tamper-evident audit trail covers CAF principle evidence, IGP outcomes, GovAssure submission revisions.',
            reference: 'CAF assessor evidence integrity',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'ncsc-caf-credential-block',
            description: 'Plaintext credentials blocked from CAF evidence artefacts and audit chain entries.',
            reference: 'CAF Principle B3 + NCSC secrets management',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ncsc-caf-encryption-active',
            description: 'NCSC-recommended cipher / TLS profile in use; key-management lifecycle attested.',
            reference: 'CAF Principle B3; NCSC cryptographic guidance',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=ncsc-caf.js.map