/**
 * UK Network and Information Systems Regulations 2018 Compliance Pack
 *
 * Statute: The Network and Information Systems Regulations 2018
 *   (SI 2018/506), as amended. The UK transposition of the original EU
 *   NIS Directive ((EU) 2016/1148), retained in UK law post-Brexit. The
 *   Cyber Security and Resilience Bill (announced King's Speech 2024)
 *   is expected to update the regime; the regulations remain in force
 *   until and unless that Bill is passed.
 *
 * Jurisdiction: GB (United Kingdom)
 * Authority: Designated competent authorities by sector:
 *   - Energy: Ofgem + DESNZ + DfI (NI)
 *   - Drinking water: DEFRA + DAERA (NI) + Drinking Water Inspectorate
 *   - Health: DHSC + relevant Health Departments (devolved)
 *   - Transport: DfT + DAERA (NI) + ORR
 *   - Digital infrastructure: NCSC (DSPs) + Ofcom (TSPs) + DSIT
 *   - Banking + financial market infrastructure: HMT + Bank of England
 *
 * Why this pack:
 *   - UK NIS Regs are the statutory basis for the cyber-resilience duty
 *     on Operators of Essential Services (OES) and Relevant Digital
 *     Service Providers (RDSPs). They are distinct from the EU NIS2
 *     Directive (covered by the `nis2` pack) — UK did NOT adopt NIS2;
 *     UK NIS Regs 2018 remain in force (with amendments tracked here).
 *   - The NCSC CAF (covered by `ncsc-caf` pack) is the operational
 *     evidence framework competent authorities use to assess compliance
 *     with the statutory duties in UK NIS Regs Reg 10 (security
 *     requirements) and Reg 11 (incident notification).
 *
 * Key statutory duties:
 *   - Reg 10: appropriate and proportionate technical and organisational
 *     measures to manage risks to network and information systems.
 *   - Reg 11: notify the relevant competent authority within 72 hours of
 *     any NIS incident having a significant impact on the continuity of
 *     the essential service or digital service.
 *   - Reg 12: cooperate with the competent authority during an
 *     investigation; provide information on request.
 *   - Reg 13: register as an OES / RDSP with the relevant competent
 *     authority before service goes live.
 *   - Reg 17: penalties — civil monetary penalties up to £17 million
 *     (or 4% of turnover for repeat / persistent contravention) for
 *     non-compliance with Reg 10 / Reg 11 duties.
 *
 * Significant-impact thresholds for incident notification (Reg 11):
 *   - Number of users affected
 *   - Duration of disruption
 *   - Geographical scope
 *   - Severity of disruption to functioning of the service
 *   - Extent of impact on economic and societal activities
 *
 * Out of scope:
 *   - EU NIS2 Directive (separate pack: `nis2`)
 *   - NCSC CAF assessment-evidence framework (separate pack: `ncsc-caf`)
 *   - Cyber Security and Resilience Bill (when passed, this pack will
 *     be amended; tracker comment in metadata)
 *   - Cyber Essentials self-assessment (separate pack: `cyber-essentials`)
 *
 * @connexum/ai-governance
 */
export const UK_NIS_REGS_CATEGORY_CLASSIFIERS = {
    NIS_REGISTRATION_RECORD: {
        references: [
            'UK NIS Regs 2018 Reg 13 — registration with competent authority',
        ],
        classifier: (input) => {
            if (/\b(?:nis\s+(?:registration|registered)\s+(?:oes|rdsp|operator|provider)|reg\s+13\s+nis)\b/i.test(input))
                return true;
            if (/\b(?:operator\s+of\s+essential\s+services|relevant\s+digital\s+service\s+provider|oes\s+designation|rdsp\s+designation)\b/i.test(input))
                return true;
            return false;
        },
    },
    NIS_SECURITY_MEASURE: {
        references: [
            'UK NIS Regs 2018 Reg 10 — security requirements',
        ],
        classifier: (input) => {
            if (/\b(?:nis\s+(?:security|reg\s+10)\s+(?:measure|control|evidence)|technical\s+and\s+organisational\s+measure\s+nis)\b/i.test(input))
                return true;
            if (/\b(?:appropriate\s+and\s+proportionate\s+nis|risk\s+management\s+evidence\s+nis)\b/i.test(input))
                return true;
            return false;
        },
    },
    NIS_INCIDENT_NOTIFICATION: {
        references: [
            'UK NIS Regs 2018 Reg 11 — incident notification within 72 hours',
        ],
        classifier: (input) => {
            if (/\b(?:nis\s+(?:incident|reg\s+11)\s+(?:notification|report|filing)|reportable\s+nis\s+incident)\b/i.test(input))
                return true;
            if (/\b(?:significant\s+impact\s+(?:nis|essential\s+service)|72[\s-]?hour\s+nis\s+notification)\b/i.test(input))
                return true;
            return false;
        },
    },
    COMPETENT_AUTHORITY_CORRESPONDENCE: {
        references: [
            'UK NIS Regs 2018 Reg 12 — cooperation duty',
        ],
        classifier: (input) => {
            if (/\b(?:competent\s+authority\s+(?:correspondence|notice|inspection|enforcement)|reg\s+12\s+nis)\b/i.test(input))
                return true;
            if (/\b(?:ofgem\s+nis|nhs\s+england\s+nis|dft\s+nis|orr\s+nis|ncsc\s+rdsp\s+notice)\b/i.test(input))
                return true;
            return false;
        },
    },
    PENALTY_NOTICE: {
        references: [
            'UK NIS Regs 2018 Reg 17 — civil monetary penalties up to £17M or 4% turnover',
        ],
        classifier: (input) => {
            if (/\b(?:nis\s+(?:penalty|enforcement)\s+notice|nis\s+civil\s+monetary\s+penalty|reg\s+17\s+nis)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety; NIS evidence artefacts must not embed credentials'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const UK_NIS_REGS_PACK = {
    categoryClassifiers: UK_NIS_REGS_CATEGORY_CLASSIFIERS,
    id: 'uk-nis-regs',
    aliases: [
        'uk-nis',
        'uk-nis-regulations',
        'uk-nis-regulations-2018',
        'nis-uk',
        'si-2018-506',
    ],
    name: 'UK Network and Information Systems Regulations 2018',
    version: '1.0.0',
    contentHash: '10954a5244fa09d4f444a28c3babbbaf3edf6eb9b092f7f7de3b36a5b32c260b',
    description: 'UK transposition of the original EU NIS Directive, retained in UK law post-Brexit (SI 2018/506). Statutory cyber-resilience duty on Operators of Essential Services (OES — energy, water, health, transport, digital infrastructure, banking) and Relevant Digital Service Providers (RDSP — online marketplaces, search engines, cloud computing). Reg 10 security duty + Reg 11 72-hour incident notification + Reg 12 cooperation duty + Reg 13 registration + Reg 17 penalties (up to £17M or 4% turnover). Distinct from EU NIS2 (`nis2` pack); paired with `ncsc-caf` (assessment evidence framework) and `cyber-essentials` (lighter SME self-assessment).',
    authority: 'Designated competent authorities by sector — Ofgem + DESNZ (energy) / DEFRA + DWI (water) / DHSC + devolved health (health) / DfT + ORR (transport) / NCSC + Ofcom + DSIT (digital) / HMT + Bank of England (finance)',
    industries: ['public-sector', 'critical-national-infrastructure', 'energy', 'telecoms', 'transport', 'financial-services', 'healthcare', 'water-utilities', 'cloud-infrastructure'],
    requiredModules: [
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Reg 13 OES / RDSP registration with the relevant competent authority before service goes live; per-jurisdiction registration record (OES is sector-specific; RDSP is NCSC-led).',
            reference: 'UK NIS Regs 2018 Reg 13',
        },
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Reg 10 appropriate and proportionate measures: default-deny on uncovered NIS-scope service paths; technical and organisational measures gate.',
            reference: 'UK NIS Regs 2018 Reg 10',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Reg 11 72-hour incident-notification routing to the relevant competent authority; significant-impact threshold detection (users / duration / geographical scope / severity / impact).',
            reference: 'UK NIS Regs 2018 Reg 11',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit chain for Reg 10 measures evidence, Reg 11 notification records, Reg 12 cooperation correspondence, and Reg 17 penalty-notice responses — admissible during competent-authority enforcement.',
            reference: 'UK NIS Regs 2018 Reg 12 cooperation duty; Reg 17 enforcement',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Surface NIS-specific evidence categories (registration, security measure, incident notification, competent-authority correspondence, penalty notice) for the audit chain and the dashboard.',
            reference: 'UK NIS Regs 2018 evidence categorisation',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Incident records and Reg 10 evidence retained 6 years (Limitation Act 1980 default; civil-penalty appeal window is 28 days but enforcement evidence must outlast).',
            reference: 'UK NIS Regs 2018 Reg 17 enforcement; Limitation Act 1980',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Reg 10 access control for NIS-scope systems; least privilege; identity-lifecycle attestation aligned with NCSC CAF B2.',
            reference: 'UK NIS Regs 2018 Reg 10; NCSC CAF Principle B2',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Reg 10 technical measures for confidentiality and integrity; NCSC-recommended cipher / TLS profile.',
            reference: 'UK NIS Regs 2018 Reg 10; NCSC CAF Principle B3',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Reg 10 covers third-party / supply-chain risk; sub-supplier NIS-scope attestation captured.',
            reference: 'UK NIS Regs 2018 Reg 10; NCSC CAF Principle A4',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'High-impact NIS service-state changes (configuration, scope, supplier) routed for T2 review; emergency change approval where the patch SLA window forces a bypass.',
            reference: 'UK NIS Regs 2018 Reg 10; ITIL emergency change overlay',
        },
    ],
    moduleConfig: {
        'attestation-manager': {
            oesRegistrationTracked: true,
            rdspRegistrationTracked: true,
            reg10MeasuresAttestationRequired: true,
        },
        'governance-runtime': {
            reg10AppropriateAndProportionateGateRequired: true,
            defaultDenyOnUncoveredNisServicePath: true,
        },
        'event-bus': {
            reg11NotificationDeadlineHours: 72,
            significantImpactThresholdDetectionRequired: true,
            competentAuthorityRoutingByJurisdiction: true,
        },
        'audit-integrity': {
            enforcementEvidenceTrackingRequired: true,
        },
        'data-classifier': {
            enabledCategories: [
                'NIS_REGISTRATION_RECORD',
                'NIS_SECURITY_MEASURE',
                'NIS_INCIDENT_NOTIFICATION',
                'COMPETENT_AUTHORITY_CORRESPONDENCE',
                'PENALTY_NOTICE',
                'CREDENTIALS',
            ],
            credentialsAction: 'BLOCK',
        },
        'session-persistence': {
            retentionDaysMinimum: 2190, // 6 years
        },
        'agent-auth': {
            leastPrivilegeRequired: true,
            identityLifecycleAttestationRequired: true,
        },
        'encryption-layer': {
            algorithm: 'aes-256-gcm',
            tlsMinVersion: '1.2',
        },
        'supply-chain': {
            subSupplierNisAttestationRequired: true,
        },
        'approval-queue': {
            highImpactStateChangeApprovalRequired: true,
            emergencyChangeApprovalRequired: true,
            reviewTier: 'T2',
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-UK', 'PROCESSOR-CONTRACT', 'NCSC-CAF-COMPATIBLE'],
        blockReasons: {
            deepseek: 'PRC jurisdiction. UK NIS Reg 10 supply-chain attestation excludes PRC routing for OES/RDSP-scope services.',
            baidu: 'PRC jurisdiction. NIS-scope service evidence cannot route through PRC infrastructure.',
            alibaba: 'PRC jurisdiction. NIS-scope service evidence cannot route through PRC infrastructure.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'NIS_REGISTRATION_RECORD',
            'NIS_SECURITY_MEASURE',
            'NIS_INCIDENT_NOTIFICATION',
            'COMPETENT_AUTHORITY_CORRESPONDENCE',
            'PENALTY_NOTICE',
            'CREDENTIALS',
        ],
        categoryActions: {
            NIS_REGISTRATION_RECORD: 'WARN',
            NIS_SECURITY_MEASURE: 'WARN',
            NIS_INCIDENT_NOTIFICATION: 'WARN',
            COMPETENT_AUTHORITY_CORRESPONDENCE: 'WARN',
            PENALTY_NOTICE: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        auditLogRetentionDays: 2190, // 6 years
        sessionRetentionDays: 2190,
        incidentRetentionDays: 2190,
        reference: 'UK NIS Regs 2018 Reg 17 enforcement window; Limitation Act 1980 6-year claim period',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb'],
    },
    incidentPolicy: {
        notificationDeadlineHours: 72,
        reference: 'UK NIS Regs 2018 Reg 11 — 72-hour notification to competent authority',
        requiredRecipients: ['competent-authority', 'ncsc', 'ciso', 'cni-board-sponsor'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'uk-nis-registration-current',
            description: 'Reg 13 OES / RDSP registration with relevant competent authority current; designation correspondence captured.',
            reference: 'UK NIS Regs 2018 Reg 13',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-nis-security-measures',
            description: 'Reg 10 appropriate-and-proportionate technical and organisational measures attested; evidence chain mapped to NCSC CAF outcomes.',
            reference: 'UK NIS Regs 2018 Reg 10; NCSC CAF',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-nis-incident-72h',
            description: 'Reg 11 72-hour incident-notification path active to competent authority; significant-impact threshold detection wired.',
            reference: 'UK NIS Regs 2018 Reg 11',
            check: 'monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-nis-cooperation-evidence',
            description: 'Reg 12 cooperation correspondence with competent authority captured tamper-evidently.',
            reference: 'UK NIS Regs 2018 Reg 12',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-nis-supply-chain',
            description: 'Sub-supplier NIS-scope attestation captured per Reg 10 third-party risk; aligned with NCSC CAF A4.',
            reference: 'UK NIS Regs 2018 Reg 10; NCSC CAF A4',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-nis-evidence-retention',
            description: 'NIS evidence retained 6 years (Limitation Act); legal-hold support active for live enforcement actions.',
            reference: 'UK NIS Regs 2018 Reg 17; Limitation Act 1980',
            check: 'retention_policy_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-nis-credential-block',
            description: 'Plaintext credentials blocked from NIS evidence artefacts and audit chain entries.',
            reference: 'UK NIS Regs 2018 Reg 10 + NCSC secrets management',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-nis-encryption-active',
            description: 'NCSC-recommended cipher / TLS profile in use; encryption at rest and in transit per Reg 10.',
            reference: 'UK NIS Regs 2018 Reg 10; NCSC cryptographic guidance',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=uk-nis-regs.js.map