/**
 * NIST Cybersecurity Framework (CSF) 2.0 Compliance Pack
 *
 * Framework: NIST Cybersecurity Framework v2.0 (Feb 2024). Distinct
 *   from `nist-ai-rmf` (AI-specific) and from the NIST 800-53 control
 *   catalog. CSF 2.0 is the foundational US cybersecurity framework
 *   with six functions (added GOVERN to the original five).
 *
 * Jurisdiction: US-origin, globally adopted. Voluntary in the US except
 *   where adopted by procurer (DoD CMMC, sectoral regulators, etc.).
 * Authority: NIST (National Institute of Standards and Technology) +
 *   adopting regulators (sector-specific).
 *
 * Six Functions (CSF 2.0):
 *   - **GOVERN (GV)** — new in 2.0; risk management strategy, policy,
 *     supply chain, oversight
 *   - **IDENTIFY (ID)** — asset, risk, supply chain visibility
 *   - **PROTECT (PR)** — access control, awareness, data security,
 *     platform security, technology infrastructure resilience
 *   - **DETECT (DE)** — continuous monitoring + adverse event analysis
 *   - **RESPOND (RS)** — incident management + analysis + reporting
 *   - **RECOVER (RC)** — incident recovery plan + communication
 *
 * Profiles + Tiers:
 *   - Current Profile + Target Profile (gap analysis)
 *   - Implementation Tiers 1-4 (Partial → Adaptive)
 *
 * Why this pack:
 *   - Many existing packs (FedRAMP, StateRAMP, CMMC2, NCSC CAF) reference
 *     CSF for their control mapping but no standalone NIST CSF pack
 *     existed. Closes that gap.
 *
 * @connexum/ai-governance
 */
export const NIST_CSF_CATEGORY_CLASSIFIERS = {
    GOVERN_FUNCTION: {
        references: ['NIST CSF 2.0 GOVERN function'],
        classifier: (i) => /\b(?:csf\s+(?:gv|govern)|nist\s+csf\s+govern|gv\.\w{2}|gv-\d{2})\b/i.test(i),
    },
    IDENTIFY_FUNCTION: {
        references: ['NIST CSF 2.0 IDENTIFY function'],
        classifier: (i) => /\b(?:csf\s+(?:id|identify)|nist\s+csf\s+identify|id\.\w{2}|id-\d{2})\b/i.test(i),
    },
    PROTECT_FUNCTION: {
        references: ['NIST CSF 2.0 PROTECT function'],
        classifier: (i) => /\b(?:csf\s+(?:pr|protect)|nist\s+csf\s+protect|pr\.\w{2}|pr-\d{2})\b/i.test(i),
    },
    DETECT_FUNCTION: {
        references: ['NIST CSF 2.0 DETECT function'],
        classifier: (i) => /\b(?:csf\s+(?:de|detect)|nist\s+csf\s+detect|de\.\w{2}|de-\d{2})\b/i.test(i),
    },
    RESPOND_FUNCTION: {
        references: ['NIST CSF 2.0 RESPOND function'],
        classifier: (i) => /\b(?:csf\s+(?:rs|respond)|nist\s+csf\s+respond|rs\.\w{2}|rs-\d{2})\b/i.test(i),
    },
    RECOVER_FUNCTION: {
        references: ['NIST CSF 2.0 RECOVER function'],
        classifier: (i) => /\b(?:csf\s+(?:rc|recover)|nist\s+csf\s+recover|rc\.\w{2}|rc-\d{2})\b/i.test(i),
    },
    CSF_PROFILE_TIER: {
        references: ['NIST CSF 2.0 Profiles + Implementation Tiers'],
        classifier: (i) => /\b(?:current\s+profile\s+csf|target\s+profile\s+csf|csf\s+(?:tier\s*[1-4]|implementation\s+tier))\b/i.test(i),
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety'],
        classifier: (i) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(i))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(i))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(i))
                return true;
            return false;
        },
    },
};
export const NIST_CSF_PACK = {
    categoryClassifiers: NIST_CSF_CATEGORY_CLASSIFIERS,
    id: 'nist-csf',
    aliases: ['nist-csf-2', 'nist-csf-2.0', 'nist-cybersecurity-framework', 'csf'],
    name: 'NIST Cybersecurity Framework 2.0',
    version: '1.0.0',
    contentHash: '0e8f57ed5264de369d35669295d62317761b4785508f43fc303b8ef49f062b45',
    description: 'NIST Cybersecurity Framework v2.0 (Feb 2024). Six functions: GOVERN (new in 2.0) + IDENTIFY + PROTECT + DETECT + RESPOND + RECOVER. Current Profile + Target Profile gap analysis; Implementation Tiers 1-4. Distinct from `nist-ai-rmf` (AI-specific) and from the forthcoming `nist-800-53` pack (control catalog). Foundational US cybersecurity framework referenced by FedRAMP, CMMC2, StateRAMP, NCSC CAF, HITRUST, and many sectoral regulators.',
    authority: 'NIST (National Institute of Standards and Technology)',
    industries: ['technology', 'public-sector', 'critical-national-infrastructure', 'financial-services', 'healthcare', 'energy', 'manufacturing', 'defense'],
    requiredModules: [
        { name: 'attestation-manager', required: true, reason: 'Per-function profile attestation; current + target profile registration; implementation tier (1-4) tracked.', reference: 'CSF 2.0 Profiles + Tiers' },
        { name: 'governance-runtime', required: true, reason: 'GOVERN function gate: risk-management strategy + policy enforcement; supply-chain governance.', reference: 'CSF 2.0 GOVERN function' },
        { name: 'audit-integrity', required: true, reason: 'Tamper-evident audit chain for CSF profile evidence + tier-progression evidence.', reference: 'CSF audit + assessment evidence' },
        { name: 'event-bus', required: true, reason: 'DETECT function continuous monitoring + RESPOND incident routing + RECOVER coordination.', reference: 'CSF DETECT + RESPOND + RECOVER' },
        { name: 'data-classifier', required: true, reason: 'Surface CSF function evidence across GOVERN / IDENTIFY / PROTECT / DETECT / RESPOND / RECOVER + profile/tier records.', reference: 'CSF evidence categorisation' },
        { name: 'agent-auth', required: true, reason: 'PROTECT function PR.AA access control; identity lifecycle attestation.', reference: 'CSF PR.AA category' },
        { name: 'encryption-layer', required: true, reason: 'PROTECT function PR.DS data security; cryptographic agility.', reference: 'CSF PR.DS category' },
        { name: 'session-persistence', required: true, reason: 'CSF assessment evidence retention across the assessment cycle (typically 3 years between full reassessments).', reference: 'CSF assessment cycle' },
        { name: 'supply-chain', required: true, reason: 'GOVERN function GV.SC supply-chain risk management; new in 2.0.', reference: 'CSF 2.0 GV.SC category' },
        { name: 'approval-queue', required: true, reason: 'Material posture changes routed for senior + risk-officer approval.', reference: 'CSF GV oversight' },
    ],
    moduleConfig: {
        'attestation-manager': { perFunctionProfileTracked: true, currentTargetProfileRegistered: true, implementationTierTracked: true },
        'governance-runtime': { governFunctionGateRequired: true },
        'data-classifier': { enabledCategories: ['GOVERN_FUNCTION', 'IDENTIFY_FUNCTION', 'PROTECT_FUNCTION', 'DETECT_FUNCTION', 'RESPOND_FUNCTION', 'RECOVER_FUNCTION', 'CSF_PROFILE_TIER', 'CREDENTIALS'], credentialsAction: 'BLOCK' },
        'event-bus': { detectMonitoringRequired: true, respondRoutingRequired: true, recoverCoordinationRequired: true },
        'agent-auth': { prAaAccessControlRequired: true },
        'encryption-layer': { algorithm: 'aes-256-gcm', prDsDataSecurityRequired: true },
        'session-persistence': { retentionDaysMinimum: 1095 },
        'supply-chain': { gvScSupplyChainRequired: true },
        'approval-queue': { reviewTier: 'T2' },
        'audit-integrity': { csfAssessmentEvidenceTrackingRequired: true },
    },
    providerPolicy: { blockedProviders: [], requiredCapabilities: ['NIST-CSF-COMPATIBLE'], blockReasons: {} },
    dataPolicy: {
        scanCategories: ['GOVERN_FUNCTION', 'IDENTIFY_FUNCTION', 'PROTECT_FUNCTION', 'DETECT_FUNCTION', 'RESPOND_FUNCTION', 'RECOVER_FUNCTION', 'CSF_PROFILE_TIER', 'CREDENTIALS'],
        categoryActions: { GOVERN_FUNCTION: 'WARN', IDENTIFY_FUNCTION: 'WARN', PROTECT_FUNCTION: 'WARN', DETECT_FUNCTION: 'WARN', RESPOND_FUNCTION: 'WARN', RECOVER_FUNCTION: 'WARN', CSF_PROFILE_TIER: 'WARN', CREDENTIALS: 'BLOCK' },
        encryptionRequired: true, encryptionStandard: 'AES-256-GCM', minimumClassification: 'INTERNAL',
    },
    retentionPolicy: { auditLogRetentionDays: 1095, sessionRetentionDays: 1095, incidentRetentionDays: 2190, reference: 'CSF assessment cycle (3y) + civil claims defaults', forceDelete: false, requiresLegalHoldSupport: true, sovereignty: ['us', 'global'] },
    incidentPolicy: { notificationDeadlineHours: 72, reference: 'CSF RESPOND function; sector-specific overlays', requiredRecipients: ['ciso', 'risk-officer', 'security-operations'], formalNotificationRequired: false },
    validators: [
        { id: 'nist-csf-govern', description: 'GOVERN function evidence: risk-management strategy, policy, supply-chain governance, oversight.', reference: 'CSF 2.0 GV', check: 'governance_active', failSeverity: 'CRITICAL' },
        { id: 'nist-csf-identify', description: 'IDENTIFY function evidence: asset, risk, supply-chain visibility.', reference: 'CSF 2.0 ID', check: 'attestation_active', failSeverity: 'HIGH' },
        { id: 'nist-csf-protect', description: 'PROTECT function evidence: access control, data security, platform security, infrastructure resilience.', reference: 'CSF 2.0 PR', check: 'governance_active', failSeverity: 'CRITICAL' },
        { id: 'nist-csf-detect', description: 'DETECT function: continuous monitoring + adverse event analysis.', reference: 'CSF 2.0 DE', check: 'monitoring_active', failSeverity: 'CRITICAL' },
        { id: 'nist-csf-respond', description: 'RESPOND function: incident management + analysis + reporting.', reference: 'CSF 2.0 RS', check: 'monitoring_active', failSeverity: 'HIGH' },
        { id: 'nist-csf-recover', description: 'RECOVER function: incident recovery plan + communication.', reference: 'CSF 2.0 RC', check: 'attestation_active', failSeverity: 'HIGH' },
        { id: 'nist-csf-profile-tier', description: 'Current Profile + Target Profile registered; Implementation Tier (1-4) attested.', reference: 'CSF Profiles + Tiers', check: 'attestation_active', failSeverity: 'HIGH' },
        { id: 'nist-csf-supply-chain', description: 'GV.SC supply-chain risk management active (new in 2.0).', reference: 'CSF 2.0 GV.SC', check: 'subservice_registry_active', failSeverity: 'HIGH' },
        { id: 'nist-csf-encryption', description: 'PR.DS data security: encryption at rest and in transit.', reference: 'CSF 2.0 PR.DS', check: 'encryption_active', failSeverity: 'HIGH' },
        { id: 'nist-csf-credential-block', description: 'Plaintext credentials blocked.', reference: 'CSF PR.AA', check: 'data_classifier_active', failSeverity: 'CRITICAL' },
    ],
};
//# sourceMappingURL=nist-csf.js.map