/**
 * ISO/IEC 27001:2022 Compliance Pack
 *
 * Information Security Management System (ISMS) standard. The 2022
 * edition is the ONLY current valid version; the 2013 edition was
 * officially retired 31 October 2025 (three-year transition ended).
 *
 * Standards referenced:
 *   - ISO/IEC 27001:2022 (ISMS requirements -- Clauses 4-10)
 *   - ISO/IEC 27002:2022 (Information security controls -- 93 controls
 *     across Organizational (A.5), People (A.6), Physical (A.7), and
 *     Technological (A.8) themes; 11 new controls added vs 2013)
 *   - ISO/IEC 27005:2022 (Risk management guidance)
 *
 * Current state (2026):
 *   - 2013 edition certificates expired 31 October 2025. No new
 *     certificates issued against 2013 since October 2022.
 *   - Pax1 exclusively supports 2022 edition.
 *   - ISO 27001 pairs naturally with ISO 42001 (AI management system)
 *     and SOC 2 (many Trust Services Criteria map to ISO 27001
 *     Annex A controls).
 *   - 2022 edition introduced 11 new controls: threat intelligence
 *     (A.5.7), ICT readiness (A.5.30), config management (A.8.9),
 *     information deletion (A.8.10), data masking (A.8.11), data leakage
 *     prevention (A.8.12), monitoring activities (A.8.16), web filtering
 *     (A.8.23), secure coding (A.8.28), plus 2 more.
 *
 * @connexum/ai-governance
 */
import { sharedPiiClassifier } from './_base-classifiers.js';
/**
 * ISO 27001:2022 category classifiers.
 * Annex A controls A.8.11 (data masking) and A.8.12 (data leakage prevention)
 * drive the PII and PAN category scans.
 *
 * NOTE: PHI was removed (F-NEW-CRIT-20). ISO 27001 is an ISMS framework; it
 * does not independently define health data. When PHI is in scope, activate
 * HIPAA or GDPR alongside ISO 27001. PII now delegates to sharedPiiClassifier
 * to eliminate the duplicated regex pattern (F-NEW-CRIT-19).
 */
export const ISO27001_CATEGORY_CLASSIFIERS = {
    PII: {
        references: ['ISO 27001:2022 A.8.11 -- data masking; A.8.12 -- data leakage prevention; personal data'],
        classifier: (input) => {
            if (sharedPiiClassifier(input))
                return true;
            // Keyword-anchored PII label patterns (F-NEW-VERA-PACK-ISO27001-PII-OVERFIRE).
            // Previously used /\b(?:name|full name|first name|last name)[:\s]+[A-Z][a-z]+ [A-Z][a-z]+/i
            // which fired on bare "name" in technical phrases such as "name resolution in DNS" or
            // "phone number policy" because the /i flag made the trailing capitalized-word requirement
            // case-insensitive, matching any two consecutive words after the keyword.
            // Option A fix (revised): require an explicit label separator (: or =) after the PII
            // label phrase so that policy documents containing "phone number policy" or "name
            // resolution in DNS" do NOT trigger the classifier. Only field-label patterns like
            // "full name:", "phone number:", "mailing address:" fire.
            if (/\b(?:full\s+name|first\s+name|last\s+name|home\s+address|mailing\s+address|phone\s+number)\s*[=:]/i.test(input))
                return true;
            return false;
        },
    },
    PAN: {
        references: ['ISO 27001:2022 A.8.12 -- data leakage prevention; payment card data'],
        pattern: /\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12})\b/,
    },
    CREDENTIALS: {
        references: ['ISO 27001:2022 A.8.5 -- secure authentication; A.5.17 -- authentication information'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
    ISMS_INCIDENT: {
        references: ['ISO 27001:2022 A.5.24-A.5.27 -- Information Security Incident Management'],
        classifier: (input) => {
            if (/\binformation\s+security\s+(incident|event)\b/i.test(input))
                return true;
            if (/\bisms\s+incident\b/i.test(input))
                return true;
            if (/\bsecurity\s+event\s+escalated\b/i.test(input))
                return true;
            if (/\bincident\s+response\s+activated\b/i.test(input))
                return true;
            if (/\bdata\s+exfiltration\s+detected\b/i.test(input))
                return true;
            if (/\bransomware\s+(suspected|detected|attack)\b/i.test(input))
                return true;
            if (/\b(?:lessons[\s-]learned|post[\s-]incident\s+review)\b/i.test(input))
                return true;
            if (/\bc2\s+(ip|server)\b/i.test(input))
                return true;
            // BROADENED (F-NEW-CLASSIFIER-FIRE-RATE-FRAMEWORK-2026-05-24): the original classifier
            // required "information security incident" verbatim. Natural-language LLM output uses
            // shorter forms such as "security incident" or "security incident not logged".
            if (/\bsecurity\s+incident\b/i.test(input))
                return true;
            return false;
        },
    },
    THREAT_INTELLIGENCE: {
        references: ['ISO 27001:2022 A.5.7 -- Threat intelligence (NEW 2022 control)'],
        classifier: (input) => {
            if (/\bthreat\s+intelligence\b/i.test(input))
                return true;
            if (/\b(?:cti|cyber\s+threat\s+intelligence)\s+(advisory|brief|feed|report)?\b/i.test(input))
                return true;
            if (/\bti\s+report\b/i.test(input))
                return true;
            if (/\bioc\s+(added|update|feed)\b/i.test(input))
                return true;
            if (/\bapt[\s-]?\d+\b/i.test(input))
                return true;
            if (/\bnation[\s-]state\s+actor\b/i.test(input))
                return true;
            if (/\bransomware[\s-]as[\s-]a[\s-]service\b/i.test(input))
                return true;
            return false;
        },
    },
    SECURE_DEV: {
        references: ['ISO 27001:2022 A.8.25-A.8.30 -- Secure development lifecycle'],
        classifier: (input) => {
            if (/\bsecure\s+development\s+lifecycle\b/i.test(input))
                return true;
            if (/\bsecure\s+coding\s+(standard|practice|guideline)/i.test(input))
                return true;
            if (/\bsdlc\s+(attestation|gate|review)\b/i.test(input))
                return true;
            if (/\bsast\s+(findings?|scan|results?)\b/i.test(input))
                return true;
            if (/\bdast\s+(scan|results?|findings?)\b/i.test(input))
                return true;
            if (/\bapplication\s+security\s+test(ing)?\b/i.test(input))
                return true;
            if (/\bsql\s+injection\s+(vulnerability|detected)\b/i.test(input))
                return true;
            if (/\bcode\s+review\s+evidence\s+missing\b/i.test(input))
                return true;
            if (/\bhardcoded\s+secrets\b/i.test(input))
                return true;
            if (/\boutsourced\s+development\b/i.test(input))
                return true;
            return false;
        },
    },
    SUPPLIER_RISK: {
        references: ['ISO 27001:2022 A.5.19-A.5.22 -- Supplier relationships'],
        classifier: (input) => {
            if (/\bsupplier\s+risk\s+assessment\b/i.test(input))
                return true;
            if (/\binformation\s+security\s+agreement\b/i.test(input) && /\bsupplier\b/i.test(input))
                return true;
            // NOTE: "ict supply chain" alone is NOT flagged — too broad, fires on compliant descriptions.
            // Only flag ICT supply chain when paired with a risk/violation signal.
            if (/\b(?:ict|information)\s+supply\s+chain\b/i.test(input) && /\b(risk|breach|fail|unauthorized|without\s+agreement|missing|gap)\b/i.test(input))
                return true;
            if (/\bsupplier\s+isms\s+(certification|attestation)\b/i.test(input))
                return true;
            if (/\bcritical\s+supplier\s+(change|notify)\b/i.test(input))
                return true;
            if (/\bsubcontractor\s+(failed|review|risk|access[\s-]control)\b/i.test(input))
                return true;
            if (/\ba\.5\.(?:19|2[0-2])\b/i.test(input))
                return true;
            // BROADENED (F-NEW-CLASSIFIER-FIRE-RATE-FRAMEWORK-2026-05-24): catch natural-language
            // descriptions of vendor access without a formal agreement, a common ISO 27001 audit finding.
            if (/\b(third[\s-]?party|vendor|supplier)\b/i.test(input) && /\bwithout\s+(a\s+)?(signed\s+)?(access|security|information\s+security)\s+(agreement|contract|policy)\b/i.test(input))
                return true;
            if (/\bsubcontractor\s+(failed|breach|notif)/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * ACCESS_CONTROL_ISSUE — NEW (F-NEW-CLASSIFIER-FIRE-RATE-FRAMEWORK-2026-05-24)
     * Catches natural-language LLM output describing access control violations
     * that the original ISMS_INCIDENT and CREDENTIALS classifiers did not cover.
     * Maps to ISO 27001:2022 Annex A controls A.5.15-A.5.18 + A.8.2-A.8.6.
     */
    ACCESS_CONTROL_ISSUE: {
        references: [
            'ISO 27001:2022 A.5.15 -- Access control policy',
            'ISO 27001:2022 A.5.18 -- Access rights',
            'ISO 27001:2022 A.8.2 -- Privileged access rights',
            'ISO 27001:2022 A.8.3 -- Information access restriction',
        ],
        classifier: (input) => {
            // Privileged access granted without formal approval (common audit finding)
            if (/\bprivileged\s+access\s+granted\b/i.test(input) && /\bwithout\s+(formal\s+)?(approval|justification|authoriz)/i.test(input))
                return true;
            // Access without approval / access without authorization
            if (/\baccess\s+(granted\s+)?without\s+(formal\s+)?(approval|authoriz|documented\s+justification)\b/i.test(input))
                return true;
            // Accessing without access rights / no access rights
            if (/\baccessing\s+\w+\s+(environment|system|server|database)\s+without\s+(a\s+)?(signed\s+)?(access\s+)?(agreement|right|grant)\b/i.test(input))
                return true;
            // No time limit set on access grant
            if (/\bno\s+termination\s+date\s+set\b/i.test(input) && /\baccess\b/i.test(input))
                return true;
            // Access review overdue / not performed
            if (/\baccess\s+review\s+(overdue|not\s+performed|not\s+completed|outstanding)\b/i.test(input))
                return true;
            // Segregation of duties violation
            if (/\bsegregation\s+of\s+duties\s+(violated|missing|not\s+enforced)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * ENCRYPTION_GAP — NEW (F-NEW-CLASSIFIER-FIRE-RATE-FRAMEWORK-2026-05-24)
     * Catches natural-language descriptions of missing encryption, a direct
     * violation of ISO 27001:2022 A.8.24 (Use of Cryptography), A.8.11 (Data
     * masking), and A.8.12 (Data leakage prevention).
     */
    ENCRYPTION_GAP: {
        references: [
            'ISO 27001:2022 A.8.24 -- Use of Cryptography',
            'ISO 27001:2022 A.8.11 -- Data masking',
            'ISO 27001:2022 A.8.12 -- Data leakage prevention',
        ],
        classifier: (input) => {
            // Unencrypted data/backup/storage
            if (/\bunencrypted\s+(backup|data|storage|media|tape|disk|drive|database|file)\b/i.test(input))
                return true;
            // Data traversing untrusted networks without encryption
            if (/\bunencrypted\s+(customer\s+)?data\s+(traversing|sent\s+(over|across|via)|transmitted|transferred)\b/i.test(input))
                return true;
            // Encryption not configured / disabled
            if (/\bencryption\s+(not\s+configured|disabled|not\s+enabled|turned\s+off)\b/i.test(input))
                return true;
            // Data leakage prevention policy not configured
            if (/\bdata\s+leakage\s+prevention\s+(policy\s+)?not\s+configured\b/i.test(input))
                return true;
            // Plain-text credentials / secrets in storage
            if (/\bplain[\s-]text\s+(credentials|secrets|passwords?|key)\s+(stored|in\s+storage|in\s+database)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * VULNERABILITY_MGMT — NEW (F-NEW-CLASSIFIER-FIRE-RATE-FRAMEWORK-2026-05-24)
     * Catches natural-language descriptions of unpatched vulnerabilities and
     * vulnerability management failures. Maps to ISO 27001:2022 A.8.8
     * (Management of technical vulnerabilities, new in 2022 edition).
     */
    VULNERABILITY_MGMT: {
        references: [
            'ISO 27001:2022 A.8.8 -- Management of technical vulnerabilities (NEW 2022 control)',
        ],
        classifier: (input) => {
            // CVE/patch not applied
            if (/\b(patch|fix|update)\s+(for\s+)?CVE[-\s]\d{4}-\d{4,}\s+not\s+applied\b/i.test(input))
                return true;
            if (/\bCVE[-\s]\d{4}-\d{4,}\s+not\s+applied\b/i.test(input))
                return true;
            if (/\bcritical\s+(patch|vulnerability|CVE)\s+.{0,60}not\s+applied\b/i.test(input))
                return true;
            // Patch management SLA missed
            if (/\bpatch\s+(management\s+)?sla\s+(?:missed|violated|breached)\b/i.test(input))
                return true;
            // System remains exposed / vulnerable after patch window
            if (/\bsystem\s+remains\s+(exposed|vulnerable)\b/i.test(input) && /\b(patch|CVE|vulnerability)\b/i.test(input))
                return true;
            // Vulnerability scan overdue
            if (/\bvulnerability\s+(scan|scanning)\s+(overdue|not\s+performed|not\s+completed|outstanding)\b/i.test(input))
                return true;
            // Known exploit / exploitable
            if (/\bknown\s+exploit(able)?\s+vulnerability\b/i.test(input))
                return true;
            return false;
        },
    },
};
export const ISO27001_PACK = {
    categoryClassifiers: ISO27001_CATEGORY_CLASSIFIERS,
    id: 'iso27001',
    name: 'ISO/IEC 27001:2022',
    version: '1.0.0',
    contentHash: '6e145204a89c88e487aa02d093a40a935ec6e08cbc179f2db8b874e0bafc07c3',
    description: 'ISO/IEC 27001:2022 Information Security Management System (ISMS) compliance. 2013 edition retired Oct 2025 -- Pax1 exclusively supports 2022 edition. Covers 93 controls across 4 themes (Organizational / People / Physical / Technological) with 11 new 2022 controls.',
    authority: 'ISO/IEC + accredited certification bodies',
    industries: ['all', 'technology', 'government', 'healthcare', 'finance', 'defence', 'critical-infrastructure'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Access control policy enforcement; deny-by-default',
            reference: 'ISO 27001 A.5.15-5.18 + A.8.2-8.6 -- Access Control',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Event logging + protection of log information',
            reference: 'ISO 27001 A.8.15, A.8.17 -- Logging + Log protection',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Cryptographic controls per policy',
            reference: 'ISO 27001 A.8.24 -- Use of Cryptography',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Information classification, labelling, and handling',
            reference: 'ISO 27001 A.5.12-5.14 -- Classification / Labelling / Handling',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Authentication information management',
            reference: 'ISO 27001 A.5.17 -- Authentication Information',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Supplier relationships + ICT supply chain security',
            reference: 'ISO 27001 A.5.19-5.23 -- Supplier Relationships + ICT Supply Chain',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Monitoring activities + security event management',
            reference: 'ISO 27001 A.8.16 -- Monitoring Activities (new in 2022)',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Threat intelligence collection + analysis',
            reference: 'ISO 27001 A.5.7 -- Threat Intelligence (new in 2022)',
        },
        {
            name: 'memory-integrity',
            required: true,
            reason: 'Configuration management + integrity verification',
            reference: 'ISO 27001 A.8.9 -- Configuration Management (new in 2022)',
        },
        {
            name: 'circuit-breaker',
            required: true,
            reason: 'ICT readiness for business continuity',
            reference: 'ISO 27001 A.5.30 -- ICT Readiness (new in 2022); A.5.29 -- Business continuity',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'ISMS scope + SoA + management review + internal audit attestations',
            reference: 'ISO 27001 Clauses 4-10 (ISMS requirements)',
        },
        {
            name: 'agent-registration-integrity',
            required: true,
            reason: 'Roles and responsibilities for AI agents must be defined and resolvable before assets are operated',
            reference: 'ISO/IEC 27001:2022 Annex A 6.1.1',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: ['PII', 'PAN', 'CREDENTIALS'],
            classificationLabellingRequired: true,
        },
        'audit-integrity': {
            logProtectionRequired: true,
        },
        'anomaly-detector': {
            threatIntelligenceActive: true,
        },
        'attestation-manager': {
            ismsDocumentedRequired: true,
            statementOfApplicabilityRequired: true,
            managementReviewAnnualRequired: true,
            internalAuditAnnualRequired: true,
        },
        'supply-chain': {
            supplierSecurityAgreementRequired: true,
            ictSupplyChainSecurityRequired: true,
        },
        'governance-runtime': {
            ismsEdition: '2022', // 2013 retired
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['ISO27001', 'ISO27001-2022'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'PII', 'PAN', 'CREDENTIALS',
            'ISMS_INCIDENT', 'THREAT_INTELLIGENCE', 'SECURE_DEV', 'SUPPLIER_RISK',
            // New categories added in F-NEW-CLASSIFIER-FIRE-RATE-FRAMEWORK-2026-05-24
            'ACCESS_CONTROL_ISSUE', 'ENCRYPTION_GAP', 'VULNERABILITY_MGMT',
        ],
        categoryActions: {
            PII: 'WARN',
            PAN: 'BLOCK',
            CREDENTIALS: 'BLOCK',
            ISMS_INCIDENT: 'LOG',
            THREAT_INTELLIGENCE: 'LOG',
            SECURE_DEV: 'WARN',
            SUPPLIER_RISK: 'WARN',
            ACCESS_CONTROL_ISSUE: 'WARN',
            ENCRYPTION_GAP: 'WARN',
            VULNERABILITY_MGMT: 'WARN',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['GLOBAL'],
        auditLogRetentionDays: 1095, // 3 years default per organisational policy
        sessionRetentionDays: 365,
        incidentRetentionDays: 1095,
        reference: 'ISO 27001:2022 A.8.15 -- Log retention per organisational policy (typically 3 years; aligned with management-review cycle)',
    },
    incidentPolicy: {
        notificationDeadlineHours: 24,
        reference: 'ISO 27001:2022 A.5.24-5.28 -- Information Security Incident Management (planning / assessment / response / lessons learned / forensic evidence)',
        requiredRecipients: ['isms-manager', 'management', 'information-security-officer'],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'iso-access-control',
            description: 'Access control policy enforced (A.5.15-5.18, A.8.2-8.6)',
            reference: 'ISO 27001 A.5.15-5.18 + A.8.2-8.6',
            check: 'rbac_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iso-logging',
            description: 'Event logging with log protection (A.8.15, A.8.17)',
            reference: 'ISO 27001 A.8.15, A.8.17',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iso-encryption',
            description: 'Cryptographic controls active (A.8.24)',
            reference: 'ISO 27001 A.8.24',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso-classification',
            description: 'Information classification and labelling (A.5.12-5.14)',
            reference: 'ISO 27001 A.5.12-5.14',
            check: 'data_classifier_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso-auth',
            description: 'Authentication information managed (A.5.17)',
            reference: 'ISO 27001 A.5.17',
            check: 'agent_auth_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso-supplier',
            description: 'Supplier security + ICT supply chain (A.5.19-5.23)',
            reference: 'ISO 27001 A.5.19-5.23',
            check: 'subservice_registry_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'iso-config-mgmt',
            description: 'Configuration management (A.8.9 -- new in 2022)',
            reference: 'ISO 27001 A.8.9',
            check: 'iso_config_mgmt_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'iso-threat-intel',
            description: 'Threat intelligence (A.5.7 -- new in 2022)',
            reference: 'ISO 27001 A.5.7',
            check: 'iso_threat_intel_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'iso-monitoring',
            description: 'Monitoring activities (A.8.16 -- new in 2022)',
            reference: 'ISO 27001 A.8.16',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso-incident-mgmt',
            description: 'Information security incident management (A.5.24-5.28)',
            reference: 'ISO 27001 A.5.24-5.28',
            check: 'incident_reporting',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso-isms',
            description: 'ISMS documented with SoA + annual management review + internal audit',
            reference: 'ISO 27001 Clauses 4-10',
            check: 'iso_isms_active',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=iso27001.js.map