"use strict";
/**
 * NIST SP 800-53 Compliance Pack
 *
 * Framework: NIST Special Publication 800-53 Revision 5 (Sept 2020,
 *   updates ongoing) — Security and Privacy Controls for Information
 *   Systems and Organizations. The US federal control catalog
 *   underpinning FedRAMP, FISMA, RMF (NIST 800-37), and many sectoral
 *   frameworks.
 *
 * Jurisdiction: US federal mandate (FISMA + OMB Circular A-130);
 *   widely adopted globally as a control reference.
 * Authority: NIST + Office of Management and Budget (OMB) +
 *   FedRAMP PMO (cloud-specific overlay)
 *
 * 20 control families (SP 800-53 Rev. 5):
 *   AC (Access Control), AT (Awareness + Training), AU (Audit +
 *   Accountability), CA (Assessment, Authorization + Monitoring),
 *   CM (Configuration Management), CP (Contingency Planning),
 *   IA (Identification + Authentication), IR (Incident Response),
 *   MA (Maintenance), MP (Media Protection), PE (Physical +
 *   Environmental), PL (Planning), PM (Program Management),
 *   PS (Personnel Security), PT (PII Processing + Transparency),
 *   RA (Risk Assessment), SA (System + Services Acquisition),
 *   SC (System + Communications Protection), SI (System + Information
 *   Integrity), SR (Supply Chain Risk Management).
 *
 * Baselines (FIPS 199 impact):
 *   - LOW (~149 controls)
 *   - MODERATE (~261 controls)
 *   - HIGH (~318 controls)
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.NIST_800_53_PACK = exports.NIST_800_53_CATEGORY_CLASSIFIERS = void 0;
exports.NIST_800_53_CATEGORY_CLASSIFIERS = {
    CONTROL_FAMILY_EVIDENCE: {
        references: ['NIST SP 800-53 Rev. 5 — 20 control families'],
        classifier: (i) => /\b(?:800[\s-]?53\s+(?:control|family)|800-53|nist\s+(?:ac|au|ca|cm|cp|ia|ir|ma|mp|pe|pl|pm|ps|pt|ra|sa|sc|si|sr|at)[\s-]?\d{1,2})\b/i.test(i),
    },
    AUTHORIZATION_PACKAGE: {
        references: ['NIST 800-37 RMF — System Security Plan + Authorization to Operate'],
        classifier: (i) => /\b(?:ssp\s+800-53|authorization\s+to\s+operate|ato\s+package|authorization\s+package\s+800-53|sar\s+800-53)\b/i.test(i),
    },
    CONTINUOUS_MONITORING: {
        references: ['NIST 800-53 CA-7 continuous monitoring'],
        classifier: (i) => /\b(?:ca-7\s+continuous\s+monitoring|conmon\s+800-53|continuous\s+monitoring\s+strategy)\b/i.test(i),
    },
    POAM: {
        references: ['NIST 800-53 CA-5 Plan of Action and Milestones'],
        classifier: (i) => /\b(?:po(?:a|am|am&m)|plan\s+of\s+action\s+(?:and\s+)?milestones|ca-5\s+poam)\b/i.test(i),
    },
    BASELINE_DESIGNATION: {
        references: ['FIPS 199 + NIST 800-53 baseline (LOW / MODERATE / HIGH)'],
        classifier: (i) => /\b(?:fips\s+199|800-53\s+(?:low|moderate|high)\s+baseline|impact\s+level\s+(?:low|moderate|high))\b/i.test(i),
    },
    CREDENTIALS: {
        references: ['NIST 800-53 IA-5 authenticator management'],
        classifier: (i) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(i))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(i))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(i))
                return true;
            return false;
        },
    },
};
exports.NIST_800_53_PACK = {
    categoryClassifiers: exports.NIST_800_53_CATEGORY_CLASSIFIERS,
    id: 'nist-800-53',
    aliases: ['nist-sp-800-53', 'sp-800-53', '800-53', 'nist-800-53-rev5'],
    name: 'NIST SP 800-53 Rev. 5 — Security and Privacy Controls',
    version: '1.0.0',
    contentHash: 'c59e0f7c091350fc9d9cc40efd553587a776254ae4e15c5ebcb6ed2c4fa10b2f',
    description: 'NIST Special Publication 800-53 Revision 5 — Security and Privacy Controls for Information Systems and Organizations. 20 control families across LOW / MODERATE / HIGH baselines (FIPS 199 impact). The US federal control catalog underpinning FedRAMP, FISMA, RMF (NIST 800-37), and widely adopted globally. Pairs with `nist-csf` (framework), `fedramp`, `stateramp`, `cmmc2`, `fisma` (when added).',
    authority: 'NIST + OMB + FedRAMP PMO',
    industries: ['public-sector', 'cloud-infrastructure', 'defense', 'financial-services', 'healthcare', 'critical-national-infrastructure'],
    requiredModules: [
        { name: 'attestation-manager', required: true, reason: 'Baseline designation (LOW/MODERATE/HIGH); System Security Plan; Authorization to Operate; per-control-family evidence; POA&M tracked.', reference: 'NIST 800-37 RMF + 800-53 control inheritance' },
        { name: 'governance-runtime', required: true, reason: 'AC family default-deny on uncovered access; CM family configuration baseline gate; SI integrity gate.', reference: 'NIST 800-53 AC + CM + SI families' },
        { name: 'audit-integrity', required: true, reason: 'AU family audit + accountability tamper-evident chain; required for ATO + assessor evidence.', reference: 'NIST 800-53 AU family' },
        { name: 'event-bus', required: true, reason: 'IR family incident response routing; CA-7 continuous monitoring telemetry; SI-4 system monitoring.', reference: 'NIST 800-53 IR + CA + SI' },
        { name: 'data-classifier', required: true, reason: 'Surface 800-53 evidence categories across the 20 families.', reference: 'NIST 800-53 evidence categorisation' },
        { name: 'agent-auth', required: true, reason: 'IA family identity + authenticator management; AC family access enforcement.', reference: 'NIST 800-53 IA + AC families' },
        { name: 'encryption-layer', required: true, reason: 'SC family system + communications protection; cryptographic agility.', reference: 'NIST 800-53 SC family' },
        { name: 'session-persistence', required: true, reason: '800-53 evidence retained per CA-2 assessment cycle (typically 3 years between full assessments) plus FedRAMP-specific overlays.', reference: 'NIST 800-53 CA-2; FedRAMP retention' },
        { name: 'supply-chain', required: true, reason: 'SR family supply-chain risk management; SR-2 SCRM plan.', reference: 'NIST 800-53 SR family (new in Rev. 5)' },
        { name: 'approval-queue', required: true, reason: 'CA-6 authorization decisions routed for AO sign-off; CM-3 configuration change approvals; PM-3 risk-management approvals.', reference: 'NIST 800-53 CA-6 + CM-3 + PM-3' },
    ],
    moduleConfig: {
        'attestation-manager': { baselineDesignationTracked: true, sspTracked: true, atoTracked: true, perFamilyEvidenceTracked: true, poamTracked: true },
        'governance-runtime': { acDefaultDenyRequired: true, cmConfigBaselineGateRequired: true, siIntegrityGateRequired: true },
        'audit-integrity': { auFamilyTamperEvidentRequired: true },
        'event-bus': { irRoutingRequired: true, conmonRequired: true, si4MonitoringRequired: true },
        'data-classifier': { enabledCategories: ['CONTROL_FAMILY_EVIDENCE', 'AUTHORIZATION_PACKAGE', 'CONTINUOUS_MONITORING', 'POAM', 'BASELINE_DESIGNATION', 'CREDENTIALS'], credentialsAction: 'BLOCK' },
        'agent-auth': { iaAuthenticatorMgmtRequired: true, acAccessEnforcementRequired: true },
        'encryption-layer': { algorithm: 'aes-256-gcm', scProtectionRequired: true },
        'session-persistence': { retentionDaysMinimum: 1095 },
        'supply-chain': { srScrmPlanRequired: true },
        'approval-queue': { reviewTier: 'T2' },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['NIST-800-53-COMPATIBLE', 'FEDRAMP-CAPABLE'],
        blockReasons: { deepseek: 'PRC jurisdiction. NIST 800-53 SR family supply-chain risk management excludes PRC routing for federal systems.', baidu: 'PRC jurisdiction.', alibaba: 'PRC jurisdiction.' },
    },
    dataPolicy: {
        scanCategories: ['CONTROL_FAMILY_EVIDENCE', 'AUTHORIZATION_PACKAGE', 'CONTINUOUS_MONITORING', 'POAM', 'BASELINE_DESIGNATION', 'CREDENTIALS'],
        categoryActions: { CONTROL_FAMILY_EVIDENCE: 'WARN', AUTHORIZATION_PACKAGE: 'WARN', CONTINUOUS_MONITORING: 'WARN', POAM: 'WARN', BASELINE_DESIGNATION: 'WARN', CREDENTIALS: 'BLOCK' },
        encryptionRequired: true, encryptionStandard: 'AES-256-GCM', minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: { auditLogRetentionDays: 1095, sessionRetentionDays: 1095, incidentRetentionDays: 2190, reference: 'NIST 800-53 CA-2 assessment cycle + FedRAMP retention', forceDelete: false, requiresLegalHoldSupport: true, sovereignty: ['us'] },
    incidentPolicy: { notificationDeadlineHours: 1, reference: 'NIST 800-53 IR-6 incident reporting; US-CERT 1-hour notification for federal systems', requiredRecipients: ['us-cert', 'authorizing-official', 'iso', 'sca'], formalNotificationRequired: true },
    validators: [
        { id: 'nist-800-53-baseline-designation', description: 'FIPS 199 impact (LOW / MODERATE / HIGH) designated; baseline control set instantiated.', reference: 'FIPS 199 + 800-53 baselines', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'nist-800-53-ssp-current', description: 'System Security Plan current; per-control implementation captured.', reference: 'NIST 800-37 RMF', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'nist-800-53-ato-active', description: 'Authorization to Operate active and within validity window.', reference: 'NIST 800-37 ATO', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'nist-800-53-conmon', description: 'CA-7 continuous monitoring strategy active; monthly + annual assessment cadence.', reference: 'NIST 800-53 CA-7', check: 'monitoring_active', failSeverity: 'CRITICAL' },
        { id: 'nist-800-53-poam', description: 'Plan of Action and Milestones current; remediation owners + due dates tracked.', reference: 'NIST 800-53 CA-5', check: 'attestation_active', failSeverity: 'HIGH' },
        { id: 'nist-800-53-incident-1h', description: 'IR-6 incident reporting wired; US-CERT 1-hour notification path active for federal systems.', reference: 'NIST 800-53 IR-6', check: 'monitoring_active', failSeverity: 'CRITICAL' },
        { id: 'nist-800-53-supply-chain', description: 'SR family SCRM plan + sub-supplier attestation captured (new in Rev. 5).', reference: 'NIST 800-53 SR family', check: 'subservice_registry_active', failSeverity: 'HIGH' },
        { id: 'nist-800-53-encryption', description: 'SC family encryption controls active; FIPS 140-3 validated cryptography.', reference: 'NIST 800-53 SC + FIPS 140-3', check: 'encryption_active', failSeverity: 'HIGH' },
        { id: 'nist-800-53-audit-trail', description: 'AU family tamper-evident audit chain active.', reference: 'NIST 800-53 AU family', check: 'audit_trail_exists', failSeverity: 'CRITICAL' },
        { id: 'nist-800-53-credential-block', description: 'Plaintext credentials blocked per IA-5 authenticator management.', reference: 'NIST 800-53 IA-5', check: 'data_classifier_active', failSeverity: 'CRITICAL' },
    ],
};
//# sourceMappingURL=nist-800-53.js.map