"use strict";
/**
 * AU Security of Critical Infrastructure Act 2018 — 11 Sectors + CIRMP
 *
 * Primary statute: Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act),
 * as amended by Security Legislation Amendment (Critical Infrastructure) Act 2021
 * and Security Legislation Amendment (Critical Infrastructure Protection) Act 2022.
 *
 * 11 critical sectors: Communications; Data storage and processing; Defence
 * industry; Education and research; Energy; Financial services and markets; Food
 * and grocery; Health care and medical; Space technology; Transport; Water and
 * sewage.
 *
 * AI relevance: AI systems that are critical infrastructure assets (e.g., data
 * storage/processing sector) or used to operate critical infrastructure assets
 * are within scope. CIRMP must include AI-specific hazards: model failure,
 * adversarial compromise, AI vendor dependency.
 *
 * Key obligations:
 *   - Asset registration on the Register maintained by Secretary of Home Affairs.
 *   - CIRMP (Part 2A): All-hazards risk programme; Board-approved annually;
 *     annual report to Secretary.
 *   - 12-hour report (s.30BC): Significant-impact cyber incidents reported to
 *     ASD within 12 hours of awareness.
 *   - 72-hour report (s.30BG): Relevant-impact incidents within 72 hours.
 *   - SoNS (Part 2B): Enhanced obligations for Systems of National Significance.
 *   - Government assistance (Part 3A): ASD may compel assistance for incidents
 *     with significant national consequence.
 *
 * Cross-pack interactions:
 *   - au-soci-act + au-cps234 + au-cps230: APRA entities operating critical
 *     infrastructure (banks, insurers) face all three regimes simultaneously.
 *     SOCI 12-hour = earliest deadline; CPS 234/230 72-hour follow.
 *   - au-soci-act + au-privacy-act: SOCI cyber incident affecting PI may
 *     simultaneously trigger NDB scheme (30-day). Two clocks run in parallel;
 *     ASD 12/72h is the harder constraint.
 *   - au-soci-act + au-aml-ctf: Financial services and markets = designated
 *     sector. Major AML system compromise (AI monitoring offline) may
 *     simultaneously trigger SOCI cyber incident notification to ASD.
 *
 * Authority: Australian Signals Directorate (ASD) / Cyber and Infrastructure
 *   Security Centre (CISC), Department of Home Affairs
 * Sovereignty: Australian Federal
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.AU_SOCI_PACK = exports.AU_SOCI_CATEGORY_CLASSIFIERS = void 0;
exports.AU_SOCI_CATEGORY_CLASSIFIERS = {
    AU_SOCI_CI_ASSET: {
        references: ['SOCI Act s.9 — critical infrastructure asset definition; registration obligation'],
        classifier: (input) => {
            if (/\b(?:critical\s+infrastructure\s+(?:asset|sector|operator)|soci\s+(?:asset|register)|responsible\s+entity.*(?:soci|critical\s+infrastructure))/i.test(input))
                return true;
            return false;
        },
    },
    AU_SOCI_DATA_ASSET: {
        references: ['SOCI Act s.12F — data storage and processing sector asset class'],
        classifier: (input) => {
            if (/\b(?:data\s+(?:storage|processing)\s+(?:asset|facility|sector)|soci.*data\s+(?:centre|infrastructure|asset)|critical\s+data\s+(?:storage|processing).*soci)/i.test(input))
                return true;
            return false;
        },
    },
    AU_SOCI_CYBER_INCIDENT: {
        references: ['SOCI Act s.30BC — 12-hour significant impact; s.30BG — 72-hour relevant impact'],
        classifier: (input) => {
            if (/\bSOCI\b.*\b(?:cyber\s+incident|critical\s+infrastructure)\b/i.test(input))
                return true;
            if (/\b(?:cyber\s+incident|critical\s+infrastructure)\b.*\bSOCI\b/i.test(input))
                return true;
            if (/\bCIRMP\b/i.test(input))
                return true;
            if (/\b(?:soci\s+cyber\s+incident|asd\s+(?:notification|notify|cyber|report).*(?:soci|critical\s+infrastructure)|significant\s+(?:cyber\s+)?impact.*(?:ci|critical\s+infrastructure))\b/i.test(input))
                return true;
            return false;
        },
    },
    AU_SOCI_CIRMP_STATUS: {
        references: ['SOCI Act Part 2A — Critical Infrastructure Risk Management Programme'],
        classifier: (input) => {
            if (/\b(?:cirmp|critical\s+infrastructure\s+risk\s+management\s+(?:programme|program|plan)|soci\s+annual\s+(?:report|review|compliance))/i.test(input))
                return true;
            return false;
        },
    },
    AU_SOCI_SONS_OBLIGATION: {
        references: ['SOCI Act Part 2B — Systems of National Significance enhanced obligations'],
        classifier: (input) => {
            if (/\b(?:sons|system[s]?\s+of\s+national\s+significance|soci.*enhanced\s+obligation|critical\s+infrastructure.*sons\s+(?:direction|designation))/i.test(input))
                return true;
            return false;
        },
    },
};
exports.AU_SOCI_PACK = {
    categoryClassifiers: exports.AU_SOCI_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: SOCI categories are entity/asset/incident-level (not subject-keyed).
     * The framework governs critical infrastructure operators at an organisational
     * level. No subject-keyed categories.
     */
    subjectKeyedCategories: [],
    id: 'au-soci-act',
    name: 'AU Security of Critical Infrastructure Act 2018 — 11 Sectors + CIRMP',
    version: '1.0.0',
    contentHash: '2041b55ba8c97730a8ef1431ede2b5570ccbac597a902ad6ae1bd53a1f5734fe',
    description: 'SOCI Act compliance for AI systems operating as or within critical infrastructure assets across 11 designated sectors. Enforces 12-hour ASD notification for significant-impact cyber incidents (s.30BC), 72-hour notification for relevant-impact incidents (s.30BG), annual CIRMP with Board approval, data storage/processing asset classification, and SoNS enhanced obligations tracking (Part 2B).',
    authority: 'Australian Signals Directorate (ASD) / Cyber and Infrastructure Security Centre (CISC)',
    industries: [
        'energy', 'water', 'banking', 'communications', 'transport',
        'healthcare', 'food', 'defence', 'education', 'space',
        'data-infrastructure',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: '12-hour ASD notification gate for significant-impact incidents; CIRMP Board-approval enforcement; SoNS direction compliance',
            reference: 'SOCI Act s.30BC (12h); s.30BG (72h); Part 2A (CIRMP); Part 2B (SoNS)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: '7-year retention for CIRMP versions, incident reports, annual compliance reports, SoNS exercise records',
            reference: 'SOCI Act Part 2A (annual compliance reports); s.30BC/30BG (incident records)',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify CI assets, data storage/processing assets, cyber incidents, CIRMP status, SoNS obligations',
            reference: 'SOCI Act Part 2A; s.30BC; s.12F (data sector)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: '12-hour and 72-hour ASD notification workflows; data asset classification approval; SoNS direction response',
            reference: 'SOCI Act s.30BC; s.30BG; Part 2B',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Cyber incident event stream with 12-hour/72-hour timer; CIRMP-annual-review-due events; SoNS direction events',
            reference: 'SOCI Act s.30BC; s.30BG; Part 2A',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'AU_SOCI_CI_ASSET',
                'AU_SOCI_DATA_ASSET',
                'AU_SOCI_CYBER_INCIDENT',
                'AU_SOCI_CIRMP_STATUS',
                'AU_SOCI_SONS_OBLIGATION',
            ],
            sociIncident12hrEnabled: true,
            sociIncident72hrEnabled: true,
            cirmpAnnualReviewRequired: true,
            dataAssetApprovalRequired: true,
            sonsDirectionTrackingEnabled: true,
        },
        'governance-runtime': {
            sociIncident12hrEnabled: true,
            sociIncident72hrEnabled: true,
            cirmpAnnualReviewRequired: true,
            dataAssetApprovalRequired: true,
            sonsDirectionTrackingEnabled: true,
        },
        'approval-queue': {
            asd12hNotificationRequired: true,
            asd72hNotificationRequired: true,
            sonsDirectionApprovalRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [
            'SOCI-CIRMP-DOCUMENTED',
            'ASD-NOTIFICATION-CAPABLE',
            'CYBER-INCIDENT-RESPONSE-TESTED',
        ],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'AU_SOCI_CI_ASSET',
            'AU_SOCI_DATA_ASSET',
            'AU_SOCI_CYBER_INCIDENT',
            'AU_SOCI_CIRMP_STATUS',
            'AU_SOCI_SONS_OBLIGATION',
        ],
        categoryActions: {
            AU_SOCI_CI_ASSET: 'LOG',
            AU_SOCI_DATA_ASSET: 'REQUIRE_APPROVAL',
            AU_SOCI_CYBER_INCIDENT: 'REQUIRE_APPROVAL',
            AU_SOCI_CIRMP_STATUS: 'WARN',
            AU_SOCI_SONS_OBLIGATION: 'REQUIRE_APPROVAL',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        sovereignty: ['AU'],
        auditLogRetentionDays: 2555, // 7 years
        sessionRetentionDays: 2555,
        incidentRetentionDays: 2555,
        reference: 'SOCI Act Part 2A (CIRMP 7y); s.30BC/30BG (incident reports 7y); annual compliance reports 7y',
    },
    incidentPolicy: {
        notificationDeadlineHours: 12, // s.30BC: 12-hour clock for significant-impact incidents (hardest constraint)
        reference: 'SOCI Act s.30BC — 12 hours for significant-impact cyber incident to ASD; s.30BG — 72 hours for relevant-impact',
        requiredRecipients: ['asd', 'cisc', 'board'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'au-soci-incident-12hr',
            description: 'ASD notified within 12 hours of awareness of significant-impact cyber incident on critical infrastructure',
            reference: 'SOCI Act s.30BC',
            check: 'au_soci_incident_12hr_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-soci-incident-72hr',
            description: 'ASD notified within 72 hours of awareness of relevant-impact cyber incident',
            reference: 'SOCI Act s.30BG',
            check: 'au_soci_incident_72hr_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-soci-sons-direction',
            description: 'SoNS government directions tracked, actioned, and documented',
            reference: 'SOCI Act Part 2B',
            check: 'au_soci_sons_direction_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-soci-cirmp-annual',
            description: 'CIRMP reviewed, Board-approved annually, and submitted to Secretary',
            reference: 'SOCI Act Part 2A',
            check: 'au_soci_cirmp_annual_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-soci-data-asset-gate',
            description: 'Data storage and processing assets classified and approved for CIRMP inclusion',
            reference: 'SOCI Act Part 2A; s.12F',
            check: 'au_soci_data_asset_gate_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=au-soci-act.js.map