/**
 * AU APRA CPS 230 — Operational Risk Management (effective July 2025)
 *
 * Primary instrument: Prudential Standard CPS 230 Operational Risk Management
 * (effective 1 July 2025). Replaces and consolidates CPS/SPS/HPS 231
 * (Outsourcing), 232 (BCM), and elements of operational risk guidance.
 *
 * Entities covered: All APRA-regulated entities: ADIs, general/life/private
 * health insurers, RSE licensees. Foreign branches included.
 *
 * AI relevance: AI systems supporting critical operations (payments,
 * underwriting, claims, advice) are material to operational resilience.
 * Model failures, adversarial manipulation, AI vendor outages = operational
 * risks within scope. Third-party AI vendors managing critical operations =
 * material service providers requiring full Para 41-56 treatment.
 *
 * Key AI obligations:
 *   - Para 33-40: Maximum Tolerable Disruption Time (MTDT) set for critical
 *     operations; AI supporting critical operations inherits tolerances.
 *   - Para 41-56: Material service provider register; pre-onboarding due
 *     diligence; contracts with APRA access rights, step-in rights, notification,
 *     subcontracting controls, termination rights; exit strategy per provider.
 *   - Para 57-68: BCPs address AI vendor failure scenarios; annual BCP testing.
 *   - Para 69-77: 72-hour APRA notification for material operational incidents;
 *     post-incident review within 10 business days.
 *
 * Cross-pack interactions:
 *   - au-cps230 + au-cps234: Complementary. CPS 234 = information security;
 *     CPS 230 = operational resilience + service providers + business continuity.
 *     Both required. CPS 230 service-provider register integrates with CPS 234
 *     third-party controls.
 *   - au-cps230 + au-soci-act: APRA entities that are SOCI critical infrastructure
 *     operators face parallel obligations. SOCI all-hazards risk programme aligns
 *     with CPS 230 framework; both apply independently.
 *   - au-cps230 + au-aml-ctf: AI AML system failure = operational incident
 *     triggering CPS 230 APRA notification in parallel with AUSTRAC reporting.
 *
 * Authority: Australian Prudential Regulation Authority (APRA)
 * Sovereignty: Australian Federal (APRA-regulated entities)
 *
 * @connexum/ai-governance
 */
export const AU_CPS230_CATEGORY_CLASSIFIERS = {
    AU_CPS230_CRITICAL_OP: {
        references: ['CPS 230 Para 33-40 — critical operations identification and MTDT'],
        classifier: (input) => {
            if (/\b(?:critical\s+operation.*(?:ai|apra|are)|ai.*(?:critical\s+operation|mtdt|tolerable\s+disruption)|ai\s+(?:payments|underwriting|claims|advice).*critical)/i.test(input))
                return true;
            return false;
        },
    },
    AU_CPS230_MATERIAL_PROVIDER: {
        references: ['CPS 230 Para 41-56 — material service provider obligations'],
        classifier: (input) => {
            if (/\b(?:material\s+(?:service\s+)?provider.*(?:cps\s*230|apra|are)|ai\s+vendor.*(?:material|step[_\-\s]?in|exit\s+strategy)|cps\s*230.*(?:due\s+diligence|service\s+provider))/i.test(input))
                return true;
            return false;
        },
    },
    AU_CPS230_OP_INCIDENT: {
        references: ['CPS 230 Para 69-77 — operational incident notification and post-incident review'],
        classifier: (input) => {
            if (/\b(?:cps\s*230\s+(?:incident|operational\s+risk\s+event)|operational\s+(?:risk\s+)?incident.*(?:apra|cps\s*230|are)|apra.*operational\s+incident)/i.test(input))
                return true;
            return false;
        },
    },
    AU_CPS230_BCP_TESTED: {
        references: ['CPS 230 Para 57-68 — business continuity planning and annual testing'],
        classifier: (input) => {
            if (/\b(?:bcp.*(?:ai\s+vendor|cps\s*230)|business\s+continuity.*(?:ai\s+(?:failure|outage|vendor)|cps\s*230)|cps\s*230.*bcp)/i.test(input))
                return true;
            return false;
        },
    },
    AU_CPS230_PROVIDER_CONTRACT: {
        references: ['CPS 230 Para 41-56 — material service provider contract completeness'],
        classifier: (input) => {
            if (/\b(?:(?:step[_\-\s]?in\s+rights|apra\s+access\s+rights|exit\s+(?:strategy|clause)|subcontracting\s+controls).*(?:ai|cps\s*230|are)|cps\s*230.*contract.*(?:apra|step[_\-\s]?in))/i.test(input))
                return true;
            return false;
        },
    },
};
export const AU_CPS230_PACK = {
    categoryClassifiers: AU_CPS230_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: CPS 230 categories are primarily operational/system-level, not
     * subject-keyed. The framework governs entity-level operational risks
     * rather than individual data subjects. No subject-keyed categories.
     */
    subjectKeyedCategories: [],
    id: 'au-cps230',
    name: 'AU APRA CPS 230 — Operational Risk Management (effective July 2025)',
    version: '1.0.0',
    contentHash: '01320073ea1c9652a310d9288142d9d3b4a222d5b879ead1aca1ffeaae7ee71a',
    description: 'APRA CPS 230 compliance for AI systems deployed as or supporting critical operations of APRA-regulated entities. Enforces material service provider due diligence (Para 41-56), contract completeness checks (APRA access rights, step-in, exit strategy), 72-hour APRA notification for operational incidents (Para 69-77), 10-business-day post-incident review, and annual BCP testing for AI-vendor-failure scenarios (Para 57-68).',
    authority: 'Australian Prudential Regulation Authority (APRA)',
    industries: [
        'banking', 'insurance', 'superannuation',
        'fintech', 'non-bank-lending',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Board-approved operational risk framework (Para 20-32); critical operation MTDT enforcement; 72-hour incident notification gate',
            reference: 'CPS 230 Para 20-32, Para 33-40, Para 69-77',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: '7-year retention for incident records, service provider register, BCP test records, due diligence records',
            reference: 'CPS 230 Para 69-77 (incident records 7y); Para 41-56 (provider records)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Material service provider register; pre-engagement due diligence; contract completeness check (APRA access, step-in, exit, subcontracting); continuous monitoring',
            reference: 'CPS 230 Para 41-56',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: '72-hour APRA operational incident notification; material provider engagement approval; BCP test approval',
            reference: 'CPS 230 Para 41-56, Para 69-77',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Operational incident event stream; critical-operation disruption events; BCP-test-due events',
            reference: 'CPS 230 Para 69-77',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify AU_CPS230_CRITICAL_OP, AU_CPS230_MATERIAL_PROVIDER, AU_CPS230_OP_INCIDENT, AU_CPS230_BCP_TESTED, AU_CPS230_PROVIDER_CONTRACT categories; detect operational risk and critical-operation governance issues in APRA-regulated entity outputs',
            reference: 'CPS 230 Para 33-40 (critical operations); Para 41-56 (material providers); Para 69-77 (incident management)',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'AU_CPS230_CRITICAL_OP',
                'AU_CPS230_MATERIAL_PROVIDER',
                'AU_CPS230_OP_INCIDENT',
                'AU_CPS230_BCP_TESTED',
                'AU_CPS230_PROVIDER_CONTRACT',
            ],
            apraOpIncidentNotify72hr: true,
            materialProviderDueDiligenceRequired: true,
            providerContractCheckEnabled: true,
            bcpAnnualTestRequired: true,
            criticalOpAiRegisterRequired: true,
            postIncidentReviewSla: 10,
        },
        'governance-runtime': {
            apraOpIncidentNotify72hr: true,
            materialProviderDueDiligenceRequired: true,
            providerContractCheckEnabled: true,
            bcpAnnualTestRequired: true,
            criticalOpAiRegisterRequired: true,
            postIncidentReviewSla: 10,
        },
        'supply-chain': {
            preEngagementDueDiligenceRequired: true,
            apraAccessRightsRequired: true,
            stepInRightsRequired: true,
            exitStrategyRequired: true,
            subcontractingControlsRequired: true,
            continuousMonitoringRequired: true,
        },
        'approval-queue': {
            apra72hNotificationWorkflowRequired: true,
            materialProviderApprovalRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [
            'APRA-ACCESS-RIGHTS-IN-CONTRACT',
            'STEP-IN-RIGHTS-IN-CONTRACT',
            'EXIT-STRATEGY-DOCUMENTED',
            'BCP-TESTED-ANNUALLY',
        ],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'AU_CPS230_CRITICAL_OP',
            'AU_CPS230_MATERIAL_PROVIDER',
            'AU_CPS230_OP_INCIDENT',
            'AU_CPS230_BCP_TESTED',
            'AU_CPS230_PROVIDER_CONTRACT',
        ],
        categoryActions: {
            AU_CPS230_CRITICAL_OP: 'REQUIRE_APPROVAL',
            AU_CPS230_MATERIAL_PROVIDER: 'REQUIRE_APPROVAL',
            AU_CPS230_OP_INCIDENT: 'REQUIRE_APPROVAL',
            AU_CPS230_BCP_TESTED: 'WARN',
            AU_CPS230_PROVIDER_CONTRACT: 'WARN',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'INTERNAL',
    },
    retentionPolicy: {
        sovereignty: ['AU'],
        auditLogRetentionDays: 2555, // 7 years
        sessionRetentionDays: 2555,
        incidentRetentionDays: 2555,
        reference: 'CPS 230 Para 69-77 (incident records 7y); Para 41-56 (provider register 7y); BCP test records (7y)',
    },
    incidentPolicy: {
        notificationDeadlineHours: 72, // Para 69-77: 72 hours for material operational incidents
        reference: 'CPS 230 Para 69-77 — APRA notification within 72 hours of material operational incident',
        requiredRecipients: ['apra', 'board', 'cro'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'au-cps230-incident-72hr',
            description: 'APRA notified within 72 hours of material operational incident',
            reference: 'CPS 230 Para 69-77',
            check: 'au_cps230_incident_72hr_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-cps230-provider-due-diligence',
            description: 'Material AI vendor due diligence completed before engagement',
            reference: 'CPS 230 Para 41-56',
            check: 'au_cps230_provider_due_diligence_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-cps230-contract-completeness',
            description: 'Provider contracts include APRA access rights, step-in rights, and exit strategy',
            reference: 'CPS 230 Para 41-56',
            check: 'au_cps230_contract_completeness_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-cps230-bcp-annual-test',
            description: 'Business continuity plan tested annually for AI-dependent and AI-vendor-failure scenarios',
            reference: 'CPS 230 Para 57-68',
            check: 'au_cps230_bcp_annual_test_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-cps230-critical-op-register',
            description: 'AI systems supporting critical operations registered with MTDT defined',
            reference: 'CPS 230 Para 33-40',
            check: 'au_cps230_critical_op_register_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-cps230-post-incident-review',
            description: 'Post-incident review completed within 10 business days',
            reference: 'CPS 230 Para 69-77',
            check: 'au_cps230_post_incident_review_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=au-cps230.js.map