/**
 * ISO 27001 per-framework narrative prompt context.
 *
 * Declares section headings, evidence-linkage requirements, and required
 * control mappings for ISO/IEC 27001:2022 compliance narratives.
 *
 * References:
 *   ISO/IEC 27001:2022 -- Information Security Management Systems (ISMS)
 *   ISO/IEC 27002:2022 -- Security controls guidance
 *   ISO/IEC 27005:2022 -- Information security risk management
 *
 * Spec: P4-AIR-02 AC 4-6
 *
 * @connexum/ai-governance
 */
export const ISO27001_PROMPT_SPEC = {
    frameworkId: 'iso27001',
    frameworkName: 'ISO/IEC 27001:2022',
    version: 'ISO/IEC 27001:2022 (Third edition, 2022-10)',
    sections: [
        {
            sectionId: 'iso27001-clause5-leadership',
            heading: 'Clause 5 Leadership and Commitment',
            regulatoryRef: 'ISO/IEC 27001:2022 Clause 5.1-5.3',
            requiredEventTypes: ['agent:registered', 'governance:verdict'],
            controlMappings: [
                '5.1 -- Leadership and commitment (top management sponsorship)',
                '5.2 -- Information security policy (formal policy establishment)',
                '5.3 -- Organizational roles, responsibilities, and authorities',
            ],
            citationRequirement: 'optional',
            promptGuidance: 'Document leadership and governance structure of the AI security management system. ' +
                'Describe how agent registration events reflect top-management-approved onboarding ' +
                'processes. Note the policy framework under which governance verdicts are issued. ' +
                'This section establishes the organisational context required by Clause 5.',
        },
        {
            sectionId: 'iso27001-clause6-planning',
            heading: 'Clause 6 Planning (Risk Management)',
            regulatoryRef: 'ISO/IEC 27001:2022 Clause 6.1-6.3',
            requiredEventTypes: ['governance:verdict', 'action:denied'],
            controlMappings: [
                '6.1.1 -- Actions to address risks and opportunities',
                '6.1.2 -- Information security risk assessment',
                '6.1.3 -- Information security risk treatment',
                '6.2 -- Information security objectives',
                '6.3 -- Planning of changes',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Document risk identification and treatment activities surfaced by the AI governance ' +
                'runtime. Cite governance verdict events as evidence that risk treatment controls fired. ' +
                'Cite deny-decision events where risk-based access restrictions were enforced. ' +
                'Quantify the risk treatment coverage rate (governance decisions / total agent actions). ' +
                'Address any residual risks identified in the audit window.',
        },
        {
            sectionId: 'iso27001-annex-a5-organisational',
            heading: 'Annex A.5 Organisational Controls',
            regulatoryRef: 'ISO/IEC 27001:2022 Annex A, Controls 5.1-5.37',
            requiredEventTypes: ['governance:verdict', 'approval:decided'],
            controlMappings: [
                'A.5.2 -- Information security roles and responsibilities',
                'A.5.10 -- Acceptable use of information and assets',
                'A.5.15 -- Access control policy',
                'A.5.16 -- Identity management',
                'A.5.17 -- Authentication information',
                'A.5.18 -- Access rights (least privilege, review, revocation)',
                'A.5.23 -- Information security for use of cloud services',
                'A.5.26 -- Response to information security incidents',
                'A.5.36 -- Compliance with policies and standards',
                'A.5.37 -- Documented operating procedures',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Map governance runtime controls to Annex A.5 organisational controls. ' +
                'For A.5.15-5.18 (access controls), cite governance verdicts and deny decisions. ' +
                'For A.5.26 (incident response), cite any incident events and response timelines. ' +
                'For A.5.36 (compliance), cite governance verdict events showing policy conformance rates. ' +
                'Quantify: policy violations, access control decisions, and incident response actions.',
        },
        {
            sectionId: 'iso27001-annex-a8-technological',
            heading: 'Annex A.8 Technological Controls',
            regulatoryRef: 'ISO/IEC 27001:2022 Annex A, Controls 8.1-8.34',
            requiredEventTypes: ['governance:verdict', 'action:denied'],
            controlMappings: [
                'A.8.2 -- Privileged access rights management',
                'A.8.3 -- Information access restriction',
                'A.8.4 -- Access to source code',
                'A.8.5 -- Secure authentication',
                'A.8.9 -- Configuration management',
                'A.8.15 -- Logging (audit logs generation and protection)',
                'A.8.16 -- Monitoring activities',
                'A.8.17 -- Clock synchronisation',
                'A.8.24 -- Use of cryptography',
                'A.8.25 -- Secure development lifecycle',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Document technological controls active in the AI governance platform. ' +
                'For A.8.15 (logging), describe audit chain completeness and tamper-resistance. ' +
                'For A.8.16 (monitoring), cite anomaly detection and circuit-breaker events. ' +
                'For A.8.24 (cryptography), note SHA-256 chain integrity and transport encryption. ' +
                'For A.8.2-8.5 (access), cite deny events as evidence of privilege enforcement. ' +
                'Provide quantified coverage metrics for each relevant sub-control.',
        },
    ],
};
//# sourceMappingURL=iso27001.js.map