/**
 * NIST SP 800-82 Rev 3 Operational Technology Security Compliance Pack
 *
 * NIST Special Publication 800-82 Revision 3 (September 2023) — "Guide to
 * Operational Technology (OT) Security." US federal guide for securing OT
 * environments including Industrial Control Systems (ICS), SCADA systems,
 * Distributed Control Systems (DCS), Programmable Logic Controllers (PLC),
 * Remote Terminal Units (RTU), building automation systems (BAS), transportation
 * control systems, and Industrial Internet of Things (IIoT).
 *
 * Standards and authorities referenced (citations only; no verbatim text):
 *   - NIST SP 800-82 Rev 3 (September 2023) — Guide to OT Security
 *   - NIST SP 800-53 Rev 5 — Security and Privacy Controls (parent catalog)
 *   - NIST SP 800-30 Rev 1 — Guide for Conducting Risk Assessments
 *   - NIST SP 800-39 — Managing Information Security Risk
 *   - NIST SP 800-92 — Guide to Computer Security Log Management (retention)
 *   - FIPS 199 — Standards for Security Categorization of Federal Information
 *   - FIPS 200 — Minimum Security Requirements for Federal Systems
 *   - FISMA — Federal Information Security Modernization Act (2014)
 *   - FAR 52.204-21 / DFARS 252.204-7012 — Federal procurement OT requirements
 *   - EO 14028 (2021) — Improving the Nation's Cybersecurity
 *   - CISA OT Cybersecurity Guidance (CISA 2022, 2023)
 *   - CIRCIA — Cyber Incident Reporting for Critical Infrastructure Act (2022)
 *   - NERC CIP standards (cross-reference for electric utilities)
 *   - IEC 62443 — International OT/IACS cybersecurity counterpart
 *   - IEC 61511 — Functional safety for process industries (SIS alignment)
 *   - IEC 61508 — Functional safety of E/E/PE systems (parent SIL standard)
 *
 * Impact Level Classification (FIPS 199 + NIST SP 800-82 §4.2):
 *   Impact levels follow FIPS 199 categorization adapted for OT environments.
 *   The potential impact is assessed for confidentiality, integrity, and
 *   availability, with OT systems typically prioritising availability and
 *   integrity (safety-instrumented systems require deterministic operation).
 *
 *   | Impact | Description                                                         |
 *   |--------|---------------------------------------------------------------------|
 *   | LOW    | Limited adverse effect — minor degradation of capability            |
 *   | MOD    | Serious adverse effect — significant degradation of primary mission |
 *   | HIGH   | Severe / catastrophic — loss of life, major financial damage,       |
 *   |        | long-term environmental contamination, infrastructure failure       |
 *
 *   Default when impact level not declared: MODERATE (conservative per FIPS 199
 *   guidance and NIST SP 800-82 §4.2 — when in doubt, classify higher).
 *
 * Purdue Enterprise Reference Architecture (NIST SP 800-82 §5.5):
 *   Level 0 — Physical process (sensors, actuators, physical systems)
 *   Level 1 — Intelligent devices (PLCs, RTUs, safety systems, drives)
 *   Level 2 — Control systems (SCADA, DCS, HMI, engineering workstations)
 *   Level 3 — Manufacturing operations (MES, historian, batch management)
 *   Level 3.5 — Industrial DMZ (boundary between OT and IT — CRITICAL zone)
 *   Level 4 — Enterprise (ERP, email, business intelligence)
 *   Level 5 — External network / Internet
 *
 * Key NIST 800-53 control families mapped to OT in SP 800-82 §6:
 *   AC  — Access Control (§6.2)
 *   AU  — Audit and Accountability (§6.3)
 *   AT  — Awareness and Training (§6.4)
 *   CA  — Assessment, Authorization, and Monitoring (§6.5)
 *   CM  — Configuration Management (§6.6)
 *   CP  — Contingency Planning (§6.7)
 *   IA  — Identification and Authentication (§6.8)
 *   IR  — Incident Response (§6.10)
 *   MA  — Maintenance (§6.11)
 *   MP  — Media Protection (§6.12)
 *   PE  — Physical and Environmental Protection (§6.13)
 *   PL  — Planning (§6.14)
 *   PM  — Program Management (§6.15)
 *   PS  — Personnel Security (§6.16)
 *   RA  — Risk Assessment (§6.17)
 *   SA  — System and Services Acquisition (§6.18 — supply chain)
 *   SC  — System and Communications Protection (§6.18 — network seg.)
 *   SI  — System and Information Integrity (§6.19)
 *   SR  — Supply Chain Risk Management (§6.20)
 *
 * Safety-Instrumented Systems (SIS) per NIST SP 800-82 §5.7:
 *   SIS are designed to bring a process to a safe state when predetermined
 *   conditions are violated (IEC 61511 / IEC 61508). SIS have separate
 *   network segments and must not be modified without formal management of
 *   change. AI-generated changes to SIS are an absolute block in this pack.
 *
 * Retention:
 *   NIST SP 800-92 + FISMA records management baseline: 7 years (2555 days).
 *   DoD / CMMC context may impose longer periods; this pack uses the
 *   7-year FISMA / NIST SP 800-92 federal records baseline.
 *
 * Sister standard: IEC 62443 (international OT/IACS counterpart). The two
 * are typically run together for US-multinational customers. Use `iec-62443`
 * pack in parallel when operating in both US-federal and international contexts.
 *
 * @connexum/ai-governance
 */
import { CompliancePack } from './index';
import { CategoryClassifiers } from '../classification/pack-driven-classifier';
/**
 * NIST SP 800-82 category classifiers.
 *
 * Covers FIPS 199 impact-level declarations (LOW / MODERATE / HIGH),
 * Purdue model zone artefacts, OT cybersecurity program documents,
 * risk management records, and Safety-Instrumented System (SIS) records.
 */
export declare const NIST_SP_800_82_CATEGORY_CLASSIFIERS: CategoryClassifiers;
/**
 * NIST SP 800-82 Rev 3 Operational Technology Security Compliance Pack.
 *
 * Pack ID: 'nist-sp-800-82'
 * Jurisdiction: US federal (FISMA mandatory); widely adopted by NERC CIP
 *   (electric utilities), AWIA (water authorities), DoD industrial base
 *   (DFARS/CMMC), and federal building automation operators. Sister standard
 *   to IEC 62443 (international) — the two are typically run together for
 *   US-multinational customers.
 *
 * Guard-layer wiring:
 *   - G1-G4 (audit, logging, classification, session): always active
 *   - G5-G6 (supply-chain SR, approval-queue): MODERATE / HIGH impact
 *   - G7-G8 (attestation, anomaly-detection): HIGH impact + SIS
 *   - G9 (transparency): HIGH impact (maximum disclosure burden)
 *   - Approval Queue: always active (HIGH immediate; MODERATE closure)
 *
 * Human-in-loop tier:
 *   - T1: LOW / MODERATE (OT security engineer review)
 *   - T2: HIGH / SIS (NIST RMF Authorizing Official + CISSP-ICSE certified)
 */
export declare const NIST_SP_800_82_PACK: CompliancePack & {
    categoryClassifiers: CategoryClassifiers;
    subjectKeyedCategories: string[];
};
//# sourceMappingURL=nist-sp-800-82.d.ts.map