// SPDX-License-Identifier: Apache-2.0
// Copyright 2024-2026 Vorion LLC
// =============================================================================
// NIS2 ENTITY AND SECTOR TYPES
// =============================================================================
/**
 * NIS2 entity types as defined in Annex I (essential) and Annex II (important).
 *
 * - `essential`: Entities in sectors of high criticality (Annex I) subject to
 *   comprehensive supervisory regime under Art 32.
 * - `important`: Entities in other critical sectors (Annex II) subject to
 *   lighter-touch supervisory regime under Art 33.
 */
export const NIS2_ENTITY_TYPES = ['essential', 'important'];
/**
 * Sectors covered by the NIS2 Directive as defined in Annexes I and II.
 *
 * Annex I (essential entity sectors): energy, transport, banking, health,
 * water, digital_infrastructure, ICT_service_management, public_admin, space.
 *
 * Annex II (important entity sectors): postal, waste, chemicals, food,
 * manufacturing, digital_providers, research.
 */
export const NIS2_SECTORS = [
    'energy',
    'transport',
    'banking',
    'health',
    'water',
    'digital_infrastructure',
    'ICT_service_management',
    'public_admin',
    'space',
    'postal',
    'waste',
    'chemicals',
    'food',
    'manufacturing',
    'digital_providers',
    'research',
];
/**
 * Sectors classified under each entity type per NIS2 Annexes I and II.
 */
const ESSENTIAL_SECTORS = [
    'energy',
    'transport',
    'banking',
    'health',
    'water',
    'digital_infrastructure',
    'ICT_service_management',
    'public_admin',
    'space',
];
const IMPORTANT_SECTORS = [
    'postal',
    'waste',
    'chemicals',
    'food',
    'manufacturing',
    'digital_providers',
    'research',
];
// =============================================================================
// EVIDENCE COLLECTION HELPERS
// =============================================================================
/**
 * Create evidence from audit logs
 */
function createLogEvidence(id, title, description, source) {
    return {
        id,
        type: 'log',
        title,
        description,
        source,
        collectedAt: new Date(),
    };
}
/**
 * Create evidence from configuration
 */
function createConfigEvidence(id, title, description, source) {
    return {
        id,
        type: 'config',
        title,
        description,
        source,
        collectedAt: new Date(),
    };
}
/**
 * Create evidence from policy documents
 */
function createPolicyEvidence(id, title, description, source) {
    return {
        id,
        type: 'policy',
        title,
        description,
        source,
        collectedAt: new Date(),
    };
}
/**
 * Create evidence from test results
 */
function createTestEvidence(id, title, description, source) {
    return {
        id,
        type: 'test-result',
        title,
        description,
        source,
        collectedAt: new Date(),
    };
}
// =============================================================================
// ART 21 — CYBERSECURITY RISK-MANAGEMENT MEASURES
// =============================================================================
/**
 * Art 21 controls implement the 10 minimum cybersecurity risk-management
 * measures required of essential and important entities.
 */
const art21Controls = [
    // Art 21(a) — Risk analysis and information system security policies
    {
        id: 'NIS2-21.1',
        name: 'Risk Analysis and Security Policies',
        description: 'Policies on risk analysis and information system security, including identification of risks, assessment of likelihood and impact, and selection of proportionate security measures (Art 21(2)(a)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-21.1-001', 'Information Security Policy', 'Organisation-wide information security policy covering risk analysis methodology', '/policies/information-security-policy.md'),
            createPolicyEvidence('nis2-21.1-002', 'Risk Assessment Methodology', 'Documented risk assessment framework aligned with ISO 27005', '/risk/risk-assessment-methodology.md'),
        ],
        crossReferences: ['NIST-RA-3', 'NIST-RA-5', 'SOC2-CC3.2'],
        owner: 'CISO',
    },
    {
        id: 'NIS2-21.2',
        name: 'Risk Treatment Plan',
        description: 'Documented risk treatment plan with selected controls, residual risk acceptance criteria, and management approval (Art 21(2)(a)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-21.2-001', 'Risk Treatment Plan', 'Risk treatment plan with selected controls and residual risk acceptance', '/risk/risk-treatment-plan.md'),
        ],
        crossReferences: ['NIST-RA-3', 'SOC2-CC3.1'],
        owner: 'Risk Manager',
    },
    // Art 21(b) — Incident handling
    {
        id: 'NIS2-21.3',
        name: 'Incident Handling Procedures',
        description: 'Procedures for detecting, managing, and responding to cybersecurity incidents, including classification, escalation, and containment (Art 21(2)(b)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-21.3-001', 'Incident Response Plan', 'Comprehensive incident response plan with defined roles and procedures', '/security/incident-response-plan.md'),
            createLogEvidence('nis2-21.3-002', 'Incident Response Records', 'Records of incident response activities and post-incident reviews', 'Incident Management System'),
        ],
        crossReferences: ['NIST-IR-4', 'NIST-IR-6', 'NIST-IR-8', 'SOC2-CC7.4'],
        owner: 'Incident Response Manager',
    },
    {
        id: 'NIS2-21.4',
        name: 'Incident Classification and Triage',
        description: 'Classification scheme for cybersecurity incidents including severity levels, impact assessment, and triage procedures aligned with CSIRT reporting thresholds (Art 21(2)(b)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-21.4-001', 'Incident Classification Matrix', 'Incident classification matrix with severity levels and response timelines', '/security/incident-classification.md'),
        ],
        crossReferences: ['NIST-IR-4', 'NIST-IR-5', 'SOC2-CC7.3'],
        owner: 'Incident Response Manager',
    },
    // Art 21(c) — Business continuity and crisis management
    {
        id: 'NIS2-21.5',
        name: 'Business Continuity Management',
        description: 'Business continuity planning including backup management, disaster recovery, and crisis management to ensure service resilience (Art 21(2)(c)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-21.5-001', 'Business Continuity Plan', 'Comprehensive BCP covering critical services and recovery procedures', '/security/business-continuity-plan.md'),
            createTestEvidence('nis2-21.5-002', 'BCP Test Results', 'Annual BCP testing results and lessons learned', '/security/bcp-test-results/'),
        ],
        crossReferences: ['NIST-CP-2', 'NIST-CP-4', 'SOC2-CC9.1'],
        owner: 'Business Continuity Manager',
    },
    {
        id: 'NIS2-21.6',
        name: 'Disaster Recovery and Backup',
        description: 'Disaster recovery procedures with defined RTOs and RPOs, backup strategies, and regular testing of recovery capabilities (Art 21(2)(c)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P1',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('nis2-21.6-001', 'Disaster Recovery Plan', 'Disaster recovery plan with defined RTOs and RPOs', '/security/disaster-recovery-plan.md'),
            createConfigEvidence('nis2-21.6-002', 'Backup Configuration', 'Automated backup configuration and schedule', '/config/backup-config.yaml'),
        ],
        crossReferences: ['NIST-CP-2', 'NIST-CP-9', 'SOC2-CC7.5'],
        owner: 'IT Operations Manager',
    },
    // Art 21(d) — Supply chain security
    {
        id: 'NIS2-21.7',
        name: 'Supply Chain Security',
        description: 'Supply chain security measures including assessment of suppliers, security requirements in contracts, and monitoring of third-party risk (Art 21(2)(d)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P1',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('nis2-21.7-001', 'Supplier Security Policy', 'Policy for assessing and managing supplier cybersecurity risk', '/policies/supplier-security.md'),
            createLogEvidence('nis2-21.7-002', 'Vendor Risk Assessments', 'Completed vendor risk assessment records', 'Vendor Management System'),
        ],
        crossReferences: ['NIST-SA-4', 'NIST-SA-9', 'NIST-SR-3', 'SOC2-CC9.2'],
        owner: 'Vendor Manager',
    },
    {
        id: 'NIS2-21.8',
        name: 'ICT Product and Service Acquisition Security',
        description: 'Security considerations in acquisition, development, and maintenance of network and information systems, including vulnerability handling and disclosure (Art 21(2)(d)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P2',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('nis2-21.8-001', 'Secure Procurement Policy', 'Policy for secure ICT product and service procurement', '/policies/secure-procurement.md'),
        ],
        crossReferences: ['NIST-SA-4', 'NIST-SR-3', 'SOC2-CC5.2'],
        owner: 'Procurement Manager',
    },
    // Art 21(e) — Network and information system security
    {
        id: 'NIS2-21.9',
        name: 'Network Security Architecture',
        description: 'Security in network and information systems acquisition, development, and maintenance including network segmentation, perimeter protection, and secure architecture design (Art 21(2)(e)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createConfigEvidence('nis2-21.9-001', 'Network Security Configuration', 'Network segmentation and firewall rule configuration', '/config/network-security.yaml'),
            createConfigEvidence('nis2-21.9-002', 'Security Architecture Document', 'Documented security architecture with defense-in-depth design', '/security/security-architecture.md'),
        ],
        crossReferences: ['NIST-SC-7', 'NIST-AC-4', 'SOC2-CC6.1'],
        owner: 'Security Engineering Manager',
    },
    {
        id: 'NIS2-21.10',
        name: 'Access Control Policies',
        description: 'Logical access control policies ensuring least-privilege, role-based access, and regular access reviews across network and information systems (Art 21(2)(e)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createConfigEvidence('nis2-21.10-001', 'Access Control Configuration', 'RBAC configuration with least-privilege enforcement', '/config/access-control.yaml'),
            createLogEvidence('nis2-21.10-002', 'Access Review Records', 'Quarterly access review documentation', 'Identity Management System - Access Reviews'),
        ],
        crossReferences: ['NIST-AC-2', 'NIST-AC-3', 'NIST-AC-6', 'SOC2-CC6.3'],
        owner: 'Identity Manager',
    },
    // Art 21(f) — Policies and procedures for assessing effectiveness
    {
        id: 'NIS2-21.11',
        name: 'Cybersecurity Measures Effectiveness Assessment',
        description: 'Policies and procedures to assess the effectiveness of cybersecurity risk-management measures, including testing, auditing, and metrics (Art 21(2)(f)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P2',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-21.11-001', 'Security Effectiveness Assessment Policy', 'Policy for periodic assessment of cybersecurity control effectiveness', '/policies/security-assessment.md'),
            createTestEvidence('nis2-21.11-002', 'Penetration Test Reports', 'Annual penetration testing results', '/security/pentest-reports/'),
        ],
        crossReferences: ['NIST-CA-2', 'NIST-CA-7', 'SOC2-CC4.1'],
        owner: 'Internal Audit Manager',
    },
    // Art 21(g) — Basic cyber hygiene practices and cybersecurity training
    {
        id: 'NIS2-21.12',
        name: 'Cyber Hygiene Practices',
        description: 'Basic cyber hygiene practices including software updates, secure configuration, network segmentation, identity and access management, and user awareness (Art 21(2)(g)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P2',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-21.12-001', 'Cyber Hygiene Guidelines', 'Documented cyber hygiene practices for all personnel', '/policies/cyber-hygiene.md'),
        ],
        crossReferences: ['NIST-CM-2', 'NIST-SI-2', 'SOC2-CC5.3'],
        owner: 'Security Awareness Manager',
    },
    {
        id: 'NIS2-21.13',
        name: 'Cybersecurity Training',
        description: 'Cybersecurity awareness training programme for all staff, including role-specific training for management bodies as required by Art 20(2) (Art 21(2)(g)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P2',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-21.13-001', 'Security Training Programme', 'Annual security awareness training programme and materials', '/training/security-training-programme.md'),
            createLogEvidence('nis2-21.13-002', 'Training Completion Records', 'Records of security training completion for all personnel', 'Learning Management System'),
        ],
        crossReferences: ['NIST-AT-2', 'NIST-AT-3', 'SOC2-CC1.4'],
        owner: 'Security Awareness Manager',
    },
    // Art 21(h) — Policies and procedures regarding cryptography and encryption
    {
        id: 'NIS2-21.14',
        name: 'Cryptography Policies',
        description: 'Policies and procedures regarding the use of cryptography and, where appropriate, encryption to protect data confidentiality and integrity (Art 21(2)(h)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-21.14-001', 'Cryptography Policy', 'Policy defining approved cryptographic algorithms and key management procedures', '/policies/cryptography-policy.md'),
            createConfigEvidence('nis2-21.14-002', 'Encryption Configuration', 'Encryption configuration for data at rest and in transit', '/config/encryption-config.yaml'),
        ],
        crossReferences: ['NIST-SC-13', 'NIST-SC-12', 'SOC2-CC6.7'],
        owner: 'Security Engineering Manager',
    },
    {
        id: 'NIS2-21.15',
        name: 'Key Management',
        description: 'Cryptographic key management lifecycle including generation, distribution, storage, rotation, and destruction of cryptographic keys (Art 21(2)(h)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P1',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('nis2-21.15-001', 'Key Management Procedure', 'Procedure for cryptographic key lifecycle management', '/procedures/key-management.md'),
        ],
        crossReferences: ['NIST-SC-12', 'SOC2-CC6.1'],
        owner: 'Security Engineering Manager',
    },
    // Art 21(i) — Human resources security
    {
        id: 'NIS2-21.16',
        name: 'Human Resources Security',
        description: 'Human resources security measures including background checks, confidentiality agreements, and security responsibilities in employment contracts (Art 21(2)(i)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P2',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-21.16-001', 'HR Security Policy', 'Human resources security policy covering pre-employment, during, and termination', '/hr/hr-security-policy.md'),
            createLogEvidence('nis2-21.16-002', 'Background Check Records', 'Records of employee background verification', 'HR System - Background Checks'),
        ],
        crossReferences: ['NIST-PS-3', 'NIST-PS-4', 'SOC2-CC1.4'],
        owner: 'HR Director',
    },
    {
        id: 'NIS2-21.17',
        name: 'Asset Management and Access Control on Termination',
        description: 'Procedures ensuring timely revocation of access rights and return of assets upon personnel changes or termination (Art 21(2)(i)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P2',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-21.17-001', 'Offboarding Procedure', 'Employee offboarding checklist including access revocation', '/hr/offboarding-procedure.md'),
        ],
        crossReferences: ['NIST-PS-4', 'NIST-AC-2', 'SOC2-CC6.3'],
        owner: 'HR Director',
    },
    // Art 21(j) — Multi-factor authentication, secured communications, and emergency comms
    {
        id: 'NIS2-21.18',
        name: 'Multi-Factor Authentication',
        description: 'Use of multi-factor authentication or continuous authentication solutions where appropriate to protect access to critical systems and data (Art 21(2)(j)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createConfigEvidence('nis2-21.18-001', 'MFA Configuration', 'Multi-factor authentication configuration for all critical systems', '/config/mfa-config.yaml'),
            createLogEvidence('nis2-21.18-002', 'MFA Enforcement Audit', 'Audit report confirming MFA enforcement across all privileged accounts', 'Identity Management System - MFA Report'),
        ],
        crossReferences: ['NIST-IA-2', 'NIST-IA-5', 'SOC2-CC6.1'],
        owner: 'Identity Manager',
        automatedTest: async () => {
            // Verify MFA is enabled for all privileged accounts
            return true;
        },
    },
    {
        id: 'NIS2-21.19',
        name: 'Secured Voice, Video, and Text Communications',
        description: 'Use of secured voice, video, and text communication systems, including end-to-end encryption where appropriate (Art 21(2)(j)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P2',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('nis2-21.19-001', 'Secure Communications Policy', 'Policy defining approved secure communication channels and protocols', '/policies/secure-communications.md'),
        ],
        crossReferences: ['NIST-SC-8', 'NIST-SC-13', 'SOC2-CC6.7'],
        owner: 'IT Operations Manager',
    },
    {
        id: 'NIS2-21.20',
        name: 'Secured Emergency Communication Systems',
        description: 'Secured emergency communication systems within the entity to ensure operational continuity during cybersecurity incidents (Art 21(2)(j)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P2',
        implementation: 'planned',
        evidence: [],
        crossReferences: ['NIST-CP-2', 'NIST-IR-4', 'SOC2-CC7.4'],
        owner: 'Business Continuity Manager',
    },
    // Art 21(2)(e) continued — Vulnerability handling and disclosure
    {
        id: 'NIS2-21.21',
        name: 'Vulnerability Handling and Disclosure',
        description: 'Vulnerability handling and disclosure processes including coordinated vulnerability disclosure, patch management, and vulnerability scanning (Art 21(2)(e)).',
        family: 'Art 21 - Cybersecurity Risk-Management Measures',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-21.21-001', 'Vulnerability Management Policy', 'Policy for vulnerability identification, assessment, and remediation', '/policies/vulnerability-management.md'),
            createLogEvidence('nis2-21.21-002', 'Vulnerability Scan Reports', 'Weekly automated vulnerability scan results', 'Vulnerability Scanner - Reports'),
        ],
        crossReferences: ['NIST-RA-5', 'NIST-SI-2', 'SOC2-CC7.1'],
        owner: 'Security Operations Manager',
        automatedTest: async () => {
            // Verify vulnerability scanning is running
            return true;
        },
    },
];
// =============================================================================
// ART 23 — REPORTING OBLIGATIONS AND TIMELINES
// =============================================================================
/**
 * Art 23 controls implement the graduated incident notification requirements
 * to the competent authority and CSIRT.
 */
const art23Controls = [
    {
        id: 'NIS2-23.1',
        name: 'Early Warning Notification (24h)',
        description: 'Without undue delay and in any event within 24 hours of becoming aware of a significant incident, submit an early warning to the CSIRT or competent authority indicating whether the incident is suspected of being caused by unlawful or malicious acts (Art 23(4)(a)).',
        family: 'Art 23 - Reporting Obligations',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-23.1-001', 'Early Warning Notification Procedure', 'Procedure for 24-hour early warning notification to CSIRT', '/procedures/early-warning-notification.md'),
            createLogEvidence('nis2-23.1-002', 'Early Warning Submission Records', 'Records of early warning notifications submitted to CSIRT', 'Incident Management System - Early Warnings'),
        ],
        crossReferences: ['NIST-IR-6', 'NIST-AU-6', 'SOC2-CC7.3'],
        owner: 'Incident Response Manager',
    },
    {
        id: 'NIS2-23.2',
        name: 'Incident Notification (72h)',
        description: 'Without undue delay and in any event within 72 hours of becoming aware of a significant incident, submit an incident notification updating the early warning with initial assessment, severity, impact, and indicators of compromise (Art 23(4)(b)).',
        family: 'Art 23 - Reporting Obligations',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-23.2-001', 'Incident Notification Template', 'Template for 72-hour incident notification including severity and impact', '/templates/incident-notification.md'),
        ],
        crossReferences: ['NIST-IR-6', 'NIST-AU-6', 'SOC2-CC7.4'],
        owner: 'Incident Response Manager',
    },
    {
        id: 'NIS2-23.3',
        name: 'Final Incident Report (1 month)',
        description: 'Submit a final report no later than one month after the incident notification, including a detailed description, root cause analysis, mitigation measures applied, and cross-border impact where applicable (Art 23(4)(d)).',
        family: 'Art 23 - Reporting Obligations',
        priority: 'P1',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('nis2-23.3-001', 'Final Report Template', 'Template for one-month final incident report with root cause analysis', '/templates/final-incident-report.md'),
        ],
        crossReferences: ['NIST-IR-6', 'NIST-IR-8', 'SOC2-CC7.4'],
        owner: 'Incident Response Manager',
    },
    {
        id: 'NIS2-23.4',
        name: 'Significant Incident Criteria',
        description: 'Defined criteria for classifying incidents as significant, including thresholds for service disruption, number of affected users, financial impact, and cross-border effects (Art 23(3)).',
        family: 'Art 23 - Reporting Obligations',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-23.4-001', 'Significant Incident Criteria', 'Criteria for determining significant incidents requiring mandatory notification', '/policies/significant-incident-criteria.md'),
        ],
        crossReferences: ['NIST-IR-5', 'SOC2-CC7.3'],
        owner: 'CISO',
    },
    {
        id: 'NIS2-23.5',
        name: 'Recipient and User Notification',
        description: 'Procedures for notifying recipients of services about significant incidents that are likely to adversely affect the provision of those services, including mitigation measures they can apply (Art 23(1)).',
        family: 'Art 23 - Reporting Obligations',
        priority: 'P2',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-23.5-001', 'User Notification Procedure', 'Procedure for notifying affected service recipients of significant incidents', '/procedures/user-incident-notification.md'),
        ],
        crossReferences: ['NIST-IR-7', 'SOC2-CC2.3'],
        owner: 'Communications Director',
    },
];
// =============================================================================
// ART 24 — EUROPEAN CYBERSECURITY CERTIFICATION
// =============================================================================
/**
 * Art 24 controls address the use of European cybersecurity certification
 * schemes and qualified trust services.
 */
const art24Controls = [
    {
        id: 'NIS2-24.1',
        name: 'European Cybersecurity Certification Adoption',
        description: 'Assessment and adoption of relevant European cybersecurity certification schemes established under Regulation (EU) 2019/881 (Cybersecurity Act) to demonstrate compliance with specific cybersecurity requirements (Art 24(1)).',
        family: 'Art 24 - European Cybersecurity Certification',
        priority: 'P3',
        implementation: 'planned',
        evidence: [],
        crossReferences: ['NIST-SA-4', 'SOC2-CC5.1'],
        owner: 'Compliance Manager',
    },
    {
        id: 'NIS2-24.2',
        name: 'ICT Product and Service Certification Requirements',
        description: 'Procedures for requiring or preferring certified ICT products, services, and processes when procuring technology, aligned with applicable European certification schemes (Art 24(2)).',
        family: 'Art 24 - European Cybersecurity Certification',
        priority: 'P3',
        implementation: 'planned',
        evidence: [],
        crossReferences: ['NIST-SA-4', 'NIST-SA-12', 'SOC2-CC9.2'],
        owner: 'Procurement Manager',
    },
];
// =============================================================================
// ART 29 — CYBERSECURITY INFORMATION-SHARING
// =============================================================================
/**
 * Art 29 controls establish voluntary cybersecurity information-sharing
 * arrangements between essential and important entities.
 */
const art29Controls = [
    {
        id: 'NIS2-29.1',
        name: 'Threat Intelligence Sharing',
        description: 'Participation in voluntary cybersecurity information-sharing arrangements to exchange threat intelligence, indicators of compromise, tactics, techniques, and procedures (Art 29(1)).',
        family: 'Art 29 - Cybersecurity Information Sharing',
        priority: 'P2',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('nis2-29.1-001', 'Information Sharing Policy', 'Policy defining threat intelligence sharing rules and trusted partners', '/policies/information-sharing.md'),
        ],
        crossReferences: ['NIST-PM-15', 'NIST-SI-5', 'SOC2-CC2.3'],
        owner: 'CISO',
    },
    {
        id: 'NIS2-29.2',
        name: 'Information Sharing Safeguards',
        description: 'Safeguards to protect commercially sensitive information, preserve personal data, and ensure compliance with competition law in information-sharing arrangements (Art 29(2)).',
        family: 'Art 29 - Cybersecurity Information Sharing',
        priority: 'P2',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('nis2-29.2-001', 'Information Sharing Agreement Template', 'Template NDA and data handling agreement for threat intelligence sharing', '/templates/information-sharing-agreement.md'),
        ],
        crossReferences: ['NIST-PM-15', 'SOC2-CC2.3'],
        owner: 'Legal Counsel',
    },
];
// =============================================================================
// ART 32 — SUPERVISORY AND ENFORCEMENT (ESSENTIAL ENTITIES)
// =============================================================================
/**
 * Art 32 controls address the supervisory and enforcement regime
 * applicable to essential entities.
 */
const art32Controls = [
    {
        id: 'NIS2-32.1',
        name: 'Proactive Supervisory Compliance (Essential)',
        description: 'Readiness for proactive supervisory measures by competent authorities including on-site inspections, off-site supervision, security audits, and security scans for essential entities (Art 32(2)).',
        family: 'Art 32 - Supervisory and Enforcement (Essential Entities)',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-32.1-001', 'Supervisory Readiness Plan', 'Plan for responding to supervisory inspections and audit requests', '/compliance/supervisory-readiness.md'),
            createLogEvidence('nis2-32.1-002', 'Audit Trail Records', 'Comprehensive audit trail demonstrating ongoing compliance', 'Compliance Management System'),
        ],
        crossReferences: ['NIST-CA-2', 'NIST-CA-7', 'SOC2-CC4.1'],
        owner: 'Compliance Manager',
    },
    {
        id: 'NIS2-32.2',
        name: 'Essential Entity Registration',
        description: 'Registration with the competent authority and provision of required entity information including sector, sub-sector, IP address ranges, and contact details (Art 32(1)).',
        family: 'Art 32 - Supervisory and Enforcement (Essential Entities)',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-32.2-001', 'Entity Registration Records', 'Records of registration with the national competent authority', '/compliance/entity-registration.md'),
        ],
        crossReferences: ['SOC2-CC2.3'],
        owner: 'Compliance Manager',
    },
    {
        id: 'NIS2-32.3',
        name: 'Enforcement Action Response Procedures (Essential)',
        description: 'Procedures for responding to enforcement actions by competent authorities, including binding instructions, implementation orders, and administrative fines up to EUR 10 million or 2% of worldwide turnover (Art 32(4)-(5)).',
        family: 'Art 32 - Supervisory and Enforcement (Essential Entities)',
        priority: 'P2',
        implementation: 'planned',
        evidence: [],
        crossReferences: ['SOC2-CC1.1'],
        owner: 'Legal Counsel',
    },
];
// =============================================================================
// ART 33 — SUPERVISORY AND ENFORCEMENT (IMPORTANT ENTITIES)
// =============================================================================
/**
 * Art 33 controls address the lighter-touch supervisory and enforcement
 * regime applicable to important entities.
 */
const art33Controls = [
    {
        id: 'NIS2-33.1',
        name: 'Reactive Supervisory Compliance (Important)',
        description: 'Readiness for ex-post supervisory measures triggered by evidence of non-compliance, including responding to information requests, audits, and security scans for important entities (Art 33(1)-(2)).',
        family: 'Art 33 - Supervisory and Enforcement (Important Entities)',
        priority: 'P2',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('nis2-33.1-001', 'Compliance Documentation', 'Maintained compliance documentation for supervisory review', '/compliance/important-entity-compliance.md'),
        ],
        crossReferences: ['NIST-CA-2', 'SOC2-CC4.1'],
        owner: 'Compliance Manager',
    },
    {
        id: 'NIS2-33.2',
        name: 'Enforcement Action Response Procedures (Important)',
        description: 'Procedures for responding to enforcement actions applicable to important entities, including binding instructions and administrative fines up to EUR 7 million or 1.4% of worldwide turnover (Art 33(4)-(5)).',
        family: 'Art 33 - Supervisory and Enforcement (Important Entities)',
        priority: 'P3',
        implementation: 'planned',
        evidence: [],
        crossReferences: ['SOC2-CC1.1'],
        owner: 'Legal Counsel',
    },
];
// =============================================================================
// NIS2 DIRECTIVE FRAMEWORK
// =============================================================================
/**
 * Complete NIS2 Directive compliance framework
 */
export const nis2Framework = {
    id: 'nis2',
    name: 'NIS2 Directive',
    version: '2022/2555',
    description: 'Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS Directive). Establishes cybersecurity risk-management and reporting obligations for essential and important entities.',
    authority: 'European Parliament and Council',
    controls: [
        ...art21Controls,
        ...art23Controls,
        ...art24Controls,
        ...art29Controls,
        ...art32Controls,
        ...art33Controls,
    ],
    effectiveDate: new Date('2024-10-18'),
};
// =============================================================================
// UTILITY FUNCTIONS
// =============================================================================
/**
 * Retrieve all controls belonging to a specific NIS2 article.
 *
 * Matches controls whose `family` field starts with `"Art {article} -"`.
 *
 * @param article - The article number (e.g., 21, 23, 24, 29, 32, 33)
 * @returns Array of controls for the specified article
 */
export function getControlsByArticle(article) {
    const prefix = `Art ${article} -`;
    return nis2Framework.controls.filter((c) => c.family.startsWith(prefix));
}
/**
 * Find a single control by its unique identifier.
 *
 * @param id - The control ID (e.g., 'NIS2-21.1', 'NIS2-23.3')
 * @returns The matching control, or undefined if not found
 */
export function getControlById(id) {
    return nis2Framework.controls.find((c) => c.id === id);
}
/**
 * Retrieve all controls with a specific implementation status.
 *
 * @param status - The implementation status to filter by
 * @returns Array of controls matching the specified status
 */
export function getControlsByStatus(status) {
    return nis2Framework.controls.filter((c) => c.implementation === status);
}
/**
 * Get a sorted list of all unique article families in the framework.
 *
 * @returns Sorted array of family strings (e.g., 'Art 21 - Cybersecurity Risk-Management Measures', ...)
 */
export function getArticleFamilies() {
    const families = new Set();
    nis2Framework.controls.forEach((c) => families.add(c.family));
    return Array.from(families).sort();
}
/**
 * Calculate compliance percentage by article, based on the ratio of
 * fully implemented controls to total controls.
 *
 * @returns Map of article number to compliance percentage (0-100)
 */
export function getComplianceByArticle() {
    const result = new Map();
    const articles = [21, 23, 24, 29, 32, 33];
    for (const art of articles) {
        const controls = getControlsByArticle(art);
        const implemented = controls.filter((c) => c.implementation === 'implemented').length;
        const pct = controls.length > 0 ? (implemented / controls.length) * 100 : 0;
        result.set(art, pct);
    }
    return result;
}
/**
 * Get the sectors applicable to a specific entity type.
 *
 * @param entityType - 'essential' or 'important'
 * @returns Array of sector identifiers for the given entity type
 */
export function getSectorsForEntityType(entityType) {
    switch (entityType) {
        case 'essential':
            return [...ESSENTIAL_SECTORS];
        case 'important':
            return [...IMPORTANT_SECTORS];
        default:
            return [];
    }
}
export default nis2Framework;
//# sourceMappingURL=nis2.js.map