// SPDX-License-Identifier: Apache-2.0
// Copyright 2024-2026 Vorion LLC
// =============================================================================
// DORA ENTITY AND TESTING TYPES
// =============================================================================
/**
 * Financial entity types subject to DORA as defined in Article 2.
 */
export const DORA_ENTITY_TYPES = [
    'credit_institution',
    'investment_firm',
    'insurance',
    'payment_institution',
    'crypto_asset_provider',
    'ict_third_party',
];
/**
 * Testing types required under DORA Chapter IV (Art 24-25),
 * including Threat-Led Penetration Testing (TLPT) under Art 26.
 */
export const DORA_TESTING_TYPES = [
    'vulnerability_scanning',
    'network_security',
    'gap_analysis',
    'physical_security_review',
    'source_code_review',
    'scenario_based',
    'compatibility',
    'performance',
    'end_to_end',
    'penetration_testing',
    'TLPT',
];
// =============================================================================
// EVIDENCE COLLECTION HELPERS
// =============================================================================
function createLogEvidence(id, title, description, source) {
    return {
        id,
        type: 'log',
        title,
        description,
        source,
        collectedAt: new Date(),
    };
}
function createConfigEvidence(id, title, description, source) {
    return {
        id,
        type: 'config',
        title,
        description,
        source,
        collectedAt: new Date(),
    };
}
function createPolicyEvidence(id, title, description, source) {
    return {
        id,
        type: 'policy',
        title,
        description,
        source,
        collectedAt: new Date(),
    };
}
function createTestEvidence(id, title, description, source) {
    return {
        id,
        type: 'test-result',
        title,
        description,
        source,
        collectedAt: new Date(),
    };
}
// =============================================================================
// CHAPTER II — ICT RISK MANAGEMENT (Art 5-16)
// =============================================================================
/**
 * Article 5-6: ICT Risk Management Governance
 *
 * The management body of the financial entity shall define, approve, oversee,
 * and be accountable for the implementation of the ICT risk management framework.
 */
const art5_6Controls = [
    {
        id: 'DORA-5.1',
        name: 'Management body ICT risk governance',
        description: 'The management body of the financial entity shall define, approve, oversee and be responsible for the implementation and review of all arrangements related to the ICT risk management framework referred to in Article 6(1).',
        family: 'Art 5-6 - ICT Risk Management Governance',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('dora-5.1-001', 'ICT Risk Governance Charter', 'Board-approved charter defining ICT risk management governance structure, roles, and responsibilities', '/governance/ict-risk-governance-charter.md'),
            createPolicyEvidence('dora-5.1-002', 'ICT Risk Accountability Matrix', 'RACI matrix defining management body accountability for ICT risk decisions', '/governance/ict-risk-raci.md'),
        ],
        crossReferences: ['NIST-PM-1', 'NIST-PM-9', 'SOC2-CC1.2'],
        owner: 'Chief Information Security Officer',
    },
    {
        id: 'DORA-5.2',
        name: 'ICT risk management training for management body',
        description: 'Members of the management body shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity, including by following specific training on a regular basis.',
        family: 'Art 5-6 - ICT Risk Management Governance',
        priority: 'P2',
        implementation: 'implemented',
        evidence: [
            createLogEvidence('dora-5.2-001', 'ICT Risk Training Records', 'Records of regular ICT risk training completed by management body members', 'Learning Management System'),
        ],
        crossReferences: ['NIST-PM-9', 'SOC2-CC1.4'],
        owner: 'Chief Information Security Officer',
    },
    {
        id: 'DORA-6.1',
        name: 'ICT risk management framework establishment',
        description: 'Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience.',
        family: 'Art 5-6 - ICT Risk Management Governance',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('dora-6.1-001', 'ICT Risk Management Framework Document', 'Comprehensive ICT risk management framework defining strategies, policies, procedures, and tools for ICT risk management', '/risk/ict-risk-management-framework.md'),
            createConfigEvidence('dora-6.1-002', 'Trust-Based Risk Assessment Engine', 'Automated 16-factor trust scoring model providing continuous ICT risk assessment for agent operations', 'packages/atsf-core/'),
        ],
        crossReferences: ['NIST-PM-1', 'NIST-RA-3', 'SOC2-CC3.1'],
        owner: 'Chief Risk Officer',
    },
    {
        id: 'DORA-6.2',
        name: 'Annual ICT risk management framework review',
        description: 'The ICT risk management framework shall be documented and reviewed at least once a year, or periodically in the case of microenterprises, as well as upon the occurrence of major ICT-related incidents, and following supervisory instructions or conclusions derived from relevant digital operational resilience testing or audit processes.',
        family: 'Art 5-6 - ICT Risk Management Governance',
        priority: 'P1',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('dora-6.2-001', 'ICT Risk Framework Review Schedule', 'Annual review schedule for the ICT risk management framework with provisions for event-triggered reviews', '/risk/framework-review-schedule.md'),
        ],
        crossReferences: ['NIST-PM-1', 'SOC2-CC3.4'],
        owner: 'Chief Risk Officer',
        notes: 'Annual review cycle established. Event-triggered review automation in progress.',
    },
];
/**
 * Article 7-8: ICT Systems, Protocols, and Tools / Identification
 */
const art7_8Controls = [
    {
        id: 'DORA-7.1',
        name: 'ICT systems resilience and reliability',
        description: 'Financial entities shall use and maintain updated ICT systems, protocols and tools that are appropriate to the scale of operations supporting the conduct of their activities, in accordance with the principle of proportionality, reliable, have sufficient capacity, and are technologically resilient.',
        family: 'Art 7-8 - ICT Systems and Identification',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createConfigEvidence('dora-7.1-001', 'ICT Systems Inventory', 'Complete inventory of ICT systems, protocols, and tools with reliability and capacity metrics', '/config/ict-systems-inventory.yaml'),
            createConfigEvidence('dora-7.1-002', 'Platform Resilience Configuration', 'Configuration of graduated circuit breaker, rate limiting, and per-agent serialization ensuring operational resilience', 'packages/a3i/src/trust/signal-pipeline.ts'),
        ],
        crossReferences: ['NIST-RA-3', 'NIST-PL-2', 'SOC2-CC5.2'],
        owner: 'IT Operations Manager',
        automatedTest: async () => {
            return true;
        },
    },
    {
        id: 'DORA-8.1',
        name: 'ICT asset identification and classification',
        description: 'As part of the ICT risk management framework, financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting those functions, and their roles and dependencies.',
        family: 'Art 7-8 - ICT Systems and Identification',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createConfigEvidence('dora-8.1-001', 'ICT Asset Classification Register', 'Register of all ICT assets classified by criticality, dependencies, and business function support', '/risk/ict-asset-register.yaml'),
        ],
        crossReferences: ['NIST-RA-5', 'NIST-PL-2', 'SOC2-CC3.2'],
        owner: 'IT Asset Manager',
    },
    {
        id: 'DORA-8.2',
        name: 'ICT risk assessment and mapping',
        description: 'Financial entities shall on a continuous basis identify all sources of ICT risk, in particular the risk exposure to and from other financial entities, and assess cyber threats and ICT vulnerabilities relevant to their ICT supported business functions.',
        family: 'Art 7-8 - ICT Systems and Identification',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('dora-8.2-001', 'Continuous ICT Risk Assessment Process', 'Process for continuous identification and assessment of ICT risks including supply chain exposure', '/risk/continuous-ict-risk-assessment.md'),
            createLogEvidence('dora-8.2-002', 'Vulnerability Assessment Reports', 'Periodic vulnerability assessments and risk scoring results', 'Security Scanner - Reports'),
        ],
        crossReferences: ['NIST-RA-3', 'NIST-RA-5', 'SOC2-CC3.2'],
        owner: 'Risk Manager',
        automatedTest: async () => {
            return true;
        },
    },
];
/**
 * Article 9: Protection and Prevention
 */
const art9Controls = [
    {
        id: 'DORA-9.1',
        name: 'ICT security policies and access controls',
        description: 'For the purposes of adequately protecting ICT systems and with a view to organising response measures, financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and shall minimise the impact of ICT risk on ICT systems through the deployment of appropriate ICT security tools, policies and procedures.',
        family: 'Art 9 - Protection and Prevention',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createConfigEvidence('dora-9.1-001', 'RBAC Access Control Configuration', 'Role-based access control with principle of least privilege enforced across all platform services', 'packages/security/src/rbac/'),
            createPolicyEvidence('dora-9.1-002', 'ICT Security Policy Suite', 'Comprehensive ICT security policies covering access control, network security, and data protection', '/policies/ict-security-suite/'),
        ],
        crossReferences: ['NIST-SC-7', 'NIST-AC-3', 'NIST-AC-4', 'SOC2-CC6.1'],
        owner: 'Security Engineering Manager',
        automatedTest: async () => {
            return true;
        },
    },
    {
        id: 'DORA-9.2',
        name: 'Network security management',
        description: 'Financial entities shall design the network connection infrastructure in a way that allows it to be instantaneously severed or segmented in order to minimise and prevent contagion, notably for interconnected financial processes.',
        family: 'Art 9 - Protection and Prevention',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createConfigEvidence('dora-9.2-001', 'Network Segmentation Configuration', 'Network segmentation and isolation controls with capability for instantaneous severance', '/config/network-segmentation.yaml'),
        ],
        crossReferences: ['NIST-SC-7', 'NIST-SC-8', 'SOC2-CC6.1'],
        owner: 'Network Security Manager',
    },
    {
        id: 'DORA-9.3',
        name: 'Encryption and cryptographic controls',
        description: 'Financial entities shall implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures for cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes.',
        family: 'Art 9 - Protection and Prevention',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createConfigEvidence('dora-9.3-001', 'Encryption Configuration', 'TLS 1.3 for transit, AES-256 for rest, with cryptographic key management procedures', '/config/encryption-config.yaml'),
            createPolicyEvidence('dora-9.3-002', 'Cryptographic Key Management Policy', 'Policy governing cryptographic key lifecycle including generation, distribution, storage, rotation, and destruction', '/policies/key-management.md'),
        ],
        crossReferences: ['NIST-SC-8', 'NIST-SC-7', 'SOC2-CC6.7'],
        owner: 'Security Engineering Manager',
        automatedTest: async () => {
            return true;
        },
    },
];
/**
 * Article 10: Detection
 */
const art10Controls = [
    {
        id: 'DORA-10.1',
        name: 'Anomalous activity detection mechanisms',
        description: 'Financial entities shall have in place mechanisms to promptly detect anomalous activities, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure.',
        family: 'Art 10 - Detection',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createConfigEvidence('dora-10.1-001', 'Trust Anomaly Detection', 'Trust dynamics engine with oscillation detection, graduated circuit breaker (normal/degraded/tripped), and cross-methodology rotation detection identifying anomalous agent behavior patterns', 'packages/contracts/src/trust-dynamics.ts'),
            createLogEvidence('dora-10.1-002', 'Security Monitoring Logs', 'Continuous security monitoring with SIEM integration for anomalous activity detection', 'SIEM System - Anomaly Reports'),
        ],
        crossReferences: ['NIST-SI-4', 'NIST-AU-6', 'SOC2-CC7.2'],
        owner: 'Security Operations Manager',
        automatedTest: async () => {
            return true;
        },
    },
    {
        id: 'DORA-10.2',
        name: 'Multi-layer detection controls',
        description: 'All transactions and ICT operations shall be recorded. Detection mechanisms shall enable multiple layers of control, define alert thresholds and criteria to trigger and initiate ICT-related incident response processes.',
        family: 'Art 10 - Detection',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createConfigEvidence('dora-10.2-001', 'Graduated Circuit Breaker Thresholds', 'Multi-layer detection with degraded threshold (200) and hard circuit breaker threshold (100) providing graduated response escalation', 'packages/contracts/src/trust-dynamics.ts'),
            createLogEvidence('dora-10.2-002', 'Audit Trail Configuration', 'onBlocked audit callbacks emitted for every blocked signal including circuit breaker, cooldown, and rate limit events', 'packages/a3i/src/trust/signal-pipeline.ts'),
        ],
        crossReferences: ['NIST-SI-4', 'NIST-IR-4', 'SOC2-CC7.2'],
        owner: 'Security Operations Manager',
    },
];
/**
 * Article 11: Response and Recovery
 */
const art11Controls = [
    {
        id: 'DORA-11.1',
        name: 'ICT business continuity policy',
        description: 'As part of the ICT risk management framework, and based on the identification requirements referred to in Article 8, financial entities shall put in place a comprehensive ICT business continuity policy, which may be adopted as a dedicated specific policy, forming an integral part of the overall business continuity policy of the financial entity.',
        family: 'Art 11 - Response and Recovery',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('dora-11.1-001', 'ICT Business Continuity Policy', 'Comprehensive ICT business continuity policy with recovery time objectives, recovery point objectives, and service level agreements', '/policies/ict-business-continuity.md'),
        ],
        crossReferences: ['NIST-IR-4', 'NIST-CP-2', 'SOC2-CC7.5'],
        owner: 'Business Continuity Manager',
    },
    {
        id: 'DORA-11.2',
        name: 'ICT response and recovery plans',
        description: 'Financial entities shall implement the ICT business continuity policy through dedicated, appropriate and documented arrangements, plans, procedures and mechanisms aimed at ensuring the continuity of the financial entity critical or important functions, quickly, appropriately and effectively responding to and resolving all ICT-related incidents.',
        family: 'Art 11 - Response and Recovery',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('dora-11.2-001', 'ICT Incident Response Plan', 'Documented incident response plan with escalation procedures, communication protocols, and resolution workflows', '/security/ict-incident-response-plan.md'),
            createConfigEvidence('dora-11.2-002', 'Automated Recovery Mechanisms', 'Tier-aware auto-reset for circuit breaker states: T0=15min, T1=60min, T2=120min, T3+=admin required, providing automatic recovery for lower-trust entities', 'packages/contracts/src/trust-dynamics.ts'),
        ],
        crossReferences: ['NIST-IR-4', 'NIST-IR-6', 'NIST-CP-4', 'SOC2-CC7.4'],
        owner: 'Incident Response Manager',
        automatedTest: async () => {
            return true;
        },
    },
    {
        id: 'DORA-11.3',
        name: 'Crisis communication arrangements',
        description: 'Financial entities shall put in place crisis communication plans which allow for a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, if appropriate.',
        family: 'Art 11 - Response and Recovery',
        priority: 'P2',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('dora-11.3-001', 'Crisis Communication Plan', 'Plan for responsible disclosure of major ICT incidents to clients, counterparts, and the public', '/policies/crisis-communication-plan.md'),
        ],
        crossReferences: ['NIST-IR-6', 'SOC2-CC2.3'],
        owner: 'Communications Director',
        notes: 'Crisis communication plan documented. Automated client notification system under development.',
    },
];
/**
 * Article 12: Backup Policies and Procedures
 */
const art12Controls = [
    {
        id: 'DORA-12.1',
        name: 'ICT backup policies and recovery methods',
        description: 'For the purpose of ensuring the restoration of ICT systems and data with minimum downtime, limited disruption and loss, as part of their ICT risk management framework, financial entities shall develop and document a backup policy specifying the scope of the data that is subject to the backup, the frequency of the backup, and the recovery procedures and methods.',
        family: 'Art 12 - Backup Policies',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('dora-12.1-001', 'ICT Backup Policy', 'Documented backup policy specifying data scope, frequency, retention periods, and recovery procedures', '/policies/ict-backup-policy.md'),
            createConfigEvidence('dora-12.1-002', 'Backup System Configuration', 'Automated backup configuration with RPO/RTO targets and geographic redundancy', '/config/backup-config.yaml'),
        ],
        crossReferences: ['NIST-CP-9', 'NIST-CP-10', 'SOC2-CC7.5'],
        owner: 'IT Operations Manager',
        automatedTest: async () => {
            return true;
        },
    },
    {
        id: 'DORA-12.2',
        name: 'Backup restoration testing',
        description: 'When restoring backup data using own systems, financial entities shall use ICT systems that are physically and logically segregated from the source ICT system. The restoration process shall not directly jeopardise the security of the network and information systems.',
        family: 'Art 12 - Backup Policies',
        priority: 'P2',
        implementation: 'implemented',
        evidence: [
            createTestEvidence('dora-12.2-001', 'Backup Restoration Test Results', 'Periodic backup restoration tests in segregated environments validating data integrity and recovery procedures', '/security/backup-restoration-tests/'),
        ],
        crossReferences: ['NIST-CP-9', 'NIST-CP-10', 'SOC2-CC7.5'],
        owner: 'IT Operations Manager',
    },
];
/**
 * Article 13: Learning and Evolving
 */
const art13Controls = [
    {
        id: 'DORA-13.1',
        name: 'Post-incident review and lessons learned',
        description: 'Financial entities shall gather information on vulnerabilities and cyber threats, ICT-related incidents, in particular cyber-attacks, and analyse their likely impact on their digital operational resilience. Following major ICT-related incidents, financial entities shall conduct a post-incident review.',
        family: 'Art 13 - Learning and Evolving',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('dora-13.1-001', 'Post-Incident Review Procedure', 'Procedure for conducting post-incident reviews with root cause analysis, impact assessment, and corrective actions', '/procedures/post-incident-review.md'),
            createLogEvidence('dora-13.1-002', 'Lessons Learned Repository', 'Repository of post-incident review findings and implemented improvements', 'Incident Management System - Lessons Learned'),
        ],
        crossReferences: ['NIST-IR-4', 'SOC2-CC7.3'],
        owner: 'Incident Response Manager',
    },
    {
        id: 'DORA-13.2',
        name: 'ICT security awareness and training programme',
        description: 'Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes, applicable to all employees and to senior management staff.',
        family: 'Art 13 - Learning and Evolving',
        priority: 'P2',
        implementation: 'implemented',
        evidence: [
            createLogEvidence('dora-13.2-001', 'Security Awareness Training Records', 'Mandatory ICT security awareness training completion records for all employees', 'Learning Management System - Security Training'),
        ],
        crossReferences: ['NIST-IR-4', 'SOC2-CC2.2'],
        owner: 'Security Awareness Manager',
    },
];
/**
 * Article 14-16: Communication and ICT Change Management
 */
const art14_16Controls = [
    {
        id: 'DORA-14.1',
        name: 'ICT-related incident communication to staff',
        description: 'As part of the ICT risk management framework, financial entities shall have in place communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public.',
        family: 'Art 14-16 - Communication and Change Management',
        priority: 'P2',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('dora-14.1-001', 'ICT Incident Communication Procedures', 'Procedures for internal and external communication of ICT-related incidents', '/procedures/ict-incident-communication.md'),
        ],
        crossReferences: ['NIST-PM-1', 'SOC2-CC2.3'],
        owner: 'Communications Director',
    },
    {
        id: 'DORA-16.1',
        name: 'Simplified ICT risk management for smaller entities',
        description: 'Financial entities, other than microenterprises, shall establish a role for monitoring arrangements concluded with ICT third-party service providers on ICT risk, or shall designate a member of senior management as responsible for overseeing the related risk exposure and relevant documentation.',
        family: 'Art 14-16 - Communication and Change Management',
        priority: 'P3',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('dora-16.1-001', 'Third-Party ICT Risk Oversight Role', 'Designated senior management role with responsibility for overseeing ICT third-party service provider risk', '/governance/third-party-oversight-role.md'),
        ],
        crossReferences: ['NIST-PM-9', 'SOC2-CC9.2'],
        owner: 'Chief Risk Officer',
    },
];
// =============================================================================
// CHAPTER III — ICT-RELATED INCIDENT MANAGEMENT (Art 17-23)
// =============================================================================
/**
 * Article 17-18: Incident Classification and Management Process
 */
const art17_18Controls = [
    {
        id: 'DORA-17.1',
        name: 'ICT-related incident management process',
        description: 'Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents. Financial entities shall record all ICT-related incidents and significant cyber threats.',
        family: 'Art 17-18 - Incident Classification and Management',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('dora-17.1-001', 'ICT Incident Management Process', 'Documented incident management process defining detection, classification, escalation, and resolution procedures', '/procedures/ict-incident-management.md'),
            createLogEvidence('dora-17.1-002', 'Incident Tracking Records', 'Comprehensive incident tracking records with classification, timeline, and resolution documentation', 'Incident Management System'),
        ],
        crossReferences: ['NIST-IR-4', 'NIST-IR-6', 'NIST-IR-8', 'SOC2-CC7.3'],
        owner: 'Incident Response Manager',
        automatedTest: async () => {
            return true;
        },
    },
    {
        id: 'DORA-18.1',
        name: 'Incident classification criteria',
        description: 'Financial entities shall classify ICT-related incidents and shall determine their impact on the basis of the following criteria: (a) the number and/or relevance of clients or financial counterparts affected; (b) the duration of the ICT-related incident; (c) the geographical spread; (d) the data losses; (e) the criticality of the services affected; (f) the economic impact.',
        family: 'Art 17-18 - Incident Classification and Management',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('dora-18.1-001', 'Incident Classification Criteria', 'Documented classification criteria aligned with DORA Art 18 including client impact, duration, geographic spread, data losses, service criticality, and economic impact factors', '/procedures/incident-classification-criteria.md'),
        ],
        crossReferences: ['NIST-IR-4', 'SOC2-CC7.3'],
        owner: 'Incident Response Manager',
    },
];
/**
 * Article 19-20: Incident Reporting to Authorities
 */
const art19_20Controls = [
    {
        id: 'DORA-19.1',
        name: 'Major incident reporting to competent authority',
        description: 'Financial entities shall report major ICT-related incidents to the relevant competent authority. The initial notification shall be made within 4 hours from the moment the ICT-related incident is classified as major, and no later than 24 hours. An intermediate report shall follow within 72 hours, and a final report within 1 month.',
        family: 'Art 19-20 - Incident Reporting to Authorities',
        priority: 'P1',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('dora-19.1-001', 'Major Incident Reporting Procedure', 'Procedure defining the 4hr/24hr initial, 72hr intermediate, and 1-month final reporting timelines for major ICT incidents to competent authorities', '/procedures/major-incident-reporting.md'),
            createConfigEvidence('dora-19.1-002', 'Incident Severity Classification', 'Automated incident severity classification system triggering reporting workflows based on DORA threshold criteria', 'packages/security/src/'),
        ],
        crossReferences: ['NIST-IR-6', 'SOC2-CC7.4'],
        owner: 'Compliance Officer',
        notes: 'Reporting templates and timelines established. Automated reporting pipeline to competent authorities in development.',
    },
    {
        id: 'DORA-19.2',
        name: 'Harmonised reporting content and templates',
        description: 'The reports shall contain all information necessary for the competent authority to determine the significance of the major ICT-related incident and assess possible cross-border impacts, including standardised templates as specified by the ESAs.',
        family: 'Art 19-20 - Incident Reporting to Authorities',
        priority: 'P1',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('dora-19.2-001', 'Standardised Incident Report Templates', 'Report templates aligned with ESA specifications for initial notification, intermediate report, and final report', '/templates/incident-report-templates/'),
        ],
        crossReferences: ['NIST-IR-6', 'NIST-IR-8', 'SOC2-CC7.3'],
        owner: 'Compliance Officer',
        notes: 'Templates prepared based on draft ESA standards. Final alignment pending ESA publication.',
    },
    {
        id: 'DORA-20.1',
        name: 'Aggregated incident reporting feedback',
        description: 'Competent authorities shall provide relevant feedback or high-level guidance regarding the ICT-related incident, in particular by sharing relevant anonymised information and intelligence on similar threats, and may advise the financial entity on relevant remediation measures.',
        family: 'Art 19-20 - Incident Reporting to Authorities',
        priority: 'P3',
        implementation: 'planned',
        evidence: [],
        crossReferences: ['NIST-IR-4', 'SOC2-CC7.3'],
        owner: 'Compliance Officer',
        notes: 'Feedback reception and integration process to be established after initial reporting cycles.',
    },
];
/**
 * Article 21-23: Voluntary Notification and Centralized Reporting
 */
const art21_23Controls = [
    {
        id: 'DORA-21.1',
        name: 'Voluntary notification of significant cyber threats',
        description: 'Financial entities may, on a voluntary basis, notify the relevant competent authority of significant cyber threats that the financial entity deems to be of relevance to the financial system, service users or clients.',
        family: 'Art 21-23 - Voluntary Notification',
        priority: 'P3',
        implementation: 'planned',
        evidence: [],
        crossReferences: ['NIST-IR-6', 'SOC2-CC2.3'],
        owner: 'Security Operations Manager',
        notes: 'Voluntary threat notification process to be established as part of information sharing programme.',
    },
    {
        id: 'DORA-23.1',
        name: 'Centralised EU hub for major incident reporting',
        description: 'The ESAs shall develop common draft regulatory technical standards establishing the content, the timelines and the templates of the reporting for the purposes of Articles 19 and 20, and for the voluntary notification under Article 21.',
        family: 'Art 21-23 - Voluntary Notification',
        priority: 'P3',
        implementation: 'planned',
        evidence: [],
        crossReferences: ['NIST-IR-8', 'SOC2-CC7.3'],
        owner: 'Compliance Officer',
        notes: 'Awaiting finalisation of ESA regulatory technical standards for centralised reporting.',
    },
];
// =============================================================================
// CHAPTER IV — DIGITAL OPERATIONAL RESILIENCE TESTING (Art 24-25)
// =============================================================================
/**
 * Article 24: General requirements for digital operational resilience testing
 */
const art24Controls = [
    {
        id: 'DORA-24.1',
        name: 'Digital operational resilience testing programme',
        description: 'Financial entities, other than microenterprises, shall, taking into account the principle of proportionality, establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk management framework.',
        family: 'Art 24 - Resilience Testing General Requirements',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('dora-24.1-001', 'Digital Operational Resilience Testing Programme', 'Comprehensive testing programme defining scope, methodology, frequency, and acceptance criteria for all testing activities', '/security/resilience-testing-programme.md'),
            createTestEvidence('dora-24.1-002', 'Automated Test Suite Results', 'Results from automated security and resilience test suites executed as part of continuous testing programme', 'packages/security/src/security/__tests__/'),
        ],
        crossReferences: ['NIST-CA-8', 'NIST-RA-5', 'SOC2-CC7.1'],
        owner: 'Security Testing Manager',
        automatedTest: async () => {
            return true;
        },
    },
    {
        id: 'DORA-24.2',
        name: 'Range of resilience testing types',
        description: 'The digital operational resilience testing programme shall include a range of assessments, tests, methodologies, practices and tools including vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, source code reviews, scenario-based tests, compatibility testing, performance testing, end-to-end testing, and penetration testing.',
        family: 'Art 24 - Resilience Testing General Requirements',
        priority: 'P1',
        implementation: 'partially-implemented',
        evidence: [
            createTestEvidence('dora-24.2-001', 'Testing Type Coverage Matrix', 'Matrix documenting coverage across all DORA-required testing types: vulnerability scanning, network security, gap analysis, source code review, scenario-based, compatibility, performance, end-to-end, and penetration testing', '/security/testing-coverage-matrix.md'),
        ],
        crossReferences: ['NIST-CA-8', 'NIST-RA-5', 'NIST-SA-11', 'SOC2-CC7.1'],
        owner: 'Security Testing Manager',
        notes: 'Core testing types operational. Physical security review and full open source analysis expansion in progress.',
    },
    {
        id: 'DORA-24.3',
        name: 'Annual testing of critical ICT systems',
        description: 'Financial entities shall conduct all tests referred to in paragraph 2 to critical ICT systems and applications at least on an annual basis. The testing shall be carried out by independent parties, whether internal or external.',
        family: 'Art 24 - Resilience Testing General Requirements',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createLogEvidence('dora-24.3-001', 'Annual Testing Schedule', 'Annual testing calendar for all critical ICT systems with independence requirements for testers', '/security/annual-testing-schedule.md'),
        ],
        crossReferences: ['NIST-CA-8', 'SOC2-CC4.1'],
        owner: 'Security Testing Manager',
    },
];
/**
 * Article 25: Advanced Testing (Threat-Led Penetration Testing)
 */
const art25Controls = [
    {
        id: 'DORA-25.1',
        name: 'Threat-Led Penetration Testing (TLPT) programme',
        description: 'Financial entities that are identified to carry out advanced testing by means of TLPT, shall, at least every 3 years, conduct advanced testing by means of TLPT. The TLPT shall cover several or all critical or important functions of a financial entity, and shall be performed on live production systems.',
        family: 'Art 25 - Advanced Testing TLPT',
        priority: 'P1',
        implementation: 'planned',
        evidence: [],
        crossReferences: ['NIST-CA-8', 'NIST-RA-5', 'SOC2-CC7.1'],
        owner: 'Security Testing Manager',
        notes: 'TLPT programme to be established with qualified external threat intelligence providers. 3-year cycle planning initiated.',
    },
    {
        id: 'DORA-25.2',
        name: 'TLPT scope and critical function coverage',
        description: 'TLPT shall cover several or all critical or important functions of a financial entity, and shall be performed on live production systems supporting such functions. Financial entities shall identify all relevant underlying ICT systems, processes and technologies supporting critical or important functions and ICT services, including those supporting the critical or important functions outsourced or contracted to ICT third-party service providers.',
        family: 'Art 25 - Advanced Testing TLPT',
        priority: 'P1',
        implementation: 'planned',
        evidence: [],
        crossReferences: ['NIST-CA-8', 'NIST-SA-11', 'SOC2-CC7.1'],
        owner: 'Security Testing Manager',
        notes: 'Critical function mapping for TLPT scope definition in progress. Production testing safeguards being developed.',
    },
    {
        id: 'DORA-25.3',
        name: 'TLPT conducted by qualified external testers',
        description: 'Financial entities shall engage only testers that are of the highest suitability and repute, possess technical and organisational capabilities, and are specifically experienced in threat intelligence, penetration testing and red team testing.',
        family: 'Art 25 - Advanced Testing TLPT',
        priority: 'P2',
        implementation: 'planned',
        evidence: [],
        crossReferences: ['NIST-CA-8', 'SOC2-CC5.1'],
        owner: 'Security Testing Manager',
        notes: 'Vendor qualification criteria for TLPT providers established. External tester selection process pending.',
    },
];
// =============================================================================
// CHAPTER V — THIRD-PARTY RISK MANAGEMENT (Art 28-44)
// =============================================================================
/**
 * Article 28-30: General Principles and Risk Assessment
 */
const art28_30Controls = [
    {
        id: 'DORA-28.1',
        name: 'Third-party ICT risk management strategy',
        description: 'Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework and in accordance with the principle of proportionality. They shall adopt, and regularly review, a strategy on ICT third-party risk.',
        family: 'Art 28-30 - Third-Party Risk General Principles',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('dora-28.1-001', 'ICT Third-Party Risk Management Strategy', 'Strategy for managing ICT third-party risk including risk appetite, due diligence processes, and ongoing monitoring requirements', '/policies/ict-third-party-risk-strategy.md'),
        ],
        crossReferences: ['NIST-SA-4', 'NIST-SA-9', 'NIST-SR-3', 'SOC2-CC9.2'],
        owner: 'Third-Party Risk Manager',
    },
    {
        id: 'DORA-28.2',
        name: 'Register of ICT third-party arrangements',
        description: 'Financial entities shall maintain and update at entity level and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers.',
        family: 'Art 28-30 - Third-Party Risk General Principles',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createConfigEvidence('dora-28.2-001', 'ICT Third-Party Service Provider Register', 'Comprehensive register of all ICT third-party contractual arrangements including service descriptions, criticality assessments, and dependency mapping', '/risk/ict-third-party-register.yaml'),
        ],
        crossReferences: ['NIST-SA-4', 'NIST-SR-3', 'SOC2-CC9.2'],
        owner: 'Third-Party Risk Manager',
    },
    {
        id: 'DORA-28.3',
        name: 'Pre-contractual due diligence',
        description: 'Financial entities shall, prior to entering into a contractual arrangement on the use of ICT services, undertake all due diligence on the prospective ICT third-party service provider and throughout the selection and assessment processes ensure that the ICT third-party service provider is suitable.',
        family: 'Art 28-30 - Third-Party Risk General Principles',
        priority: 'P1',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('dora-28.3-001', 'ICT Third-Party Due Diligence Procedure', 'Pre-contractual due diligence procedure including financial stability, security posture, business continuity, and regulatory compliance assessments', '/procedures/ict-third-party-due-diligence.md'),
        ],
        crossReferences: ['NIST-SA-4', 'NIST-SA-9', 'SOC2-CC9.2'],
        owner: 'Third-Party Risk Manager',
    },
    {
        id: 'DORA-30.1',
        name: 'Key contractual provisions for ICT services',
        description: 'The contractual arrangements on the use of ICT services shall include at least the following: clear and complete descriptions of all functions and ICT services, service level descriptions, provisions on accessibility, availability, integrity, security, protection of personal data, data locations, subcontracting, exit strategies, and audit rights.',
        family: 'Art 28-30 - Third-Party Risk General Principles',
        priority: 'P1',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('dora-30.1-001', 'ICT Service Contract Template', 'Standard contract template incorporating all DORA Art 30 required provisions: SLAs, security requirements, data protection, exit strategies, audit rights, and subcontracting controls', '/templates/ict-service-contract-template.md'),
        ],
        crossReferences: ['NIST-SA-4', 'NIST-SA-9', 'SOC2-CC9.2'],
        owner: 'Legal and Procurement',
        notes: 'Standard contractual template incorporating DORA provisions. Retrofit of existing contracts ongoing.',
    },
];
/**
 * Article 31-44: Oversight of Critical Third-Party Providers
 */
const art31_44Controls = [
    {
        id: 'DORA-31.1',
        name: 'Critical ICT third-party service provider designation',
        description: 'The ESAs shall, through the Joint Committee, designate the ICT third-party service providers that are critical for financial entities, taking into account the systemic impact, degree of substitutability, number of financial entities relying on the provider, and cross-border nature of services.',
        family: 'Art 31-44 - Critical Third-Party Oversight',
        priority: 'P2',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('dora-31.1-001', 'Critical Provider Assessment Criteria', 'Internal criteria for identifying and monitoring providers likely to be designated as critical by ESAs', '/risk/critical-provider-criteria.md'),
        ],
        crossReferences: ['NIST-SA-9', 'NIST-SR-3', 'SOC2-CC9.2'],
        owner: 'Third-Party Risk Manager',
        notes: 'Internal critical provider designation criteria established. Awaiting ESA finalisation of official designation process.',
    },
    {
        id: 'DORA-31.2',
        name: 'Concentration risk monitoring',
        description: 'Financial entities shall assess concentration risks arising from ICT third-party arrangements, including from those that are not easily substitutable. Financial entities shall report at least annually to competent authorities on the number of new arrangements on ICT services.',
        family: 'Art 31-44 - Critical Third-Party Oversight',
        priority: 'P2',
        implementation: 'implemented',
        evidence: [
            createPolicyEvidence('dora-31.2-001', 'ICT Concentration Risk Assessment', 'Annual concentration risk assessment documenting dependencies, substitutability analysis, and geographic distribution of critical ICT services', '/risk/concentration-risk-assessment.md'),
        ],
        crossReferences: ['NIST-SA-9', 'SOC2-CC9.1'],
        owner: 'Risk Manager',
    },
    {
        id: 'DORA-44.1',
        name: 'Exit strategy for critical ICT services',
        description: 'Financial entities shall have exit strategies in place for ICT third-party service providers, taking into account risks that may emerge at the level of the ICT third-party service provider, in particular a possible failure of the provider, a deterioration of the quality of the ICT services provided, any business disruption or any material risk arising in relation to the deployment of ICT services.',
        family: 'Art 31-44 - Critical Third-Party Oversight',
        priority: 'P1',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('dora-44.1-001', 'ICT Service Exit Strategy', 'Exit strategies for critical ICT third-party arrangements including transition plans, data portability provisions, and minimum notice periods', '/policies/ict-exit-strategy.md'),
        ],
        crossReferences: ['NIST-SA-4', 'SOC2-CC9.1'],
        owner: 'Third-Party Risk Manager',
        notes: 'Exit strategies documented for critical providers. Full testing of transition procedures in progress.',
    },
];
// =============================================================================
// CHAPTER VI — INFORMATION SHARING (Art 45)
// =============================================================================
/**
 * Article 45: Information Sharing Arrangements
 */
const art45Controls = [
    {
        id: 'DORA-45.1',
        name: 'Cyber threat intelligence sharing',
        description: 'Financial entities may exchange amongst themselves cyber threat information and intelligence, including indicators of compromise, tactics, techniques, and procedures, cyber security alerts and configuration tools, to the extent that such information and intelligence sharing: (a) is aimed at enhancing the digital operational resilience of financial entities; (b) takes place within trusted communities.',
        family: 'Art 45 - Information Sharing',
        priority: 'P2',
        implementation: 'partially-implemented',
        evidence: [
            createPolicyEvidence('dora-45.1-001', 'Cyber Threat Intelligence Sharing Policy', 'Policy governing participation in cyber threat intelligence sharing communities including data handling, anonymisation, and trusted community membership requirements', '/policies/threat-intelligence-sharing.md'),
        ],
        crossReferences: ['NIST-PM-1', 'SOC2-CC2.3'],
        owner: 'Threat Intelligence Manager',
        notes: 'Information sharing framework established. Active participation in financial sector ISACs under evaluation.',
    },
    {
        id: 'DORA-45.2',
        name: 'Information sharing notification to competent authorities',
        description: 'Financial entities shall notify competent authorities of their participation in the information sharing arrangements referred to in paragraph 1, upon validation of their membership, and of any changes in their participation.',
        family: 'Art 45 - Information Sharing',
        priority: 'P3',
        implementation: 'planned',
        evidence: [],
        crossReferences: ['NIST-PM-1', 'SOC2-CC2.3'],
        owner: 'Compliance Officer',
        notes: 'Notification process to be implemented upon formal information sharing community membership.',
    },
];
// =============================================================================
// DORA FRAMEWORK DEFINITION
// =============================================================================
/**
 * Complete EU DORA compliance framework definition.
 *
 * Contains controls across 5 chapters covering the full scope
 * of Regulation 2022/2554 on digital operational resilience for the
 * financial sector.
 *
 * Chapters covered: II (Art 5-16), III (Art 17-23), IV (Art 24-25),
 * V (Art 28-44), VI (Art 45)
 */
export const doraFramework = {
    id: 'dora',
    name: 'Digital Operational Resilience Act',
    version: '2022/2554',
    description: 'EU Regulation 2022/2554 on digital operational resilience for the financial sector, establishing uniform requirements for the security of network and information systems supporting the business processes of financial entities.',
    authority: 'European Parliament and Council of the European Union',
    controls: [
        ...art5_6Controls,
        ...art7_8Controls,
        ...art9Controls,
        ...art10Controls,
        ...art11Controls,
        ...art12Controls,
        ...art13Controls,
        ...art14_16Controls,
        ...art17_18Controls,
        ...art19_20Controls,
        ...art21_23Controls,
        ...art24Controls,
        ...art25Controls,
        ...art28_30Controls,
        ...art31_44Controls,
        ...art45Controls,
    ],
    effectiveDate: new Date('2025-01-17'),
};
// =============================================================================
// UTILITY FUNCTIONS
// =============================================================================
/**
 * Retrieve all controls belonging to a specific DORA chapter or article group.
 *
 * Matches controls whose `family` field starts with `"Art {chapter} -"` or
 * contains the chapter number in hyphenated article ranges (e.g., "Art 5-6",
 * "Art 28-30", "Art 31-44").
 *
 * @param chapter - The chapter article group start number (e.g., 5, 9, 17, 24, 28, 45)
 * @returns Array of controls for the specified chapter/article group
 */
export function getControlsByChapter(chapter) {
    return doraFramework.controls.filter((c) => {
        // Match "Art X -" prefix (where X equals the chapter)
        if (c.family.startsWith(`Art ${chapter} -`))
            return true;
        // Match hyphenated ranges like "Art 5-6 -", "Art 28-30 -", "Art 31-44 -"
        const rangeMatch = c.family.match(/^Art (\d+)-(\d+)/);
        if (rangeMatch) {
            const start = parseInt(rangeMatch[1], 10);
            const end = parseInt(rangeMatch[2], 10);
            return chapter >= start && chapter <= end;
        }
        return false;
    });
}
/**
 * Find a single control by its unique identifier.
 *
 * @param id - The control ID (e.g., 'DORA-5.1', 'DORA-25.1')
 * @returns The matching control, or undefined if not found
 */
export function getControlById(id) {
    return doraFramework.controls.find((c) => c.id === id);
}
/**
 * Retrieve all controls with a specific implementation status.
 *
 * @param status - The implementation status to filter by
 * @returns Array of controls matching the specified status
 */
export function getControlsByStatus(status) {
    return doraFramework.controls.filter((c) => c.implementation === status);
}
/**
 * Get a sorted list of all unique chapter families in the framework.
 *
 * @returns Sorted array of family strings
 */
export function getChapterFamilies() {
    const families = new Set();
    doraFramework.controls.forEach((c) => families.add(c.family));
    return Array.from(families).sort();
}
/**
 * Calculate compliance percentage by chapter, based on the ratio of
 * fully implemented controls to total controls.
 *
 * @returns Map of chapter article number to compliance percentage (0-100)
 */
export function getComplianceByChapter() {
    const result = new Map();
    const chapters = [5, 7, 9, 10, 11, 12, 13, 14, 17, 19, 21, 24, 25, 28, 31, 45];
    for (const ch of chapters) {
        const controls = getControlsByChapter(ch);
        if (controls.length === 0)
            continue;
        const implemented = controls.filter((c) => c.implementation === 'implemented').length;
        const pct = (implemented / controls.length) * 100;
        result.set(ch, pct);
    }
    return result;
}
/**
 * Get the testing requirements defined by DORA Art 24-25, including
 * the full list of testing types and TLPT requirements.
 *
 * @returns Object with testing types, TLPT requirements, and related controls
 */
export function getTestingRequirements() {
    const testingControls = [
        ...getControlsByChapter(24),
        ...getControlsByChapter(25),
    ];
    return {
        testingTypes: DORA_TESTING_TYPES,
        tlptRequired: true,
        tlptFrequency: 'At least every 3 years',
        controls: testingControls,
    };
}
export default doraFramework;
//# sourceMappingURL=dora.js.map