/**
 * PCI-DSS v4.0 Compliance Controls
 *
 * Payment Card Industry Data Security Standard
 *
 * @module compliance/pci-dss
 */
/**
 * PCI-DSS control categories
 */
export const PCI_DSS_CATEGORIES = [
    "Build and Maintain a Secure Network",
    "Protect Cardholder Data",
    "Maintain a Vulnerability Management Program",
    "Implement Strong Access Control Measures",
    "Regularly Monitor and Test Networks",
    "Maintain an Information Security Policy",
];
/**
 * PCI-DSS v4.0 controls relevant to code security
 */
export const PCI_DSS_CONTROLS = [
    // Requirement 1: Install and maintain network security controls
    {
        id: "1.2.1",
        framework: "PCI-DSS",
        category: "Build and Maintain a Secure Network",
        title: "Configuration standards for network security controls",
        description: "Configuration standards exist for all network security controls and are consistent with industry-accepted hardening standards.",
        keywords: ["firewall", "network", "configuration", "hardening"],
        findingCategories: ["configuration", "network-security"],
    },
    // Requirement 2: Apply secure configurations
    {
        id: "2.2.1",
        framework: "PCI-DSS",
        category: "Build and Maintain a Secure Network",
        title: "System hardening standards",
        description: "Configuration standards are developed, implemented, and maintained to address known security vulnerabilities.",
        keywords: ["hardening", "configuration", "security", "defaults"],
        findingCategories: ["configuration", "security"],
    },
    {
        id: "2.2.6",
        framework: "PCI-DSS",
        category: "Build and Maintain a Secure Network",
        title: "Primary functions with different security levels",
        description: "System components that handle different security levels are managed to prevent the mixing of functionalities.",
        keywords: ["separation", "isolation", "security-levels"],
        findingCategories: ["architecture", "security"],
    },
    // Requirement 3: Protect stored account data
    {
        id: "3.4.1",
        framework: "PCI-DSS",
        category: "Protect Cardholder Data",
        title: "PAN rendered unreadable",
        description: "PAN is rendered unreadable anywhere it is stored using strong cryptography.",
        keywords: ["encryption", "PAN", "cardholder", "cryptography"],
        findingCategories: ["encryption", "data-exposure", "secrets"],
        cweIds: ["CWE-311", "CWE-312"],
    },
    {
        id: "3.5.1",
        framework: "PCI-DSS",
        category: "Protect Cardholder Data",
        title: "Access to stored account data is restricted",
        description: "Access to stored account data is restricted based on business need to know.",
        keywords: ["access-control", "account-data", "authorization"],
        findingCategories: ["authorization", "data-exposure"],
        cweIds: ["CWE-284", "CWE-285"],
    },
    // Requirement 4: Protect data with strong cryptography
    {
        id: "4.2.1",
        framework: "PCI-DSS",
        category: "Protect Cardholder Data",
        title: "Strong cryptography during transmission",
        description: "Strong cryptography is used to safeguard PAN during transmission over open, public networks.",
        keywords: ["TLS", "encryption", "transmission", "HTTPS"],
        findingCategories: ["encryption", "transport-security"],
        cweIds: ["CWE-319", "CWE-523"],
    },
    // Requirement 5: Protect systems from malicious software
    {
        id: "5.2.1",
        framework: "PCI-DSS",
        category: "Maintain a Vulnerability Management Program",
        title: "Malicious software detection",
        description: "An anti-malware solution is deployed on all systems commonly affected by malicious software.",
        keywords: ["malware", "antivirus", "security"],
        findingCategories: ["security", "malware"],
    },
    // Requirement 6: Develop and maintain secure systems
    {
        id: "6.2.1",
        framework: "PCI-DSS",
        category: "Maintain a Vulnerability Management Program",
        title: "Secure development processes",
        description: "Bespoke and custom software are developed securely.",
        keywords: ["secure-development", "SDLC", "coding"],
        findingCategories: ["security", "code-quality"],
    },
    {
        id: "6.2.4",
        framework: "PCI-DSS",
        category: "Maintain a Vulnerability Management Program",
        title: "Software engineering techniques prevent attacks",
        description: "Software engineering techniques prevent or mitigate common software attacks.",
        keywords: [
            "injection",
            "XSS",
            "CSRF",
            "buffer-overflow",
            "security-controls",
        ],
        findingCategories: ["injection", "xss", "csrf", "security"],
        cweIds: ["CWE-89", "CWE-79", "CWE-352", "CWE-120"],
    },
    {
        id: "6.3.1",
        framework: "PCI-DSS",
        category: "Maintain a Vulnerability Management Program",
        title: "Security vulnerabilities identified and managed",
        description: "Security vulnerabilities are identified and managed through a formal process.",
        keywords: ["vulnerability", "patching", "CVE", "remediation"],
        findingCategories: ["dependencies", "vulnerabilities"],
        cweIds: ["CWE-1035"],
    },
    {
        id: "6.3.2",
        framework: "PCI-DSS",
        category: "Maintain a Vulnerability Management Program",
        title: "Inventory of custom software",
        description: "An inventory of bespoke and custom software and third-party components is maintained.",
        keywords: ["inventory", "SBOM", "dependencies", "components"],
        findingCategories: ["dependencies", "sbom"],
    },
    // Requirement 7: Restrict access by business need to know
    {
        id: "7.2.1",
        framework: "PCI-DSS",
        category: "Implement Strong Access Control Measures",
        title: "Access control model",
        description: "An access control model is defined and implemented to restrict access based on business need to know.",
        keywords: ["access-control", "authorization", "need-to-know"],
        findingCategories: ["authorization", "access-control"],
        cweIds: ["CWE-284", "CWE-285"],
    },
    {
        id: "7.2.5",
        framework: "PCI-DSS",
        category: "Implement Strong Access Control Measures",
        title: "Application and system accounts restricted",
        description: "Access for application and system accounts is limited to the minimum required.",
        keywords: ["service-accounts", "least-privilege", "permissions"],
        findingCategories: ["authorization", "configuration"],
    },
    // Requirement 8: Identify users and authenticate access
    {
        id: "8.2.1",
        framework: "PCI-DSS",
        category: "Implement Strong Access Control Measures",
        title: "Unique identification for all users",
        description: "All users are assigned a unique ID before allowing them to access system components.",
        keywords: ["authentication", "user-id", "identity"],
        findingCategories: ["authentication", "identity"],
        cweIds: ["CWE-287"],
    },
    {
        id: "8.3.1",
        framework: "PCI-DSS",
        category: "Implement Strong Access Control Measures",
        title: "Strong authentication for users and administrators",
        description: "Strong authentication mechanisms are implemented for user and administrative access.",
        keywords: ["MFA", "authentication", "password", "strong-auth"],
        findingCategories: ["authentication", "mfa"],
        cweIds: ["CWE-287", "CWE-308"],
    },
    {
        id: "8.6.1",
        framework: "PCI-DSS",
        category: "Implement Strong Access Control Measures",
        title: "System or application accounts managed",
        description: "If accounts used by systems or applications can be used for interactive login, they are managed and controlled.",
        keywords: ["service-accounts", "system-accounts", "credentials"],
        findingCategories: ["authentication", "secrets"],
    },
    // Requirement 10: Track and monitor access
    {
        id: "10.2.1",
        framework: "PCI-DSS",
        category: "Regularly Monitor and Test Networks",
        title: "Audit logs capture security events",
        description: "Audit logs capture all individual user access to cardholder data.",
        keywords: ["logging", "audit", "monitoring"],
        findingCategories: ["logging", "audit"],
        cweIds: ["CWE-778"],
    },
    {
        id: "10.3.1",
        framework: "PCI-DSS",
        category: "Regularly Monitor and Test Networks",
        title: "Audit log protection",
        description: "Audit logs are protected from unauthorized modification.",
        keywords: ["log-integrity", "tampering", "protection"],
        findingCategories: ["logging", "integrity"],
    },
    // Requirement 11: Test security regularly
    {
        id: "11.3.1",
        framework: "PCI-DSS",
        category: "Regularly Monitor and Test Networks",
        title: "Vulnerability scans",
        description: "Internal vulnerability scans are performed at least quarterly and after any significant change.",
        keywords: ["scanning", "vulnerability", "testing"],
        findingCategories: ["vulnerabilities", "security"],
    },
    {
        id: "11.4.1",
        framework: "PCI-DSS",
        category: "Regularly Monitor and Test Networks",
        title: "Penetration testing",
        description: "Penetration testing is performed at least annually and after any significant change.",
        keywords: ["pentest", "penetration", "testing"],
        findingCategories: ["security", "testing"],
    },
];
/**
 * Get all PCI-DSS controls
 */
export function getPCIDSSControls() {
    return PCI_DSS_CONTROLS;
}
/**
 * Get PCI-DSS controls by category
 */
export function getPCIDSSControlsByCategory(category) {
    return PCI_DSS_CONTROLS.filter((c) => c.category === category);
}
/**
 * Get PCI-DSS categories
 */
export function getPCIDSSCategories() {
    return PCI_DSS_CATEGORIES;
}
//# sourceMappingURL=pci-dss.js.map