/**
 * CIS Critical Security Controls v8
 *
 * Center for Internet Security Controls
 *
 * @module compliance/cis
 */
/**
 * CIS control categories (Implementation Groups)
 */
export const CIS_CATEGORIES = [
    "Inventory and Control of Enterprise Assets",
    "Inventory and Control of Software Assets",
    "Data Protection",
    "Secure Configuration",
    "Account Management",
    "Access Control Management",
    "Continuous Vulnerability Management",
    "Audit Log Management",
    "Email and Web Browser Protections",
    "Malware Defenses",
    "Data Recovery",
    "Network Infrastructure Management",
    "Network Monitoring and Defense",
    "Security Awareness Training",
    "Service Provider Management",
    "Application Software Security",
    "Incident Response Management",
    "Penetration Testing",
];
/**
 * CIS Controls v8 relevant to code security
 */
export const CIS_CONTROLS = [
    // Control 2: Inventory and Control of Software Assets
    {
        id: "2.1",
        framework: "CIS",
        category: "Inventory and Control of Software Assets",
        title: "Establish and Maintain a Software Inventory",
        description: "Establish and maintain a detailed inventory of all licensed software installed on enterprise assets.",
        keywords: ["inventory", "SBOM", "software", "dependencies"],
        findingCategories: ["dependencies", "sbom"],
    },
    {
        id: "2.2",
        framework: "CIS",
        category: "Inventory and Control of Software Assets",
        title: "Ensure Authorized Software is Currently Supported",
        description: "Ensure that only currently supported software is designated as authorized.",
        keywords: ["supported", "EOL", "outdated", "deprecated"],
        findingCategories: ["dependencies", "vulnerabilities"],
    },
    {
        id: "2.5",
        framework: "CIS",
        category: "Inventory and Control of Software Assets",
        title: "Allowlist Authorized Software",
        description: "Use technical controls to ensure only authorized software can execute.",
        keywords: ["allowlist", "whitelist", "authorized"],
        findingCategories: ["security", "configuration"],
    },
    // Control 3: Data Protection
    {
        id: "3.1",
        framework: "CIS",
        category: "Data Protection",
        title: "Establish and Maintain a Data Management Process",
        description: "Establish and maintain a data management process that addresses data sensitivity, ownership, and handling.",
        keywords: ["data", "management", "classification"],
        findingCategories: ["data-exposure", "data-protection"],
    },
    {
        id: "3.10",
        framework: "CIS",
        category: "Data Protection",
        title: "Encrypt Sensitive Data in Transit",
        description: "Encrypt sensitive data in transit using strong encryption.",
        keywords: ["encryption", "transit", "TLS", "HTTPS"],
        findingCategories: ["encryption", "transport-security"],
        cweIds: ["CWE-319"],
    },
    {
        id: "3.11",
        framework: "CIS",
        category: "Data Protection",
        title: "Encrypt Sensitive Data at Rest",
        description: "Encrypt sensitive data at rest using strong encryption.",
        keywords: ["encryption", "rest", "storage", "cryptography"],
        findingCategories: ["encryption", "data-protection"],
        cweIds: ["CWE-311", "CWE-312"],
    },
    // Control 4: Secure Configuration
    {
        id: "4.1",
        framework: "CIS",
        category: "Secure Configuration",
        title: "Establish Secure Configuration Process",
        description: "Establish and maintain a secure configuration process for enterprise assets.",
        keywords: ["configuration", "hardening", "baseline"],
        findingCategories: ["configuration", "security"],
    },
    {
        id: "4.7",
        framework: "CIS",
        category: "Secure Configuration",
        title: "Manage Default Accounts",
        description: "Manage default accounts on enterprise assets and software.",
        keywords: ["default", "accounts", "credentials"],
        findingCategories: ["authentication", "secrets"],
        cweIds: ["CWE-798"],
    },
    // Control 5: Account Management
    {
        id: "5.1",
        framework: "CIS",
        category: "Account Management",
        title: "Establish Account Management Process",
        description: "Establish and maintain an inventory of all accounts managed in the enterprise.",
        keywords: ["accounts", "inventory", "management"],
        findingCategories: ["authentication", "identity"],
    },
    {
        id: "5.2",
        framework: "CIS",
        category: "Account Management",
        title: "Use Unique Passwords",
        description: "Use unique passwords for all enterprise assets.",
        keywords: ["passwords", "unique", "credentials"],
        findingCategories: ["authentication", "secrets"],
        cweIds: ["CWE-521"],
    },
    // Control 6: Access Control Management
    {
        id: "6.1",
        framework: "CIS",
        category: "Access Control Management",
        title: "Establish Access Granting Process",
        description: "Establish and maintain an access granting process for enterprise assets.",
        keywords: ["access", "granting", "authorization"],
        findingCategories: ["authorization", "access-control"],
        cweIds: ["CWE-284"],
    },
    {
        id: "6.3",
        framework: "CIS",
        category: "Access Control Management",
        title: "Require MFA for Externally-Exposed Applications",
        description: "Require MFA for externally-exposed enterprise or third-party applications.",
        keywords: ["MFA", "authentication", "external"],
        findingCategories: ["authentication", "mfa"],
        cweIds: ["CWE-308"],
    },
    {
        id: "6.5",
        framework: "CIS",
        category: "Access Control Management",
        title: "Require MFA for Administrative Access",
        description: "Require MFA for all administrative access accounts.",
        keywords: ["MFA", "admin", "administrative"],
        findingCategories: ["authentication", "mfa"],
        cweIds: ["CWE-308"],
    },
    // Control 7: Continuous Vulnerability Management
    {
        id: "7.1",
        framework: "CIS",
        category: "Continuous Vulnerability Management",
        title: "Establish Vulnerability Management Process",
        description: "Establish and maintain a documented vulnerability management process.",
        keywords: ["vulnerability", "management", "process"],
        findingCategories: ["vulnerabilities", "security"],
    },
    {
        id: "7.3",
        framework: "CIS",
        category: "Continuous Vulnerability Management",
        title: "Perform Automated Vulnerability Scans",
        description: "Perform automated vulnerability scans of internal enterprise assets.",
        keywords: ["scanning", "automated", "vulnerability"],
        findingCategories: ["vulnerabilities", "security"],
    },
    {
        id: "7.4",
        framework: "CIS",
        category: "Continuous Vulnerability Management",
        title: "Remediate Detected Vulnerabilities",
        description: "Remediate detected vulnerabilities in software through processes and tooling.",
        keywords: ["remediation", "patching", "fixing"],
        findingCategories: ["vulnerabilities", "dependencies"],
        cweIds: ["CWE-1035"],
    },
    // Control 8: Audit Log Management
    {
        id: "8.2",
        framework: "CIS",
        category: "Audit Log Management",
        title: "Collect Audit Logs",
        description: "Collect audit logs from all enterprise assets capable of generating them.",
        keywords: ["logging", "audit", "collection"],
        findingCategories: ["logging", "audit"],
        cweIds: ["CWE-778"],
    },
    {
        id: "8.5",
        framework: "CIS",
        category: "Audit Log Management",
        title: "Collect Detailed Audit Logs",
        description: "Configure detailed audit logging for enterprise assets containing sensitive data.",
        keywords: ["detailed", "logging", "sensitive"],
        findingCategories: ["logging", "audit"],
    },
    // Control 16: Application Software Security
    {
        id: "16.1",
        framework: "CIS",
        category: "Application Software Security",
        title: "Establish Application Security Process",
        description: "Establish and maintain a secure application development process.",
        keywords: ["application", "security", "SDLC"],
        findingCategories: ["security", "code-quality"],
    },
    {
        id: "16.2",
        framework: "CIS",
        category: "Application Software Security",
        title: "Establish Process for Third-Party Libraries",
        description: "Establish and maintain a process to accept and address reports of software vulnerabilities.",
        keywords: ["third-party", "libraries", "dependencies"],
        findingCategories: ["dependencies", "vulnerabilities"],
    },
    {
        id: "16.4",
        framework: "CIS",
        category: "Application Software Security",
        title: "Perform Root Cause Analysis",
        description: "Conduct root cause analysis on security vulnerabilities.",
        keywords: ["root-cause", "analysis", "vulnerabilities"],
        findingCategories: ["security", "vulnerabilities"],
    },
    {
        id: "16.5",
        framework: "CIS",
        category: "Application Software Security",
        title: "Use Up-to-Date Components",
        description: "Use up-to-date and trusted third-party software components.",
        keywords: ["components", "up-to-date", "dependencies"],
        findingCategories: ["dependencies", "vulnerabilities"],
        cweIds: ["CWE-1035"],
    },
    {
        id: "16.6",
        framework: "CIS",
        category: "Application Software Security",
        title: "Establish Code Repository Security",
        description: "Establish and maintain a process to protect code repositories.",
        keywords: ["repository", "code", "security"],
        findingCategories: ["secrets", "security"],
    },
    {
        id: "16.9",
        framework: "CIS",
        category: "Application Software Security",
        title: "Train Developers on Security",
        description: "Ensure developers are trained in application security topics.",
        keywords: ["training", "developers", "security"],
        findingCategories: ["security"],
    },
    {
        id: "16.10",
        framework: "CIS",
        category: "Application Software Security",
        title: "Apply Secure Design Principles",
        description: "Apply secure design principles in application architectures.",
        keywords: ["secure-design", "architecture", "principles"],
        findingCategories: ["security", "architecture"],
    },
    {
        id: "16.11",
        framework: "CIS",
        category: "Application Software Security",
        title: "Implement Web Application Firewalls",
        description: "Implement a Web Application Firewall (WAF) for web applications.",
        keywords: ["WAF", "firewall", "web"],
        findingCategories: ["security", "injection", "xss"],
        cweIds: ["CWE-89", "CWE-79"],
    },
    {
        id: "16.12",
        framework: "CIS",
        category: "Application Software Security",
        title: "Implement Code-Level Security Checks",
        description: "Apply static and dynamic application security testing tools.",
        keywords: ["SAST", "DAST", "testing", "security"],
        findingCategories: ["security", "code-quality"],
    },
];
/**
 * Get all CIS controls
 */
export function getCISControls() {
    return CIS_CONTROLS;
}
/**
 * Get CIS controls by category
 */
export function getCISControlsByCategory(category) {
    return CIS_CONTROLS.filter((c) => c.category === category);
}
/**
 * Get CIS categories
 */
export function getCISCategories() {
    return CIS_CATEGORIES;
}
//# sourceMappingURL=cis.js.map