/**
 * Framework Attestation Content
 *
 * Framework-specific attestation text for audit-defensible compliance reports.
 * Each framework has methodology, scope limitations, and auditor notes.
 *
 * @module compliance/attestation
 */
/**
 * Attestation content for each compliance framework
 */
export const FRAMEWORK_ATTESTATIONS = {
    "SOC2": {
        fullName: "SOC 2 Trust Services Criteria",
        methodology: [
            "**Deterministic Scanning:** Pattern-based detection of security vulnerabilities using Semgrep, gitleaks, npm audit, and other static analyzers",
            "**Control Mapping:** Automated mapping of security findings to SOC 2 Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy)",
            "**Severity Correlation:** Finding severity to control risk impact correlation",
            "**Tamper-Evident Logging:** Hash-chained audit trail with optional Sigstore signing",
            "**Evidence Collection:** Cryptographically attested artifacts for audit defensibility",
        ],
        scopeLimitations: [
            "Formal SOC 2 Type I or Type II examination by a licensed CPA firm",
            "Organizational policies and procedures documentation review",
            "Management assertion and system description validation",
            "Physical and environmental security controls assessment",
            "Personnel security and HR process verification",
            "Vendor and third-party risk management review",
        ],
        auditorNote: "This automated assessment identifies technical gaps in your security posture. A licensed CPA firm must perform the formal SOC 2 examination. This report can serve as evidence of continuous monitoring for your auditor.",
    },
    "ISO27001": {
        fullName: "ISO/IEC 27001:2022 Information Security Management",
        methodology: [
            "**Deterministic Scanning:** Pattern-based detection using static analysis tools aligned with ISO 27001 Annex A controls",
            "**Control Mapping:** Automated mapping of findings to ISO 27001 Annex A control objectives",
            "**Risk Assessment:** Finding severity to control impact correlation per ISO 27001 risk methodology",
            "**Tamper-Evident Logging:** Hash-chained audit trail for evidence integrity",
            "**Evidence Collection:** Cryptographically attested artifacts supporting certification audits",
        ],
        scopeLimitations: [
            "Formal ISO 27001 certification audit by an accredited certification body",
            "ISMS documentation review (policies, procedures, risk assessment)",
            "Management review and leadership commitment verification",
            "Internal audit program evaluation",
            "Physical security and environmental controls",
            "Human resource security processes",
            "Business continuity planning review",
        ],
        auditorNote: "This automated assessment supports your ISO 27001 Statement of Applicability evidence. Certification must be performed by an accredited certification body. This report demonstrates continuous technical control monitoring.",
    },
    "PCI-DSS": {
        fullName: "PCI DSS v4.0 Payment Card Industry Data Security Standard",
        methodology: [
            "**Deterministic Scanning:** Pattern-based detection for PCI DSS technical requirements (encryption, authentication, logging)",
            "**Control Mapping:** Automated mapping to PCI DSS v4.0 requirements",
            "**Cardholder Data Detection:** Scanning for potential PAN, CVV, and sensitive authentication data exposure",
            "**Tamper-Evident Logging:** Hash-chained audit trail meeting PCI DSS logging requirements",
            "**Evidence Collection:** Cryptographically attested artifacts for QSA review",
        ],
        scopeLimitations: [
            "Formal PCI DSS assessment by a Qualified Security Assessor (QSA)",
            "Network segmentation validation and penetration testing",
            "Cardholder data environment (CDE) scope determination",
            "Physical security controls at data center locations",
            "Personnel background checks and security awareness training",
            "Vendor and service provider compliance validation",
            "Incident response testing and tabletop exercises",
        ],
        auditorNote: "This automated assessment identifies technical gaps relevant to PCI DSS requirements. A QSA must perform the formal assessment. For SAQ merchants, this report provides evidence of continuous security monitoring.",
    },
    "HIPAA": {
        fullName: "HIPAA Security Rule (45 CFR Part 164)",
        methodology: [
            "**Deterministic Scanning:** Pattern-based detection of PHI exposure, access control gaps, and audit trail deficiencies",
            "**Control Mapping:** Automated mapping to HIPAA Security Rule administrative, physical, and technical safeguards",
            "**PHI Detection:** Scanning for Protected Health Information in code, logs, and configuration",
            "**Tamper-Evident Logging:** Hash-chained audit trail meeting HIPAA audit requirements",
            "**Evidence Collection:** Cryptographically attested artifacts for OCR investigation readiness",
        ],
        scopeLimitations: [
            "Formal HIPAA compliance audit or OCR investigation response",
            "Administrative safeguards (policies, training, sanctions)",
            "Physical safeguards (facility access, workstation security)",
            "Business Associate Agreement (BAA) review and management",
            "Risk analysis and management program evaluation",
            "Incident response and breach notification procedures",
            "Employee training and security awareness programs",
        ],
        auditorNote: "This automated assessment identifies technical gaps in HIPAA Security Rule compliance. This does not constitute a formal compliance audit. The report demonstrates reasonable technical safeguards and continuous monitoring.",
    },
    "42-CFR-PART-2": {
        fullName: "42 CFR Part 2 - Confidentiality of Substance Use Disorder Patient Records",
        methodology: [
            "**Deterministic Scanning:** Pattern-based detection of SUD record disclosure, consent validation, and audit gaps",
            "**Control Mapping:** Automated mapping to 42 CFR Part 2 confidentiality requirements",
            "**SUD-Specific Detection:** Scanning for substance use disorder information disclosure patterns",
            "**Consent Validation:** Detection of consent bypass and missing authorization checks",
            "**Tamper-Evident Logging:** Hash-chained audit trail meeting federal audit requirements",
            "**Evidence Collection:** Cryptographically attested artifacts for SAMHSA compliance review",
        ],
        scopeLimitations: [
            "Formal 42 CFR Part 2 compliance review by qualified counsel or auditor",
            "Written consent form and process validation",
            "Qualified Service Organization Agreement (QSOA) review",
            "Re-disclosure notice and prohibition verification",
            "Patient rights and complaint procedures",
            "Program staff training on SUD confidentiality",
            "Court order and law enforcement request procedures",
        ],
        auditorNote: "42 CFR Part 2 provides stricter protections than HIPAA for substance use disorder records. This automated assessment identifies technical gaps. Legal counsel should review consent forms and disclosure procedures.",
    },
    "CIS": {
        fullName: "CIS Critical Security Controls v8",
        methodology: [
            "**Deterministic Scanning:** Pattern-based detection aligned with CIS Controls implementation groups",
            "**Control Mapping:** Automated mapping to CIS Controls v8 safeguards",
            "**Implementation Group Assessment:** Findings categorized by IG1, IG2, IG3 applicability",
            "**Tamper-Evident Logging:** Hash-chained audit trail for evidence integrity",
            "**Evidence Collection:** Cryptographically attested artifacts for security assessment",
        ],
        scopeLimitations: [
            "Formal CIS Controls assessment or CIS-CAT Pro benchmark",
            "Asset inventory and hardware/software management verification",
            "Network infrastructure and perimeter security assessment",
            "Vulnerability management program effectiveness review",
            "Security awareness training program evaluation",
            "Incident response capability testing",
            "Data protection and backup verification",
        ],
        auditorNote: "This automated assessment maps findings to CIS Controls safeguards. For formal benchmarking, use CIS-CAT Pro or engage a certified assessor. This report demonstrates continuous security control monitoring.",
    },
    "GDPR": {
        fullName: "General Data Protection Regulation (EU) 2016/679",
        methodology: [
            "**Deterministic Scanning:** Pattern-based detection of personal data exposure and processing issues",
            "**Control Mapping:** Automated mapping to GDPR articles and technical requirements",
            "**Personal Data Detection:** Scanning for PII exposure in code, logs, and configuration",
            "**Data Protection Impact:** Finding severity correlation to data subject rights impact",
            "**Tamper-Evident Logging:** Hash-chained audit trail for accountability demonstration",
            "**Evidence Collection:** Cryptographically attested artifacts for DPA inquiry readiness",
        ],
        scopeLimitations: [
            "Formal Data Protection Impact Assessment (DPIA)",
            "Records of Processing Activities (RoPA) review",
            "Data Subject Rights implementation verification",
            "Lawful basis determination and documentation",
            "Data Protection Officer (DPO) designation assessment",
            "Cross-border transfer mechanism validation",
            "Vendor and processor agreement review",
            "Privacy notice and consent mechanism audit",
        ],
        auditorNote: "This automated assessment identifies technical gaps relevant to GDPR Article 32 security requirements. A Data Protection Officer or qualified privacy professional should conduct comprehensive GDPR compliance review.",
    },
    "NIST-800-53": {
        fullName: "NIST SP 800-53 Rev. 5 Security and Privacy Controls",
        methodology: [
            "**Deterministic Scanning:** Pattern-based detection aligned with NIST 800-53 control families",
            "**Control Mapping:** Automated mapping to NIST 800-53 Rev. 5 controls and control enhancements",
            "**Baseline Assessment:** Findings mapped to Low, Moderate, and High impact baselines",
            "**Control Family Coverage:** Assessment across Access Control, Audit, Configuration Management, and other families",
            "**Tamper-Evident Logging:** Hash-chained audit trail meeting federal logging requirements",
            "**Evidence Collection:** Cryptographically attested artifacts for FedRAMP/FISMA compliance",
        ],
        scopeLimitations: [
            "Formal NIST 800-53 assessment by accredited assessor (3PAO for FedRAMP)",
            "System Security Plan (SSP) documentation review",
            "Plan of Action and Milestones (POA&M) validation",
            "Continuous monitoring program evaluation",
            "Authorization boundary and system categorization",
            "Interconnection security agreements",
            "Contingency planning and testing",
            "Personnel security and training verification",
        ],
        auditorNote: "This automated assessment maps findings to NIST 800-53 controls. For FedRAMP authorization, a 3PAO must conduct the formal assessment. For FISMA, the agency Authorizing Official makes the final determination.",
    },
    // AI-Specific Frameworks
    "OWASP-LLM": {
        fullName: "OWASP LLM Top 10 for Large Language Model Applications",
        methodology: [
            "**LLM-Specific Scanning:** Detection of prompt injection, insecure output handling, and training data poisoning vulnerabilities",
            "**Control Mapping:** Automated mapping to OWASP LLM Top 10 risk categories",
            "**Agent Security:** Assessment of tool use boundaries, permission escalation, and data exfiltration paths",
            "**Trust Boundary Analysis:** Evaluation of LLM input/output trust boundaries and sanitization",
            "**Tamper-Evident Logging:** Hash-chained audit trail for AI security evidence",
            "**Evidence Collection:** Cryptographically attested artifacts for security assessment",
        ],
        scopeLimitations: [
            "Formal red-team adversarial testing of LLM systems",
            "Model training data provenance and bias analysis",
            "Prompt engineering security review",
            "Human-in-the-loop procedure verification",
            "Model supply chain security assessment",
            "Production deployment architecture review",
            "Incident response procedures for AI failures",
        ],
        auditorNote: "This automated assessment identifies technical vulnerabilities in LLM applications per OWASP guidance. AI security requires ongoing red-team testing and adversarial evaluation beyond static analysis.",
    },
    "NIST-AI-RMF": {
        fullName: "NIST AI Risk Management Framework 1.0",
        methodology: [
            "**AI Risk Detection:** Scanning for risks across NIST AI RMF functions (Govern, Map, Measure, Manage)",
            "**Trustworthy AI Mapping:** Assessment against trustworthy AI characteristics (valid, reliable, safe, secure, accountable, transparent, explainable, fair)",
            "**Control Mapping:** Automated mapping to NIST AI RMF subcategories",
            "**Risk Measurement:** Finding severity correlation to AI risk levels",
            "**Tamper-Evident Logging:** Hash-chained audit trail for AI governance evidence",
            "**Evidence Collection:** Cryptographically attested artifacts for AI risk assessment",
        ],
        scopeLimitations: [
            "Formal AI risk assessment by qualified AI governance professionals",
            "AI impact assessment and stakeholder engagement",
            "Model performance and fairness evaluation",
            "Organizational AI governance program maturity",
            "Human oversight and accountability structures",
            "AI incident management and response procedures",
            "Third-party AI component risk assessment",
        ],
        auditorNote: "This automated assessment maps findings to NIST AI RMF controls. Comprehensive AI risk management requires organizational governance, human oversight, and ongoing monitoring beyond technical controls.",
    },
    "MITRE-ATLAS": {
        fullName: "MITRE ATLAS (Adversarial Threat Landscape for AI Systems)",
        methodology: [
            "**Adversarial Technique Detection:** Scanning for vulnerabilities mapped to MITRE ATLAS tactics and techniques",
            "**Attack Surface Analysis:** Identification of ML attack vectors (reconnaissance, resource development, initial access, execution, persistence, evasion, impact)",
            "**Control Mapping:** Automated mapping to ATLAS mitigations",
            "**Threat Modeling:** Finding correlation to known adversarial ML attack patterns",
            "**Tamper-Evident Logging:** Hash-chained audit trail for security evidence",
            "**Evidence Collection:** Cryptographically attested artifacts for threat assessment",
        ],
        scopeLimitations: [
            "Active adversarial testing and red-team exercises",
            "Model robustness and adversarial example testing",
            "Data poisoning and backdoor detection",
            "Model extraction and inversion attacks assessment",
            "Supply chain security for ML components",
            "Incident response for adversarial AI attacks",
            "Threat intelligence integration for ML systems",
        ],
        auditorNote: "This automated assessment identifies vulnerabilities mapped to MITRE ATLAS adversarial techniques. Active red-team testing and adversarial evaluation are essential for comprehensive ML security assessment.",
    },
    "EU-AI-ACT": {
        fullName: "EU AI Act (Regulation 2024/1689)",
        methodology: [
            "**Risk Classification:** Assessment against EU AI Act risk categories (unacceptable, high-risk, limited, minimal)",
            "**High-Risk AI Requirements:** Scanning for technical requirements applicable to high-risk AI systems",
            "**Control Mapping:** Automated mapping to EU AI Act articles and annexes",
            "**Transparency Requirements:** Detection of AI system disclosure and documentation gaps",
            "**Tamper-Evident Logging:** Hash-chained audit trail for regulatory evidence",
            "**Evidence Collection:** Cryptographically attested artifacts for compliance demonstration",
        ],
        scopeLimitations: [
            "Formal conformity assessment by notified bodies (for high-risk AI)",
            "AI system registration and documentation review",
            "Fundamental rights impact assessment",
            "Quality management system evaluation",
            "Human oversight implementation verification",
            "Post-market monitoring procedures",
            "Incident reporting and recall procedures",
        ],
        auditorNote: "This automated assessment identifies technical gaps relevant to EU AI Act requirements. High-risk AI systems require conformity assessment by notified bodies. Legal counsel should advise on risk classification and applicable obligations.",
    },
    "ISO-42001": {
        fullName: "ISO/IEC 42001:2023 AI Management System",
        methodology: [
            "**AIMS Control Assessment:** Scanning for alignment with ISO 42001 AI management system controls",
            "**Control Mapping:** Automated mapping to ISO 42001 Annex A and Annex B controls",
            "**Risk-Based Assessment:** Finding severity correlation to AI risk management requirements",
            "**Documentation Detection:** Identification of required AI system documentation gaps",
            "**Tamper-Evident Logging:** Hash-chained audit trail for certification evidence",
            "**Evidence Collection:** Cryptographically attested artifacts supporting AIMS certification",
        ],
        scopeLimitations: [
            "Formal ISO 42001 certification audit by accredited certification body",
            "AI policy and objectives documentation review",
            "AI system lifecycle management evaluation",
            "Leadership commitment and AI governance verification",
            "Competence and awareness program assessment",
            "Internal audit program for AI management",
            "Continual improvement process evaluation",
        ],
        auditorNote: "This automated assessment supports ISO 42001 Statement of Applicability evidence. Certification must be performed by an accredited certification body. This report demonstrates continuous AI management system monitoring.",
    },
};
/**
 * Get attestation content for a framework
 */
export function getFrameworkAttestation(framework) {
    return FRAMEWORK_ATTESTATIONS[framework];
}
/**
 * Format attestation section as markdown
 */
export function formatAttestationAsMarkdown(framework) {
    const attestation = FRAMEWORK_ATTESTATIONS[framework];
    const lines = [];
    lines.push("## Attestation");
    lines.push("");
    lines.push(`This report was generated through automated security scanning and compliance mapping for **${attestation.fullName}**.`);
    lines.push("");
    lines.push("### Assessment Methodology");
    lines.push("");
    for (const step of attestation.methodology) {
        lines.push(`- ${step}`);
    }
    lines.push("");
    lines.push("### Scope Limitations");
    lines.push("");
    lines.push("This automated assessment does **NOT** replace:");
    lines.push("");
    for (const limitation of attestation.scopeLimitations) {
        lines.push(`- ${limitation}`);
    }
    lines.push("");
    lines.push("### Auditor Note");
    lines.push("");
    lines.push(`> ${attestation.auditorNote}`);
    lines.push("");
    return lines.join("\n");
}
/**
 * Format attestation for multi-framework report
 */
export function formatMultiFrameworkAttestationAsMarkdown(frameworks) {
    const lines = [];
    lines.push("## Attestation");
    lines.push("");
    lines.push("This report was generated through automated security scanning and compliance mapping for the following frameworks:");
    lines.push("");
    for (const framework of frameworks) {
        const attestation = FRAMEWORK_ATTESTATIONS[framework];
        lines.push(`- **${attestation.fullName}**`);
    }
    lines.push("");
    lines.push("### Assessment Methodology");
    lines.push("");
    lines.push("The following methodology was applied across all frameworks:");
    lines.push("");
    lines.push("1. **Deterministic Scanning:** Pattern-based detection using static analysis tools (Semgrep, gitleaks, npm audit, Bandit, Gosec, etc.)");
    lines.push("2. **Finding-to-Control Mapping:** Automated mapping of security findings to framework-specific controls");
    lines.push("3. **Severity Correlation:** Finding severity to control risk impact assessment");
    lines.push("4. **Tamper-Evident Logging:** Hash-chained audit trail with optional Sigstore signing");
    lines.push("5. **Evidence Collection:** Cryptographically attested artifacts for audit defensibility");
    lines.push("");
    lines.push("### Scope Limitations");
    lines.push("");
    lines.push("This automated assessment does **NOT** replace:");
    lines.push("");
    lines.push("- Formal compliance audits by accredited assessors or certification bodies");
    lines.push("- Organizational policies, procedures, and governance documentation");
    lines.push("- Physical security and environmental controls assessment");
    lines.push("- Personnel security, training, and awareness programs");
    lines.push("- Vendor and third-party risk management reviews");
    lines.push("- Business continuity and incident response testing");
    lines.push("");
    lines.push("### Framework-Specific Notes");
    lines.push("");
    for (const framework of frameworks) {
        const attestation = FRAMEWORK_ATTESTATIONS[framework];
        lines.push(`**${framework}:** ${attestation.auditorNote}`);
        lines.push("");
    }
    return lines.join("\n");
}
//# sourceMappingURL=attestation.js.map