@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/packs/iec-62443.js

@@ -0,0 +1,686 @@
+/**
+ * IEC 62443 Industrial Automation and Control Systems Security Compliance Pack
+ *
+ * IEC 62443 (formerly ISA-99) -- international multi-part standard family for
+ * the cybersecurity of Industrial Automation and Control Systems (IACS).
+ * 14 published parts spanning policy, procedures, system design, and product
+ * requirements. The standard addresses asset owners, service providers,
+ * system integrators, and product suppliers across all OT-connected sectors.
+ *
+ * Standards referenced (citations only; no verbatim text from the standard):
+ *   - IEC 62443-1-1:2009 — Terminology, concepts and models
+ *   - IEC 62443-2-1:2010 — Establishing an IACS security program (CSMS)
+ *   - IEC 62443-2-2 (draft) — IACS security protection rating
+ *   - IEC 62443-2-3:2015 — Patch management in the IACS environment
+ *   - IEC 62443-2-4:2015+AMD1:2017 — Security program requirements for
+ *     IACS service providers
+ *   - IEC 62443-3-2:2020 — Security risk assessment for system design
+ *     (zone and conduit model; Security Level Target assignment)
+ *   - IEC 62443-3-3:2013 — System security requirements and security levels
+ *     (7 Foundational Requirements; Security Level 1-4 controls)
+ *   - IEC 62443-4-1:2018 — Secure product development lifecycle (SDL)
+ *   - IEC 62443-4-2:2019 — Technical security requirements for IACS
+ *     components (component-level security requirements)
+ *   - ISA-99 (origin body; ISA/IEC joint sponsorship)
+ *   - EU NIS2 Directive (EU) 2022/2555 — Operators of Essential Services (OES)
+ *     and Digital Service Providers (DSPs); significant incident notification 24h
+ *   - ENISA IACS/OT cybersecurity reference framework (2022)
+ *   - NIST SP 800-82 Rev. 3 — Guide to OT Security (US sister standard)
+ *   - IEC 61508 — Functional safety of E/E/PE systems (parent SIL standard)
+ *   - IECEE CB scheme (product certifications against IEC 62443-4-2)
+ *
+ * Security Level Classification (IEC 62443-3-2 §5.4 + IEC 62443-3-3 §4):
+ *   Security Level Target (SL-T) is assigned per zone/conduit following risk
+ *   assessment. Process burden and required controls scale with SL.
+ *
+ *   | SL | Threat profile                                                   |
+ *   |----|------------------------------------------------------------------|
+ *   |  1 | Casual / coincidental violation; generic off-the-shelf scanning |
+ *   |  2 | Intentional with simple means + low resources; generic IT tools  |
+ *   |  3 | Intentional with sophisticated means + IACS skills; targeted OT  |
+ *   |  4 | Nation-state actor; Stuxnet-class; extended resources + skills   |
+ *
+ *   Default when SL not declared: SL 2 (conservative per governance-runtime).
+ *
+ * Foundational Requirements (FR) — IEC 62443-3-3 §4:
+ *   FR 1 — Identification and Authentication Control (IAC)
+ *   FR 2 — Use Control (UC)
+ *   FR 3 — System Integrity (SI)
+ *   FR 4 — Data Confidentiality (DC)
+ *   FR 5 — Restricted Data Flow (RDF) — zone + conduit segmentation
+ *   FR 6 — Timely Response to Events (TRE)
+ *   FR 7 — Resource Availability (RA)
+ *
+ * Zone and Conduit Model (IEC 62443-3-2 §5.5):
+ *   IACS assets are grouped into security zones based on function, risk level,
+ *   and required Security Level. Conduits are the controlled communication
+ *   paths between zones. The zone/conduit model is the central architecture
+ *   artefact for IEC 62443 system security.
+ *
+ * Key sectors and customers:
+ *   Manufacturing — automotive plants, food & beverage, semiconductor fabs
+ *   Oil & gas — upstream exploration, midstream pipelines, LNG terminals
+ *   Electric utilities — generation, transmission, distribution, smart grid
+ *   Water / wastewater — treatment plants, SCADA-controlled distribution
+ *   Industrial IoT — connected sensors, edge controllers, OT gateways
+ *   System integrators — Rockwell, Schneider Electric, Siemens, Honeywell,
+ *                         ABB, Emerson, Yokogawa, Mitsubishi Electric
+ *   Product suppliers — IACS component OEMs certifying to IEC 62443-4-2
+ *
+ * Retention:
+ *   IEC 62443-2-1 CSMS documentation: common ICS asset-owner baseline is
+ *   7 years (2555 days), aligned with NIS2 Directive records obligations
+ *   for Operators of Essential Services (OES). Some sectors (nuclear,
+ *   critical infrastructure) impose longer sector-specific periods; this
+ *   pack uses the 7-year NIS2 / common ICS baseline.
+ *
+ * @connexum/ai-governance
+ */
+/**
+ * IEC 62443 category classifiers.
+ *
+ * Covers Security Level declarations (SL 1-4), zone and conduit model
+ * artefacts, CSMS documentation, and Foundational Requirement control
+ * records per IEC 62443-3-3.
+ */
+export const IEC_62443_CATEGORY_CLASSIFIERS = {
+    /**
+     * SL4 — Security Level 4: nation-state threat (IEC 62443-3-2 §5.4).
+     * Intentional violation using sophisticated means, extended resources,
+     * and IACS-specific skills. Stuxnet-class adversaries. Unauthorized
+     * changes BLOCKED — requires full security impact analysis + OT security
+     * lead sign-off before any action is taken.
+     */
+    SL4: {
+        references: [
+            'IEC 62443-3-2:2020 §5.4 — Security Level Target assignment',
+            'IEC 62443-3-3:2013 §4 — SL 4 system security requirements',
+        ],
+        classifier: (input) => {
+            if (/\b(?:SL[_\s-]?4|security[_\s-]level[_\s-]?4|SL4|sl4_zone|sl_4)\b/i.test(input))
+                return true;
+            if (/\b(?:nation.?state\s+(?:ICS|OT|IACS|industrial)|stuxnet[_\s-]class|advanced\s+persistent\s+threat\s+(?:ICS|OT|IACS|SL4))\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * SL3 — Security Level 3: sophisticated targeted OT attacker (IEC 62443-3-2 §5.4).
+     * Intentional violation with sophisticated means, moderate resources, and
+     * IACS-specific knowledge. Examples: competitor industrial espionage,
+     * hacktivist groups with OT expertise. Changes require approval gate.
+     */
+    SL3: {
+        references: [
+            'IEC 62443-3-2:2020 §5.4 — Security Level Target assignment',
+            'IEC 62443-3-3:2013 §4 — SL 3 system security requirements',
+        ],
+        classifier: (input) => {
+            if (/\b(?:SL[_\s-]?3|security[_\s-]level[_\s-]?3|SL3|sl3_zone|sl_3)\b/i.test(input))
+                return true;
+            if (/\b(?:sophisticated\s+(?:ICS|OT|IACS)\s+attacker|targeted\s+(?:industrial|OT|ICS)\s+attack\s+SL3)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * SL2 — Security Level 2: generic IT attacker with public tools (IEC 62443-3-2 §5.4).
+     * Intentional violation with simple means, low resources; generic IT-style
+     * tooling (Metasploit, Shodan scanning). Default classification when SL
+     * is not declared. Anomaly closure requires approval.
+     */
+    SL2: {
+        references: [
+            'IEC 62443-3-2:2020 §5.4 — Security Level Target assignment',
+            'IEC 62443-3-3:2013 §4 — SL 2 system security requirements',
+        ],
+        classifier: (input) => {
+            if (/\b(?:SL[_\s-]?2|security[_\s-]level[_\s-]?2|SL2|sl2_zone|sl_2)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * SL1 — Security Level 1: casual / coincidental violation (IEC 62443-3-2 §5.4).
+     * Unintentional or incidental threats; generic off-the-shelf scanning by
+     * a curious operator. LOG with audit record. Minimum process burden.
+     */
+    SL1: {
+        references: [
+            'IEC 62443-3-2:2020 §5.4 — Security Level Target assignment',
+            'IEC 62443-3-3:2013 §4 — SL 1 system security requirements',
+        ],
+        classifier: (input) => {
+            if (/\b(?:SL[_\s-]?1|security[_\s-]level[_\s-]?1|SL1|sl1_zone|sl_1)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * ZONE_CONDUIT_ARTEFACT — Zone and conduit model documentation
+     * (IEC 62443-3-2 §5.5). Foundational architecture artefact grouping
+     * IACS assets into security zones and defining controlled conduits.
+     * Changes require security impact review.
+     */
+    ZONE_CONDUIT_ARTEFACT: {
+        references: [
+            'IEC 62443-3-2:2020 §5.5 — Zone and conduit model',
+            'IEC 62443-3-2:2020 §5.4 — Security Level Target per zone',
+        ],
+        classifier: (input) => {
+            if (/\b(?:zone[_\s-]conduit|security\s+zone\s+(?:IEC.?62443|IACS|OT)|conduit\s+(?:IEC.?62443|IACS)|IACS\s+zone|OT\s+network\s+zone)\b/i.test(input))
+                return true;
+            if (/\b(?:zone_conduit_(?:model|map|design|record|diagram)|conduit_(?:security|model|62443))\b/.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * CSMS_ARTEFACT — Cyber Security Management System documentation
+     * (IEC 62443-2-1). Policy, procedures, and management framework for
+     * IACS cybersecurity. Required of all asset owners. Changes require review.
+     */
+    CSMS_ARTEFACT: {
+        references: [
+            'IEC 62443-2-1:2010 — IACS security program / CSMS',
+            'IEC 62443-2-4:2015 — IACS service provider security requirements',
+        ],
+        classifier: (input) => {
+            if (/\b(?:CSMS|cyber\s+security\s+management\s+system\s+(?:IEC.?62443|IACS)|IACS\s+security\s+program|ISA.?99\s+CSMS)\b/i.test(input))
+                return true;
+            if (/\b(?:csms_(?:document|policy|procedure|record|review)|iec62443_2_1_program)\b/.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * SDL_ARTEFACT — Secure Development Lifecycle records per IEC 62443-4-1.
+     * Covers security requirements, design reviews, implementation, verification,
+     * defect management, and end-of-life. Required for product suppliers.
+     */
+    SDL_ARTEFACT: {
+        references: [
+            'IEC 62443-4-1:2018 — Secure product development lifecycle requirements',
+        ],
+        classifier: (input) => {
+            if (/\b(?:IEC.?62443[_\s-]4[_\s-]1|SDL\s+(?:IEC.?62443|IACS|OT)|secure\s+development\s+lifecycle\s+(?:IEC.?62443|IACS|OT))\b/i.test(input))
+                return true;
+            if (/\b(?:sdl_(?:iec62443|iacs|ot)|iec62443_sdl_(?:record|evidence|review))\b/.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+/**
+ * IEC 62443 Industrial Automation and Control Systems Security Compliance Pack.
+ *
+ * Pack ID: 'iec-62443'
+ * Jurisdiction: International (IEC TC 65; ISA-99 origin; adopted by IECEE CB
+ *   scheme, ENISA, NIS2 Directive sectoral guidance for OES/DSP, NIST SP 800-82
+ *   US alignment, NERC CIP energy sector overlay, many national regulators).
+ *
+ * Guard-layer wiring:
+ *   - G1-G4 (audit, logging, classification, session): always active
+ *   - G5-G6 (supply-chain SDL, approval-queue): SL 2/3/4
+ *   - G7-G8 (attestation, anomaly-detection): SL 3/4
+ *   - G9 (transparency): SL 4 only (maximum disclosure burden)
+ *   - Approval Queue: always active (SL 4/3 immediate; SL 2 anomaly closure)
+ *
+ * Human-in-loop tier:
+ *   - T1: SL 1/2 (OT security engineer review)
+ *   - T2: SL 3/4 (TÜV / ISA-certified OT cybersecurity professional)
+ */
+export const IEC_62443_PACK = {
+    categoryClassifiers: IEC_62443_CATEGORY_CLASSIFIERS,
+    /**
+     * Zone/conduit artefacts and CSMS documents are subject-keyed per
+     * zone / IACS asset — they must be traceable to specific system
+     * segments under IEC 62443-3-2.
+     */
+    subjectKeyedCategories: [
+        'SL4',
+        'SL3',
+        'ZONE_CONDUIT_ARTEFACT',
+        'CSMS_ARTEFACT',
+        'SDL_ARTEFACT',
+    ],
+    id: 'iec-62443',
+    name: 'IEC 62443 Industrial Automation and Control Systems Security',
+    version: '1.0.0',
+    description: 'IEC 62443 (formerly ISA-99) — international multi-part cybersecurity standard family for ' +
+        'Industrial Automation and Control Systems (IACS). 14 published parts covering asset owners ' +
+        '(62443-2-1 CSMS), service providers (62443-2-4), system design (62443-3-2 zone/conduit + ' +
+        'SL assignment; 62443-3-3 system controls), and product suppliers (62443-4-1 SDL; 62443-4-2 ' +
+        'component requirements). Four Security Levels (SL 1: casual — SL 4: nation-state/Stuxnet-class). ' +
+        'Seven Foundational Requirements (FR1 IAC — FR7 RA) mapped to validators. SL 3/4 behavioral ' +
+        'validator for unverified-change CRITICAL escalation. 7-year retention (NIS2 OES baseline). ' +
+        '24h NIS2 + sectoral incident notification. Reviewer tier: TÜV / ISA-certified OT cybersecurity ' +
+        'professional. Adopted across manufacturing, oil + gas, electric utilities, water/wastewater, ' +
+        'industrial-IoT, and Tier-1 OT suppliers.',
+    authority: 'IEC TC 65 (Industrial-process measurement, control and automation); ISA-99 origin; ' +
+        'widely adopted by IECEE CB scheme, ENISA, NIS2 sectoral guidance',
+    industries: [
+        'manufacturing',
+        'oil-and-gas',
+        'electric-utilities',
+        'water-wastewater',
+        'industrial-iot',
+        'tier-1-supplier',
+    ],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'Security Level (SL 1-4) tracking mandatory for every IEC 62443 process gate. ' +
+                'SL 4 changes require blocking until full security impact analysis + OT security ' +
+                'lead sign-off. SL 3 changes require approval gate. SL 2 anomaly closure requires ' +
+                'approval. Governance runtime enforces zone/conduit model and CSMS prerequisite ' +
+                'checks before any IACS software or configuration change proceeds.',
+            reference: 'IEC 62443-3-2:2020 §5.4 — SL-T assignment; IEC 62443-2-1:2010 — CSMS',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Tamper-evident records for IACS security lifecycle artefacts: zone/conduit model, ' +
+                'CSMS documentation, risk assessment records, SL justifications, Foundational ' +
+                'Requirement control evidence, SDL artefacts (IEC 62443-4-1), component security ' +
+                'requirement records (IEC 62443-4-2), patch management logs (IEC 62443-2-3), ' +
+                'and incident management records per IEC 62443-2-1 §4.3.4.5. Required for NIS2 ' +
+                'OES audit submissions and sectoral regulator inspections.',
+            reference: 'IEC 62443-2-1:2010 — CSMS documentation; IEC 62443-3-2:2020 §5 — risk assessment records',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Security Level signal detection (SL 1-4) per zone/conduit; zone and conduit ' +
+                'model artefact identification; CSMS document categorisation; SDL and component ' +
+                'security requirement record scanning (IEC 62443-4-1 / 4-2); Foundational ' +
+                'Requirement control evidence classification for FR1-FR7.',
+            reference: 'IEC 62443-3-2:2020 §5.4 — SL classification; IEC 62443-3-3:2013 §4 — FR1-FR7',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            reason: 'Component security requirement inventory per IEC 62443-4-2; COTS OT component ' +
+                'evaluation; service provider security program assessment per IEC 62443-2-4; ' +
+                'SDL compliance verification for product suppliers (IEC 62443-4-1). AI-assisted ' +
+                'code generation tools used in IACS environments require supply-chain evaluation ' +
+                'for OT-specific safety and security impacts before outputs are accepted.',
+            reference: 'IEC 62443-4-2:2019 — component-level CRs; IEC 62443-2-4:2015 — service provider program',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'SL 4 change approval (OT security lead + plant manager sign-off required). ' +
+                'SL 3 change approval gate. SL 2 anomaly closure review. All zone/conduit model ' +
+                'changes and CSMS updates require human review before downstream IACS configuration ' +
+                'or code change proceeds. Component security requirement changes require OT security ' +
+                'engineer approval before deployment to production IACS.',
+            reference: 'IEC 62443-2-1:2010 §4.3.4.5 — change management; IEC 62443-3-2:2020 §5 — SL change review',
+        },
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'CSMS attestation for asset owners; SL 3/4 zone security assessment sign-off; ' +
+                'SDL compliance attestation for product suppliers (IEC 62443-4-1); component ' +
+                'security requirement verification attestation (IEC 62443-4-2); IECEE CB scheme ' +
+                'certification evidence management. OT cybersecurity professionals (TÜV / ISA- ' +
+                'certified) sign the system security assessment at SL 3/4.',
+            reference: 'IEC 62443-2-1:2010 — CSMS program attestation; IEC 62443-4-1:2018 — SDL attestation',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'IEC 62443 CSMS documentation and security assessment records must persist for ' +
+                'the IACS asset operational lifetime. 7-year NIS2 OES records baseline (2555 days). ' +
+                'Continuity of zone/conduit model, risk assessment, and incident records across ' +
+                'sessions is mandatory for regulatory audit submissions, NIS2 significant incident ' +
+                'reporting, and sectoral regulator inspections (ENTSO-E, NERC, WRC).',
+            reference: 'IEC 62443-2-1:2010 — CSMS documentation retention; EU NIS2 Directive OES records',
+        },
+        {
+            name: 'anomaly-detector',
+            required: true,
+            reason: 'Real-time detection of unverified changes to SL 3/4 IACS control system elements. ' +
+                'Flags conditions that may require immediate OT security engineer notification. ' +
+                'Detects SL 4 software or configuration modifications without verification record — ' +
+                'must block immediately. Detects SL 3 anomalies requiring immediate escalation to ' +
+                'OT security lead and plant manager. SL 2 anomaly triggers approval-queue routing.',
+            reference: 'IEC 62443-3-2:2020 §5.4 — SL change detection; IEC 62443-2-1:2010 §4.3.4.5 — incident handling',
+        },
+        {
+            name: 'transparency-injector',
+            required: true,
+            reason: 'AI-generated code or configuration provenance disclosure to OT security engineers, ' +
+                'TÜV / ISA-certified assessors, plant managers, and regulatory-affairs teams. ' +
+                'Security Level context disclosure on every AI output used in an IACS task without ' +
+                'independent manual verification. Required for NIS2 OES accountability obligations.',
+            reference: 'IEC 62443-2-4:2015 — service provider transparency; EU NIS2 Directive accountability',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'SL 3/4 change event routing; zone/conduit model update lifecycle events; CSMS ' +
+                'review milestone events; Foundational Requirement control gap notification; patch ' +
+                'management status events (IEC 62443-2-3); significant incident routing for NIS2 ' +
+                '24h notification deadline; sectoral regulator submission milestone events.',
+            reference: 'IEC 62443-2-1:2010 §4.3.4.5 — incident event handling; EU NIS2 Directive notification triggers',
+        },
+    ],
+    moduleConfig: {
+        'governance-runtime': {
+            securityLevelTrackingRequired: true,
+            sl3ChangeApprovalRequired: true,
+            sl4ChangeApprovalRequired: true,
+            sl2AnomalyClosureApprovalRequired: true,
+            sl3AnomalyImmediateEscalationRequired: true,
+            sl4AnomalyImmediateEscalationRequired: true,
+            zoneConduitModelRequired: true,
+            csmsCovered: true,
+            iec62443Part33SystemControlsRequired: true,
+            iec62443Part41SecureDevelopmentLifecycleRequired: true,
+            iec62443Part42ComponentRequirementsRequired: true,
+        },
+        'approval-queue': {
+            sl4ChangeApprovalRequired: true,
+            sl3ChangeApprovalRequired: true,
+            sl2AnomalyClosureApprovalRequired: true,
+            otSecurityEngineerReviewRequired: true,
+            humanInLoopTierSl12: 'T1',
+            humanInLoopTierSl34: 'T2',
+        },
+        'attestation-manager': {
+            csmsAttestationRequired: true,
+            sl34ZoneSecurityAssessmentSignOffRequired: true,
+            sdlComplianceAttestationRequired: true,
+            componentSecurityRequirementVerificationRequired: true,
+            systemSecurityAssessmentRequired: true,
+        },
+        'supply-chain': {
+            componentSecurityRequirementInventoryRequired: true,
+            iec62443Part42EvaluationRequired: true,
+            serviceProviderSecurityProgramAssessmentRequired: true,
+            sdlComplianceVerificationRequired: true,
+            aiCodeGenToolOtEvaluationRequired: true,
+        },
+        'anomaly-detector': {
+            sl4AnomalyImmediateEscalationRequired: true,
+            sl3AnomalyImmediateEscalationRequired: true,
+            unverifiedSl3Sl4ChangeDetectionActive: true,
+        },
+        'transparency-injector': {
+            aiGeneratedCodeProvenanceDisclosureRequired: true,
+            securityLevelContextDisclosureRequired: true,
+        },
+        'event-bus': {
+            sl34ChangeEventsActive: true,
+            zoneConduitModelUpdateEventsActive: true,
+            csmsReviewMilestoneEventsActive: true,
+            patchManagementStatusEventsActive: true,
+            nis2IncidentNotificationEventsActive: true,
+            sectoralRegulatorSubmissionEventsActive: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
+        requiredCapabilities: ['IEC-62443-READY', 'OT-SECURITY-LIFECYCLE'],
+        blockReasons: {
+            deepseek: 'PRC-jurisdiction LLM providers cannot meet NIS2 Directive data-handling ' +
+                'requirements for Operators of Essential Services (OES) processing IACS security ' +
+                'artefacts. Zone/conduit models, CSMS documentation, and SL 3/4 risk assessment ' +
+                'records require verifiable non-PRC jurisdiction under NIS2 Art. 21 + EU sectoral ' +
+                'OT-cyber guidance (ENISA IACS framework 2022). PRC data localisation law (DSL + CSL) ' +
+                'creates unresolvable conflict with OES data sovereignty obligations.',
+            baidu: 'PRC-jurisdiction LLM; IEC 62443 CSMS documentation, zone/conduit security ' +
+                'artefacts, and IACS incident records for NIS2 OES entities must remain under ' +
+                'verifiable non-PRC jurisdiction per NIS2 Directive Art. 21 security measures ' +
+                'and ENISA IACS cybersecurity framework. PRC dual-use export controls on ' +
+                'industrial control system security software create unresolvable compliance conflict.',
+            alibaba: 'PRC-jurisdiction LLM; SL 3/4 IACS security lifecycle artefacts must remain ' +
+                'outside PRC data jurisdiction per NIS2 Directive OES data sovereignty requirements ' +
+                'and sectoral OT-cyber regulations (NERC CIP, ENTSO-E, WRC). PRC CSL + DSL ' +
+                'data-localisation obligations are incompatible with EU NIS2 cross-border incident ' +
+                'reporting and ENISA threat intelligence sharing requirements for critical infrastructure.',
+        },
+    },
+    dataPolicy: {
+        scanCategories: [
+            'SL4',
+            'SL3',
+            'SL2',
+            'SL1',
+            'ZONE_CONDUIT_ARTEFACT',
+            'CSMS_ARTEFACT',
+            'SDL_ARTEFACT',
+        ],
+        categoryActions: {
+            // SL 4: unauthorised changes BLOCKED — OT security lead + plant manager required
+            SL4: 'BLOCK',
+            // SL 3: changes enter approval queue for OT security engineer review
+            SL3: 'REVIEWED',
+            // SL 2: anomaly closure requires approval; changes logged
+            SL2: 'REVIEWED',
+            // SL 1: logging sufficient for basic OT security audit
+            SL1: 'LOG',
+            // Zone/conduit artefacts: REVIEWED — changes affect all downstream security
+            ZONE_CONDUIT_ARTEFACT: 'REVIEWED',
+            // CSMS artefacts: REVIEWED — policy changes require management approval
+            CSMS_ARTEFACT: 'REVIEWED',
+            // SDL artefacts: REVIEWED — changes require product security engineer review
+            SDL_ARTEFACT: 'REVIEWED',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256-GCM',
+        minimumClassification: 'RESTRICTED',
+    },
+    retentionPolicy: {
+        /**
+         * IEC 62443-2-1 CSMS documentation retention baseline is 7 years (2555 days),
+         * aligned with NIS2 Directive (EU) 2022/2555 records obligations for Operators
+         * of Essential Services (OES). Some sectors (nuclear under IAEA/ENSREG,
+         * pipelines under TSA directives) impose longer sector-specific periods;
+         * this pack uses the 7-year NIS2 / common ICS asset-owner baseline.
+         */
+        sovereignty: ['international'],
+        auditLogRetentionDays: 2555, // 7 years — NIS2 OES records + common ICS asset-owner baseline
+        sessionRetentionDays: 2555,
+        incidentRetentionDays: 2555,
+        reference: 'IEC 62443-2-1:2010 — CSMS documentation retention for IACS operational lifetime. ' +
+            'EU NIS2 Directive (EU) 2022/2555 — OES records retention obligations. ' +
+            'Common ICS asset-owner baseline: 7 years (2555 days). ' +
+            'Sector-specific periods (nuclear, pipeline) may be longer — apply the stricter requirement.',
+    },
+    incidentPolicy: {
+        /**
+         * EU NIS2 Directive (EU) 2022/2555 Art. 23:
+         *   OES must notify the competent authority or CSIRT within 24 hours of
+         *   becoming aware of a significant incident (early warning).
+         *   Full notification within 72 hours. Final report within 1 month.
+         *   IEC 62443-2-1 §4.3.4.5 CSMS incident handling aligns with the
+         *   24h NIS2 early-warning trigger for critical infrastructure OT incidents.
+         *   Using 24h as the baseline notification deadline (NIS2 early warning).
+         */
+        notificationDeadlineHours: 24, // 24h — NIS2 Art. 23 early warning + IEC 62443-2-1 §4.3.4.5
+        reference: 'EU NIS2 Directive (EU) 2022/2555 Art. 23 — 24h early warning for significant incidents. ' +
+            'IEC 62443-2-1:2010 §4.3.4.5 — CSMS incident management and notification. ' +
+            'NIS2 Art. 23(4) — 72h full notification + 1-month final report. ' +
+            'Baseline: 24h early warning to competent authority / CSIRT.',
+        requiredRecipients: [
+            'ciso',
+            'plant-manager',
+            'ot-security-lead',
+            'regulatory-affairs',
+            'crown-jewel-system-owner',
+        ],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'iec62443-security-level-assigned',
+            description: 'Security Level Target (SL-T: 1-4) assigned to every IACS zone and conduit ' +
+                'with documented rationale from the risk assessment per IEC 62443-3-2 §5.4. ' +
+                'Default: SL 2 when classification missing (governance-runtime conservative default). ' +
+                'SL selection must be traceable to threat profile, vulnerability assessment, and ' +
+                'consequence analysis for each zone.',
+            reference: 'IEC 62443-3-2:2020 §5.4 — Security Level Target (SL-T) assignment',
+            check: 'iec62443_security_level_assigned',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'iec62443-zone-conduit-model',
+            description: 'Zone and conduit model on file per IEC 62443-3-2 §5.5: IACS assets grouped ' +
+                'into security zones based on function and required SL; conduits defined as ' +
+                'controlled communication paths between zones; zone/conduit diagram current and ' +
+                'approved. All assets assigned to a zone; orphaned assets are a CRITICAL finding.',
+            reference: 'IEC 62443-3-2:2020 §5.5 — Zone and conduit model',
+            check: 'iec62443_zone_conduit_model_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'iec62443-cyber-security-management-system',
+            description: 'Cyber Security Management System (CSMS) established per IEC 62443-2-1: ' +
+                'scope and policy on file; security risk assessment process documented; ' +
+                'security program organisational responsibilities defined; CSMS reviewed and ' +
+                'approved by senior management. Asset owner CSMS is the root of all IEC 62443 ' +
+                'conformance — no zone/conduit model or SL controls are valid without it.',
+            reference: 'IEC 62443-2-1:2010 — Establishing an IACS security program (CSMS)',
+            check: 'iec62443_csms_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'iec62443-iac-controls',
+            description: 'Identification and Authentication Control (FR 1) requirements implemented ' +
+                'per IEC 62443-3-3 §SR 1.x: unique identifiers for all IACS users, software ' +
+                'processes, and devices; multi-factor authentication for SL 2+; password policy ' +
+                'enforced; PKI or equivalent for SL 3/4 device authentication. All FR 1 ' +
+                'System Requirements (SR) met at or above the zone SL target.',
+            reference: 'IEC 62443-3-3:2013 FR1 (Identification & Auth Control) — SR 1.1-SR 1.13',
+            check: 'iec62443_iac_controls_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62443-uc-controls',
+            description: 'Use Control (FR 2) requirements implemented per IEC 62443-3-3 §SR 2.x: ' +
+                'role-based access control for IACS functions; enforcement of wireless policies; ' +
+                'mobile code usage policies enforced; use control audit log active. Least-privilege ' +
+                'principle applied to all operator, engineer, and remote-access roles at zone SL.',
+            reference: 'IEC 62443-3-3:2013 FR2 (Use Control) — SR 2.1-SR 2.12',
+            check: 'iec62443_uc_controls_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62443-si-controls',
+            description: 'System Integrity (FR 3) requirements implemented per IEC 62443-3-3 §SR 3.x: ' +
+                'communications integrity mechanisms (message authentication, checksums); ' +
+                'malicious code protection active on IACS hosts where feasible; input validation ' +
+                'on all IACS application interfaces; software and firmware integrity verification ' +
+                'at SL 3/4. All FR 3 SRs met at or above zone SL target.',
+            reference: 'IEC 62443-3-3:2013 FR3 (System Integrity) — SR 3.1-SR 3.9',
+            check: 'iec62443_si_controls_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62443-dc-controls',
+            description: 'Data Confidentiality (FR 4) requirements implemented per IEC 62443-3-3 §SR 4.x: ' +
+                'information confidentiality at rest and in transit enforced for SL 2+; encryption ' +
+                'applied to sensitive IACS data at SL 3/4; information leakage prevention active; ' +
+                'network and security configuration information protected from unauthorized disclosure.',
+            reference: 'IEC 62443-3-3:2013 FR4 (Data Confidentiality) — SR 4.1-SR 4.3',
+            check: 'iec62443_dc_controls_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62443-rdf-controls',
+            description: 'Restricted Data Flow (FR 5) requirements implemented per IEC 62443-3-3 §SR 5.x: ' +
+                'zone segmentation enforced at conduits; network traffic restricted to approved ' +
+                'flows only; connection policies applied at all zone boundaries; industrial DMZ ' +
+                'deployed for any external-facing IACS conduits. Zone/conduit model is the ' +
+                'governing architecture document for all FR 5 controls.',
+            reference: 'IEC 62443-3-3:2013 FR5 (Restricted Data Flow) — SR 5.1-SR 5.4',
+            check: 'iec62443_rdf_controls_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62443-tre-controls',
+            description: 'Timely Response to Events (FR 6) requirements implemented per IEC 62443-3-3 ' +
+                '§SR 6.x: audit log active with all security-relevant events captured; automated ' +
+                'monitoring and alarming on anomalous IACS conditions; CSIRT contact defined; ' +
+                'incident response plan tested at least annually. NIS2 24h early-warning process ' +
+                'integrated with FR 6 monitoring controls.',
+            reference: 'IEC 62443-3-3:2013 FR6 (Timely Response to Events) — SR 6.1-SR 6.2',
+            check: 'iec62443_tre_controls_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62443-ra-controls',
+            description: 'Resource Availability (FR 7) requirements implemented per IEC 62443-3-3 §SR 7.x: ' +
+                'DoS protection mechanisms active at IACS network boundaries; backup and restore ' +
+                'procedures validated; emergency power provisions documented; redundant IACS ' +
+                'functions at SL 3/4 for crown-jewel systems. Availability requirements aligned ' +
+                'with process safety and production continuity objectives.',
+            reference: 'IEC 62443-3-3:2013 FR7 (Resource Availability) — SR 7.1-SR 7.8',
+            check: 'iec62443_ra_controls_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62443-secure-development-lifecycle',
+            description: 'Secure Development Lifecycle (SDL) process active per IEC 62443-4-1: security ' +
+                'requirements captured; security architecture and design review performed; ' +
+                'implementation guidelines enforced (secure coding, MISRA/CERT-C equivalent); ' +
+                'security verification and validation evidence on file; defect management process ' +
+                'active; end-of-life security disclosure policy documented. Required for all ' +
+                'product suppliers targeting IEC 62443-4-2 component certification.',
+            reference: 'IEC 62443-4-1:2018 SDL — full lifecycle: requirements through end-of-life',
+            check: 'iec62443_sdl_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62443-component-security-requirements',
+            description: 'Component-level security requirements (CR) met per IEC 62443-4-2: software ' +
+                'application, embedded device, host device, and network device CRs satisfied at ' +
+                'or above the component SL target; CR evidence on file; IECEE CB scheme ' +
+                'certification records available where applicable. AI-generated IACS component ' +
+                'code must pass CR verification before deployment to production zones.',
+            reference: 'IEC 62443-4-2:2019 — Technical security requirements for IACS components (CRs)',
+            check: 'iec62443_component_security_requirements_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62443-patch-management',
+            description: 'Patch management process active per IEC 62443-2-3: patch notification monitoring ' +
+                'from IACS vendors operational; patch evaluation and testing procedure documented; ' +
+                'patch deployment schedule defined and followed; compensating controls in place for ' +
+                'patches not yet applied; patch records retained. OT patch cycles typically longer ' +
+                'than IT — compensating control documentation is mandatory when patches are deferred.',
+            reference: 'IEC 62443-2-3:2015 — Patch management in the IACS environment',
+            check: 'iec62443_patch_management_active',
+            failSeverity: 'MEDIUM',
+        },
+        {
+            id: 'iec62443-incident-management',
+            description: 'Incident management process active per IEC 62443-2-1 §4.3.4.5: IACS security ' +
+                'incident detection, classification, and response procedures documented; incident ' +
+                'response team with OT security expertise defined; lessons-learned process active; ' +
+                'NIS2 24h early-warning notification process integrated; incident records retained ' +
+                '7 years (NIS2 OES baseline). At SL 3/4 incidents must trigger immediate escalation ' +
+                'to OT security lead, plant manager, and crown-jewel system owner.',
+            reference: 'IEC 62443-2-1:2010 §4.3.4.5 — CSMS incident handling',
+            check: 'iec62443_incident_management_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62443-behavioral-validator-sl3-sl4-unverified-change',
+            description: 'Behavioral validator: detects unverified software or configuration changes to ' +
+                'SL 3 or SL 4 IACS zones. Any AI-generated or agent-initiated modification to ' +
+                'an IACS control system element classified at SL 3 or SL 4 must be blocked ' +
+                'pending full security impact analysis, zone/conduit model re-validation, and ' +
+                'OT security lead sign-off. No partial-pass path: SL 3/4 unverified changes are ' +
+                'an absolute block. SL 4 violations are escalated immediately to plant manager ' +
+                'and crown-jewel system owner.',
+            reference: 'IEC 62443-3-2:2020 §5.4 — SL-T; IEC 62443-3-3:2013 §4 — SL 3/4 controls; IEC 62443-2-1:2010 §4.3.4.5',
+            check: 'behavioralValidator_iec62443_sl3_sl4_unverified_change',
+            failSeverity: 'CRITICAL',
+        },
+    ],
+};
+//# sourceMappingURL=iec-62443.js.map