@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/packs/nist-sp-800-82.js

@@ -0,0 +1,721 @@
+/**
+ * NIST SP 800-82 Rev 3 Operational Technology Security Compliance Pack
+ *
+ * NIST Special Publication 800-82 Revision 3 (September 2023) — "Guide to
+ * Operational Technology (OT) Security." US federal guide for securing OT
+ * environments including Industrial Control Systems (ICS), SCADA systems,
+ * Distributed Control Systems (DCS), Programmable Logic Controllers (PLC),
+ * Remote Terminal Units (RTU), building automation systems (BAS), transportation
+ * control systems, and Industrial Internet of Things (IIoT).
+ *
+ * Standards and authorities referenced (citations only; no verbatim text):
+ *   - NIST SP 800-82 Rev 3 (September 2023) — Guide to OT Security
+ *   - NIST SP 800-53 Rev 5 — Security and Privacy Controls (parent catalog)
+ *   - NIST SP 800-30 Rev 1 — Guide for Conducting Risk Assessments
+ *   - NIST SP 800-39 — Managing Information Security Risk
+ *   - NIST SP 800-92 — Guide to Computer Security Log Management (retention)
+ *   - FIPS 199 — Standards for Security Categorization of Federal Information
+ *   - FIPS 200 — Minimum Security Requirements for Federal Systems
+ *   - FISMA — Federal Information Security Modernization Act (2014)
+ *   - FAR 52.204-21 / DFARS 252.204-7012 — Federal procurement OT requirements
+ *   - EO 14028 (2021) — Improving the Nation's Cybersecurity
+ *   - CISA OT Cybersecurity Guidance (CISA 2022, 2023)
+ *   - CIRCIA — Cyber Incident Reporting for Critical Infrastructure Act (2022)
+ *   - NERC CIP standards (cross-reference for electric utilities)
+ *   - IEC 62443 — International OT/IACS cybersecurity counterpart
+ *   - IEC 61511 — Functional safety for process industries (SIS alignment)
+ *   - IEC 61508 — Functional safety of E/E/PE systems (parent SIL standard)
+ *
+ * Impact Level Classification (FIPS 199 + NIST SP 800-82 §4.2):
+ *   Impact levels follow FIPS 199 categorization adapted for OT environments.
+ *   The potential impact is assessed for confidentiality, integrity, and
+ *   availability, with OT systems typically prioritising availability and
+ *   integrity (safety-instrumented systems require deterministic operation).
+ *
+ *   | Impact | Description                                                         |
+ *   |--------|---------------------------------------------------------------------|
+ *   | LOW    | Limited adverse effect — minor degradation of capability            |
+ *   | MOD    | Serious adverse effect — significant degradation of primary mission |
+ *   | HIGH   | Severe / catastrophic — loss of life, major financial damage,       |
+ *   |        | long-term environmental contamination, infrastructure failure       |
+ *
+ *   Default when impact level not declared: MODERATE (conservative per FIPS 199
+ *   guidance and NIST SP 800-82 §4.2 — when in doubt, classify higher).
+ *
+ * Purdue Enterprise Reference Architecture (NIST SP 800-82 §5.5):
+ *   Level 0 — Physical process (sensors, actuators, physical systems)
+ *   Level 1 — Intelligent devices (PLCs, RTUs, safety systems, drives)
+ *   Level 2 — Control systems (SCADA, DCS, HMI, engineering workstations)
+ *   Level 3 — Manufacturing operations (MES, historian, batch management)
+ *   Level 3.5 — Industrial DMZ (boundary between OT and IT — CRITICAL zone)
+ *   Level 4 — Enterprise (ERP, email, business intelligence)
+ *   Level 5 — External network / Internet
+ *
+ * Key NIST 800-53 control families mapped to OT in SP 800-82 §6:
+ *   AC  — Access Control (§6.2)
+ *   AU  — Audit and Accountability (§6.3)
+ *   AT  — Awareness and Training (§6.4)
+ *   CA  — Assessment, Authorization, and Monitoring (§6.5)
+ *   CM  — Configuration Management (§6.6)
+ *   CP  — Contingency Planning (§6.7)
+ *   IA  — Identification and Authentication (§6.8)
+ *   IR  — Incident Response (§6.10)
+ *   MA  — Maintenance (§6.11)
+ *   MP  — Media Protection (§6.12)
+ *   PE  — Physical and Environmental Protection (§6.13)
+ *   PL  — Planning (§6.14)
+ *   PM  — Program Management (§6.15)
+ *   PS  — Personnel Security (§6.16)
+ *   RA  — Risk Assessment (§6.17)
+ *   SA  — System and Services Acquisition (§6.18 — supply chain)
+ *   SC  — System and Communications Protection (§6.18 — network seg.)
+ *   SI  — System and Information Integrity (§6.19)
+ *   SR  — Supply Chain Risk Management (§6.20)
+ *
+ * Safety-Instrumented Systems (SIS) per NIST SP 800-82 §5.7:
+ *   SIS are designed to bring a process to a safe state when predetermined
+ *   conditions are violated (IEC 61511 / IEC 61508). SIS have separate
+ *   network segments and must not be modified without formal management of
+ *   change. AI-generated changes to SIS are an absolute block in this pack.
+ *
+ * Retention:
+ *   NIST SP 800-92 + FISMA records management baseline: 7 years (2555 days).
+ *   DoD / CMMC context may impose longer periods; this pack uses the
+ *   7-year FISMA / NIST SP 800-92 federal records baseline.
+ *
+ * Sister standard: IEC 62443 (international OT/IACS counterpart). The two
+ * are typically run together for US-multinational customers. Use `iec-62443`
+ * pack in parallel when operating in both US-federal and international contexts.
+ *
+ * @connexum/ai-governance
+ */
+/**
+ * NIST SP 800-82 category classifiers.
+ *
+ * Covers FIPS 199 impact-level declarations (LOW / MODERATE / HIGH),
+ * Purdue model zone artefacts, OT cybersecurity program documents,
+ * risk management records, and Safety-Instrumented System (SIS) records.
+ */
+export const NIST_SP_800_82_CATEGORY_CLASSIFIERS = {
+    /**
+     * HIGH_IMPACT — FIPS 199 HIGH impact OT system (NIST SP 800-82 §4.2).
+     * Severe or catastrophic adverse effect: loss of life, major financial
+     * damage, long-term environmental contamination, or infrastructure failure.
+     * Unauthorised changes BLOCKED — requires full security impact analysis +
+     * OT security lead + authorizing official sign-off before any action proceeds.
+     */
+    HIGH_IMPACT: {
+        references: [
+            'NIST SP 800-82 Rev 3 §4.2 — FIPS 199 HIGH impact OT categorisation',
+            'FIPS 199 — Standards for Security Categorization of Federal Information',
+        ],
+        classifier: (input) => {
+            if (/\b(?:high[_\s-]impact|impact[_\s-]level[_\s-]?high|fips199[_\s-]high|HIGH_IMPACT_OT|ot[_\s-]high)\b/i.test(input))
+                return true;
+            if (/\b(?:loss\s+of\s+life\s+(?:OT|ICS|SCADA|PLC|SIS)|catastrophic\s+(?:OT|ICS|industrial)\s+(?:failure|event))\b/i.test(input))
+                return true;
+            if (/\b(?:sis[_\s-]high|safety[_\s-]instrumented[_\s-]system[_\s-]high|critical\s+infrastructure\s+high\s+impact)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * MODERATE_IMPACT — FIPS 199 MODERATE impact OT system (NIST SP 800-82 §4.2).
+     * Serious adverse effect: significant degradation of primary mission,
+     * substantial financial damage, or significant harm without loss of life.
+     * Default classification when impact level is not declared (conservative).
+     * Changes require approval gate.
+     */
+    MODERATE_IMPACT: {
+        references: [
+            'NIST SP 800-82 Rev 3 §4.2 — FIPS 199 MODERATE impact OT categorisation',
+            'FIPS 199 — Standards for Security Categorization of Federal Information',
+        ],
+        classifier: (input) => {
+            if (/\b(?:moderate[_\s-]impact|impact[_\s-]level[_\s-]?moderate|fips199[_\s-]moderate|MODERATE_IMPACT_OT|ot[_\s-]moderate)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * LOW_IMPACT — FIPS 199 LOW impact OT system (NIST SP 800-82 §4.2).
+     * Limited adverse effect: minor degradation of capability, minor financial
+     * damage, or minor harm. LOG with audit record. Minimum OT process burden.
+     */
+    LOW_IMPACT: {
+        references: [
+            'NIST SP 800-82 Rev 3 §4.2 — FIPS 199 LOW impact OT categorisation',
+            'FIPS 199 — Standards for Security Categorization of Federal Information',
+        ],
+        classifier: (input) => {
+            if (/\b(?:low[_\s-]impact|impact[_\s-]level[_\s-]?low|fips199[_\s-]low|LOW_IMPACT_OT|ot[_\s-]low)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * PURDUE_ARTEFACT — Purdue model zone documentation (NIST SP 800-82 §5.5).
+     * Foundational OT architecture artefact defining network segmentation by
+     * Purdue levels (0-5). Zone boundary changes require security impact review.
+     * Industrial DMZ (Level 3.5) is the highest-scrutiny boundary zone.
+     */
+    PURDUE_ARTEFACT: {
+        references: [
+            'NIST SP 800-82 Rev 3 §5.5 — Purdue Enterprise Reference Architecture',
+            'NIST SP 800-82 Rev 3 §5.6 — Network segmentation and firewalls',
+        ],
+        classifier: (input) => {
+            if (/\b(?:purdue[_\s-](?:model|level|zone|diagram|architecture)|purdue_(?:l[0-5]|dmz|industrial)|ot[_\s-]network[_\s-]segmentation)\b/i.test(input))
+                return true;
+            if (/\b(?:industrial[_\s-]dmz|idmz|level[_\s-]3\.5|ot[_\s-]it[_\s-]boundary)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * OT_PROGRAM_ARTEFACT — OT cybersecurity program documentation
+     * (NIST SP 800-82 §3). Policy, workforce training, risk management
+     * framework, and governance documents. Required of all OT system operators
+     * subject to FISMA. Changes require management review.
+     */
+    OT_PROGRAM_ARTEFACT: {
+        references: [
+            'NIST SP 800-82 Rev 3 §3 — OT cybersecurity program',
+            'NIST SP 800-82 Rev 3 §4 — OT risk management',
+        ],
+        classifier: (input) => {
+            if (/\b(?:ot[_\s-]cybersecurity[_\s-]program|ot[_\s-]security[_\s-](?:policy|plan|program)|nist[_\s-]800[_\s-]82[_\s-]program)\b/i.test(input))
+                return true;
+            if (/\b(?:ot_program_(?:document|policy|procedure|review)|nist80082_(?:program|plan|policy))\b/.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * SIS_ARTEFACT — Safety-Instrumented System (SIS) records and documentation
+     * (NIST SP 800-82 §5.7 + IEC 61511 / IEC 61508 alignment). SIS bring
+     * processes to a safe state when abnormal conditions occur. Changes to SIS
+     * require formal management of change and SIL-certified engineer sign-off.
+     * AI-generated modifications to SIS are an absolute block.
+     */
+    SIS_ARTEFACT: {
+        references: [
+            'NIST SP 800-82 Rev 3 §5.7 — Safety-Instrumented Systems',
+            'IEC 61511:2016 — Functional safety for process industries (SIS)',
+        ],
+        classifier: (input) => {
+            if (/\b(?:SIS|safety[_\s-]instrumented[_\s-]system|safety[_\s-]instrumented[_\s-]systems|SIL[_\s-](?:1|2|3|4)|safety[_\s-]integrity[_\s-]level)\b/i.test(input))
+                return true;
+            if (/\b(?:sis_(?:record|config|change|modification|update|artefact)|61511[_\s-]sis)\b/.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+/**
+ * NIST SP 800-82 Rev 3 Operational Technology Security Compliance Pack.
+ *
+ * Pack ID: 'nist-sp-800-82'
+ * Jurisdiction: US federal (FISMA mandatory); widely adopted by NERC CIP
+ *   (electric utilities), AWIA (water authorities), DoD industrial base
+ *   (DFARS/CMMC), and federal building automation operators. Sister standard
+ *   to IEC 62443 (international) — the two are typically run together for
+ *   US-multinational customers.
+ *
+ * Guard-layer wiring:
+ *   - G1-G4 (audit, logging, classification, session): always active
+ *   - G5-G6 (supply-chain SR, approval-queue): MODERATE / HIGH impact
+ *   - G7-G8 (attestation, anomaly-detection): HIGH impact + SIS
+ *   - G9 (transparency): HIGH impact (maximum disclosure burden)
+ *   - Approval Queue: always active (HIGH immediate; MODERATE closure)
+ *
+ * Human-in-loop tier:
+ *   - T1: LOW / MODERATE (OT security engineer review)
+ *   - T2: HIGH / SIS (NIST RMF Authorizing Official + CISSP-ICSE certified)
+ */
+export const NIST_SP_800_82_PACK = {
+    categoryClassifiers: NIST_SP_800_82_CATEGORY_CLASSIFIERS,
+    /**
+     * HIGH impact and SIS artefacts are subject-keyed per OT system /
+     * process zone — they must be traceable to specific OT assets under
+     * NIST SP 800-82 §4 + §5.7 for authorizing official accountability.
+     */
+    subjectKeyedCategories: [
+        'HIGH_IMPACT',
+        'PURDUE_ARTEFACT',
+        'SIS_ARTEFACT',
+        'OT_PROGRAM_ARTEFACT',
+    ],
+    id: 'nist-sp-800-82',
+    name: 'NIST SP 800-82 Rev 3 Operational Technology Security',
+    version: '3.0.0',
+    description: 'NIST SP 800-82 Rev 3 (September 2023) — US federal guide for securing Operational ' +
+        'Technology (OT) environments including ICS, SCADA, DCS, PLC, RTU, building automation, ' +
+        'transportation control, and Industrial IoT. Provides an OT-specific overlay on the NIST ' +
+        'SP 800-53 Rev 5 control catalog with three FIPS 199 impact levels (LOW / MODERATE / HIGH; ' +
+        'defaults to MODERATE). Purdue model segmentation (Levels 0-5 + industrial DMZ). Safety-' +
+        'Instrumented System (SIS) protection per §5.7 + IEC 61511 alignment. Eight NIST 800-53 ' +
+        'control family validators: AC, AU, CM, CP, IR, SC, SI, SR. 7-year retention (FISMA + ' +
+        'SP 800-92; 2555 days). 24h CISA + EO 14028 incident notification. Reviewer tier: NIST RMF / ' +
+        'FedRAMP / CISSP-ICSE certified. Mandatory for US federal OT via FISMA + FAR/DFARS. ' +
+        'Cross-referenced by NERC CIP, EO 14028, CISA OT guidance. Sister standard: IEC 62443 ' +
+        '(international) — typically run together for US-multinational customers.',
+    authority: 'National Institute of Standards and Technology (NIST), U.S. Department of Commerce; ' +
+        'mandated for federal OT via FISMA + FAR/DFARS; cross-referenced by NERC CIP, EO 14028, CISA OT guidance',
+    industries: [
+        'us-federal-contractor',
+        'electric-utilities',
+        'water-wastewater',
+        'oil-and-gas',
+        'manufacturing',
+        'us-defense-industrial-base',
+        'transportation-systems',
+        'building-automation',
+    ],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'FIPS 199 impact level (LOW / MODERATE / HIGH) tracking mandatory for every NIST ' +
+                'SP 800-82 process gate. HIGH impact changes require blocking until full security ' +
+                'impact analysis + OT security lead + authorizing official sign-off. MODERATE impact ' +
+                'changes require approval gate. Governance runtime enforces Purdue model segmentation ' +
+                'checks, FIPS 199 categorization, and NIST 800-53 control overlay before any OT ' +
+                'software or configuration change proceeds. SIS modifications are an absolute block.',
+            reference: 'NIST SP 800-82 Rev 3 §4.2 — FIPS 199 impact categorisation; §3 — OT cybersecurity program',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Tamper-evident records for OT security lifecycle artefacts: FIPS 199 categorization ' +
+                'records, risk assessment documentation (SP 800-30), OT cybersecurity program documents ' +
+                'per §3, Purdue model zone diagrams, NIST 800-53 control overlay evidence, SIS ' +
+                'management-of-change records per §5.7, and incident records. Required for FISMA ' +
+                'authorization packages, NIST RMF artifact submissions, CISA OT audit inspections, ' +
+                'and NERC CIP compliance evidence (electric utility customers).',
+            reference: 'NIST SP 800-82 Rev 3 §4 — risk management records; FISMA §3553 — audit requirements',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'FIPS 199 impact signal detection (LOW / MODERATE / HIGH) per OT zone and process; ' +
+                'Purdue model artefact identification; OT cybersecurity program document categorisation; ' +
+                'SIS record detection for absolute-block routing; NIST 800-53 control family evidence ' +
+                'classification (AC, AU, CM, CP, IR, SC, SI, SR control families per §6).',
+            reference: 'NIST SP 800-82 Rev 3 §4.2 — FIPS 199 classification; §6 — 800-53 control family overlay',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            reason: 'NIST SP 800-53 SR (Supply Chain Risk Management) family controls applied to OT ' +
+                'per SP 800-82 §6.20. OT component vendor evaluation; COTS PLC / RTU / SCADA ' +
+                'component assessment; CMMC supply-chain requirements for DoD industrial base ' +
+                'customers; EO 14028 software bill of materials (SBOM) requirements for OT. ' +
+                'AI-generated OT code requires supply-chain evaluation for OT-specific safety and ' +
+                'security impacts before outputs are accepted into the control system.',
+            reference: 'NIST SP 800-82 Rev 3 §6.20 + SP 800-53 SR family; EO 14028 — SBOM for OT',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'HIGH impact change approval (OT security lead + authorizing official sign-off). ' +
+                'MODERATE impact change approval gate. SIS modification absolute block pending formal ' +
+                'management of change. All Purdue model zone boundary changes and OT program updates ' +
+                'require human review before downstream OT configuration or code change proceeds. ' +
+                'NIST 800-53 CM (Configuration Management) controls require formal approval of OT ' +
+                'changes before deployment to production systems.',
+            reference: 'NIST SP 800-82 Rev 3 §6.6 + SP 800-53 CM family; §5.7 — SIS management of change',
+        },
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'FISMA authorization-to-operate (ATO) attestation for OT system operators; HIGH ' +
+                'impact zone security assessment sign-off by NIST RMF-certified authorizing official; ' +
+                'SIS engineering change attestation by SIL-certified engineer (IEC 61511 alignment); ' +
+                'NIST 800-53 CA (Assessment, Authorization, Monitoring) control attestation. ' +
+                'FedRAMP-authorized cloud services used in OT environments require additional ' +
+                'attestation from the FedRAMP Program Management Office (PMO) liaison.',
+            reference: 'NIST SP 800-82 Rev 3 §6.5 + SP 800-53 CA family; FISMA §3553 — ATO',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'NIST SP 800-82 OT security documentation and FISMA authorization records must ' +
+                'persist for the full system lifecycle. 7-year FISMA / NIST SP 800-92 federal records ' +
+                'baseline (2555 days). Continuity of FIPS 199 categorization, risk assessment, ' +
+                'Purdue model diagrams, and incident records across sessions is mandatory for NIST RMF ' +
+                'artifact submissions, FISMA Inspector General audits, CISA OT incident investigations, ' +
+                'and NERC CIP compliance evidence retention (electric utility customers).',
+            reference: 'NIST SP 800-82 Rev 3 §3 — program documentation; NIST SP 800-92 — federal records baseline',
+        },
+        {
+            name: 'anomaly-detector',
+            required: true,
+            reason: 'Real-time detection of unverified changes to HIGH impact OT systems and SIS. ' +
+                'Flags conditions requiring immediate OT security lead notification per CISA OT ' +
+                'incident guidance and EO 14028. Detects HIGH impact OT software or configuration ' +
+                'modifications without verification record — must block immediately. Detects SIS ' +
+                'modifications requiring absolute block. MODERATE impact anomalies trigger approval- ' +
+                'queue routing. NIST 800-53 IR and SI control families require continuous monitoring.',
+            reference: 'NIST SP 800-82 Rev 3 §6.10 + SP 800-53 IR family; §6.19 + SP 800-53 SI family',
+        },
+        {
+            name: 'transparency-injector',
+            required: true,
+            reason: 'AI-generated OT code or configuration provenance disclosure to OT security engineers, ' +
+                'NIST RMF-certified authorizing officials, system security officers, and CISA liaisons. ' +
+                'FIPS 199 impact level context disclosure on every AI output used in an OT task without ' +
+                'independent manual verification. Required for FISMA accountability obligations and EO ' +
+                '14028 software provenance requirements applied to OT environments.',
+            reference: 'NIST SP 800-82 Rev 3 §3 — OT program accountability; EO 14028 — AI/software provenance',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'HIGH impact change event routing; Purdue model boundary update lifecycle events; ' +
+                'OT cybersecurity program review milestone events; NIST 800-53 control gap notification; ' +
+                'SIS management-of-change events requiring SIL-engineer sign-off; CISA + CIRCIA 24h ' +
+                'incident notification deadline routing; NERC CIP compliance event submission for ' +
+                'electric utility customers; FISMA continuous monitoring status events.',
+            reference: 'NIST SP 800-82 Rev 3 §6.10 + SP 800-53 IR family; CIRCIA — 24h reporting trigger',
+        },
+    ],
+    moduleConfig: {
+        'governance-runtime': {
+            impactLevelTrackingRequired: true,
+            highImpactChangeApprovalRequired: true,
+            moderateImpactChangeApprovalRequired: true,
+            moderateImpactAnomalyClosureApprovalRequired: true,
+            highImpactAnomalyImmediateEscalationRequired: true,
+            purdueModelSegmentationRequired: true,
+            fips199CategorizationRequired: true,
+            nist80053ControlOverlayRequired: true,
+            safetyInstrumentedSystemProtectionRequired: true,
+            ciraReportingActive: true,
+        },
+        'approval-queue': {
+            highImpactChangeApprovalRequired: true,
+            moderateImpactChangeApprovalRequired: true,
+            moderateImpactAnomalyClosureApprovalRequired: true,
+            sisModificationAbsoluteBlockRequired: true,
+            otSecurityEngineerReviewRequired: true,
+            humanInLoopTierLowModerate: 'T1',
+            humanInLoopTierHighSis: 'T2',
+        },
+        'attestation-manager': {
+            fismaAtoAttestationRequired: true,
+            highImpactZoneSecurityAssessmentSignOffRequired: true,
+            sisEngineeringChangeAttestationRequired: true,
+            nistRmfAuthorizingOfficialSignOffRequired: true,
+            systemSecurityPlanAttestationRequired: true,
+        },
+        'supply-chain': {
+            otComponentVendorEvaluationRequired: true,
+            cmmcSupplyChainRequirementsRequired: true,
+            eo14028SbomRequired: true,
+            aiCodeGenToolOtEvaluationRequired: true,
+            srControlFamilyInventoryRequired: true,
+        },
+        'anomaly-detector': {
+            highImpactAnomalyImmediateEscalationRequired: true,
+            sisModificationAbsoluteBlockRequired: true,
+            unverifiedHighImpactChangeDetectionActive: true,
+        },
+        'transparency-injector': {
+            aiGeneratedCodeProvenanceDisclosureRequired: true,
+            fips199ImpactLevelContextDisclosureRequired: true,
+        },
+        'event-bus': {
+            highImpactChangeEventsActive: true,
+            purdueModelBoundaryUpdateEventsActive: true,
+            otProgramReviewMilestoneEventsActive: true,
+            sisManagementOfChangeEventsActive: true,
+            cisaIncidentNotificationEventsActive: true,
+            nercCipComplianceEventsActive: true,
+            fismaMonitoringStatusEventsActive: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
+        requiredCapabilities: ['NIST-800-82-READY', 'US-FEDERAL-OT-SECURITY'],
+        blockReasons: {
+            deepseek: 'PRC-jurisdiction LLM providers cannot meet US federal OT security requirements ' +
+                '(FISMA + FedRAMP + CMMC + EO 14028 supply-chain provisions). NIST SP 800-82 OT ' +
+                'security artefacts — FIPS 199 categorization records, Purdue model diagrams, SIS ' +
+                'engineering records, and NIST 800-53 control evidence — for FISMA-covered systems ' +
+                'must remain under US jurisdiction. PRC data localisation law (DSL + CSL) creates ' +
+                'unresolvable conflict with FISMA § 3553, DFARS 252.204-7012, and EO 14028 OT ' +
+                'supply-chain security requirements.',
+            baidu: 'PRC-jurisdiction LLM; NIST SP 800-82 OT security program documentation, Purdue ' +
+                'model zone artefacts, and FISMA authorization records for federal OT systems must ' +
+                'remain under verifiable US jurisdiction per FISMA § 3553 and FAR 52.204-21. ' +
+                'CMMC Level 2/3 requirements (DFARS 252.204-7012) applicable to DoD industrial base ' +
+                'customers prohibit routing OT security data through PRC-jurisdiction services. PRC ' +
+                'dual-use export controls on industrial control system security software create an ' +
+                'unresolvable compliance conflict with US OT federal procurement requirements.',
+            alibaba: 'PRC-jurisdiction LLM; HIGH impact OT system security lifecycle artefacts and SIS ' +
+                'engineering records must remain outside PRC data jurisdiction per FISMA, DFARS, ' +
+                'and EO 14028 supply-chain provisions. NERC CIP electric utility customers cannot ' +
+                'route bulk electric system (BES) cyber system (BCS) data through PRC-jurisdiction ' +
+                'services per NERC CIP-003-8 and CISA OT cybersecurity guidance. PRC CSL + DSL ' +
+                'data-localisation obligations are incompatible with US federal OT data sovereignty ' +
+                'requirements and CISA cross-sector OT incident sharing obligations.',
+        },
+    },
+    dataPolicy: {
+        scanCategories: [
+            'HIGH_IMPACT',
+            'MODERATE_IMPACT',
+            'LOW_IMPACT',
+            'PURDUE_ARTEFACT',
+            'OT_PROGRAM_ARTEFACT',
+            'SIS_ARTEFACT',
+        ],
+        categoryActions: {
+            // HIGH: unauthorised changes BLOCKED — OT security lead + authorizing official required
+            HIGH_IMPACT: 'BLOCK',
+            // MODERATE: changes enter approval queue for OT security engineer review
+            MODERATE_IMPACT: 'REVIEWED',
+            // LOW: logging sufficient for basic OT security audit
+            LOW_IMPACT: 'LOG',
+            // Purdue artefacts: REVIEWED — zone boundary changes affect all downstream security
+            PURDUE_ARTEFACT: 'REVIEWED',
+            // OT program documents: REVIEWED — policy changes require management approval
+            OT_PROGRAM_ARTEFACT: 'REVIEWED',
+            // SIS artefacts: BLOCK — absolute block; SIL-certified engineer sign-off required
+            SIS_ARTEFACT: 'BLOCK',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256-GCM',
+        minimumClassification: 'RESTRICTED',
+    },
+    retentionPolicy: {
+        /**
+         * NIST SP 800-92 + FISMA records management: 7-year federal records
+         * baseline (2555 days). DoD / CMMC context may require longer retention;
+         * apply the stricter requirement for DoD industrial base customers.
+         */
+        sovereignty: ['us'],
+        auditLogRetentionDays: 2555, // 7 years — FISMA + NIST SP 800-92 federal records baseline
+        sessionRetentionDays: 2555,
+        incidentRetentionDays: 2555,
+        reference: 'NIST SP 800-92 — Guide to Computer Security Log Management: federal retention baseline. ' +
+            'FISMA 2014 § 3553 — OT security documentation retention for authorization packages. ' +
+            'Common federal OT baseline: 7 years (2555 days). ' +
+            'DoD / CMMC context (DFARS 252.204-7012) may impose longer periods — apply stricter requirement.',
+    },
+    incidentPolicy: {
+        /**
+         * CISA OT incident reporting baseline + EO 14028 + CIRCIA (2022):
+         *   CIRCIA mandates 72h reporting to CISA for covered entities once enacted
+         *   (rulemaking ongoing as of SP 800-82 Rev 3 publication).
+         *   EO 14028 §6 and CISA OT guidance recommend 24h initial notification
+         *   for significant OT incidents at federal and critical infrastructure sites.
+         *   DoD / CMMC: 72h reporting under DFARS 252.204-7012 for cyber incidents.
+         *   Conservative baseline for federal OT: 24h CISA + authorizing official.
+         */
+        notificationDeadlineHours: 24, // 24h — CISA + EO 14028 + conservative federal OT baseline
+        reference: 'EO 14028 §6 — 24h significant incident notification for federal OT. ' +
+            'CISA OT Cybersecurity Guidance — 24h initial OT incident reporting. ' +
+            'CIRCIA 2022 — cyber incident reporting for critical infrastructure (rulemaking). ' +
+            'DFARS 252.204-7012 — 72h DoD cyber incident reporting (DoD industrial base).',
+        requiredRecipients: [
+            'ciso',
+            'system-security-officer',
+            'ot-security-lead',
+            'cisa-liaison',
+            'authorizing-official',
+            'nerc-cip-coordinator',
+        ],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'nist80082-impact-level-assigned',
+            description: 'FIPS 199 impact level (LOW / MODERATE / HIGH) assigned to every OT system ' +
+                'and zone with documented rationale per NIST SP 800-82 §4.2. Impact categorization ' +
+                'covers confidentiality, integrity, and availability, with OT typically prioritising ' +
+                'availability and integrity (safety-critical deterministic operation). Default: ' +
+                'MODERATE when categorization missing (governance-runtime conservative default ' +
+                'per FIPS 199 guidance). Categorization must be traceable to a formal risk ' +
+                'assessment per SP 800-30 and reviewed by the authorizing official.',
+            reference: 'NIST SP 800-82 §4.2 + FIPS 199 (LOW/MODERATE/HIGH)',
+            check: 'nist80082_impact_level_assigned',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'nist80082-purdue-model-segmentation',
+            description: 'Purdue Enterprise Reference Architecture (PERA) network segmentation on file per ' +
+                'NIST SP 800-82 §5.5: OT assets assigned to Purdue levels (0-5); industrial DMZ ' +
+                '(Level 3.5) deployed between OT and IT networks; firewall policies enforced at ' +
+                'every zone boundary; Level 0-2 (PLC / SCADA / DCS) air-gapped or firewalled from ' +
+                'Level 4+ (enterprise) traffic. All OT assets assigned to a Purdue level; unassigned ' +
+                'assets are a CRITICAL finding. DMZ missing between Levels 3 and 4 is CRITICAL.',
+            reference: 'NIST SP 800-82 §5.5 (Purdue Enterprise Reference Architecture)',
+            check: 'nist80082_purdue_model_segmentation',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'nist80082-cybersecurity-program',
+            description: 'OT cybersecurity program established per NIST SP 800-82 §3: program charter and ' +
+                'scope on file; OT security roles and responsibilities defined (CISO, system security ' +
+                'officer, OT security lead, authorizing official); workforce training active; OT ' +
+                'cybersecurity policies documented and approved by senior management; program ' +
+                'reviewed annually. FISMA §3554 requires OT program documentation as part of the ' +
+                'agency-wide information security program for federal OT operators.',
+            reference: 'NIST SP 800-82 §3 (OT cybersecurity program)',
+            check: 'nist80082_cybersecurity_program',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'nist80082-risk-management',
+            description: 'OT risk management process active per NIST SP 800-82 §4, adapted from SP 800-30 ' +
+                'and SP 800-39: threat and vulnerability identification (NIST NVD + ICS-CERT ' +
+                'advisories monitored); likelihood and impact analysis documented; risk response ' +
+                'decisions recorded; residual risk accepted by authorizing official; risk register ' +
+                'reviewed at least annually or after significant OT changes. FIPS 200 minimum ' +
+                'security requirements applied as the control baseline floor.',
+            reference: 'NIST SP 800-82 §4 + SP 800-30 + 800-39',
+            check: 'nist80082_risk_management',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nist80082-ac-controls',
+            description: 'Access Control (AC) family controls from NIST 800-53 Rev 5 applied to OT per ' +
+                'SP 800-82 §6.2: role-based access control for OT operator / engineer / administrator ' +
+                'roles; least privilege enforced on all OT system interfaces; account management ' +
+                'procedures active (provisioning, deprovisioning, periodic review); remote access to ' +
+                'OT systems restricted (jump server / VPN required); wireless access policies enforced. ' +
+                'MODERATE and HIGH impact OT systems require MFA for remote access.',
+            reference: 'NIST SP 800-82 §6.2 + SP 800-53 AC family (Access Control)',
+            check: 'nist80082_ac_controls',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nist80082-au-controls',
+            description: 'Audit and Accountability (AU) family controls from NIST 800-53 Rev 5 applied to OT ' +
+                'per SP 800-82 §6.3: audit logging active on all OT system components where technically ' +
+                'feasible; security-relevant events captured (login, configuration change, alarm, ' +
+                'network access); centralized OT-specific SIEM or historian receiving logs; log ' +
+                'integrity protection active; 7-year log retention (NIST SP 800-92 baseline). ' +
+                'Compensating controls documented when OT devices do not support native logging.',
+            reference: 'NIST SP 800-82 §6.3 + SP 800-53 AU family (Audit and Accountability)',
+            check: 'nist80082_au_controls',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nist80082-cm-controls',
+            description: 'Configuration Management (CM) family controls from NIST 800-53 Rev 5 applied to OT ' +
+                'per SP 800-82 §6.6: OT baseline configurations established and documented for all PLCs, ' +
+                'RTUs, HMIs, historians, and SCADA servers; configuration change control process active ' +
+                '(formal approval before changes deployed to production OT); configuration inventory ' +
+                'current; CM board or equivalent reviewing OT changes at MODERATE / HIGH impact systems; ' +
+                'unauthorized software installation blocked on OT hosts.',
+            reference: 'NIST SP 800-82 §6.6 + SP 800-53 CM family (Configuration Management)',
+            check: 'nist80082_cm_controls',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nist80082-cp-controls',
+            description: 'Contingency Planning (CP) family controls from NIST 800-53 Rev 5 applied to OT per ' +
+                'SP 800-82 §6.7: OT contingency plan on file covering system backup, recovery, and ' +
+                'reconstitution procedures; OT-specific recovery time objectives (RTO) and recovery ' +
+                'point objectives (RPO) defined; backup of OT configurations and programs validated; ' +
+                'contingency plan tested annually (tabletop or full exercise); off-site backup copies ' +
+                'maintained for HIGH impact OT systems.',
+            reference: 'NIST SP 800-82 §6.7 + SP 800-53 CP family (Contingency Planning)',
+            check: 'nist80082_cp_controls',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nist80082-ir-controls',
+            description: 'Incident Response (IR) family controls from NIST 800-53 Rev 5 applied to OT per ' +
+                'SP 800-82 §6.10: OT-specific incident response plan on file; IR team with OT ' +
+                'expertise defined; CISA OT incident reporting process integrated (24h notification); ' +
+                'incident detection and analysis capabilities active on OT networks; lessons-learned ' +
+                'process active; IR plan tested at least annually with OT-specific scenarios. ' +
+                'CIRCIA reporting obligations for covered critical infrastructure entities integrated.',
+            reference: 'NIST SP 800-82 §6.10 + SP 800-53 IR family (Incident Response)',
+            check: 'nist80082_ir_controls',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nist80082-sc-controls',
+            description: 'System and Communications Protection (SC) family controls from NIST 800-53 Rev 5 ' +
+                'applied to OT per SP 800-82 §6.18: Purdue model network segmentation enforced; ' +
+                'industrial DMZ (Level 3.5) deployed with OT-specific firewall / unidirectional ' +
+                'gateway; encrypted communications on OT network segments where technically feasible ' +
+                '(legacy protocols may use compensating controls); boundary protection at all OT-IT ' +
+                'interfaces; wireless OT communications encrypted and authenticated.',
+            reference: 'NIST SP 800-82 §6.18 + SP 800-53 SC family (System and Comms Protection)',
+            check: 'nist80082_sc_controls',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nist80082-si-controls',
+            description: 'System and Information Integrity (SI) family controls from NIST 800-53 Rev 5 applied ' +
+                'to OT per SP 800-82 §6.19: malicious code protection active on OT hosts where ' +
+                'vendor-supported; security alerts monitored via ICS-CERT / CISA advisories; ' +
+                'OT software and firmware integrity verification active; security function verification ' +
+                'on OT components at startup; spam and information input validation on OT application ' +
+                'interfaces. Application allowlisting used instead of traditional AV where feasible.',
+            reference: 'NIST SP 800-82 §6.19 + SP 800-53 SI family (System and Info Integrity)',
+            check: 'nist80082_si_controls',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nist80082-sr-controls',
+            description: 'Supply Chain Risk Management (SR) family controls from NIST 800-53 Rev 5 applied to ' +
+                'OT per SP 800-82 §6.20: OT supplier risk assessment process active; SBOM (Software ' +
+                'Bill of Materials) for OT software and firmware components maintained (EO 14028); ' +
+                'COTS OT component evaluation for security vulnerabilities before procurement; OT ' +
+                'vendor security requirements in procurement contracts; counterfeit component detection ' +
+                'processes for PLCs, RTUs, and embedded OT hardware.',
+            reference: 'NIST SP 800-82 §6.20 + SP 800-53 SR family (Supply Chain Risk Management)',
+            check: 'nist80082_sr_controls',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nist80082-safety-instrumented-system',
+            description: 'Safety-Instrumented System (SIS) protection active per NIST SP 800-82 §5.7: ' +
+                'SIS on a separate network segment from BPCS (Basic Process Control System); ' +
+                'SIS changes governed by formal management of change with SIL-certified engineer ' +
+                'sign-off (IEC 61511 / IEC 61508 alignment); SIS software version control active; ' +
+                'no AI-generated changes to SIS logic without human-in-loop review + sign-off; ' +
+                'SIS cyber assessment performed before any network connection added. Missing SIS ' +
+                'isolation is an absolute CRITICAL finding with no compensating control path.',
+            reference: 'NIST SP 800-82 §5.7 + IEC 61511 alignment (SIS)',
+            check: 'nist80082_safety_instrumented_system',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'nist80082-cisa-incident-reporting',
+            description: 'CISA OT incident reporting process active per NIST SP 800-82 §6.10 + CIRCIA + ' +
+                'EO 14028: OT security incidents reported to CISA within 24 hours of discovery ' +
+                '(EO 14028 + CISA OT guidance baseline); CIRCIA reporting for covered critical ' +
+                'infrastructure entities wired (72h rulemaking target); NERC CIP incident reporting ' +
+                'for electric utility OT (NERC CIP-008-6); CISA ICS-CERT coordination contacts ' +
+                'maintained; incident records preserved 7 years. Formal notification required to ' +
+                'CISO, system security officer, OT security lead, CISA liaison, and authorizing official.',
+            reference: 'NIST SP 800-82 §6.10 + CIRCIA + EO 14028',
+            check: 'nist80082_cisa_incident_reporting',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nist80082-behavioral-validator-high-impact-unverified-change',
+            description: 'Behavioral validator: detects unverified software or configuration changes to ' +
+                'HIGH impact OT systems or Safety-Instrumented Systems (SIS). Any AI-generated ' +
+                'or agent-initiated modification to an OT control system element classified at ' +
+                'FIPS 199 HIGH impact or categorized as SIS must be blocked pending full security ' +
+                'impact analysis, Purdue model zone re-validation, OT security lead review, and ' +
+                'authorizing official sign-off. No partial-pass path: HIGH impact and SIS unverified ' +
+                'changes are an absolute block. HIGH impact violations escalated immediately to ' +
+                'system security officer and authorizing official. SIS violations also escalate ' +
+                'to the SIL-certified process safety engineer.',
+            reference: 'NIST SP 800-82 §4.2 + §5.7 + FIPS 199 HIGH + IEC 61511 alignment',
+            check: 'behavioralValidator_nist80082_high_impact_unverified_change',
+            failSeverity: 'CRITICAL',
+        },
+    ],
+};
+//# sourceMappingURL=nist-sp-800-82.js.map