@connexum/ai-governance 1.0.0-beta.11

package/dist/packs/nist-sp-800-82.d.ts

@@ -0,0 +1,127 @@
+/**
+ * NIST SP 800-82 Rev 3 Operational Technology Security Compliance Pack
+ *
+ * NIST Special Publication 800-82 Revision 3 (September 2023) — "Guide to
+ * Operational Technology (OT) Security." US federal guide for securing OT
+ * environments including Industrial Control Systems (ICS), SCADA systems,
+ * Distributed Control Systems (DCS), Programmable Logic Controllers (PLC),
+ * Remote Terminal Units (RTU), building automation systems (BAS), transportation
+ * control systems, and Industrial Internet of Things (IIoT).
+ *
+ * Standards and authorities referenced (citations only; no verbatim text):
+ *   - NIST SP 800-82 Rev 3 (September 2023) — Guide to OT Security
+ *   - NIST SP 800-53 Rev 5 — Security and Privacy Controls (parent catalog)
+ *   - NIST SP 800-30 Rev 1 — Guide for Conducting Risk Assessments
+ *   - NIST SP 800-39 — Managing Information Security Risk
+ *   - NIST SP 800-92 — Guide to Computer Security Log Management (retention)
+ *   - FIPS 199 — Standards for Security Categorization of Federal Information
+ *   - FIPS 200 — Minimum Security Requirements for Federal Systems
+ *   - FISMA — Federal Information Security Modernization Act (2014)
+ *   - FAR 52.204-21 / DFARS 252.204-7012 — Federal procurement OT requirements
+ *   - EO 14028 (2021) — Improving the Nation's Cybersecurity
+ *   - CISA OT Cybersecurity Guidance (CISA 2022, 2023)
+ *   - CIRCIA — Cyber Incident Reporting for Critical Infrastructure Act (2022)
+ *   - NERC CIP standards (cross-reference for electric utilities)
+ *   - IEC 62443 — International OT/IACS cybersecurity counterpart
+ *   - IEC 61511 — Functional safety for process industries (SIS alignment)
+ *   - IEC 61508 — Functional safety of E/E/PE systems (parent SIL standard)
+ *
+ * Impact Level Classification (FIPS 199 + NIST SP 800-82 §4.2):
+ *   Impact levels follow FIPS 199 categorization adapted for OT environments.
+ *   The potential impact is assessed for confidentiality, integrity, and
+ *   availability, with OT systems typically prioritising availability and
+ *   integrity (safety-instrumented systems require deterministic operation).
+ *
+ *   | Impact | Description                                                         |
+ *   |--------|---------------------------------------------------------------------|
+ *   | LOW    | Limited adverse effect — minor degradation of capability            |
+ *   | MOD    | Serious adverse effect — significant degradation of primary mission |
+ *   | HIGH   | Severe / catastrophic — loss of life, major financial damage,       |
+ *   |        | long-term environmental contamination, infrastructure failure       |
+ *
+ *   Default when impact level not declared: MODERATE (conservative per FIPS 199
+ *   guidance and NIST SP 800-82 §4.2 — when in doubt, classify higher).
+ *
+ * Purdue Enterprise Reference Architecture (NIST SP 800-82 §5.5):
+ *   Level 0 — Physical process (sensors, actuators, physical systems)
+ *   Level 1 — Intelligent devices (PLCs, RTUs, safety systems, drives)
+ *   Level 2 — Control systems (SCADA, DCS, HMI, engineering workstations)
+ *   Level 3 — Manufacturing operations (MES, historian, batch management)
+ *   Level 3.5 — Industrial DMZ (boundary between OT and IT — CRITICAL zone)
+ *   Level 4 — Enterprise (ERP, email, business intelligence)
+ *   Level 5 — External network / Internet
+ *
+ * Key NIST 800-53 control families mapped to OT in SP 800-82 §6:
+ *   AC  — Access Control (§6.2)
+ *   AU  — Audit and Accountability (§6.3)
+ *   AT  — Awareness and Training (§6.4)
+ *   CA  — Assessment, Authorization, and Monitoring (§6.5)
+ *   CM  — Configuration Management (§6.6)
+ *   CP  — Contingency Planning (§6.7)
+ *   IA  — Identification and Authentication (§6.8)
+ *   IR  — Incident Response (§6.10)
+ *   MA  — Maintenance (§6.11)
+ *   MP  — Media Protection (§6.12)
+ *   PE  — Physical and Environmental Protection (§6.13)
+ *   PL  — Planning (§6.14)
+ *   PM  — Program Management (§6.15)
+ *   PS  — Personnel Security (§6.16)
+ *   RA  — Risk Assessment (§6.17)
+ *   SA  — System and Services Acquisition (§6.18 — supply chain)
+ *   SC  — System and Communications Protection (§6.18 — network seg.)
+ *   SI  — System and Information Integrity (§6.19)
+ *   SR  — Supply Chain Risk Management (§6.20)
+ *
+ * Safety-Instrumented Systems (SIS) per NIST SP 800-82 §5.7:
+ *   SIS are designed to bring a process to a safe state when predetermined
+ *   conditions are violated (IEC 61511 / IEC 61508). SIS have separate
+ *   network segments and must not be modified without formal management of
+ *   change. AI-generated changes to SIS are an absolute block in this pack.
+ *
+ * Retention:
+ *   NIST SP 800-92 + FISMA records management baseline: 7 years (2555 days).
+ *   DoD / CMMC context may impose longer periods; this pack uses the
+ *   7-year FISMA / NIST SP 800-92 federal records baseline.
+ *
+ * Sister standard: IEC 62443 (international OT/IACS counterpart). The two
+ * are typically run together for US-multinational customers. Use `iec-62443`
+ * pack in parallel when operating in both US-federal and international contexts.
+ *
+ * @connexum/ai-governance
+ */
+import { CompliancePack } from './index';
+import { CategoryClassifiers } from '../classification/pack-driven-classifier';
+/**
+ * NIST SP 800-82 category classifiers.
+ *
+ * Covers FIPS 199 impact-level declarations (LOW / MODERATE / HIGH),
+ * Purdue model zone artefacts, OT cybersecurity program documents,
+ * risk management records, and Safety-Instrumented System (SIS) records.
+ */
+export declare const NIST_SP_800_82_CATEGORY_CLASSIFIERS: CategoryClassifiers;
+/**
+ * NIST SP 800-82 Rev 3 Operational Technology Security Compliance Pack.
+ *
+ * Pack ID: 'nist-sp-800-82'
+ * Jurisdiction: US federal (FISMA mandatory); widely adopted by NERC CIP
+ *   (electric utilities), AWIA (water authorities), DoD industrial base
+ *   (DFARS/CMMC), and federal building automation operators. Sister standard
+ *   to IEC 62443 (international) — the two are typically run together for
+ *   US-multinational customers.
+ *
+ * Guard-layer wiring:
+ *   - G1-G4 (audit, logging, classification, session): always active
+ *   - G5-G6 (supply-chain SR, approval-queue): MODERATE / HIGH impact
+ *   - G7-G8 (attestation, anomaly-detection): HIGH impact + SIS
+ *   - G9 (transparency): HIGH impact (maximum disclosure burden)
+ *   - Approval Queue: always active (HIGH immediate; MODERATE closure)
+ *
+ * Human-in-loop tier:
+ *   - T1: LOW / MODERATE (OT security engineer review)
+ *   - T2: HIGH / SIS (NIST RMF Authorizing Official + CISSP-ICSE certified)
+ */
+export declare const NIST_SP_800_82_PACK: CompliancePack & {
+    categoryClassifiers: CategoryClassifiers;
+    subjectKeyedCategories: string[];
+};
+//# sourceMappingURL=nist-sp-800-82.d.ts.map

package/dist/packs/nist-sp-800-82.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nist-sp-800-82.d.ts","sourceRoot":"","sources":["../../src/packs/nist-sp-800-82.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,EAAE,mBA6GjD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,EAAE,cAAc,GAAG;IACjD,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,sBAAsB,EAAE,MAAM,EAAE,CAAC;CA6gBlC,CAAC"}