Compliance Automation

Compliance Automation

Identity

Reference System Usage

You must ground your responses in the provided reference files, treating them as the source of truth for this domain:

• For Creation: Always consult `references/patterns.md`. This file dictates how things should be built. Ignore generic approaches if a specific pattern exists here.
• For Diagnosis: Always consult `references/sharp_edges.md`. This file lists the critical failures and "why" they happen. Use it to explain risks to the user.
• For Review: Always consult `references/validations.md`. This contains the strict rules and constraints. Use it to validate user inputs objectively.

Note: If a user's request conflicts with the guidance in these files, politely correct them using the information provided in the references.

Compliance Automation

Patterns

Golden Rules

---

Rule

Policies in version control

Reason

Audit trail, peer review, rollback

---

Rule

Evidence immutable once collected

Reason

Prevents tampering, maintains integrity

---

Rule

Continuous > periodic assessment

Reason

Drift detected in minutes, not months

---

Rule

Controls map to frameworks

Reason

One control satisfies multiple frameworks

---

Rule

Automate evidence collection

Reason

Manual collection doesn't scale

Control Status

• pass
• fail
• not_applicable
• error

Severity Levels

Critical

Immediate action required

High

Action within 24 hours

Medium

Action within 1 week

Low

Informational

Evidence Types

• screenshot
• log_export
• config_snapshot
• api_response
• report
• attestation

Common Frameworks

Soc2

Full Name

SOC 2 Type II

Focus

Trust Service Criteria

Controls

CC series

Iso27001

Full Name

ISO 27001

Focus

Information Security Management

Controls

Annex A

Pci Dss

Full Name

PCI DSS

Focus

Payment Card Security

Controls

12 requirements

Hipaa

Full Name

HIPAA

Focus

Healthcare Data Protection

Controls

Administrative, Physical, Technical

Ccm Components

Policy Engine

OPA Rego rules

Evidence Collector

Automated artifact gathering

Continuous Monitoring

Real-time assessment

Drift Detection

Baseline comparison

Alerting

Violation notifications

Anti-Patterns

---

Pattern

Manual evidence collection

Problem

Doesn't scale, error-prone

Solution

Automated collectors with scheduling

---

Pattern

Point-in-time audits

Problem

Drift undetected between audits

Solution

Continuous monitoring

---

Pattern

Policies in documentation

Problem

Can't be enforced automatically

Solution

Policy-as-code with OPA

---

Pattern

Siloed compliance

Problem

Duplicated effort per framework

Solution

Unified control framework

---

Pattern

Evidence in email/tickets

Problem

Not immutable, hard to find

Solution

Centralized evidence store with integrity

Compliance Automation - Sharp Edges

Evidence Can Be Modified After Collection

Id

evidence-tampering

Severity

critical

Summary

Audit evidence stored in mutable storage undermines integrity

Symptoms

• Evidence files can be edited
• No hash verification
• Auditor questions evidence authenticity

Why

Compliance evidence must be immutable to prove it wasn't altered after collection. If evidence can be modified, its value is zero - auditors can't trust it, and you can't prove your controls were working.

Gotcha

"Here's our evidence from last month" "How do I know this wasn't modified?" "It's in our S3 bucket..." "Can anyone edit that bucket?" "..."

Evidence is worthless if it can be tampered with

Solution

1. Immutable storage:

• S3 Object Lock (GOVERNANCE or COMPLIANCE mode)
• Azure Immutable Blob Storage
• Write-once storage

2. Integrity verification:

• SHA-256 hash at collection
• Hash stored separately
• Verify before audit

3. Chain of custody:

• Log all access
• Timestamp with trusted time source
• Digital signatures

Policies Don't Match Current Infrastructure

Id

stale-policies

Severity

high

Summary

Policy-as-code hasn't been updated as infrastructure evolved

Symptoms

• New resources not covered by policies
• Policies reference deprecated configurations
• False negatives in compliance checks

Why

Infrastructure changes constantly - new services, renamed resources, changed configurations. If policies aren't updated, they silently stop checking what matters. You think you're compliant, but you're not.

Gotcha

"We passed all compliance checks" "What about the new Kubernetes cluster?" "It's not in our policies yet" "So it's completely unchecked?"

New infrastructure deployed without compliance coverage

Solution

1. Policy CI/CD:

• Policies version-controlled
• Review policies on infrastructure changes
• Automated policy testing

2. Coverage monitoring:

• Track resource types vs policy coverage
• Alert on new uncovered resources
• Require policies before production

3. Regular audits:

• Quarterly policy review
• Compare against infrastructure inventory
• Update policies proactively

Checking Compliance But Not Enforcing

Id

compliance-theater

Severity

high

Summary

Violations are detected but nothing happens

Symptoms

• Dashboard shows failures
• No remediation workflow
• Same violations for months

Why

Compliance monitoring is useless if violations aren't addressed. If you detect problems but don't fix them, you're just documenting your non-compliance - which is worse than not knowing.

Gotcha

"Our compliance dashboard shows 47 critical violations" "How long have they been there?" "Some for 6 months" "Why weren't they fixed?" "Nobody assigned to remediation"

Detecting problems without fixing them is compliance theater

Solution

1. Automated remediation:

• Auto-fix low-risk violations
• Auto-create tickets for others
• SLA for remediation

2. Enforcement:

• Block non-compliant deployments
• Require exception approval
• Time-bound exceptions only

3. Accountability:

• Violations assigned to owners
• Escalation for overdue items
• Executive visibility

Scrambling Before Annual Audit

Id

annual-audit-panic

Severity

medium

Summary

Evidence collection is a last-minute fire drill

Symptoms

• Weeks of audit prep
• Missing evidence scramble
• Evidence created retroactively

Why

If you're only collecting evidence before audits, you're proving you can scramble under pressure - not that your controls work year-round. Continuous compliance means the audit is just a review of existing data.

Gotcha

"Audit is next month!" "Time to collect evidence" "But the logs from January were purged" "And we changed our access process in March" "And nobody documented the old one"

Annual panic reveals continuous compliance failure

Solution

1. Continuous evidence collection:

• Automated daily/weekly collection
• Stored with retention policies
• Never delete before audit

2. Always audit-ready:

• Evidence available instantly
• Dashboards show current state
• No special prep needed

3. Process discipline:

• Document process changes immediately
• Evidence generated as side effect
• Real-time compliance visibility

Compliance Automation - Validations

Mutable Evidence Storage

Id

mutable-evidence-storage

Severity

error

Type

regex

Pattern

• evidence.bucket(?!.object_lock)
• store_evidence\((?!.*immutable)
• s3.put_object(?!.ObjectLockMode)

Message

Evidence may be stored in mutable storage - integrity risk.

Fix Action

Use S3 Object Lock or immutable blob storage

Applies To

• */.py
• */.ts
• */.yaml

Missing Evidence Hash

Id

no-evidence-hash

Severity

warning

Type

regex

Pattern

• collect_evidence\((?!.*hash)
• store_evidence\((?!.*sha256)
• Evidence\((?!.*content_hash)

Message

Evidence may lack integrity hash for verification.

Fix Action

Add SHA-256 hash to all evidence artifacts

Applies To

• */.py
• */.ts

Policy Without Version Control

Id

policy-no-version

Severity

warning

Type

regex

Pattern

• policy.=."""(?!.*version)
• POLICY.=(?!.v[0-9])

Message

Policy may not be version controlled.

Fix Action

Store policies in version control with versioning

Applies To

• */.py
• */.rego

Missing Compliance Alerting

Id

no-compliance-alerting

Severity

warning

Type

regex

Pattern

• compliance.check(?!.alert)
• control.fail(?!.notify)

Message

Compliance failure may not trigger alerts.

Fix Action

Add alerting for compliance violations

Applies To

• */.py
• */.yaml

Manual Evidence Collection

Id

manual-evidence-collection

Severity

info

Type

regex

Pattern

• evidence.*manual
• collect.screenshot.manually
• export.for.audit

Message

Evidence collection may be manual - consider automation.

Fix Action

Automate evidence collection on schedule

Applies To

• */.py
• */.md

Missing Evidence Retention

Id

no-retention-policy

Severity

warning

Type

regex

Pattern

• evidence(?!.*retention)
• store_artifact(?!.*expire)

Message

Evidence may lack retention policy.

Fix Action

Define evidence retention (typically 7 years)

Applies To

• */.py
• */.yaml

Hardcoded Compliance Exception

Id

hardcoded-compliance-exception

Severity

warning

Type

regex

Pattern

• skip.compliance.=.*True
• ignore.control.=.*True
• exception.*permanent

Message

Hardcoded compliance exception found.

Fix Action

Use time-bound exceptions with approval workflow

Applies To

• */.py
• */.yaml