<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: automating-compliance-evidence-collection
description: >-
  Automate compliance evidence collection for CIS benchmarks, NIST 800-53,
  SOC 2, and PCI DSS. Build scripts that gather system configurations, access
  controls, encryption status, and audit logs into structured evidence packages.
domain: cybersecurity
subdomain: automation-scripting
tags:
  - compliance
  - cis-benchmarks
  - nist-800-53
  - soc2
  - pci-dss
  - audit
  - evidence-collection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Automating Compliance Evidence Collection

## Overview

Compliance evidence collection is labor-intensive when done manually. This skill
automates gathering configuration evidence, access control reviews, encryption
verification, and audit log collection mapped to specific compliance controls
(CIS, NIST 800-53, SOC 2, PCI DSS). Output packages are ready for auditor review.

Mode: `[MODE: BLUE]` — Compliance automation and audit evidence.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with root/sudo for system configuration access | Required |
| Target systems | Linux (Debian/RHEL families) |
| Knowledge of applicable compliance framework controls | Required |
| Optional | `ansible` for multi-host evidence collection |

## Key Concepts

### CIS Benchmark Checks

```python
import subprocess

def check_ssh_config() -> dict:
    """CIS 5.2.x — Verify SSH hardening settings."""
    checks = {
        "PermitRootLogin": {"expected": "no", "cis": "5.2.10"},
        "PasswordAuthentication": {"expected": "no", "cis": "5.2.5"},
        "X11Forwarding": {"expected": "no", "cis": "5.2.6"},
        "MaxAuthTries": {"expected": "4", "cis": "5.2.7"},
        "Protocol": {"expected": "2", "cis": "5.2.4"},
    }
    results = []
    try:
        content = open("/etc/ssh/sshd_config").read()
    except FileNotFoundError:
        return {"error": "sshd_config not found"}

    for setting, info in checks.items():
        for line in content.splitlines():
            line = line.strip()
            if line.startswith(setting):
                value = line.split()[-1]
                results.append({
                    "control": info["cis"],
                    "setting": setting,
                    "expected": info["expected"],
                    "actual": value,
                    "compliant": value == info["expected"],
                })
                break
    return {"check": "ssh_config", "results": results}
```

### File Permission Audits

```python
import os
import stat

def check_file_permissions(path: str, expected_mode: int, cis_id: str) -> dict:
    """Check file permissions against CIS benchmark requirement."""
    try:
        st = os.stat(path)
        actual_mode = stat.S_IMODE(st.st_mode)
        return {
            "control": cis_id,
            "path": path,
            "expected_mode": oct(expected_mode),
            "actual_mode": oct(actual_mode),
            "compliant": actual_mode <= expected_mode,
            "owner": st.st_uid,
            "group": st.st_gid,
        }
    except FileNotFoundError:
        return {"control": cis_id, "path": path, "error": "file not found"}
```

## Workflow

### Step 1: Run CIS Benchmark Checks

```bash
node scripts/agent.js --action cis-check --output /tmp/compliance/cis-evidence.json
```

### Step 2: Collect Access Control Evidence

```bash
node scripts/agent.js --action access-review --output /tmp/compliance/access-review.json
```

### Step 3: Verify Encryption Status

```bash
node scripts/agent.js --action encryption-check --output /tmp/compliance/encryption.json
```

## Verification

- [ ] CIS checks cover SSH, file permissions, kernel parameters
- [ ] Each finding maps to a specific control ID
- [ ] Compliant/non-compliant status is clear for each check
- [ ] Evidence packages include timestamps and system identification
- [ ] Output format is suitable for auditor review

## References

- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
- [NIST SP 800-53](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [SOC 2 Trust Service Criteria](https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/sorhome)
- [PCI DSS v4.0](https://www.pcisecuritystandards.org/)
