<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: automating-compliance-reporting
description: >-
  Automate compliance reporting for SOC 2, PCI DSS, HIPAA, and NIST frameworks
  with evidence collection, control mapping, gap analysis, and report generation.
domain: cybersecurity
subdomain: security-operations-automation
tags:
  - compliance
  - soc2
  - pci-dss
  - hipaa
  - nist
  - reporting
  - evidence-collection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Automating Compliance Reporting

## Overview

Compliance reporting automation collects evidence from infrastructure, maps
controls to framework requirements, identifies gaps, and generates audit-ready
reports. This eliminates manual evidence gathering and ensures continuous
compliance visibility across SOC 2, PCI DSS, HIPAA, and NIST CSF.

Mode: `[MODE: BLUE]` — Compliance assurance automation.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `requests`, `jinja2` | Required |
| API access to infrastructure (AWS, Azure, GCP) | Required |
| SIEM/log management for audit log evidence | Required |
| IAM system for access control evidence | Required |

## Key Concepts

### Control Mapping

```python
FRAMEWORK_CONTROLS = {
    "soc2": {
        "CC6.1": {"title": "Logical Access Controls", "evidence": ["iam_policies", "mfa_status"]},
        "CC6.3": {"title": "Encryption at Rest", "evidence": ["encryption_config", "kms_keys"]},
        "CC7.2": {"title": "Monitoring Activities", "evidence": ["siem_alerts", "audit_logs"]},
    },
    "pci_dss": {
        "1.1": {"title": "Firewall Configuration", "evidence": ["firewall_rules", "network_diagram"]},
        "8.3": {"title": "MFA for Admin Access", "evidence": ["mfa_status", "admin_accounts"]},
        "10.2": {"title": "Audit Trails", "evidence": ["audit_logs", "log_retention"]},
    },
}
```

### Evidence Collection

```python
def collect_evidence(control_id: str, evidence_types: list[str]) -> dict:
    """Collect evidence artifacts for a specific control."""
    evidence = {}
    for etype in evidence_types:
        evidence[etype] = {
            "collected": True,
            "timestamp": "2026-03-18T00:00:00Z",
            "artifact_path": f"/evidence/{control_id}/{etype}.json",
        }
    return evidence
```

## Workflow

### Step 1: Generate Compliance Report

```bash
node scripts/agent.js --action report --framework soc2
```

### Step 2: Gap Analysis

```bash
node scripts/agent.js --action gap-analysis --framework pci_dss
```

### Step 3: Collect Evidence

```bash
node scripts/agent.js --action collect-evidence --framework soc2 --control CC6.1
```

## Verification

- [ ] Control mapping covers all framework requirements
- [ ] Evidence collection captures artifacts with timestamps
- [ ] Gap analysis identifies missing controls and evidence
- [ ] Reports are audit-ready with framework-specific formatting

## References

- [SOC 2 Trust Service Criteria](https://us.aicpa.org/interestareas/frc/assuranceadvisoryservices/sorhome)
- [PCI DSS v4.0](https://www.pcisecuritystandards.org/document_library/)
- [NIST CSF 2.0](https://www.nist.gov/cyberframework)
- [HIPAA Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/index.html)
