<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Building Compliance Awareness Programs

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js reg-training --regulation pci-dss --audience cardholder-data-handlers` | Generate regulation-specific training for target audience |
| `node agent.js audit-prep --standard sox --timeline 90-days` | Build audit preparation training and timeline |
| `node agent.js evidence --controls access-review,change-mgmt,logging` | Create evidence collection procedure training |
| `node agent.js acknowledgment --policies aup,data-handling,incident --workflow annual` | Design policy acknowledgment workflow |

### Examples

```bash
# Generate regulation-specific training for target audience
node agent.js reg-training --regulation pci-dss --audience cardholder-data-handlers

# Build audit preparation training and timeline
node agent.js audit-prep --standard sox --timeline 90-days

# Create evidence collection procedure training
node agent.js evidence --controls access-review,change-mgmt,logging

# Design policy acknowledgment workflow
node agent.js acknowledgment --policies aup,data-handling,incident --workflow annual
```

## External Tools

| Tool | Command | Purpose |
|---|---|---|
| Drata | `drata --compliance-status --framework soc2` | Automated compliance monitoring |
| Archer GRC | `archer --control-status --regulation sox` | GRC risk and compliance |
| PolicyTech | `policytech --acknowledgment-report --quarter Q1` | Policy management platform |

## Compliance Frameworks

| Standard | Training Requirement |
|---|---|
| SOX Section 404 | Internal controls over financial reporting |
| PCI DSS 12.6 | Security awareness program requirements |
| HIPAA Administrative | Administrative safeguards for health information |
| SOC 2 CC1.4 | Security awareness and communication criteria |
