<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: compliance-audit
description: >-
  Security compliance and audit management including SOC 2 Type II preparation,
  PCI DSS v4.0 assessment, FedRAMP authorization, ISO 27001/27002 implementation,
  NIST CSF alignment, HIPAA security rule compliance, audit evidence collection,
  control mapping across frameworks, and continuous compliance monitoring.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - soc2
  - pci-dss
  - fedramp
  - iso-27001
  - nist-csf
  - hipaa
  - compliance
  - audit
  - grc
  - control-mapping
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  nist-csf: ["ID.GV-1", "ID.GV-2", "ID.GV-3", "PR.IP-1"]
  frameworks: ["SOC 2", "PCI DSS v4.0", "ISO 27001:2022", "NIST CSF 2.0", "FedRAMP", "HIPAA"]
---

# Compliance & Audit

## When to Use

Activate when the operator asks about SOC 2, PCI DSS, FedRAMP, ISO 27001,
NIST CSF, HIPAA compliance, audit preparation, control mapping, evidence
collection, or GRC program management.

Mode: `[MODE: ARCHITECT]` for compliance program design; `[MODE: BLUE]` for control implementation.

## Quick Reference

| Framework | Scope | Key Requirement | Audit Cycle |
|-----------|-------|-----------------|-------------|
| SOC 2 Type II | SaaS/cloud services | Trust Service Criteria (5 categories) | Annual |
| PCI DSS v4.0 | Payment card data | 12 requirements, ~250 controls | Annual + quarterly scans |
| ISO 27001:2022 | ISMS | 93 controls in Annex A | 3-year cert, annual surveillance |
| NIST CSF 2.0 | All organizations | 6 functions, 22 categories | Self-assessment |
| FedRAMP | US govt cloud | NIST 800-53 controls by impact level | Annual + continuous |
| HIPAA | Healthcare/PHI | Security Rule (18 standards) | Self-assessment + OCR audit |

## Workflow

### 1. Framework Cross-Mapping

```
Control mapping (single control → multiple frameworks):

"Multi-Factor Authentication" maps to:
├── SOC 2: CC6.1 (Logical Access Controls)
├── PCI DSS: 8.4 (MFA for CDE access)
├── ISO 27001: A.8.5 (Secure authentication)
├── NIST CSF: PR.AC-7 (Authentication)
├── FedRAMP: IA-2 (Identification and Authentication)
├── HIPAA: §164.312(d) (Person or entity authentication)
└── CIS Controls: 6.3 (Require MFA)

Benefits of cross-mapping:
├── Implement once, satisfy many frameworks
├── Reduce evidence collection burden
├── Identify gaps across all frameworks at once
└── Demonstrate control maturity to multiple auditors
```

### 2. SOC 2 Type II

```
Trust Service Criteria:
├── Security (Common Criteria — required)
│   ├── CC1: Control Environment
│   ├── CC2: Communication and Information
│   ├── CC3: Risk Assessment
│   ├── CC4: Monitoring Activities
│   ├── CC5: Control Activities
│   ├── CC6: Logical and Physical Access Controls
│   ├── CC7: System Operations
│   ├── CC8: Change Management
│   └── CC9: Risk Mitigation
├── Availability (optional)
├── Processing Integrity (optional)
├── Confidentiality (optional)
└── Privacy (optional)

Preparation timeline (6-12 months):
├── Month 1-2: Gap assessment against TSC
├── Month 3-4: Remediate gaps, implement controls
├── Month 5-6: Internal audit / readiness assessment
├── Month 7-12: Observation period (Type II requires 6-12 months)
├── Month 12+: External audit by CPA firm
└── Ongoing: Continuous compliance monitoring

Evidence collection examples:
├── CC6.1: Screenshots of MFA configuration, IAM policy docs
├── CC6.2: User access provisioning/deprovisioning tickets
├── CC7.1: Vulnerability scan reports, patch management logs
├── CC8.1: Change management tickets with approval workflow
└── CC9.1: Vendor risk assessment documents
```

### 3. PCI DSS v4.0

```
12 Requirements:
├── Build and Maintain a Secure Network
│   ├── Req 1: Install and maintain network security controls
│   └── Req 2: Apply secure configurations to all components
├── Protect Account Data
│   ├── Req 3: Protect stored account data
│   └── Req 4: Protect CHD with strong cryptography in transit
├── Maintain a Vulnerability Management Program
│   ├── Req 5: Protect from malicious software
│   └── Req 6: Develop and maintain secure systems
├── Implement Strong Access Control
│   ├── Req 7: Restrict access by business need-to-know
│   ├── Req 8: Identify users and authenticate access
│   └── Req 9: Restrict physical access to CHD
├── Regularly Monitor and Test Networks
│   ├── Req 10: Log and monitor all access
│   └── Req 11: Test security regularly
└── Maintain an Information Security Policy
    └── Req 12: Support security with policies and programs

v4.0 key changes (mandatory March 2025):
├── Customized approach option (alternative to defined approach)
├── Targeted risk analysis for flexible control implementation
├── Enhanced authentication (MFA for all CDE access)
├── Automated log review mechanisms
└── Anti-phishing mechanisms for personnel
```

### 4. Continuous Compliance

```bash
# Automated compliance monitoring tools:
# - Vanta, Drata, Secureframe (SaaS compliance platforms)
# - Prowler (AWS/Azure/GCP security posture)
# - OpenSCAP (NIST/CIS benchmark scanning)
# - Chef InSpec (infrastructure compliance as code)

# InSpec example: verify SSH hardening
describe sshd_config do
  its('Protocol') { should cmp 2 }
  its('PermitRootLogin') { should eq 'no' }
  its('PasswordAuthentication') { should eq 'no' }
  its('MaxAuthTries') { should cmp <= 3 }
end

# Prowler compliance check
prowler aws --compliance cis_2.0 --output-formats json-ocsf

# Evidence automation:
# Screenshot collection → automated via API
# Log exports → scheduled SIEM reports
# Config snapshots → Infrastructure as Code diffs
# Access reviews → IAM tools with quarterly workflow
```

## Verification

- [ ] Framework requirements mapped to implemented controls
- [ ] Evidence collection automated where possible
- [ ] Gap assessment completed with remediation timeline
- [ ] Control owners assigned for each requirement
- [ ] Internal audit completed before external audit
- [ ] Continuous compliance monitoring active
- [ ] Cross-framework mapping reduces duplicate evidence
