<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-regulatory-compliance-tracking
description: >-
  Build regulatory compliance tracking systems that monitor regulatory changes, map obligations to controls, track compliance status, and manage regulatory reporting deadlines.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - regulatory-compliance
  - regulatory-tracking
  - compliance-monitoring
  - obligation-management
  - regulatory-change
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Regulatory Compliance Tracking

## Overview

Organizations face an ever-changing regulatory landscape. This technique covers building systems to track regulatory obligations, monitor for regulatory changes, map requirements to implemented controls, manage reporting deadlines, and maintain compliance evidence repositories.

Mode: `[MODE: ARCHITECT]` — Regulatory compliance tracking and obligation management.

## Prerequisites

| Requirement | Details |
|---|---|
| Regulatory inventory | Applicable regulations identified |
| Control framework | Controls mapped to requirements |
| Python 3.10+ | For agent tooling |

## Workflow

### 1. Regulatory Obligation Inventory

```
Obligation tracking structure:
├── Regulation: GDPR (EU 2016/679)
│   ├── Obligation: Data breach notification
│   ├── Article: Art. 33
│   ├── Requirement: Notify DPA within 72 hours
│   ├── Mapped controls: IR-001, IR-002, IR-003
│   ├── Evidence: IR plan, notification template, drill logs
│   ├── Compliance status: Compliant
│   └── Last assessed: 2026-01-15
├── Regulation: PCI DSS v4.0
│   ├── Obligation: Quarterly vulnerability scans
│   ├── Requirement: 11.3.2
│   ├── Mapped controls: VM-001, VM-002
│   ├── Evidence: ASV scan reports
│   ├── Compliance status: Compliant
│   └── Next deadline: 2026-03-31
└── Regulation: HIPAA Security Rule
    ├── Obligation: Risk analysis
    ├── Reference: §164.308(a)(1)(ii)(A)
    ├── Mapped controls: RA-001, RA-002
    ├── Evidence: Annual risk assessment report
    ├── Compliance status: Partially compliant
    └── Gap: Risk assessment not updated this year
```

### 2. Regulatory Change Monitoring

```
Change monitoring workflow:
├── Sources:
│   ├── Federal Register (US regulations)
│   ├── EUR-Lex (EU regulations)
│   ├── Regulatory agency RSS feeds
│   ├── Law firm newsletters
│   └── GRC platform regulatory feeds
├── Assessment:
│   ├── Applicability determination
│   ├── Gap analysis against current controls
│   ├── Impact assessment (effort, cost, timeline)
│   └── Implementation plan development
└── Tracking:
    ├── Effective date monitoring
    ├── Implementation milestone tracking
    ├── Compliance validation testing
    └── Board/committee reporting
```

### 3. Compliance Calendar

```
Recurring deadlines:
├── Monthly:
│   ├── Access review certifications
│   └── Patch compliance reporting
├── Quarterly:
│   ├── PCI DSS ASV scans (Req 11.3.2)
│   ├── Risk register review
│   └── Security awareness metrics
├── Annually:
│   ├── SOC 2 Type II audit
│   ├── PCI DSS assessment
│   ├── HIPAA risk analysis
│   ├── Policy review cycle
│   └── BCP/DR testing
└── As-needed:
    ├── GDPR breach notification (72 hours)
    ├── SEC cyber incident disclosure (4 business days)
    └── State breach notification (varies by jurisdiction)
```

## Verification

- [ ] Process documented and approved
- [ ] Stakeholders identified and engaged
- [ ] Tooling configured and automated where possible
- [ ] Outputs reviewed and validated
- [ ] Reporting integrated into GRC program
- [ ] Periodic review schedule established
