--- name: "compliance-os" description: "Compliance OS — meta-orchestrator that lets compliance teams CONFIGURE which frameworks apply, COMPUTE cross-framework control overlap, SIMULATE internal audits, and CONSOLIDATE evidence across multiple frameworks. Four decisions: (1) Given a company profile, which of the 12 supported frameworks apply (ISO 27001/13485/42001/14971, EU AI Act, MDR 745, GDPR, SOC 2, FDA QSR, NIST CSF 2.0, NIS2, HIPAA)? (2) Across selected frameworks, which controls overlap and how much evidence reuses? (3) For a given framework + scope, what does a realistic mock audit produce — drawing from the 205-scenario library? (4) Across selected frameworks, what's the unified evidence checklist with reuse map? Use when standing up a multi-framework program, planning the annual audit calendar, or preparing for certification stage 1. Does NOT replace per-framework skills (it orchestrates them)." license: MIT metadata: version: 1.0.0 author: Alireza Rezvani category: compliance-os domain: multi-framework-compliance-orchestration updated: 2026-05-13 python-tools: framework_selector.py, cross_framework_mapper.py, audit_simulator.py, evidence_pool_generator.py frameworks: iso-27001, iso-13485, iso-42001, iso-14971, eu-ai-act, eu-mdr-745, gdpr, soc-2, fda-qsr, nist-csf, nis2, hipaa --- # Compliance OS — Meta-Orchestrator Multi-framework compliance program orchestration. **Four decisions, no per-framework deep-dive:** 1. **Which frameworks apply to this company?** — `framework_selector.py` ranks the 12 supported frameworks against a company profile (industry, geography, AI use, medical, financial, headcount, customers, healthcare-PHI, NIS2 essential/important entity, US gov contractor) and returns applicable ones with dependency graph 2. **How much do selected frameworks overlap?** — `cross_framework_mapper.py` computes control-level overlap with confidence rating; outputs unified control matrix + evidence-reuse opportunities 3. **What does a mock audit produce?** — `audit_simulator.py` generates 8–15 finding scenarios with severity distribution matching IIA expectations + interview questions per control 4. **What's the unified evidence checklist?** — `evidence_pool_generator.py` consolidates evidence across enabled frameworks; outputs which artefact satisfies which controls across which frameworks This skill is **NOT** a per-framework deep-dive. The per-framework skills (`ra-qm-team/skills/iso42001-specialist/`, `compliance-team-eu-ai-act/`, `ra-qm-team/skills/gdpr-dsgvo-expert/`, etc.) do the operational work. Compliance OS orchestrates them. This skill is **NOT** a substitute for binding legal advice. Cross-framework mappings reflect published guidance (ISO standards, regulations, EDPB/Commission guidance, IIA / AICPA professional standards). Novel cross-walks should be reviewed with counsel. ## Keywords compliance orchestration, multi-framework compliance, compliance OS, cross-framework mapping, control overlap, evidence pool, evidence reuse, audit simulation, mock audit, internal audit programme, GRC, governance risk compliance, framework selector, compliance program, integrated compliance, ISO 19011, IIA IPPF, AICPA AT-C, NIST CSF profile, multi-cert program, SOC 2 + ISO 27001, ISO 27001 + ISO 42001, ISO 13485 + MDR 745, AI Act + ISO 42001, GDPR + ISO 27001, compliance officer, compliance team workflow, certification readiness ## Quick Start ```bash # Decision A: Which frameworks apply for the company? python scripts/framework_selector.py # embedded mid-stage AI SaaS sample python scripts/framework_selector.py path/to/profile.json # Decision B: Compute cross-framework overlap python scripts/cross_framework_mapper.py # embedded ISO 27001 + SOC 2 sample python scripts/cross_framework_mapper.py path/to/control_libs.json # Decision C: Simulate an audit python scripts/audit_simulator.py # embedded ISO 27001 sample python scripts/audit_simulator.py path/to/audit_scope.json # Decision D: Consolidate evidence checklist across frameworks python scripts/evidence_pool_generator.py # embedded 3-framework sample python scripts/evidence_pool_generator.py path/to/program.json ``` ## Key Questions (ask these first) - **Have you named every applicable framework?** Forgetting one means rebuilding the audit program later. Run `framework_selector.py` with your profile. - **What's the most certificate / regulation your company already operates?** That's your reuse anchor. Map every new framework against it. - **What's the audit calendar?** A multi-framework program means surveillance audits stacked through the year — plan auditor independence + capacity. - **Where is evidence stored?** Multi-framework programs collapse when evidence lives in one team's drive without an index. Run `evidence_pool_generator.py` to surface the reuse opportunities. - **What's the management-review cadence across frameworks?** Each framework wants its own management review, but a single integrated review (per ISO Annex SL) typically satisfies all of them with one calendar slot. - **Who owns the meta-program?** If no single accountable role, the program fragments. ## Core Responsibilities ### 1. Framework Selection **The framework:** company-profile JSON in → applicable-framework list out with dependency graph. **Deterministic logic:** - Medical device → ISO 13485 + ISO 14971 + (EU MDR 745 if EU market) + (FDA QSR if US market) - Customer-facing AI → ISO 42001 + EU AI Act (if EU users) + GDPR (if personal data) - B2B SaaS with enterprise customers → SOC 2 + ISO 27001 (often required for procurement) - EU customers + personal data → GDPR mandatory - Highly regulated industry (financial, health) → additional sectoral overlays **Run** `framework_selector.py` to apply the decision rules. ### 2. Cross-Framework Control Mapping **The framework:** for each selected framework, parse its control library; compute overlap with other selected frameworks. **Per merged-control output:** - Mapping confidence (HIGH / MEDIUM / LOW) - Evidence-reuse opportunity (single artefact satisfies N controls) - Per-framework citation - Implementation guidance reusable across frameworks **Densest known overlap:** ISO 27001 Annex A ↔ SOC 2 Trust Services Criteria — historically ~75% control coverage shared. Adding ISO 42001 brings AI-specific controls; adding GDPR brings privacy-specific. **Run** `cross_framework_mapper.py` with framework control libraries. ### 3. Audit Simulation **The framework:** generate a realistic mock internal audit per ISO 19011 + IIA IPPF standards. **Per audit output:** - 8–15 finding scenarios per ISO 19011 typical depth - Severity distribution: ≥ 40% observations/OFI, ≤ 15% critical/major (IIA expectation for healthy programs) - Interview questions per scoped control (3–5 questions per control) - Document-review request list - Walk-through requests where applicable **Run** `audit_simulator.py` with framework + scope. ### 4. Evidence Pool **The framework:** consolidate evidence requirements across enabled frameworks; identify reuse opportunities. **Output:** - Evidence artefact list (e.g., access-review log, supplier risk register, incident log) - Per artefact: list of (framework, control) tuples it satisfies - Reuse-leverage score (artefact A satisfies N controls across M frameworks) - Acquisition cost estimate (effort to produce + maintain) **Run** `evidence_pool_generator.py` with program config. ## Workflows ### Workflow 1: Program Bootstrap (multi-framework, 4–8 weeks) **Goal:** stand up a compliance program covering 2–4 frameworks simultaneously. ```bash # 1. Run framework selector with company profile python scripts/framework_selector.py profile.json # 2. For each applicable framework, identify the per-framework skill and run its gap analysis # 3. Run cross-framework mapper to identify reuse opportunities python scripts/cross_framework_mapper.py control_libs.json # 4. Run evidence pool generator to consolidate python scripts/evidence_pool_generator.py program.json # 5. Cross-check with cs-compliance-officer agent # 6. Output: prioritized program backlog with owners + dates ``` ### Workflow 2: Annual Audit Calendar (yearly) **Goal:** plan internal audit cycles covering all applicable frameworks. ```bash # 1. Refresh framework selector if profile changed python scripts/framework_selector.py profile.json # 2. For each framework, run its internal-audit-plan tool # (e.g., aims_audit_scheduler.py for ISO 42001; isms_audit_scheduler.py for ISO 27001) # 3. Coordinate the audit calendar across frameworks (auditor independence + capacity) # 4. Run audit simulator for each framework to prep auditors python scripts/audit_simulator.py scope.json # 5. Output: integrated audit calendar with owners + auditor assignments ``` ### Workflow 3: Pre-Certification Readiness (per new framework, 6–12 weeks) **Goal:** prepare for an external certification audit. ```bash # 1. Run gap analysis for the new framework # (ISO 42001: aims_gap_analyzer.py; ISO 27001: compliance_checker.py; SOC 2: gap_analyzer.py) # 2. Run cross-framework mapper against already-certified frameworks python scripts/cross_framework_mapper.py control_libs.json # 3. Reuse evidence for HIGH-confidence mappings; build new for MEDIUM/LOW # 4. Run audit simulator to dry-run the certification audit python scripts/audit_simulator.py scope.json # 5. Close remaining gaps before external auditor stage 1 ``` ### Workflow 4: Evidence Pool Consolidation (quarterly) **Goal:** keep the unified evidence pool fresh + reusable. ```bash # 1. Refresh evidence pool generator python scripts/evidence_pool_generator.py program.json # 2. Identify HIGH-reuse-leverage artefacts (1 evidence -> 5+ controls) # 3. Confirm evidence freshness (within retention requirement per framework) # 4. Audit the evidence pool itself (no orphan controls, no stale evidence) ``` ## Output Standards ``` **Bottom Line:** [one sentence — what's the multi-framework picture + biggest reuse opportunity] **The Decision:** [one of: framework-set | overlap-map | audit-plan | evidence-consolidation] **The Evidence:** [framework names + control IDs from the tool, not adjectives] **How to Act:** [3 concrete next steps with owners + dates] **Your Decision:** [the call only the compliance officer can make — which frameworks to pursue, audit cycle priority, evidence-reuse policy] ``` ## Adjacent Skills - `../../ra-qm-team/skills/iso42001-specialist/` — ISO 42001 deep-dive (paired with compliance-team-iso42001 plugin) - `../../ra-qm-team/skills/eu-ai-act-specialist/` — EU AI Act deep-dive (paired with compliance-team-eu-ai-act plugin) - `../../ra-qm-team/skills/information-security-manager-iso27001/` — ISO 27001 ISMS deep-dive - `../../ra-qm-team/skills/quality-manager-qms-iso13485/` — ISO 13485 QMS deep-dive - `../../ra-qm-team/skills/gdpr-dsgvo-expert/` — GDPR deep-dive - `../../ra-qm-team/skills/soc2-compliance/` — SOC 2 deep-dive - `../../ra-qm-team/skills/fda-consultant-specialist/` — FDA QSR deep-dive - `../../ra-qm-team/skills/mdr-745-specialist/` — EU MDR 745 deep-dive - `../../ra-qm-team/skills/risk-management-specialist/` — ISO 14971 deep-dive - `../../c-level-advisor/chief-ai-officer-advisor/` — Executive AI risk decisions (build-vs-buy, model selection) - `../../c-level-advisor/skills/general-counsel-advisor/` — Legal review for novel cases ## References - [compliance_os_pattern.md](references/compliance_os_pattern.md) — The meta-framework architecture (configure → map → simulate → consolidate → review); when to use vs not - [cross_framework_overlap.md](references/cross_framework_overlap.md) — The 9-framework × control-family overlap table with mapping confidence (Phase 3 expands to 12 frameworks via `cross_framework_mapper.py`) - [audit_simulation_methodology.md](references/audit_simulation_methodology.md) — ISO 19011 + IIA IPPF + AICPA AT-C audit-simulation principles + severity distribution heuristics - [evidence_management.md](references/evidence_management.md) — Evidence pool design + retention + freshness + reuse-leverage scoring - [multi_framework_audit_playbook.md](references/multi_framework_audit_playbook.md) — Integrated audit programme for 2+ frameworks (Phase 2) - [evidence_artifact_reuse_index.md](references/evidence_artifact_reuse_index.md) — Empirically-derived reuse-leverage ranking across all 12 frameworks (Phase 3) ## Phase 3 Asset: Mock Audit Scenario Library `assets/mock_audit_library.json` — 205 pre-built finding scenarios spanning 12 frameworks + 26 themes + 4 severity levels (34 critical, 88 major, 54 minor, 29 observation). Each scenario tags applicable frameworks; cross-reference `scripts/cross_framework_mapper.py` merged-controls catalogue to resolve framework-specific control IDs. Use as input to enrich `audit_simulator.py` mock audits, as a training resource for new internal auditors, or as the seed for finding-pattern detection across multi-framework programmes. --- **Version:** 1.2.0 **Status:** Production Ready FILE:assets/company_profile_template.json { "company": "", "industry": "", "products_include_ai": false, "ai_high_risk_per_eu": false, "deploys_ai_in_eu": false, "products_are_medical_devices": false, "sells_to_eu_customers": false, "sells_to_us_customers": false, "sells_to_enterprise_b2b": false, "processes_personal_data": false, "processes_eu_personal_data": false, "headcount": 0, "stage": "", "processes_phi": false, "us_healthcare_covered_entity": false, "us_healthcare_business_associate": false, "nis2_essential_entity": false, "nis2_important_entity": false, "adopts_nist_csf": false, "us_government_contractor": false } FILE:assets/control_library_template.json { "program": "", "enabled_frameworks": [ "iso_27001", "soc_2", "iso_42001", "eu_ai_act", "gdpr" ], "_supported_framework_ids": [ "iso_27001", "iso_13485", "iso_42001", "iso_14971", "eu_ai_act", "eu_mdr_745", "gdpr", "soc_2", "fda_qsr" ], "_note": "Enable only the frameworks the framework_selector returned as applicable. Cross-framework mapper will compute overlap across enabled frameworks only." } FILE:assets/mock_audit_library.json { "schema_version": "1.0.0", "description": "Pre-built finding scenarios for mock internal audits. Each scenario has theme + severity + applicable_frameworks tags; cross-reference scripts/cross_framework_mapper.py merged-controls catalogue to resolve framework-specific control IDs.", "supported_frameworks": [ "iso_27001", "iso_13485", "iso_42001", "iso_14971", "eu_ai_act", "eu_mdr_745", "gdpr", "soc_2", "fda_qsr", "nist_csf", "nis2", "hipaa" ], "severity_levels": { "critical": "Major nonconformity: absence of, or systemic failure to implement, a required management-system process. Blocks certification at stage 1.", "major": "Material gap in a required control. Corrective action plan within 30 days.", "minor": "Localized gap; control works overall. Corrective action within 90 days.", "observation": "Improvement opportunity; no nonconformity. Optional recommendation." }, "scenarios": [ {"id": "F-AC-001", "theme": "access_control", "severity": "critical", "title": "Orphaned privileged access from terminations", "description": "Quarterly access review missed 3 cycles; 12 terminated employees retain prod admin access > 90 days post-termination. Audit log shows 4 of them performed actions in the system after their last working day.", "remediation": "Immediate revocation; investigate access logs for unauthorized activity; reinstate quarterly review cadence with automated tooling.", "remediation_days": 14, "applicable_frameworks": ["iso_27001", "soc_2", "iso_42001", "gdpr", "nist_csf", "hipaa", "nis2"]}, {"id": "F-AC-002", "theme": "access_control", "severity": "critical", "title": "Shared admin credentials in production", "description": "Production database admin password shared across 5 engineers; rotation last performed > 12 months ago. No audit trail for individual actions.", "remediation": "Rotate immediately; provision per-user named accounts; enable individual audit logging; document procedure.", "remediation_days": 7, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "hipaa", "nis2"]}, {"id": "F-AC-003", "theme": "access_control", "severity": "major", "title": "Quarterly access review evidence lacks justification", "description": "Quarterly access review records exist but lack documented business justification for retained privileges. Reviewers approve in bulk without per-user rationale.", "remediation": "Update review template to require per-user justification; train reviewers; sample-check next quarter.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "hipaa", "nist_csf"]}, {"id": "F-AC-004", "theme": "access_control", "severity": "major", "title": "JML workflow does not auto-deprovision", "description": "Joiner-mover-leaver workflow exists but is manual; observed 5+ day gap between HR termination and access revocation.", "remediation": "Implement IDP integration with HR system for auto-deprovisioning within 24 hours; trail for exceptions.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "iso_42001", "gdpr", "hipaa", "nis2"]}, {"id": "F-AC-005", "theme": "access_control", "severity": "major", "title": "MFA not enforced on admin accounts", "description": "Multi-factor authentication is documented in policy but not technically enforced on cloud admin accounts; 8 admin users authenticate without MFA.", "remediation": "Enforce MFA at IDP level; emergency-break-glass procedure documented; close legacy accounts.", "remediation_days": 30, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "hipaa", "nis2", "gdpr"]}, {"id": "F-AC-006", "theme": "access_control", "severity": "minor", "title": "Access review records lack completion timestamps", "description": "Access review records lack documented review-completion timestamps in 2 of 6 sampled reviews. Cannot confirm review was completed on time.", "remediation": "Update review tooling to capture timestamp at review-action time; backfill where possible.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "hipaa"]}, {"id": "F-AC-007", "theme": "access_control", "severity": "minor", "title": "RBAC matrix doesn't cover cloud resources", "description": "Role-based access control matrix exists for application tier but does not address cloud-resource scope (IAM policies, S3 buckets, KMS keys).", "remediation": "Extend RBAC matrix; document cloud-IAM role-to-business-role mapping.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-AC-008", "theme": "access_control", "severity": "observation", "title": "Consider just-in-time (JIT) access for production", "description": "Standing access to production is the default; JIT access with approval workflow would reduce blast radius and improve audit trail.", "remediation": "Pilot JIT tooling (e.g., Teleport, ConductorOne, ConsoleMe) for one team.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-AC-009", "theme": "access_control", "severity": "observation", "title": "Privileged access review cadence could be more frequent", "description": "Quarterly cadence meets standard; for ≥ critical-tier systems, monthly review provides earlier detection of orphaned access.", "remediation": "Increase cadence for critical-tier systems to monthly.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "soc_2", "hipaa", "nist_csf"]}, {"id": "F-AC-010", "theme": "access_control", "severity": "observation", "title": "Session timeout policies inconsistent", "description": "Session-timeout policies vary across applications (30 min in CRM, 8 hours in BI tool, no timeout in internal admin tool). Inconsistent risk posture.", "remediation": "Define policy by data sensitivity tier; align tooling configuration.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "hipaa"]}, {"id": "F-AI-001", "theme": "asset_inventory", "severity": "major", "title": "Asset inventory missing cloud + SaaS + AI tools", "description": "Asset register includes server inventory but omits 60% of SaaS tools and 100% of AI/LLM tools acquired in past 12 months. No central source of truth.", "remediation": "Integrate SSO with SaaS-discovery tooling; require AI-tool registration before procurement; quarterly refresh.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "iso_42001", "nist_csf", "gdpr"]}, {"id": "F-AI-002", "theme": "asset_inventory", "severity": "major", "title": "Data classification scheme not applied", "description": "Data classification scheme documented (public / internal / confidential / restricted) but only 30% of data stores have classification labels applied.", "remediation": "Apply classification to remaining stores; automate via DLP tooling where feasible.", "remediation_days": 120, "applicable_frameworks": ["iso_27001", "soc_2", "gdpr", "hipaa", "nist_csf"]}, {"id": "F-AI-003", "theme": "asset_inventory", "severity": "minor", "title": "Asset owners not assigned for 15% of assets", "description": "15% of inventory entries lack named owners; orphan ownership impedes timely incident response.", "remediation": "Assign owners; require owner field on new asset creation.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-AI-004", "theme": "asset_inventory", "severity": "minor", "title": "Third-party AI services not tagged in inventory", "description": "Inventory does not flag which assets are powered by third-party AI services (e.g., OpenAI, Anthropic, Cohere). Material for ISO 42001 A.10 + EU AI Act Article 25.", "remediation": "Add AI-vendor tag; update procurement intake form.", "remediation_days": 90, "applicable_frameworks": ["iso_42001", "eu_ai_act", "iso_27001"]}, {"id": "F-AI-005", "theme": "asset_inventory", "severity": "observation", "title": "Asset decommissioning workflow informal", "description": "When assets are decommissioned, data destruction is documented but inventory entries persist; clutters reporting.", "remediation": "Add decommission state to inventory schema; archive after retention period.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "soc_2", "hipaa"]}, {"id": "F-RM-001", "theme": "risk_management", "severity": "critical", "title": "Risk register without treatment plans", "description": "Risk register identifies 30+ risks but lacks documented treatment plans (modify/share/retain/avoid per ISO 23894) for high/critical risks.", "remediation": "Run risk-treatment workshop per high/critical risk; document treatment + signoff; link to specific controls.", "remediation_days": 30, "applicable_frameworks": ["iso_27001", "iso_42001", "soc_2", "nist_csf", "nis2", "hipaa"]}, {"id": "F-RM-002", "theme": "risk_management", "severity": "critical", "title": "AI risk assessment not re-run after material model change", "description": "AI risk assessment last performed at initial deployment 18 months ago. Model has been retrained twice; risk profile not re-evaluated.", "remediation": "Trigger re-assessment; update register; document drift monitoring threshold; commit to re-assessment on every material change.", "remediation_days": 45, "applicable_frameworks": ["iso_42001", "eu_ai_act"]}, {"id": "F-RM-003", "theme": "risk_management", "severity": "major", "title": "Risk methodology inconsistently applied", "description": "Different teams use different risk-scoring methodologies; severity scores not comparable across the register.", "remediation": "Standardize on single methodology (e.g., 5x5 likelihood × impact matrix); train risk owners; re-score existing register.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "iso_42001", "iso_14971", "nist_csf", "soc_2"]}, {"id": "F-RM-004", "theme": "risk_management", "severity": "major", "title": "Residual risk acceptance lacks management signoff", "description": "30% of 'retain' risk-treatment decisions lack documented management signoff. Some retain decisions made by individual contributors.", "remediation": "Define signoff matrix by severity; backfill where possible; route remaining retain decisions through proper authority.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "iso_42001", "iso_14971", "nis2", "hipaa"]}, {"id": "F-RM-005", "theme": "risk_management", "severity": "major", "title": "Risk register not updated for 6+ months", "description": "Risk register last refreshed > 6 months ago. New risks from product changes, new vendors, regulatory developments not captured.", "remediation": "Refresh; commit to quarterly cadence minimum.", "remediation_days": 30, "applicable_frameworks": ["iso_27001", "iso_42001", "nist_csf", "nis2"]}, {"id": "F-RM-006", "theme": "risk_management", "severity": "minor", "title": "DPIA exists but Article 35(7) elements incomplete", "description": "DPIA documented for high-risk processing but does not cover all Article 35(7)(a)-(d) required elements (missing necessity + proportionality assessment).", "remediation": "Update DPIA template; refresh affected DPIAs.", "remediation_days": 60, "applicable_frameworks": ["gdpr", "iso_42001"]}, {"id": "F-RM-007", "theme": "risk_management", "severity": "minor", "title": "Risk treatment plans lack effective-date tracking", "description": "Treatment plans are documented but lack effective-date or expected-completion fields; cannot track remediation timeliness.", "remediation": "Add date fields; update existing entries.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "iso_42001", "soc_2"]}, {"id": "F-RM-008", "theme": "risk_management", "severity": "observation", "title": "Consider FAIR quantitative risk methodology for top-tier risks", "description": "Current methodology is qualitative; quantitative analysis (e.g., Open FAIR) for top-5 risks would improve decision quality.", "remediation": "Pilot FAIR on 2-3 top risks.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "nist_csf"]}, {"id": "F-RM-009", "theme": "risk_management", "severity": "observation", "title": "Risk-related KPIs not reported to executive", "description": "Risk register exists but no rolled-up KPIs (e.g., # critical risks open, mean time to treatment) reported in management review.", "remediation": "Add risk KPIs to management review inputs.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "iso_42001", "nist_csf"]}, {"id": "F-SM-001", "theme": "supplier_management", "severity": "critical", "title": "Critical SaaS in use without DPA", "description": "Critical SaaS supplier (handles personal data of 500K+ users) in use without signed DPA per GDPR Article 28. Pre-existing arrangement not refreshed since 2018.", "remediation": "Engage vendor for DPA execution; if vendor refuses, evaluate replacement.", "remediation_days": 30, "applicable_frameworks": ["gdpr", "iso_27001", "soc_2", "hipaa"]}, {"id": "F-SM-002", "theme": "supplier_management", "severity": "critical", "title": "Business Associate Agreement missing for HIPAA-relevant vendor", "description": "Vendor processes PHI on behalf of the organization but no signed Business Associate Agreement (BAA) per HIPAA §164.314(a). Material exposure.", "remediation": "Sign BAA; if vendor refuses, evaluate replacement; document remediation timeline.", "remediation_days": 30, "applicable_frameworks": ["hipaa", "iso_27001"]}, {"id": "F-SM-003", "theme": "supplier_management", "severity": "major", "title": "Annual supplier reviews incomplete", "description": "Annual supplier security review not completed for 3 of 8 critical suppliers in past year.", "remediation": "Run overdue reviews; calendar future reviews; document escalation for non-responsive vendors.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "iso_42001", "hipaa", "nis2", "gdpr"]}, {"id": "F-SM-004", "theme": "supplier_management", "severity": "major", "title": "Sub-processor list not maintained", "description": "Critical supplier handling personal data uses sub-processors; the sub-processor list is not maintained or available; GDPR Article 28(2) not satisfied.", "remediation": "Request sub-processor list from vendor; establish change notification mechanism; document.", "remediation_days": 60, "applicable_frameworks": ["gdpr", "iso_27001", "nist_csf"]}, {"id": "F-SM-005", "theme": "supplier_management", "severity": "major", "title": "AI-specific contract clauses not in vendor agreements", "description": "Third-party AI service in use; contract lacks AI-specific clauses (training-data use restrictions, drift notification, sub-processor list for AI sub-services).", "remediation": "Negotiate addendum; document acceptance.", "remediation_days": 90, "applicable_frameworks": ["iso_42001", "eu_ai_act", "iso_27001"]}, {"id": "F-SM-006", "theme": "supplier_management", "severity": "major", "title": "Supplier exit / termination procedure not documented", "description": "No procedure for safe vendor exit (data return, model deletion, monitoring transition). Discovered during attempt to terminate one supplier.", "remediation": "Draft procedure; pilot on next vendor termination; document.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "iso_42001", "soc_2", "gdpr"]}, {"id": "F-SM-007", "theme": "supplier_management", "severity": "minor", "title": "Vendor onboarding checklist applied inconsistently", "description": "Supplier onboarding checklist exists but is bypassed in 'urgent' procurements; 4 of 12 recent vendors lack complete onboarding evidence.", "remediation": "Make checklist mandatory at procurement gate; remediate gaps in existing 4.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-SM-008", "theme": "supplier_management", "severity": "minor", "title": "Supplier SOC 2 reports collected but not reviewed", "description": "Critical suppliers' SOC 2 Type II reports collected on initial onboarding but not reviewed annually as new reports issued.", "remediation": "Set calendar for annual review; document key findings + acceptance.", "remediation_days": 60, "applicable_frameworks": ["soc_2", "iso_27001"]}, {"id": "F-SM-009", "theme": "supplier_management", "severity": "observation", "title": "Consider centralizing supplier risk evidence in GRC tool", "description": "Supplier evidence scattered across procurement Drive, Compliance Drive, and email. Centralization in GRC tool would reduce audit prep effort.", "remediation": "Evaluate GRC tooling; migrate over 6 months.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "soc_2", "iso_42001"]}, {"id": "F-SM-010", "theme": "supplier_management", "severity": "observation", "title": "Vendor risk-tiering could be more granular", "description": "Vendors tier as 'critical / non-critical' currently; more granular tiers (e.g., based on data type, criticality, integration depth) would refine review cadence.", "remediation": "Define 3-tier model; reclassify existing inventory.", "remediation_days": 120, "applicable_frameworks": ["iso_27001", "soc_2", "hipaa"]}, {"id": "F-IR-001", "theme": "incident_response", "severity": "critical", "title": "GDPR Article 33 breach notification missed", "description": "Breach occurred 96 hours ago; supervisory authority not notified despite Article 33 72-hour requirement. Investigation revealed unclear breach-criteria decision.", "remediation": "File notification immediately with rationale for delay; review breach-criteria decision tree; conduct tabletop exercise; document.", "remediation_days": 7, "applicable_frameworks": ["gdpr", "iso_27001", "hipaa", "nis2"]}, {"id": "F-IR-002", "theme": "incident_response", "severity": "critical", "title": "Recent P1 incident lacks PIR within SLA", "description": "P1 production incident occurred 45 days ago; post-incident review (PIR) not documented within stated 30-day SLA.", "remediation": "Complete PIR immediately; identify corrective actions; calendar future PIRs.", "remediation_days": 14, "applicable_frameworks": ["iso_27001", "soc_2", "iso_42001", "nist_csf"]}, {"id": "F-IR-003", "theme": "incident_response", "severity": "critical", "title": "Severity definitions inconsistently applied", "description": "Severity definitions documented but inconsistently applied across teams; impact analysis varies. Two recent P2 incidents arguably P1 by definition.", "remediation": "Train responders on severity rubric; calibration exercise quarterly; track severity-classification consistency.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "iso_42001", "gdpr", "hipaa"]}, {"id": "F-IR-004", "theme": "incident_response", "severity": "major", "title": "Notification SLAs not aligned across frameworks", "description": "GDPR 72h, NIS2 24h-early-warning + 72h-notification, EU AI Act 15-day (or 2-day critical-infra), HIPAA 60-day. Internal procedures collapse to a single 'breach' notification without per-framework branching.", "remediation": "Update IR procedure to branch by applicable framework; train responders.", "remediation_days": 60, "applicable_frameworks": ["gdpr", "nis2", "eu_ai_act", "hipaa", "iso_27001"]}, {"id": "F-IR-005", "theme": "incident_response", "severity": "major", "title": "Incident commander rotation not documented", "description": "Incident commander rotation exists informally but is not documented; recent incidents had ambiguous IC ownership.", "remediation": "Document rotation; publish on-call schedule.", "remediation_days": 30, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-IR-006", "theme": "incident_response", "severity": "major", "title": "Breach log incomplete per Article 33(5)", "description": "GDPR breach log captures only DPA-notifiable events; Article 33(5) requires ALL breaches logged regardless of notifiability.", "remediation": "Update breach log scope; backfill recent breaches; train DPO on requirement.", "remediation_days": 60, "applicable_frameworks": ["gdpr", "iso_27001", "hipaa"]}, {"id": "F-IR-007", "theme": "incident_response", "severity": "major", "title": "Detection mechanism gaps", "description": "Mean time to detect (MTTD) for past 3 incidents averaged 8 days; SIEM rules not tuned for recently-onboarded systems.", "remediation": "Audit SIEM coverage; tune rules; test detection for high-impact attack scenarios.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "nis2"]}, {"id": "F-IR-008", "theme": "incident_response", "severity": "minor", "title": "Tabletop exercise not conducted in last 12 months", "description": "Annual incident-response tabletop exercise not performed in past 12 months.", "remediation": "Schedule + run tabletop; document lessons learned.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "nis2", "hipaa"]}, {"id": "F-IR-009", "theme": "incident_response", "severity": "minor", "title": "Customer notification timing not tracked", "description": "Customer-facing incident notifications sent but timing not tracked against committed SLA. Cannot demonstrate SLA compliance.", "remediation": "Track notification timestamps; report against SLA quarterly.", "remediation_days": 60, "applicable_frameworks": ["soc_2", "iso_27001", "gdpr"]}, {"id": "F-IR-010", "theme": "incident_response", "severity": "observation", "title": "Consider chaos engineering for resilience testing", "description": "Incident response prepares for failures; chaos engineering would proactively surface latent weaknesses.", "remediation": "Pilot chaos engineering on non-prod first; expand if mature.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-ML-001", "theme": "monitoring_logging", "severity": "critical", "title": "Production application logs disabled", "description": "Production application logs disabled in past 30 days due to disk space; not detected until audit fieldwork. 30-day blind spot.", "remediation": "Re-enable; resize storage; alert on log volume drops; investigate any incidents during blind period.", "remediation_days": 7, "applicable_frameworks": ["iso_27001", "soc_2", "iso_42001", "hipaa", "nist_csf"]}, {"id": "F-ML-002", "theme": "monitoring_logging", "severity": "major", "title": "Log retention misaligned with framework requirement", "description": "Log retention configured at 90 days; ISO 27001 + framework requirements expect 12 months minimum for some logs.", "remediation": "Update retention configuration; backfill from archives where feasible; document policy.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "hipaa", "nist_csf", "gdpr"]}, {"id": "F-ML-003", "theme": "monitoring_logging", "severity": "major", "title": "Tamper-evident logging not enforced", "description": "Tamper-evident logging not enforced on privileged-user activity logs; logs writable to same store as application data.", "remediation": "Move logs to write-once storage; document architecture; verify immutability.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "hipaa", "nist_csf", "nis2"]}, {"id": "F-ML-004", "theme": "monitoring_logging", "severity": "major", "title": "AI model drift not monitored", "description": "AI system in production; no drift monitoring against original validation data. No defined drift threshold for retraining.", "remediation": "Implement drift monitoring; define threshold; escalation path.", "remediation_days": 90, "applicable_frameworks": ["iso_42001", "eu_ai_act"]}, {"id": "F-ML-005", "theme": "monitoring_logging", "severity": "minor", "title": "Monitoring alert thresholds not documented", "description": "Monitoring alert thresholds exist in tooling but not documented; rationale unclear.", "remediation": "Document thresholds + rationale + on-call response action.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-ML-006", "theme": "monitoring_logging", "severity": "minor", "title": "Cloud audit logs not centralized", "description": "Cloud audit logs (CloudTrail/Cloud Audit Logs) exist per account but not centralized to SIEM; cross-account analysis manual.", "remediation": "Forward logs to central SIEM; configure cross-account analysis.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-ML-007", "theme": "monitoring_logging", "severity": "observation", "title": "Consider anomaly detection on top of rule-based monitoring", "description": "Current monitoring is rule-based; anomaly detection (statistical or ML-based) would surface novel patterns.", "remediation": "Pilot on key data flows.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-CM-001", "theme": "change_management", "severity": "critical", "title": "Emergency change procedure not formalized", "description": "Emergency change procedure not documented; observed 3 cases of production changes in past 30 days without recorded approval. Two affected customer data.", "remediation": "Draft emergency change procedure including retroactive review; train engineers; audit recent emergency changes.", "remediation_days": 30, "applicable_frameworks": ["iso_27001", "soc_2", "iso_13485", "hipaa", "nist_csf"]}, {"id": "F-CM-002", "theme": "change_management", "severity": "major", "title": "Change advisory board rubber-stamps", "description": "Change advisory board records show approvals but zero rejected changes in last 6 months. Board likely not exercising substantive review.", "remediation": "Calibration training for board; track reject + revise rate; ensure reviewers have time + context.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "iso_13485"]}, {"id": "F-CM-003", "theme": "change_management", "severity": "major", "title": "Rollback procedure not tested", "description": "Rollback procedure documented but not tested for 2 services in audit scope. Cannot confirm operability.", "remediation": "Test rollback in staging; document; schedule quarterly verification.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "iso_13485", "nist_csf"]}, {"id": "F-CM-004", "theme": "change_management", "severity": "minor", "title": "Post-implementation reviews skipped for high-risk changes", "description": "Change advisory board records show approvals but no post-implementation review for high-risk changes (defined by impact rubric).", "remediation": "Reinstate post-implementation review for high-risk; define follow-up timeline.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "iso_13485"]}, {"id": "F-CM-005", "theme": "change_management", "severity": "observation", "title": "Link change records to deployment automation", "description": "Change records and deployment automation are separate systems; linking would strengthen evidence chain.", "remediation": "Integrate via deployment tagging.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-BC-001", "theme": "business_continuity", "severity": "critical", "title": "BCP/DRP exists but never tested", "description": "Business continuity + disaster recovery plans exist on paper but no recovery exercise in 24+ months. Untested = ineffective.", "remediation": "Conduct full DR exercise; document results; commit to annual exercise cadence.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "nis2", "hipaa"]}, {"id": "F-BC-002", "theme": "business_continuity", "severity": "major", "title": "RPO/RTO objectives not measured", "description": "Recovery objectives defined but not measured during recent failover events. Cannot confirm objectives are achievable.", "remediation": "Measure during next exercise; tune objectives or recovery capability.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "hipaa"]}, {"id": "F-BC-003", "theme": "business_continuity", "severity": "major", "title": "Backup integrity not verified", "description": "Backups occur but restoration testing not performed in past 12 months. Cannot confirm backups are usable.", "remediation": "Quarterly restoration tests; document verification evidence.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "hipaa", "nis2"]}, {"id": "F-BC-004", "theme": "business_continuity", "severity": "minor", "title": "BCP doesn't address third-party SaaS outage", "description": "BCP covers self-hosted infrastructure; doesn't address critical SaaS-vendor outage scenarios.", "remediation": "Extend BCP for SaaS outage scenarios; document vendor SLAs + alternatives.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "nis2"]}, {"id": "F-BC-005", "theme": "business_continuity", "severity": "observation", "title": "Consider chaos game-day exercises", "description": "Annual DR exercise meets standard; chaos game-day adds value by testing under more realistic conditions.", "remediation": "Pilot game-day for one service.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-CT-001", "theme": "competence_training", "severity": "major", "title": "Annual security training not 100% complete", "description": "Annual security training completion is 89% across the company; 12 employees past due > 30 days.", "remediation": "Escalate to managers for non-completers; revoke access for chronic non-completers; document policy.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "hipaa", "nis2"]}, {"id": "F-CT-002", "theme": "competence_training", "severity": "major", "title": "AI literacy training not in place", "description": "EU AI Act Article 4 requires AI literacy for staff dealing with AI systems; no AI-specific training implemented.", "remediation": "Develop + roll out AI literacy training; track completion by role.", "remediation_days": 90, "applicable_frameworks": ["eu_ai_act", "iso_42001"]}, {"id": "F-CT-003", "theme": "competence_training", "severity": "major", "title": "Competence requirements undefined for ML engineers", "description": "Competence requirements defined for engineering roles but not specifically for ML engineers; assumes 'they have degrees'.", "remediation": "Define ML-engineer competence requirements; verify against existing staff.", "remediation_days": 90, "applicable_frameworks": ["iso_42001"]}, {"id": "F-CT-004", "theme": "competence_training", "severity": "minor", "title": "Training effectiveness verification missing", "description": "Training completion recorded but effectiveness verification (assessment, simulation, observed behavior) not performed.", "remediation": "Add post-training assessment; track scores.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "iso_42001", "iso_13485", "soc_2"]}, {"id": "F-CT-005", "theme": "competence_training", "severity": "observation", "title": "Consider role-based training tiers", "description": "Training is uniform across roles; role-based tiers would surface compliance-officer-specific, dev-specific, etc.", "remediation": "Design role-tiered curriculum.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-DG-001", "theme": "data_governance", "severity": "critical", "title": "Training data lacks provenance records", "description": "AI training data sourced from multiple vendors + scraped sources; no provenance records. EU AI Act Article 10(2)(d) + ISO 42001 A.7.4 not satisfied.", "remediation": "Audit current training data; document provenance per source; remove data without verifiable provenance.", "remediation_days": 90, "applicable_frameworks": ["iso_42001", "eu_ai_act", "gdpr"]}, {"id": "F-DG-002", "theme": "data_governance", "severity": "critical", "title": "PII in training data without lawful basis", "description": "Training data contains PII; lawful basis (GDPR Article 6) not documented for AI training use case. Article 10(5) AI Act bias-detection exception not applicable here.", "remediation": "Document lawful basis or remove PII; if legitimate interests, document LIA; halt training until resolved.", "remediation_days": 30, "applicable_frameworks": ["gdpr", "iso_42001", "eu_ai_act"]}, {"id": "F-DG-003", "theme": "data_governance", "severity": "major", "title": "Data quality dimensions not defined", "description": "Data quality monitoring exists but dimensions (completeness, accuracy, timeliness, consistency) not formally defined. Audit against ISO 42001 A.7.3 incomplete.", "remediation": "Define dimensions per data store; document measurement methodology.", "remediation_days": 90, "applicable_frameworks": ["iso_42001", "iso_27001", "gdpr"]}, {"id": "F-DG-004", "theme": "data_governance", "severity": "major", "title": "Article 30 RoPA stale", "description": "GDPR Article 30 records of processing activities last refreshed 8 months ago; new processing activities not captured.", "remediation": "Refresh RoPA; commit to quarterly updates; integrate with new-feature intake.", "remediation_days": 60, "applicable_frameworks": ["gdpr"]}, {"id": "F-DG-005", "theme": "data_governance", "severity": "major", "title": "Retention schedules not enforced", "description": "Data retention schedules documented but not enforced in tooling. Data persists beyond stated retention.", "remediation": "Implement automated retention enforcement; backfill cleanup; document deletions.", "remediation_days": 90, "applicable_frameworks": ["gdpr", "iso_27001", "hipaa", "iso_42001"]}, {"id": "F-DG-006", "theme": "data_governance", "severity": "minor", "title": "Consent management workflow lacks withdrawal mechanism", "description": "Consent collected at signup; withdrawal mechanism exists in privacy notice but not technically implemented.", "remediation": "Implement self-service consent withdrawal; honour within reasonable time.", "remediation_days": 90, "applicable_frameworks": ["gdpr"]}, {"id": "F-DG-007", "theme": "data_governance", "severity": "observation", "title": "Consider data lineage tooling", "description": "Data flows documented manually; data-lineage tooling would automate + maintain freshness.", "remediation": "Evaluate tooling (e.g., OpenLineage, DataHub, Atlan).", "remediation_days": 180, "applicable_frameworks": ["iso_42001", "gdpr"]}, {"id": "F-CR-001", "theme": "cryptography", "severity": "major", "title": "Encryption at rest using deprecated algorithm", "description": "Some data stores still use deprecated AES-128 (or 3DES); current standard expects AES-256.", "remediation": "Plan migration; document; complete within 6 months.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "hipaa", "nis2", "gdpr"]}, {"id": "F-CR-002", "theme": "cryptography", "severity": "major", "title": "Key rotation not enforced", "description": "Cryptographic key rotation policy exists (annual) but not enforced; production keys 3+ years old.", "remediation": "Rotate immediately; automate rotation via KMS; document.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "hipaa", "nis2", "gdpr"]}, {"id": "F-CR-003", "theme": "cryptography", "severity": "major", "title": "TLS configuration permits deprecated versions", "description": "TLS 1.0 + 1.1 still accepted on public endpoints; current standard expects TLS 1.2 minimum.", "remediation": "Disable TLS 1.0 + 1.1; verify all clients support 1.2+; document.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "hipaa", "nis2", "gdpr"]}, {"id": "F-CR-004", "theme": "cryptography", "severity": "minor", "title": "Cryptographic inventory incomplete", "description": "Cryptographic inventory exists but lacks documentation of algorithm + key length per data store.", "remediation": "Audit each store; document; flag deprecated algorithms.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "nist_csf", "hipaa"]}, {"id": "F-CR-005", "theme": "cryptography", "severity": "observation", "title": "Consider post-quantum cryptography roadmap", "description": "Current crypto is RSA + ECC; post-quantum standards finalized in 2024. Long-term planning for migration recommended.", "remediation": "Define PQC migration roadmap.", "remediation_days": 365, "applicable_frameworks": ["iso_27001", "nist_csf", "nis2"]}, {"id": "F-SD-001", "theme": "secure_sdlc", "severity": "critical", "title": "Production deploy without SAST results", "description": "Recent production deploys lack SAST scan evidence; SAST configured in CI but bypassed via manual override.", "remediation": "Make SAST a required gate; remove override capability for production; investigate bypassed deploys.", "remediation_days": 30, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-SD-002", "theme": "secure_sdlc", "severity": "major", "title": "Code review records inconsistent", "description": "Some commits to main branch lack documented review; review-required branch protection not consistently enforced.", "remediation": "Enforce review on protected branches across all repos; audit recent commits.", "remediation_days": 30, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-SD-003", "theme": "secure_sdlc", "severity": "major", "title": "Threat modeling not performed for new services", "description": "New service launched last quarter without threat model. ISO 27001 A.8.25-31 + secure-by-design expectations not met.", "remediation": "Retroactive threat model; integrate threat modeling into design-review gate.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "nis2"]}, {"id": "F-SD-004", "theme": "secure_sdlc", "severity": "minor", "title": "Dependency scanning missing for some repos", "description": "Dependency scanning configured for production services but not for internal tools.", "remediation": "Extend dependency scanning to all repos.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-SD-005", "theme": "secure_sdlc", "severity": "observation", "title": "Consider supply-chain security per SLSA", "description": "Build provenance + supply-chain security gaps; SLSA framework would formalize improvements.", "remediation": "Adopt SLSA Level 2 minimum for production builds.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "nist_csf", "nis2"]}, {"id": "F-VM-001", "theme": "vulnerability_mgmt", "severity": "critical", "title": "Critical vulnerabilities past patch SLA", "description": "5 critical-severity CVEs in production older than 30-day patch SLA; one is actively exploited in wild.", "remediation": "Patch immediately; document compensating controls if patching not possible; investigate any compromise indicators.", "remediation_days": 14, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "nis2", "hipaa"]}, {"id": "F-VM-002", "theme": "vulnerability_mgmt", "severity": "major", "title": "Vulnerability scanning not running weekly", "description": "Scanning configured but execution stopped in past quarter due to tool change. 90+ day blind spot.", "remediation": "Resume scanning; investigate vulnerabilities discovered post-resume.", "remediation_days": 30, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "nis2", "hipaa"]}, {"id": "F-VM-003", "theme": "vulnerability_mgmt", "severity": "major", "title": "Patch SLAs not defined by severity", "description": "Patch SLA defined for 'all CVEs within 90 days'; not differentiated by severity. Critical vulns should be < 30 days.", "remediation": "Define severity-tiered SLAs; communicate; track compliance.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "hipaa", "nis2"]}, {"id": "F-VM-004", "theme": "vulnerability_mgmt", "severity": "minor", "title": "Vulnerability exceptions lack expiry", "description": "Exception tracking exists but exceptions have no expiry; some are 18+ months old without re-evaluation.", "remediation": "Add expiry; re-evaluate all open exceptions.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-VM-005", "theme": "vulnerability_mgmt", "severity": "observation", "title": "Consider container image base auditing", "description": "Vulnerability scanning catches runtime; auditing base images at build time would prevent vulnerabilities reaching production.", "remediation": "Add build-time scanning + base-image inventory.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "nist_csf"]}, {"id": "F-PS-001", "theme": "physical_security", "severity": "major", "title": "Server room access log incomplete", "description": "Server room access log shows entries but lacks visitor escort records for 4 of 12 sampled entries.", "remediation": "Reinforce escort policy; train + supervise; verify in next quarter.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "iso_13485", "hipaa"]}, {"id": "F-PS-002", "theme": "physical_security", "severity": "major", "title": "Workstation security policy not enforced", "description": "Workstation locking policy documented but not enforced; observed several unattended unlocked workstations during walkthrough.", "remediation": "Configure auto-lock at 5 min; train staff; verify.", "remediation_days": 30, "applicable_frameworks": ["iso_27001", "hipaa", "soc_2"]}, {"id": "F-PS-003", "theme": "physical_security", "severity": "minor", "title": "Visitor sign-in process bypassed", "description": "Visitor sign-in book exists but bypassed for 'known' visitors; 8 sampled visits lack sign-in evidence.", "remediation": "Reinforce policy + signage; consider electronic visitor management.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "iso_13485", "hipaa"]}, {"id": "F-PS-004", "theme": "physical_security", "severity": "observation", "title": "Consider biometric access for sensitive zones", "description": "Current access is card-based; biometric for sensitive zones (server rooms, R&D labs) would strengthen access discipline.", "remediation": "Evaluate biometric tooling; pilot.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "hipaa", "iso_13485"]}, {"id": "F-DP-001", "theme": "data_protection_privacy", "severity": "critical", "title": "Right to erasure not honored within SLA", "description": "Erasure request from 60 days ago not fully completed; data persists in 3 systems including backups. GDPR Article 17 + 12(3) breached.", "remediation": "Complete erasure; identify all systems; commit to per-system erasure workflow.", "remediation_days": 14, "applicable_frameworks": ["gdpr"]}, {"id": "F-DP-002", "theme": "data_protection_privacy", "severity": "critical", "title": "International transfer without SCCs", "description": "Personal data transferred to US subprocessor; no adequacy decision relied on, no SCCs signed, no derogation applies. Schrems II requirement breached.", "remediation": "Execute SCCs (Commission 2021/914); conduct TIA per EDPB Rec. 01/2020; supplementary measures where needed.", "remediation_days": 30, "applicable_frameworks": ["gdpr"]}, {"id": "F-DP-003", "theme": "data_protection_privacy", "severity": "major", "title": "Privacy notice missing Article 13/14 elements", "description": "Privacy notice published but lacks retention periods + data subject rights detail per Article 13(2).", "remediation": "Update notice; publish version; track versions for evidence trail.", "remediation_days": 30, "applicable_frameworks": ["gdpr"]}, {"id": "F-DP-004", "theme": "data_protection_privacy", "severity": "major", "title": "Cookie banner pre-ticks consent", "description": "Cookie banner pre-ticks non-essential cookies; valid consent per GDPR Article 7 + EDPB guidance requires affirmative action.", "remediation": "Redesign banner; default to no consent for non-essential; document A/B test.", "remediation_days": 30, "applicable_frameworks": ["gdpr"]}, {"id": "F-DP-005", "theme": "data_protection_privacy", "severity": "major", "title": "DPO appointment not formal", "description": "DPO exists but appointment letter not signed by senior management per GDPR Article 37 + 38. Reporting line ambiguous.", "remediation": "Formal appointment letter; clarify reporting line to highest management; publish contact.", "remediation_days": 30, "applicable_frameworks": ["gdpr"]}, {"id": "F-DP-006", "theme": "data_protection_privacy", "severity": "minor", "title": "DSAR identity verification process inconsistent", "description": "DSAR identity verification varies across teams; one DSAR processed without proper identity check.", "remediation": "Standardize verification procedure; train DPO + intake team.", "remediation_days": 60, "applicable_frameworks": ["gdpr"]}, {"id": "F-DP-007", "theme": "data_protection_privacy", "severity": "observation", "title": "Consider privacy-enhancing technologies (PETs)", "description": "Current privacy posture is procedural; PETs (differential privacy, federated learning, secure enclaves) for high-risk processing would reduce exposure.", "remediation": "Pilot PET for one high-risk processing.", "remediation_days": 365, "applicable_frameworks": ["gdpr", "iso_42001"]}, {"id": "F-MR-001", "theme": "management_review", "severity": "critical", "title": "Management review not performed in 18 months", "description": "Management review last documented 18 months ago. Clause 9.3 expects at planned intervals (annual minimum). System effectiveness not formally evaluated.", "remediation": "Schedule + conduct review; document inputs + outputs; calendar future reviews.", "remediation_days": 30, "applicable_frameworks": ["iso_27001", "iso_42001", "iso_13485", "soc_2"]}, {"id": "F-MR-002", "theme": "management_review", "severity": "major", "title": "Management review missing AI-specific inputs", "description": "Management review covers ISMS but not AIMS-specific inputs (drift events, incidents, risk-register changes per ISO 42001 Clause 9.3).", "remediation": "Update review template for AIMS inputs; include in next review.", "remediation_days": 60, "applicable_frameworks": ["iso_42001"]}, {"id": "F-MR-003", "theme": "management_review", "severity": "major", "title": "Open action items past due", "description": "Management review action items: 4 of 9 past due > 60 days. Tracking not actively managed.", "remediation": "Reassign owners; escalate stuck items; re-baseline due dates.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "iso_42001", "iso_13485", "soc_2"]}, {"id": "F-MR-004", "theme": "management_review", "severity": "minor", "title": "Review attendance lacks senior leadership", "description": "Review held but CEO + CTO absent; attendance of senior leadership expected per Clause 5.1 + 9.3.", "remediation": "Schedule with leadership in advance; share inputs ahead of meeting.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "iso_42001", "iso_13485", "soc_2"]}, {"id": "F-IA-001", "theme": "internal_audit", "severity": "critical", "title": "No internal audit programme", "description": "Clause 9.2 internal audit programme not documented; audits happen ad-hoc; no rolling 3-year coverage plan.", "remediation": "Design programme; assign auditors; schedule next 12 months minimum.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "iso_42001", "iso_13485", "soc_2", "hipaa"]}, {"id": "F-IA-002", "theme": "internal_audit", "severity": "major", "title": "Auditors audit own work", "description": "Internal auditor for Clause 8.3 audit also owns the lifecycle process being audited. Independence breached.", "remediation": "Reassign auditor; document independence verification per assignment.", "remediation_days": 30, "applicable_frameworks": ["iso_27001", "iso_42001", "iso_13485"]}, {"id": "F-IA-003", "theme": "internal_audit", "severity": "major", "title": "Audit findings not tracked to closure", "description": "Audit findings logged but closure verification not consistently performed. 12 findings show 'closed' without evidence of effectiveness.", "remediation": "Verify closure; require evidence; reopen unverified.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "iso_42001", "soc_2"]}, {"id": "F-IA-004", "theme": "internal_audit", "severity": "minor", "title": "Audit programme doesn't cover all clauses", "description": "Audit programme covers Clauses 4-7 but not 8-10 in current 3-year cycle.", "remediation": "Update programme; add missing clauses to remaining cycle.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "iso_42001", "iso_13485"]}, {"id": "F-CI-001", "theme": "continual_improvement", "severity": "major", "title": "CAPA without effectiveness verification", "description": "Corrective action plans documented + closed but effectiveness verification missing for 6 of 10 sampled CAPAs.", "remediation": "Add measurable effectiveness verification to template; verify per CAPA; sample-check.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "iso_42001", "iso_13485", "fda_qsr"]}, {"id": "F-CI-002", "theme": "continual_improvement", "severity": "major", "title": "Root cause analysis shallow", "description": "Root cause analysis on CAPAs documented but stops at proximate cause (e.g., 'engineer made mistake'); 5 Whys not applied.", "remediation": "Train CAPA owners on RCA methodology; re-do RCA on recent CAPAs.", "remediation_days": 90, "applicable_frameworks": ["iso_13485", "iso_42001", "iso_27001", "fda_qsr"]}, {"id": "F-CI-003", "theme": "continual_improvement", "severity": "minor", "title": "Trend analysis not performed", "description": "Individual CAPAs handled but trend analysis across CAPAs not performed; missed systemic issues.", "remediation": "Quarterly trend analysis; pattern identification; address systemic causes.", "remediation_days": 90, "applicable_frameworks": ["iso_13485", "iso_27001", "iso_42001", "fda_qsr"]}, {"id": "F-CI-004", "theme": "continual_improvement", "severity": "observation", "title": "Consider integrating CAPA into existing ticketing", "description": "CAPA tracking in separate tool from incident tickets; integration would reduce overhead.", "remediation": "Evaluate ticket-system extensions; pilot.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "soc_2"]}, {"id": "F-DC-001", "theme": "documentation_control", "severity": "major", "title": "Obsolete documents accessible", "description": "Old versions of policies and procedures accessible in shared drives without 'obsolete' marking; risk of using superseded content.", "remediation": "Archive obsolete versions; reorganize document drive; reinforce procedure.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "iso_13485", "iso_42001", "fda_qsr"]}, {"id": "F-DC-002", "theme": "documentation_control", "severity": "major", "title": "Document approval workflow bypassed", "description": "Document approval workflow exists but 3 recent policy updates published without documented approval.", "remediation": "Enforce workflow at publication; train owners; audit recent publications.", "remediation_days": 30, "applicable_frameworks": ["iso_27001", "iso_13485", "iso_42001", "soc_2"]}, {"id": "F-DC-003", "theme": "documentation_control", "severity": "minor", "title": "Document review cadence not enforced", "description": "Annual review cadence stated but 25% of controlled documents past due > 90 days.", "remediation": "Calendar reviews; track due dates; remind owners.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "iso_13485", "iso_42001"]}, {"id": "F-AIMS-001", "theme": "aims_specific", "severity": "critical", "title": "AI policy missing required commitments", "description": "AI policy commits to lawful use only; missing beneficial purpose, human oversight, and continual improvement. ISO 42001 Clause 5.2 + Annex A.2.2 not satisfied.", "remediation": "Rewrite policy with all 4 commitments; board signoff; publish.", "remediation_days": 60, "applicable_frameworks": ["iso_42001"]}, {"id": "F-AIMS-002", "theme": "aims_specific", "severity": "critical", "title": "AIMS scope omits third-party AI", "description": "AIMS scope statement (Clause 4.3) lists company-built AI systems but omits AI features in SaaS vendors used internally. Scope incomplete.", "remediation": "Update scope; inventory third-party AI; include in AIMS controls.", "remediation_days": 60, "applicable_frameworks": ["iso_42001"]}, {"id": "F-AIMS-003", "theme": "aims_specific", "severity": "critical", "title": "AI system lifecycle skips decommission", "description": "AI lifecycle procedure (A.6) covers design through deployment + operation but lacks decommission phase. ISO 42001 expects full lifecycle.", "remediation": "Define decommission procedure; train owners; document.", "remediation_days": 60, "applicable_frameworks": ["iso_42001"]}, {"id": "F-AIMS-004", "theme": "aims_specific", "severity": "major", "title": "V&V procedure for AI systems undefined", "description": "Annex A.6.2.4 verification + validation procedure not documented; tests exist but acceptance criteria not formalized.", "remediation": "Define V&V procedure; document acceptance criteria per system class; train.", "remediation_days": 90, "applicable_frameworks": ["iso_42001"]}, {"id": "F-AIMS-005", "theme": "aims_specific", "severity": "major", "title": "Impact assessment signed by wrong authority", "description": "AI impact assessments for high-impact systems signed by tech lead; management approval expected per A.5.4.", "remediation": "Define signoff authority by impact tier; re-route assessments; backfill where needed.", "remediation_days": 60, "applicable_frameworks": ["iso_42001"]}, {"id": "F-AIA-001", "theme": "ai_act_specific", "severity": "critical", "title": "Article 5 prohibited practice in production", "description": "AI system performs emotion recognition in workplace setting; Article 5(1)(f) prohibition applies. System cannot remain on EU market.", "remediation": "Disable in EU immediately; evaluate redesign for permitted use cases; document.", "remediation_days": 7, "applicable_frameworks": ["eu_ai_act"]}, {"id": "F-AIA-002", "theme": "ai_act_specific", "severity": "critical", "title": "High-risk AI without conformity assessment", "description": "Annex III high-risk AI system on EU market; no Article 43 conformity assessment performed before placement.", "remediation": "Withdraw from market until conformity assessment complete; document Annex IV; CE marking.", "remediation_days": 30, "applicable_frameworks": ["eu_ai_act"]}, {"id": "F-AIA-003", "theme": "ai_act_specific", "severity": "major", "title": "Non-EU provider without authorized representative", "description": "Non-EU provider placing AI system on EU market without appointed authorized representative per Article 22.", "remediation": "Appoint EU-established authorized representative; document mandate.", "remediation_days": 60, "applicable_frameworks": ["eu_ai_act"]}, {"id": "F-AIA-004", "theme": "ai_act_specific", "severity": "major", "title": "Article 50 transparency not implemented", "description": "Customer-facing chatbot does not disclose AI interaction per Article 50(1).", "remediation": "Add disclosure to UX; A/B test wording.", "remediation_days": 30, "applicable_frameworks": ["eu_ai_act"]}, {"id": "F-AIA-005", "theme": "ai_act_specific", "severity": "major", "title": "GPAI without Article 53 technical documentation", "description": "GPAI model provided to downstream integrators; Annex XI technical documentation not maintained.", "remediation": "Develop documentation per Annex XI; publish training-data summary; copyright policy.", "remediation_days": 60, "applicable_frameworks": ["eu_ai_act"]}, {"id": "F-13485-001", "theme": "qms_specific", "severity": "critical", "title": "DHF incomplete for commercial device", "description": "Design history file for commercially distributed device lacks design validation evidence per ISO 13485 Clause 7.3.7.", "remediation": "Compile validation evidence; document; if not feasible, withdraw + revalidate.", "remediation_days": 60, "applicable_frameworks": ["iso_13485", "fda_qsr"]}, {"id": "F-13485-002", "theme": "qms_specific", "severity": "critical", "title": "Process validation stale", "description": "Sterilization process not revalidated for 7 years despite supplier changes. ISO 13485 Clause 7.5.6 expects periodic revalidation.", "remediation": "Revalidate; document; calendar future revalidation.", "remediation_days": 90, "applicable_frameworks": ["iso_13485", "fda_qsr"]}, {"id": "F-13485-003", "theme": "qms_specific", "severity": "major", "title": "Risk management file frozen at release", "description": "ISO 14971 risk management file not updated post-launch; post-production information feedback not occurring.", "remediation": "Update RMF with post-production information; commit to periodic review.", "remediation_days": 90, "applicable_frameworks": ["iso_13485", "iso_14971", "eu_mdr_745", "fda_qsr"]}, {"id": "F-13485-004", "theme": "qms_specific", "severity": "major", "title": "PMCF plan exists but not executed", "description": "Post-market clinical follow-up plan documented per EU MDR Annex XIV Part B; execution data lacking after 12 months.", "remediation": "Execute per plan; document; report to notified body if outside plan.", "remediation_days": 90, "applicable_frameworks": ["iso_13485", "eu_mdr_745"]}, {"id": "F-FDA-001", "theme": "fda_specific", "severity": "critical", "title": "MDR-reportable event not reported", "description": "Serious adverse event reportable per 21 CFR 803.50 not reported within 30 days. FDA enforcement exposure.", "remediation": "File MDR immediately with delay rationale; review complaint trending; CAPA.", "remediation_days": 7, "applicable_frameworks": ["fda_qsr"]}, {"id": "F-FDA-002", "theme": "fda_specific", "severity": "major", "title": "Complaint files incomplete", "description": "Complaint log per 21 CFR 820.198 missing investigation closure for 8 of 30 sampled complaints.", "remediation": "Investigate + close; train complaint handlers.", "remediation_days": 60, "applicable_frameworks": ["fda_qsr"]}, {"id": "F-FDA-003", "theme": "fda_specific", "severity": "major", "title": "Form 483 open observations past response window", "description": "Form 483 received 6 months ago; 2 of 5 observations lack documented response within 15-working-day window.", "remediation": "Respond immediately; document corrective action; escalate to legal counsel.", "remediation_days": 14, "applicable_frameworks": ["fda_qsr"]}, {"id": "F-FDA-004", "theme": "fda_specific", "severity": "minor", "title": "Labeling review evidence gaps", "description": "Labeling per 21 CFR 801 reviewed at launch but no documented re-review for label changes in past 18 months.", "remediation": "Audit labels; document review per change.", "remediation_days": 60, "applicable_frameworks": ["fda_qsr"]}, {"id": "F-HIPAA-001", "theme": "hipaa_specific", "severity": "critical", "title": "PHI breach not assessed under Breach Notification Rule", "description": "PHI exposure event 4 months ago; risk-of-compromise assessment per §164.402 not documented. Breach notification potentially required + missed.", "remediation": "Conduct retroactive assessment; if breach, notify per §164.404 + §164.406; document.", "remediation_days": 14, "applicable_frameworks": ["hipaa"]}, {"id": "F-HIPAA-002", "theme": "hipaa_specific", "severity": "critical", "title": "Security Risk Analysis not performed", "description": "HIPAA Security Rule §164.308(a)(1)(ii)(A) risk analysis not documented in past 24 months despite material system changes.", "remediation": "Conduct + document analysis; address top risks; calendar annual review.", "remediation_days": 60, "applicable_frameworks": ["hipaa"]}, {"id": "F-HIPAA-003", "theme": "hipaa_specific", "severity": "major", "title": "Encryption addressable spec not formally evaluated", "description": "HIPAA encryption is 'addressable'; organization not encrypting PHI at rest in one data store; no documented analysis of why.", "remediation": "Document analysis; if not encrypted, implement alternative protective measure or encrypt.", "remediation_days": 90, "applicable_frameworks": ["hipaa"]}, {"id": "F-HIPAA-004", "theme": "hipaa_specific", "severity": "major", "title": "Workforce sanctions policy not enforced", "description": "§164.308(a)(1)(ii)(C) sanctions policy documented but no recorded sanctions despite repeat policy violations.", "remediation": "Apply sanctions per policy; document; refresh training.", "remediation_days": 60, "applicable_frameworks": ["hipaa"]}, {"id": "F-NIS2-001", "theme": "nis2_specific", "severity": "critical", "title": "Incident notification 24h early warning missed", "description": "NIS2 Article 23 24-hour early warning to competent authority + CSIRT not provided after recent significant incident.", "remediation": "File retrospectively; document delay rationale; engage authority; update IR procedure.", "remediation_days": 7, "applicable_frameworks": ["nis2"]}, {"id": "F-NIS2-002", "theme": "nis2_specific", "severity": "critical", "title": "Management body not approving cybersecurity measures", "description": "NIS2 Article 20 requires management bodies to approve cybersecurity risk-management measures + oversee implementation. Approval missing from board minutes.", "remediation": "Add to board agenda; document approval; ongoing oversight cadence.", "remediation_days": 60, "applicable_frameworks": ["nis2"]}, {"id": "F-NIS2-003", "theme": "nis2_specific", "severity": "major", "title": "10 minimum cybersecurity measures incomplete", "description": "NIS2 Article 21(2)(a)-(j) 10 minimum measures: 2 not documented (policies on cryptography, basic cyber hygiene).", "remediation": "Document missing policies; verify implementation; submit registration update.", "remediation_days": 90, "applicable_frameworks": ["nis2"]}, {"id": "F-CSF-001", "theme": "csf_specific", "severity": "major", "title": "NIST CSF profile not defined", "description": "Organization adopts NIST CSF 2.0 conceptually but no documented profile (current + target state) per CSF practice.", "remediation": "Develop profile; identify gaps; roadmap.", "remediation_days": 90, "applicable_frameworks": ["nist_csf"]}, {"id": "F-CSF-002", "theme": "csf_specific", "severity": "minor", "title": "Recover function under-developed", "description": "CSF GOVERN + IDENTIFY + PROTECT + DETECT + RESPOND well-developed; RECOVER function lacks documented recovery planning.", "remediation": "Develop recovery planning + communications procedures.", "remediation_days": 90, "applicable_frameworks": ["nist_csf", "iso_27001"]}, {"id": "F-AC-011", "theme": "access_control", "severity": "major", "title": "Service accounts without rotation", "description": "Service-account credentials shared across systems; no rotation in past 24 months.", "remediation": "Rotate; introduce secrets-management tooling; document.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "hipaa", "nis2"]}, {"id": "F-AC-012", "theme": "access_control", "severity": "major", "title": "Privileged access logs not reviewed", "description": "Privileged user activity logs collected but no periodic review for anomalous behavior.", "remediation": "Define review cadence; assign reviewer; SIEM alerts for high-risk patterns.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "hipaa", "nist_csf"]}, {"id": "F-AC-013", "theme": "access_control", "severity": "minor", "title": "Break-glass account not monitored", "description": "Emergency break-glass account exists but its usage not monitored; could be used without trace.", "remediation": "Alert on break-glass usage; quarterly review.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "hipaa"]}, {"id": "F-AI-006", "theme": "asset_inventory", "severity": "major", "title": "Personal device access not inventoried", "description": "BYOD devices accessing corporate data not in asset inventory; mobile device management (MDM) coverage incomplete.", "remediation": "Inventory BYOD; require MDM enrollment; document policy.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "hipaa", "nist_csf"]}, {"id": "F-AI-007", "theme": "asset_inventory", "severity": "major", "title": "Shadow IT discovered during audit", "description": "5 SaaS tools in use by teams without procurement / security review; some handle personal data.", "remediation": "Bring shadow IT under management or sunset; revise procurement gate.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "gdpr", "hipaa", "nist_csf"]}, {"id": "F-AI-008", "theme": "asset_inventory", "severity": "observation", "title": "Inventory not integrated with CMDB", "description": "Asset inventory in spreadsheet; lacks integration with operational CMDB. Drift inevitable.", "remediation": "Integrate via API or migrate to CMDB-as-source-of-truth.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-RM-010", "theme": "risk_management", "severity": "major", "title": "AI bias risk not formally identified", "description": "AI risk register lacks systematic identification of bias risks across protected demographic categories.", "remediation": "Apply ISO 23894 risk identification methodology; bias testing per category; document.", "remediation_days": 90, "applicable_frameworks": ["iso_42001", "eu_ai_act"]}, {"id": "F-RM-011", "theme": "risk_management", "severity": "minor", "title": "Risk treatment costs not estimated", "description": "Risk treatment plans don't estimate implementation cost; cost/benefit analysis missing.", "remediation": "Add cost estimate field; quarterly review.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "iso_42001", "nist_csf"]}, {"id": "F-SM-011", "theme": "supplier_management", "severity": "major", "title": "Critical vendor SOC 2 expired", "description": "Critical vendor's SOC 2 Type II report on file is 18 months old; current period not yet collected.", "remediation": "Request current report; if vendor delayed, document compensating evidence.", "remediation_days": 60, "applicable_frameworks": ["soc_2", "iso_27001"]}, {"id": "F-SM-012", "theme": "supplier_management", "severity": "minor", "title": "Vendor contact lists stale", "description": "Vendor security contact information stale; recent contact attempts bounced.", "remediation": "Refresh contact lists; verify quarterly.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "gdpr"]}, {"id": "F-IR-011", "theme": "incident_response", "severity": "major", "title": "Forensic data preservation not standard", "description": "Recent incidents lack forensic preservation of affected systems; impedes investigation.", "remediation": "Document forensic preservation procedure; train IR team.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "hipaa", "nist_csf"]}, {"id": "F-IR-012", "theme": "incident_response", "severity": "minor", "title": "External communications template missing", "description": "External communications for incidents drafted ad-hoc; no pre-approved templates.", "remediation": "Develop templates; legal + comms review; approve.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "gdpr"]}, {"id": "F-ML-008", "theme": "monitoring_logging", "severity": "major", "title": "Database query logging disabled", "description": "Production database query logging disabled for performance reasons; can't audit who queried what.", "remediation": "Enable query logging for sensitive tables; size storage; document trade-offs.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "hipaa", "gdpr", "nist_csf"]}, {"id": "F-ML-009", "theme": "monitoring_logging", "severity": "minor", "title": "Log timestamps not in standard timezone", "description": "Logs across systems use mix of local timezones + UTC; correlation difficult.", "remediation": "Standardize on UTC; document; backfill where feasible.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-CM-006", "theme": "change_management", "severity": "minor", "title": "Configuration drift not detected", "description": "Production configuration drift from documented baseline; no detection mechanism.", "remediation": "Deploy infrastructure-as-code drift detection; alert on deviations.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-CM-007", "theme": "change_management", "severity": "observation", "title": "Consider GitOps for change discipline", "description": "Some changes still applied imperatively; GitOps would enforce change-via-PR discipline.", "remediation": "Pilot GitOps for one infrastructure layer.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-BC-006", "theme": "business_continuity", "severity": "major", "title": "Single region deployment without DR plan", "description": "Production deployment in single AWS region; no documented multi-region or cross-region DR plan.", "remediation": "Define DR plan (cross-region replicas, runbooks); test.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "nis2"]}, {"id": "F-BC-007", "theme": "business_continuity", "severity": "minor", "title": "Communications plan missing for major outage", "description": "BCP covers technical recovery but lacks customer + employee communication plan for major outage.", "remediation": "Develop communications plan; pre-approved templates; cascade.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "nis2"]}, {"id": "F-CT-006", "theme": "competence_training", "severity": "minor", "title": "Onboarding security training not within 30 days", "description": "Some new hires complete security training 60+ days after start; expected within 30 days.", "remediation": "Calendar reminders; manager accountability; track completion timeline.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "hipaa", "nist_csf"]}, {"id": "F-CT-007", "theme": "competence_training", "severity": "observation", "title": "Phishing simulation results trending up", "description": "Phishing simulation click-rate increasing; training content may not be effective.", "remediation": "Refresh training content; targeted training for repeat clickers.", "remediation_days": 120, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "nis2", "hipaa"]}, {"id": "F-DG-008", "theme": "data_governance", "severity": "major", "title": "Data classification policy applied unevenly", "description": "Data classification policy applied to engineering data stores but not marketing tools containing customer data.", "remediation": "Extend classification; train marketing.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "soc_2", "gdpr", "hipaa"]}, {"id": "F-DG-009", "theme": "data_governance", "severity": "minor", "title": "Pseudonymization not consistently applied", "description": "Pseudonymization documented for some pipelines; not consistently applied to analytics datasets containing personal data.", "remediation": "Audit analytics datasets; pseudonymize where lawful basis is analytics.", "remediation_days": 90, "applicable_frameworks": ["gdpr", "iso_42001"]}, {"id": "F-CR-006", "theme": "cryptography", "severity": "major", "title": "Keys stored alongside data", "description": "Encryption keys stored in same cloud account / region as encrypted data; compromise of one yields the other.", "remediation": "Move keys to dedicated KMS account; restrict access.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "hipaa"]}, {"id": "F-CR-007", "theme": "cryptography", "severity": "minor", "title": "Certificate expiration monitoring incomplete", "description": "Certificate expiration alerts configured for some endpoints; internal certificates lack monitoring.", "remediation": "Extend monitoring; centralize certificate inventory.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-SD-006", "theme": "secure_sdlc", "severity": "major", "title": "Secrets in source control", "description": "Code review uncovered API keys + DB credentials committed to git history.", "remediation": "Rotate exposed secrets; remove from history; install pre-commit hooks; train.", "remediation_days": 30, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "hipaa"]}, {"id": "F-SD-007", "theme": "secure_sdlc", "severity": "minor", "title": "Pull-request templates lack security checklist", "description": "PR templates exist but don't prompt security considerations (auth, input validation, secrets).", "remediation": "Add security checklist to template; train.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf"]}, {"id": "F-VM-006", "theme": "vulnerability_mgmt", "severity": "major", "title": "Penetration test recommendations untracked", "description": "Annual penetration test completed; 12 findings; tracking + closure of remediation not centralized.", "remediation": "Centralize tracking; assign owners; verify closure.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "soc_2", "nist_csf", "hipaa"]}, {"id": "F-VM-007", "theme": "vulnerability_mgmt", "severity": "observation", "title": "Consider bug bounty programme", "description": "External vulnerability discovery limited to annual pentest; bug bounty would broaden coverage.", "remediation": "Evaluate bug bounty platforms; pilot.", "remediation_days": 180, "applicable_frameworks": ["iso_27001", "nist_csf"]}, {"id": "F-PS-005", "theme": "physical_security", "severity": "minor", "title": "Clean desk policy not enforced", "description": "Clean desk policy documented but walkthrough found sensitive printouts on unattended desks.", "remediation": "Reinforce policy; periodic walkthroughs; train.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "hipaa"]}, {"id": "F-PS-006", "theme": "physical_security", "severity": "observation", "title": "Hardware disposal evidence incomplete", "description": "Hardware disposal documented for laptops; lacks evidence of certified destruction for storage media.", "remediation": "Use certified destruction service; collect certificates.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "hipaa", "nist_csf"]}, {"id": "F-DP-008", "theme": "data_protection_privacy", "severity": "major", "title": "DSAR response > 30 days", "description": "12 of 50 DSARs in past quarter responded after Article 12(3) 1-month SLA; no extension communicated.", "remediation": "Investigate process bottlenecks; resource appropriately; communicate extensions where needed.", "remediation_days": 60, "applicable_frameworks": ["gdpr"]}, {"id": "F-DP-009", "theme": "data_protection_privacy", "severity": "minor", "title": "Privacy notice version history missing", "description": "Privacy notice updated multiple times; no version archive; cannot demonstrate which notice was active when.", "remediation": "Archive past versions with date stamps.", "remediation_days": 60, "applicable_frameworks": ["gdpr"]}, {"id": "F-DP-010", "theme": "data_protection_privacy", "severity": "minor", "title": "Article 22 automated decisions not flagged", "description": "Automated decision-making (Article 22) used in credit decisions; data subjects not informed; human review not offered.", "remediation": "Add transparency; offer human review; document procedure.", "remediation_days": 60, "applicable_frameworks": ["gdpr", "eu_ai_act"]}, {"id": "F-DC-004", "theme": "documentation_control", "severity": "observation", "title": "Consider read-only published documents", "description": "Controlled documents stored as editable Google Docs; risk of unauthorized edit. Read-only PDF publishing would be stronger control.", "remediation": "Publish read-only PDFs; restrict editing to authors.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "iso_13485", "iso_42001"]}, {"id": "F-IA-005", "theme": "internal_audit", "severity": "minor", "title": "Audit reports lack standard format", "description": "Audit reports vary in format across auditors; difficult to compare or trend.", "remediation": "Define standard report template.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "iso_42001", "soc_2", "iso_13485"]}, {"id": "F-AIMS-006", "theme": "aims_specific", "severity": "major", "title": "AI model card missing", "description": "Production AI system lacks model card per Annex A.6.2.7. Documentation per Mitchell et al. (2019) pattern not produced.", "remediation": "Develop model card; publish internally; commit to update with retraining.", "remediation_days": 60, "applicable_frameworks": ["iso_42001"]}, {"id": "F-AIMS-007", "theme": "aims_specific", "severity": "minor", "title": "Datasheet for datasets not produced", "description": "Training datasets lack datasheet per Gebru et al. (2021) pattern; not satisfying Annex A.7.4 fully.", "remediation": "Develop datasheets per dataset; document provenance + composition + intended use.", "remediation_days": 90, "applicable_frameworks": ["iso_42001"]}, {"id": "F-AIA-006", "theme": "ai_act_specific", "severity": "major", "title": "Article 27 FRIA missing for public-sector deployer", "description": "Public-sector body deploying high-risk AI; Fundamental Rights Impact Assessment per Article 27 not performed.", "remediation": "Conduct FRIA; document; consult DPA where required.", "remediation_days": 60, "applicable_frameworks": ["eu_ai_act"]}, {"id": "F-AIA-007", "theme": "ai_act_specific", "severity": "minor", "title": "EU database registration pending", "description": "High-risk Annex III system not yet registered in EU database per Article 71.", "remediation": "Register; document.", "remediation_days": 30, "applicable_frameworks": ["eu_ai_act"]}, {"id": "F-AIA-008", "theme": "ai_act_specific", "severity": "critical", "title": "Substantial modification turns deployer into provider", "description": "Deployer substantially modified high-risk AI system; now operates as provider per Article 25(1) but did not assume provider obligations.", "remediation": "Document role change; assume provider obligations; conformity assessment.", "remediation_days": 30, "applicable_frameworks": ["eu_ai_act"]}, {"id": "F-13485-005", "theme": "qms_specific", "severity": "major", "title": "Design transfer evidence missing", "description": "Design transfer per Clause 7.3.8 not formally documented for recent product. Manufacturing operates with insufficient design records.", "remediation": "Compile transfer evidence; document training; verify capability.", "remediation_days": 60, "applicable_frameworks": ["iso_13485", "fda_qsr"]}, {"id": "F-13485-006", "theme": "qms_specific", "severity": "observation", "title": "Consider digital quality management system", "description": "QMS run on shared drives; eQMS would improve traceability + audit-readiness.", "remediation": "Evaluate eQMS vendors; pilot.", "remediation_days": 180, "applicable_frameworks": ["iso_13485", "fda_qsr"]}, {"id": "F-FDA-005", "theme": "fda_specific", "severity": "major", "title": "UDI compliance gaps", "description": "Some devices commercially distributed lack UDI labeling per 21 CFR 830.", "remediation": "Audit + label; submit to GUDID; document.", "remediation_days": 90, "applicable_frameworks": ["fda_qsr"]}, {"id": "F-FDA-006", "theme": "fda_specific", "severity": "observation", "title": "Pre-submission strategy could leverage Q-sub", "description": "Product strategy proceeds toward 510(k) without leveraging FDA Q-Submission programme.", "remediation": "Consider Q-sub for novel aspects.", "remediation_days": 180, "applicable_frameworks": ["fda_qsr"]}, {"id": "F-HIPAA-005", "theme": "hipaa_specific", "severity": "major", "title": "Workforce member access not minimum-necessary", "description": "Workforce access provisioned at role level rather than minimum-necessary per §164.502(b). Some members access PHI beyond their need.", "remediation": "Audit + tighten access; document minimum-necessary determination.", "remediation_days": 90, "applicable_frameworks": ["hipaa"]}, {"id": "F-HIPAA-006", "theme": "hipaa_specific", "severity": "minor", "title": "Notice of privacy practices outdated", "description": "Notice of privacy practices per §164.520 last updated 2 years ago; substantive policy changes not reflected.", "remediation": "Update notice; redistribute per requirement; document.", "remediation_days": 60, "applicable_frameworks": ["hipaa"]}, {"id": "F-NIS2-004", "theme": "nis2_specific", "severity": "major", "title": "Registration with competent authority pending", "description": "Organization meets NIS2 essential entity criteria but has not registered with national competent authority per Article 24.", "remediation": "Submit registration; document.", "remediation_days": 30, "applicable_frameworks": ["nis2"]}, {"id": "F-NIS2-005", "theme": "nis2_specific", "severity": "minor", "title": "Supply-chain security measures not documented", "description": "NIS2 Article 21(2)(d) supply-chain security measures not separately documented from generic supplier-management.", "remediation": "Document NIS2-specific supply-chain measures.", "remediation_days": 60, "applicable_frameworks": ["nis2"]}, {"id": "F-CSF-003", "theme": "csf_specific", "severity": "minor", "title": "CSF tiers not assigned", "description": "NIST CSF 2.0 implementation tiers (Partial / Risk Informed / Repeatable / Adaptive) not assigned per function.", "remediation": "Self-assess tiers; document; target tier.", "remediation_days": 90, "applicable_frameworks": ["nist_csf"]}, {"id": "F-MDR-001", "theme": "mdr_specific", "severity": "critical", "title": "EU MDR technical documentation gap", "description": "Technical documentation per Annex II/III lacks recent clinical-evaluation update; notified body audit imminent.", "remediation": "Update documentation immediately; engage notified body.", "remediation_days": 30, "applicable_frameworks": ["eu_mdr_745"]}, {"id": "F-MDR-002", "theme": "mdr_specific", "severity": "major", "title": "Person Responsible for Regulatory Compliance not appointed", "description": "EU MDR Article 15 PRRC role not formally appointed for the EU operations.", "remediation": "Appoint PRRC meeting Article 15(1)-(2) qualifications; document.", "remediation_days": 30, "applicable_frameworks": ["eu_mdr_745"]}, {"id": "F-MDR-003", "theme": "mdr_specific", "severity": "minor", "title": "PMCF reports lag schedule", "description": "Post-Market Clinical Follow-up reports not produced per agreed schedule.", "remediation": "Catch up; rebaseline schedule.", "remediation_days": 90, "applicable_frameworks": ["eu_mdr_745"]}, {"id": "F-14971-001", "theme": "risk_management_medical", "severity": "major", "title": "Risk management plan not updated for software change", "description": "ISO 14971 risk management plan + risk file not updated after material software change.", "remediation": "Update RMF; re-evaluate risks; document.", "remediation_days": 60, "applicable_frameworks": ["iso_14971", "iso_13485", "eu_mdr_745"]}, {"id": "F-14971-002", "theme": "risk_management_medical", "severity": "minor", "title": "Residual risk evaluation lacks acceptability criteria", "description": "Residual risk evaluated but acceptability criteria per ISO 14971 §7 not formally established.", "remediation": "Define acceptability criteria; document.", "remediation_days": 90, "applicable_frameworks": ["iso_14971", "iso_13485"]}, {"id": "F-MDR-004", "theme": "mdr_specific", "severity": "major", "title": "EUDAMED registration incomplete", "description": "EU MDR EUDAMED registration of device, manufacturer, or UDI elements incomplete despite mandatory data submission requirements.", "remediation": "Complete required EUDAMED modules; track future module activations.", "remediation_days": 60, "applicable_frameworks": ["eu_mdr_745"]}, {"id": "F-MDR-005", "theme": "mdr_specific", "severity": "minor", "title": "Vigilance reporting log incomplete", "description": "EU MDR vigilance reporting log per Article 87 has 3 entries past 15-day reporting timeline.", "remediation": "Investigate root cause; tighten internal SLA; train.", "remediation_days": 60, "applicable_frameworks": ["eu_mdr_745"]}, {"id": "F-14971-003", "theme": "risk_management_medical", "severity": "major", "title": "Production + post-production information feedback weak", "description": "ISO 14971 §9 requires production + post-production information be collected + analysed; current process only acts on customer complaints, missing field data + service trends.", "remediation": "Expand information sources; document process; integrate with PMS.", "remediation_days": 90, "applicable_frameworks": ["iso_14971", "iso_13485", "eu_mdr_745"]}, {"id": "F-AIA-009", "theme": "ai_act_specific", "severity": "major", "title": "Deepfake content not marked AI-generated", "description": "Generative AI feature produces audio/video without machine-readable AI-generated marking per Article 50(2).", "remediation": "Implement watermarking; document.", "remediation_days": 60, "applicable_frameworks": ["eu_ai_act"]}, {"id": "F-AIA-010", "theme": "ai_act_specific", "severity": "minor", "title": "Instructions for use missing operational risks section", "description": "Article 13 instructions for use provided to deployers but do not adequately describe foreseeable operational risks.", "remediation": "Update IFU with risks + mitigations; train downstream.", "remediation_days": 60, "applicable_frameworks": ["eu_ai_act"]}, {"id": "F-FDA-007", "theme": "fda_specific", "severity": "major", "title": "Cybersecurity for connected device not addressed in 510(k)", "description": "Connected device 510(k) submission lacks cybersecurity content per FDA Cybersecurity Guidance (Sep 2023); FDA refused acceptance.", "remediation": "Develop cybersecurity content per guidance; resubmit.", "remediation_days": 90, "applicable_frameworks": ["fda_qsr"]}, {"id": "F-FDA-008", "theme": "fda_specific", "severity": "minor", "title": "510(k) summary lacks comparative data", "description": "510(k) summary per 21 CFR 807.92 lacks substantive comparison to predicate device.", "remediation": "Add comparative data; resubmit if FDA requests.", "remediation_days": 60, "applicable_frameworks": ["fda_qsr"]}, {"id": "F-HIPAA-007", "theme": "hipaa_specific", "severity": "minor", "title": "Workforce member termination workflow missing PHI access revocation", "description": "Termination workflow revokes general access but doesn't specifically address PHI access systems; 2 terminated members retained EHR access > 2 days.", "remediation": "Add PHI-specific revocation step; verify.", "remediation_days": 30, "applicable_frameworks": ["hipaa", "iso_27001"]}, {"id": "F-MR-005", "theme": "management_review", "severity": "minor", "title": "Management review inputs not pre-distributed", "description": "Management review held but inputs distributed only at meeting; senior leadership cannot prepare in advance.", "remediation": "Pre-distribute inputs 1 week in advance.", "remediation_days": 60, "applicable_frameworks": ["iso_27001", "iso_42001", "iso_13485", "soc_2"]}, {"id": "F-IA-006", "theme": "internal_audit", "severity": "observation", "title": "Audit programme could integrate cross-framework findings", "description": "Audits performed per framework but cross-framework finding impact not systematically tracked; missed reuse opportunity.", "remediation": "Use compliance-os cross_framework_mapper output to tag findings.", "remediation_days": 90, "applicable_frameworks": ["iso_27001", "iso_42001", "soc_2", "iso_13485"]} ] } FILE:references/audit_simulation_methodology.md # Audit Simulation Methodology — ISO 19011 + IIA IPPF + AICPA AT-C This reference answers exactly one decision: **what does a realistic internal audit look like, and how do we generate a mock audit that prepares the team without breaking trust?** Pair with `scripts/audit_simulator.py` for the deterministic mock audit generator. ## Why Simulate Audits? External certification audits are high-stakes events. A team that has never been audited internally before its first stage 2 ISO certification audit will struggle even if every artefact is in place — interview cadence, document-pull SLAs, walk-through pacing are operational muscles built only by practice. Mock audits provide: - Operational practice (auditees experience the rhythm of an interview) - Auditor-side practice (internal auditors practice their methodology before high-stakes certification audits) - Discovery of gaps before they become findings - Calibration of effort (how long does evidence assembly actually take?) - Cross-training (auditors from one team learn another team's controls) ## Audit Standards That Govern Simulation **ISO/IEC 19011:2018** — Guidelines for auditing management systems. Defines: - Audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach - Auditor competence (Clause 7) - Audit process: initiating → preparing → conducting → reporting (Clauses 5–6) **IIA International Professional Practices Framework (IPPF)** — internal-audit-specific: - IPPF Standards 1000-1322 — Attribute Standards (purpose, independence, proficiency, due professional care, quality assurance) - IPPF Standards 2000-2600 — Performance Standards (engagement planning through monitoring) - Severity grading approach (rated finding scale) **AICPA AT-C 105 + AU-C 240** — SOC 2 audit context: trust services criteria + auditor's responsibility framework. ## The Mock Audit Workflow Compliance OS `audit_simulator.py` deterministically generates one stage of a mock audit. The full simulation lifecycle: ``` 1. SCOPE → define framework + controls in scope + auditee team 2. PREPARE → audit_simulator.py outputs: findings + interview questions + document-review requests 3. CONDUCT → simulated interview + document review (1-2 hours per control) 4. REPORT → finding write-up + severity classification + corrective action assignment 5. CLOSE → corrective action tracking through CAPA ``` ## Finding Severity Distribution (the IIA expectation) A healthy compliance program produces audits with this distribution: | Severity | Healthy proportion | What it indicates | |---|---|---| | **Critical (major nonconformity)** | ≤ 15% | Blocks certification; requires major corrective action | | **Major** | 15–25% | Important gaps requiring 30-day corrective action plans | | **Minor** | 20–30% | Operational gaps requiring corrective action timeline | | **Observation / OFI** | ≥ 40% | Improvement opportunities; no required action | **Why this shape?** If 80% of findings are critical, either the audit was destructive (auditee not given fair chance to demonstrate compliance) or the program is genuinely failing. If 80% of findings are observations, the audit was too superficial. The compliance OS audit simulator enforces this shape by deterministic severity rotation. A first audit (year 1) will skew higher to critical/major; a mature program (year 3+) skews to observations. ## Number of Findings Per Audit ISO 19011 Clause 6 typical audit depth: - Small scope (5 controls, 1 day): 5–10 findings - Medium scope (10–15 controls, 3–5 days): 10–20 findings - Full system audit (all clauses, 1–2 weeks): 25–50 findings The simulator targets 8–15 findings per audit (medium scope) as the default. ## Interview Question Quality Auditor questions follow the **walk-through pattern**: 1. **Open** — "Walk me through how this control is implemented day-to-day." 2. **Sample** — "Show me a specific example from the last 30 days." 3. **Drill** — "What happens if [edge case]?" 4. **Verify** — "Where is this documented?" Each control gets 3–5 questions following this pattern. The simulator's `interview_questions()` function provides theme-specific questions per the IIA performance standards. ## Document-Review Requests Per ISO 19011, the auditor reviews: - The procedure (the "what should happen") - The records (the "what actually happened") - The evidence of management oversight (the "did anyone check?") A document-review request typically asks for all three. The simulator's `document_requests()` function generates the request list per theme. ## Auditor Independence Test Clause 9.2 of ISO management-system standards requires auditor independence. The simulator does NOT enforce auditor assignment (that's `aims_audit_scheduler.py` for ISO 42001 or `isms_audit_scheduler.py` for ISO 27001) but the workflow assumes an independent auditor. **Independence rules:** - Auditor cannot audit their own work - Auditor reports to a different chain of command than the auditee - For small organizations, rotating auditors between teams + occasional external auditor satisfies independence ## Finding Categories (the taxonomy) The simulator uses 5 finding themes mapped to common control families: | Theme | Maps to control families | |---|---| | `access_control` | ISO 27001 A.5.15 / A.8.2 / A.8.3; SOC 2 CC6.1-6.3; ISO 42001 A.4.4 | | `logging_monitoring` | ISO 27001 A.8.15 / A.8.16; SOC 2 CC7.1-7.2; ISO 42001 A.9.3 / A.9.4 | | `change_management` | ISO 27001 A.8.32; SOC 2 CC8.1; ISO 42001 A.6.2.5 | | `supplier_mgmt` | ISO 27001 A.5.19-A.5.22; SOC 2 CC9.2; ISO 42001 A.10.2; GDPR Art. 28 | | `incident_response` | ISO 27001 A.5.24-27, A.6.8; SOC 2 CC7.3-7.5; ISO 42001 A.8.4; EU AI Act Art. 73; GDPR Art. 33-34 | This taxonomy covers the highest-leverage controls across the 9 supported frameworks. Adding new themes is a matter of extending `FINDING_TEMPLATES` + `CONTROL_TO_THEME` mappings. ## Anti-Patterns in Audit Simulation 1. **Auditing for trapping vs auditing for evidence.** Mock audits aim to surface gaps, not embarrass the auditee. If team morale drops after the mock, the audit was structured wrong. 2. **Skipping the "obvious" controls.** Critical findings often hide in mundane controls (e.g., terminated employee with retained access). Simulator deliberately includes prosaic theme rotation. 3. **No prior-year follow-up.** The simulator's `prior_year_findings_open` parameter forces the first finding to be a follow-up. Real audits always follow up on prior open findings (ISO 19011 Clause 6.3). 4. **One severity-skewed audit.** Distribution rule guards against this; if all findings are critical or all are observations, recalibrate the audit scope or methodology. ## When This Reference Doesn't Help - **Specific industry-vertical audit requirements.** Use sectoral skills (financial, healthcare). - **Auditor competence + certification.** See ISACA CISA, IRCA Lead Auditor courses. - **Audit report-writing detail.** See ISO 19011 Clause 6.5 + IIA performance standards 2410–2440. --- **Source authorities (non-exhaustive):** - **ISO/IEC 19011:2018** — Guidelines for auditing management systems (the canonical methodology) - **IIA International Professional Practices Framework (IPPF)** — Attribute Standards 1000-1322 + Performance Standards 2000-2600 - **AICPA AT-C 105** — Trust Services Criteria attestation engagement - **AICPA AU-C 240** — Auditor's responsibilities relating to fraud (financial audit, conceptually applied) - **ISACA CISA Review Manual** (27th ed., 2024) — IS audit practitioner methodology - **ASQ Certified Quality Auditor (CQA) Body of Knowledge** — quality audit methodology - **NIST SP 800-53A Rev 5** — Assessing Security and Privacy Controls (assessment procedures for each control) - **ISO/IEC 17021-1:2015** — Conformity assessment requirements for bodies providing audit and certification - **IRCA (International Register of Certificated Auditors)** — Lead auditor certification programme materials - **The Open Group** — Open FAIR (Factor Analysis of Information Risk) for risk-based audit prioritization FILE:references/compliance_os_pattern.md # Compliance OS — The Meta-Framework Pattern This reference answers exactly one decision: **when do we orchestrate frameworks vs run them separately, and what does the meta-framework architecture look like?** ## The Problem Compliance OS Solves Most growing companies hit a wall: 2–3 compliance frameworks operating in parallel, each with its own tooling, its own audit calendar, its own evidence requirements, its own internal owner. The result: - **Duplicate evidence collection** — access-review records assembled 3 times for ISO 27001, SOC 2, and ISO 42001 audits - **Conflicting audit calendars** — surveillance audits stack in the same week with insufficient auditor capacity - **Fragmented management review** — each framework wants its own management review, taking 5x the executive time - **Inconsistent control taxonomies** — "access control" means slightly different things across SOC 2 and ISO 27001 Annex A and ISO 42001 Annex A - **Unowned cross-framework gaps** — controls in framework A but not B fall to ad-hoc ownership - **Evidence freshness mismatch** — ISO 27001 wants 12-month log retention, GDPR can want longer, leading to either over-retention or compliance gaps Compliance OS is the orchestration layer that sits **above** per-framework skills and consolidates the cross-framework view. ## The Four Operations ``` [ Company Profile JSON ] │ v ╔═══════════════════════╗ ║ 1. CONFIGURE ║ framework_selector.py ║ "Which apply?" ║ ╚═══════════════════════╝ │ v ╔═══════════════════════╗ ║ 2. MAP ║ cross_framework_mapper.py ║ "What overlaps?" ║ ╚═══════════════════════╝ │ v ╔═══════════════════════╗ ║ 3. SIMULATE ║ audit_simulator.py ║ "What audit looks ║ ║ like to fail?" ║ ╚═══════════════════════╝ │ v ╔═══════════════════════╗ ║ 4. CONSOLIDATE ║ evidence_pool_generator.py ║ "Where's the evidence║ ║ + what reuses?" ║ ╚═══════════════════════╝ │ v [ Multi-framework plan ] ``` Each operation is a stdlib Python tool with deterministic logic — no LLM calls, no hidden state. ## When to Use Compliance OS | Situation | Use compliance-os? | |---|---| | Single framework only (e.g., just SOC 2) | No — the per-framework skill is sufficient | | 2+ frameworks operating in parallel | Yes | | Adding a new framework to existing program | Yes — for cross-framework reuse mapping | | Planning annual audit calendar across multiple certifications | Yes | | Onboarding a new AI system that triggers ISO 42001 + EU AI Act + GDPR | Yes | | Acquiring a company with different compliance posture | Yes — for gap mapping post-acquisition | | Internal-audit-only program (no external certification) | Yes if multi-framework; No if single | ## What Compliance OS Is NOT - **NOT a per-framework deep-dive skill.** Per-framework skills (`ra-qm-team/skills/iso42001-specialist/`, etc.) do the operational work. Compliance OS orchestrates them. - **NOT a GRC platform replacement.** GRC platforms (Drata, Vanta, OneTrust, Hyperproof, etc.) are tools that operationalize what compliance OS describes — they're complementary. Compliance OS gives the conceptual map; GRC tools store the evidence. - **NOT a binding legal opinion.** Cross-framework mappings reflect published guidance from ISO, AICPA, NIST, IIA, EDPB. Novel cross-walks need outside counsel. - **NOT a certification body.** Certification audits are performed by accredited bodies. Compliance OS prepares for them. ## Roles and Ownership A multi-framework compliance program typically has these roles. Compliance OS does not replace them — it gives them a shared mental model. | Role | Owns | |---|---| | **Compliance officer** | The meta-program; framework selector; cross-framework mapper; consolidated evidence pool | | **CISO** | ISO 27001 + SOC 2 + cybersecurity slices of ISO 42001 + GDPR Article 32 | | **DPO** | GDPR; privacy slice of ISO 42001 (A.7.6); EU AI Act Article 27 FRIA where applicable | | **AIMS lead** | ISO 42001; AI-specific slice of EU AI Act Article 17 QMS | | **QMS lead** | ISO 13485 / FDA QSR / EU MDR 745 (medical-device contexts) | | **Risk manager** | ISO 14971 + AI risk per ISO 23894 | | **Internal auditor(s)** | Clause 9.2 audit programmes across all frameworks | | **Executive sponsor** | Management review (Clause 9.3) across all frameworks | A typical mid-stage AI SaaS has compliance officer + CISO + DPO as the core trio; AIMS lead is a part-time hat. ## The Integrated Management System Pattern When multiple management-system standards apply (ISO 27001 + ISO 42001 + ISO 9001/13485 + ISO 14001), the recommended structure is an **Integrated Management System (IMS)** rather than parallel siloed systems. The IMS pattern: - Single scope statement covering all applicable standards - Single policy set with framework-specific overlays (e.g., the AI policy required by ISO 42001 A.2.2 sits alongside the info-sec policy required by ISO 27001 A.5.1) - Single document control procedure - Single internal audit programme covering all standards over a rolling 3-year cycle - Single management review covering all standards - Single CAPA loop with framework-tagged nonconformities - Per-framework deep-dive evidence under common umbrella Compliance OS is the operating model for the IMS pattern. ## How Compliance OS Relates to Sectoral Programs | Sectoral context | Compliance OS approach | |---|---| | Pure SaaS (no AI, no medical) | Skip compliance-os. Use ISO 27001 + SOC 2 + GDPR skills directly. | | AI SaaS (EU users) | Use compliance-os. Frameworks: ISO 27001 + SOC 2 + ISO 42001 + EU AI Act + GDPR. | | AI medical device | Use compliance-os. Frameworks: ISO 13485 + 14971 + 42001 + EU AI Act + EU MDR / FDA QSR + GDPR. Most complex case. | | Financial / regulated industry | Use compliance-os + sectoral overlay (e.g., NYDFS, FINMA, NIS2). | ## Anti-Patterns to Avoid 1. **Building compliance-os before having ≥ 2 frameworks operating maturely.** Premature orchestration. Mature one framework first; layer the second; THEN orchestrate. 2. **Using compliance-os to bypass per-framework deep work.** The cross-framework mapping says "reuse evidence from framework A." That presumes framework A's evidence is solid. Reuse mapping ≠ skip diligence. 3. **Treating mapping confidence as binary.** HIGH confidence means same evidence; MEDIUM means existing evidence with overlay; LOW means concept overlap. LOW mappings still need new artefacts. 4. **Forgetting that bindings (regulations) outrank certifications.** GDPR + EU AI Act non-compliance carries actual penalties; ISO 27001 non-certification just blocks procurement. Sequence accordingly. 5. **Replacing the per-framework skill with compliance-os.** Compliance OS orchestrates; per-framework skills do the deep work. ## When This Reference Doesn't Help - **Specific framework requirements.** See the per-framework skill. - **GRC platform selection.** Tooling decision; commercial market evolves rapidly. - **Per-sector regulatory deep-dive.** Use sectoral skills (financial, healthcare, etc.). --- **Source authorities (non-exhaustive):** - **ISO/IEC 19011:2018** — Guidelines for auditing management systems (the canonical audit standard for ISO-family certifications) - **IIA International Professional Practices Framework (IPPF)** — Internal Audit Standards (Standards 1000-2600); attribute + performance standards - **AICPA AT-C 105 + AU-C 240** — Trust Services + auditor's responsibility framework (SOC 2 + financial audit overlap) - **COSO Enterprise Risk Management 2017** — Integrated framework for risk management across the enterprise - **NIST Cybersecurity Framework 2.0** — profile pattern for organizing security/risk programmes (precedent for compliance-os approach) - **ISO/IEC 27001:2022** — Information security management (foundational management system for most compliance programs) - **ISO/IEC 17021** — Conformity assessment requirements (governs certification bodies; informs audit cycle) - **ISACA** — *Auditing Artificial Intelligence* (2nd ed., 2024) — multi-framework AI audit guidance - **ENISA** — *Multilayer Framework for Good Cybersecurity Practices for AI* (Mar 2023) — multi-layer integration - **Annex SL of the ISO/IEC Directives** (2024) — the high-level structure shared by management system standards enabling integration FILE:references/cross_framework_overlap.md # Cross-Framework Overlap — The 9-Framework × Control-Family Matrix This reference answers exactly one decision: **for each common control family, which of the 9 supported frameworks address it, and at what confidence?** Pair with `scripts/cross_framework_mapper.py` for the deterministic lookup. ## The 9 Frameworks | ID | Standard | Type | |---|---|---| | iso_27001 | ISO/IEC 27001:2022 + Annex A | Certifiable management system (info-sec) | | iso_13485 | ISO 13485:2016 | Certifiable management system (medical device QMS) | | iso_42001 | ISO/IEC 42001:2023 | Certifiable management system (AIMS) | | iso_14971 | ISO 14971:2019 | Process standard (medical device risk management) | | eu_ai_act | Regulation (EU) 2024/1689 | Binding regulation (AI) | | eu_mdr_745 | Regulation (EU) 2017/745 | Binding regulation (medical devices) | | gdpr | Regulation (EU) 2016/679 | Binding regulation (privacy) | | soc_2 | AICPA SOC 2 TSC | Attestation (US enterprise procurement) | | fda_qsr | FDA 21 CFR 820 | Binding regulation (US medical devices) | ## Highest-Overlap Pairs (where reuse leverage is maximized) 1. **ISO 27001 ↔ SOC 2** — densest known overlap. ISO 27001:2022 Annex A 93 controls map to SOC 2 TSC ~75% by published cross-walks. The 19 merged controls in `cross_framework_mapper.py` cite 51 atomic ISO 27001 + 34 atomic SOC 2 controls in HIGH-confidence themes. Adding SOC 2 on top of certified ISO 27001 is typically ~3 months of incremental work. 2. **ISO 13485 ↔ FDA QSR** — harmonised in 2024 (FDA Quality Management System Regulation rule). Most evidence reuses. 3. **ISO 42001 ↔ ISO 27001** — 60% reuse: most Clauses 4–10 evidence transfers with AI scope appended; Annex A controls A.7 (data) + A.10 (third-party) overlap heavily; the 40% net-new is mostly A.5 (impact assessment) + A.6 (lifecycle) + A.9 (use of AI systems). 4. **EU AI Act Article 17 ↔ ISO 42001** — ISO 42001 satisfies most of Article 17(1)(a)–(m) QMS requirements. The cross-walk in `compliance-team-iso42001/references/cross_framework_mapping_ai.md` provides Article 17 line-item mapping. 5. **GDPR ↔ ISO 27001 Annex A.5.34** — privacy by design overlap; GDPR Article 32 technical and organizational measures maps to ISO 27001 cryptography (A.8.24) + access control (A.5.15) + incident response (A.5.24). ## Control Family Overlap Matrix (summary) Legend: ✅ direct overlap; 🔶 partial overlap with overlay; ⚠️ concept overlap only; ⛔ not applicable. | Control family | 27001 | 13485 | 42001 | 14971 | EU AI Act | MDR | GDPR | SOC 2 | FDA QSR | |---|---|---|---|---|---|---|---|---|---| | Access control | ✅ | 🔶 | 🔶 | ⛔ | ⛔ | ⛔ | 🔶 | ✅ | 🔶 | | Asset inventory | ✅ | ✅ | ✅ | ⛔ | ⛔ | ⛔ | 🔶 | ✅ | ✅ | | Risk management | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | 🔶 | ✅ | 🔶 | | Supplier mgmt | ✅ | ✅ | ✅ | ⛔ | 🔶 | 🔶 | ✅ | ✅ | 🔶 | | Incident response | ✅ | ✅ | 🔶 | 🔶 | 🔶 | ✅ | ✅ | ✅ | ✅ | | Logging & monitoring | ✅ | 🔶 | 🔶 | ⛔ | 🔶 | 🔶 | ⚠️ | ✅ | 🔶 | | Change management | ✅ | ✅ | 🔶 | ⛔ | ⛔ | ✅ | ⛔ | ✅ | ✅ | | BCP / DR | ✅ | 🔶 | ⛔ | ⛔ | ⛔ | ⛔ | ⛔ | ✅ | ⛔ | | Competence + training | ✅ | ✅ | ✅ | ⛔ | 🔶 | ✅ | ⛔ | ✅ | ✅ | | Data governance | 🔶 | ✅ | ✅ | ⛔ | ✅ | ⚠️ | ✅ | ⚠️ | 🔶 | | Internal audit | ✅ | ✅ | ✅ | ⛔ | ⛔ | 🔶 | ⛔ | ✅ | 🔶 | | Management review | ✅ | ✅ | ✅ | ⛔ | ⛔ | 🔶 | ⛔ | 🔶 | ⛔ | | Cryptography | ✅ | ⛔ | ⛔ | ⛔ | ⛔ | ⛔ | ✅ | ✅ | ⛔ | | Secure SDLC | ✅ | ⛔ | 🔶 | ⛔ | 🔶 | ⛔ | ⛔ | ✅ | ⛔ | | Vulnerability mgmt | ✅ | ⛔ | ⛔ | ⛔ | ⛔ | ⛔ | ⛔ | ✅ | ⛔ | | Physical security | ✅ | ✅ | ⛔ | ⛔ | ⛔ | ✅ | ⛔ | ✅ | ✅ | | Personal data protection | ✅ | ⛔ | 🔶 | ⛔ | 🔶 | ⛔ | ✅ | 🔶 | ⛔ | | Documentation control | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | 🔶 | ✅ | ✅ | | Continual improvement / CAPA | ✅ | ✅ | ✅ | ✅ | ⛔ | ✅ | ⛔ | ✅ | ✅ | ## How to Use This Matrix 1. **Identify the union** of applicable frameworks (from `framework_selector.py`) 2. **For each control family**, find the row and read the columns for your frameworks 3. **Build evidence once** for the framework with the strongest requirement, then reuse-with-overlay for others 4. **Document the reuse mapping** in your compliance program documentation so auditors can trace evidence to framework controls ## Practical Reuse Sequencing If you operate ISO 27001 (mature) and add a second framework: | Add | Reuse leverage from 27001 | |---|---| | **SOC 2** | ~75% — heaviest reuse; the canonical pair | | **ISO 42001** | ~60% — Clauses 4–10 reuse strong; Annex A.7/A.10 reuse strong; A.5/A.6/A.9 net-new | | **GDPR** | ~50% — Article 32 organizational measures reuse; Articles 5/6/30 net-new privacy work | | **EU AI Act** | ~40% — Article 17 QMS via ISO 42001 path; Articles 9/10 net-new; transparency net-new | | **ISO 13485** | ~30% — document control + CAPA reuse; design controls + medical specifics net-new | | **FDA QSR** | ~30% — via ISO 13485 path; sectoral overlay | | **EU MDR 745** | ~25% — most net-new (technical documentation, clinical evidence, UDI) | | **ISO 14971** | ~20% — process standard, integrates with 13485 | ## Confidence Levels Explained The `cross_framework_mapper.py` returns one of three confidence levels per mapping: - **HIGH (H)** — same evidence satisfies both framework controls without modification. Example: a quarterly access-review record satisfies ISO 27001 A.5.15 + SOC 2 CC6.1 simultaneously. - **MEDIUM (M)** — existing evidence plus a framework-specific overlay. Example: ISO 27001 supplier-management procedure adapted to add AI-specific clauses for ISO 42001 A.10.2. - **LOW (L)** — concept overlap only; new artefact required. Example: ISO 42001 A.5.2 impact assessment uses concepts from GDPR DPIA but is a separate artefact. ## When This Reference Doesn't Help - **Specific atomic control numbers.** See the per-framework skill's references. - **Sector-specific overlays.** See sectoral skills (financial, healthcare). - **Audit simulation depth.** See `audit_simulation_methodology.md`. --- **Source authorities (non-exhaustive):** - **ISO/IEC 27001:2022** + Annex A (the foundational pair source) - **ISO/IEC 42001:2023** + Annex A - **AICPA Trust Services Criteria** (2017 + 2022 update) - **Regulation (EU) 2024/1689** (EU AI Act) - **Regulation (EU) 2016/679** (GDPR) - **Regulation (EU) 2017/745** (EU MDR) - **ISO 13485:2016** - **ISO 14971:2019** - **FDA 21 CFR 820** (QSR) — harmonised under the FDA Quality Management System Regulation rule (effective 2026) - **NIST SP 800-53 Rev 5** — security and privacy controls catalog (cross-walk reference) - **NIST CSF 2.0** — profile pattern - **ISACA** — *Mapping ISO 27001 to SOC 2* (continually updated) - **CIS Controls v8** — additional cross-walk - **CSA STAR** — cloud-specific cross-walk FILE:references/evidence_artifact_reuse_index.md # Evidence Artefact Reuse Index — Which Evidence Type Satisfies Most Controls Across Frameworks This reference answers exactly one decision: **which evidence artefacts have the highest reuse leverage across the 12 supported frameworks, and what's the priority order for building them in a multi-framework programme?** Pair with `scripts/evidence_pool_generator.py` for the operational catalogue. This document is the empirically-derived ranking + reasoning. ## Methodology Reuse leverage = count of distinct (framework, control) tuples that one evidence artefact satisfies. Computed by tracing artefact-to-control mappings across: - ISO/IEC 27001:2022 Annex A - ISO/IEC 42001:2023 Annex A - ISO 13485:2016 + ISO 14971:2019 - AICPA Trust Services Criteria (SOC 2) - Regulation (EU) 2024/1689 (AI Act) - Regulation (EU) 2017/745 (MDR) - Regulation (EU) 2016/679 (GDPR) - FDA 21 CFR 820 (QSR / QMSR) - NIST Cybersecurity Framework 2.0 - Directive (EU) 2022/2555 (NIS2) - HIPAA Security Rule + Privacy Rule + Breach Notification For each evidence artefact, count of frameworks × controls satisfied = leverage score. ## The Top-Tier Artefacts (Build These First) | Rank | Artefact | Reuse leverage | Acquisition cost | Why it's #1 | |---|---|---|---|---| | 1 | **Risk register with treatment plans** | 30+ mappings × 8+ frameworks | High | Every management-system standard + binding regulation demands risk management. Single artefact serves ISO 27001 Clause 6.1, ISO 42001 Clause 6.1.2, SOC 2 CC3, EU AI Act Article 9, GDPR Article 35 DPIA, NIST CSF GV.RM + ID.RA, NIS2 Article 21(2)(a), HIPAA §164.308(a)(1)(ii)(A) | | 2 | **Asset inventory with classification** | 25+ mappings × 7+ frameworks | Medium | Required for ISO 27001 A.5.9-12, SOC 2 CC6.1, ISO 42001 A.4, GDPR Article 30, NIST CSF ID.AM, HIPAA §164.308 + §164.310(d). Foundation for almost every other artefact. | | 3 | **Incident log + post-incident reviews + notifications** | 30+ mappings × 8+ frameworks | Medium | ISO 27001 A.5.24-27 + A.6.8, SOC 2 CC7.3-5, GDPR Articles 33-34, EU AI Act Article 73, NIS2 Article 23, HIPAA §164.308(a)(6) + Breach Notification, NIST CSF RS + RC | | 4 | **Supplier inventory + reviews + DPAs/BAAs** | 25+ mappings × 8+ frameworks | Medium | ISO 27001 A.5.19-22, SOC 2 CC9.2, ISO 42001 A.10, GDPR Article 28, EU AI Act Article 25, NIST CSF GV.SC, NIS2 Article 21(2)(d), HIPAA §164.314(a) BAA | | 5 | **Policy set (AI + info-sec + privacy + code-of-conduct)** | 20+ mappings × 7+ frameworks | Medium | ISO 27001 A.5.1, ISO 42001 Clause 5.2 + A.2.2-3, SOC 2 CC1.1-2, GDPR Article 24, NIST CSF GV.PO, EU AI Act Article 17(1)(a) | ## High-Leverage Artefacts (Build Next) | Rank | Artefact | Reuse leverage | Acquisition cost | Notes | |---|---|---|---|---| | 6 | **Centralized tamper-evident logs** | 20+ mappings × 6+ frameworks | High | ISO 27001 A.8.15-16, SOC 2 CC7.1-2, ISO 42001 A.9.3-4, EU AI Act Article 12 + 72, NIST CSF DE.CM, HIPAA §164.312(b) audit controls | | 7 | **Training records (per role, with effectiveness verification)** | 18+ mappings × 7+ frameworks | Medium | ISO 27001 A.6.3, SOC 2 CC1.4 + CC2.2, ISO 42001 Clause 7.2-3 + A.4.4, EU AI Act Article 4, NIST CSF PR.AT, NIS2 Article 21(2)(g), HIPAA §164.308(a)(5) | | 8 | **Data inventory + provenance + consent register** | 20+ mappings × 6+ frameworks | High | ISO 27001 A.5.34, ISO 42001 A.7, EU AI Act Article 10, GDPR Articles 5+6+30, NIST CSF PR.DS + ID.AM-07, HIPAA §164.502 + §164.514 | | 9 | **Internal audit programme records** | 15+ mappings × 6+ frameworks | Medium | ISO 27001 Clause 9.2, ISO 42001 Clause 9.2, ISO 13485 Clause 8.2.4, SOC 2 CC4.1, NIST CSF ID.IM, HIPAA §164.308(a)(8) | | 10 | **Management review minutes + action tracking** | 12+ mappings × 5+ frameworks | Low | ISO 27001 Clause 9.3, ISO 42001 Clause 9.3, ISO 13485 Clause 5.6, NIST CSF GV.OV, NIS2 Article 20 | ## Mid-Leverage Artefacts | Rank | Artefact | Reuse leverage | Acquisition cost | Notes | |---|---|---|---|---| | 11 | **Change records + rollback procedures + post-implementation reviews** | 14+ mappings × 5+ frameworks | Low | ISO 27001 A.8.32, SOC 2 CC8.1, ISO 42001 A.6.2.5, ISO 13485 Clause 7.3.9, NIST CSF PR.PS, HIPAA §164.308(a)(5)(ii)(B) | | 12 | **Crypto records (algorithms, key lifecycle, KMS architecture)** | 14+ mappings × 6+ frameworks | Medium | ISO 27001 A.8.24, SOC 2 CC6.1 + CC6.7, GDPR Article 32(1)(a), NIST CSF PR.DS-01-02 + PR.PS-05, NIS2 Article 21(2)(h), HIPAA §164.312(a)(2)(iv) + §164.312(e)(2)(ii) | | 13 | **BCP/DRP + RPO/RTO + exercise records** | 12+ mappings × 5+ frameworks | High | ISO 27001 A.5.29-30 + A.8.13-14, SOC 2 A1.2-3, NIST CSF RC.RP + RC.IM + RC.CO, NIS2 Article 21(2)(c), HIPAA §164.308(a)(7) | | 14 | **DPIA records + LIAs + privacy notice version history** | 12+ mappings × 4+ frameworks | High | GDPR Articles 5+6+24+25+30+35+38, EU AI Act Article 27 FRIA (overlap), ISO 27001 A.5.34, ISO 42001 A.7.6 | | 15 | **Quarterly access review records + RBAC matrix + JML evidence** | 18+ mappings × 7+ frameworks | Low | ISO 27001 A.5.15 + A.8.2-3, SOC 2 CC6.1-3, ISO 42001 A.4.4, GDPR Article 32(1)(b), NIST CSF PR.AA, NIS2 Article 21(2)(i), HIPAA §164.308(a)(3-4) + §164.312(a)(1) | | 16 | **Vulnerability scan + patch SLA + remediation evidence** | 12+ mappings × 5+ frameworks | Medium | ISO 27001 A.8.7-9, SOC 2 CC7.1-2 + CC7.4, NIST CSF ID.RA + PR.PS-02, NIS2 Article 21(2)(f), HIPAA §164.308(a)(5)(ii)(B) | ## Low-Leverage (Framework-Specific) Artefacts Build these only when the specific framework applies; lower reuse value across the programme. | Artefact | Primary framework(s) | Why low-leverage | |---|---|---| | Annex IV technical documentation (EU AI Act) | EU AI Act | Specific to AI Act high-risk systems | | Design History File (DHF) | ISO 13485, FDA QSR | Specific to medical-device QMS | | Process validation (IQ/OQ/PQ) | ISO 13485, FDA QSR | Specific to medical-device manufacturing | | Clinical evaluation (Annex XIV) | EU MDR | Specific to medical-device EU placement | | Model card + datasheet | ISO 42001, EU AI Act | AI-specific | | FRIA (Fundamental Rights Impact Assessment) | EU AI Act | Specific to high-risk AI public-sector deployers | | Notice of Privacy Practices | HIPAA | Specific to US healthcare | | Form 483 response records | FDA QSR | Specific to FDA-inspected entities | | NIS2 incident notifications (24h/72h/1m) | NIS2 | Specific to NIS2-in-scope entities | | EUDAMED registration | EU MDR | Specific to EU MDR | ## Reuse-Leverage Operational Pattern For a multi-framework programme, the recommended build order is: ``` Phase 1 (Weeks 1-4): - Risk register with treatment plans (top reuse) - Asset inventory with classification - Policy set - Quarterly access review records + RBAC matrix Phase 2 (Weeks 5-12): - Centralized tamper-evident logs - Supplier inventory + DPAs/BAAs - Training records - Crypto records - Internal audit programme records - Management review records Phase 3 (Weeks 13-24): - Data inventory + provenance + consent (build alongside Phase 1 if GDPR/HIPAA early) - BCP/DRP + exercise records - DPIA records - Vulnerability scan + remediation - Change records + rollback procedures - Incident log + post-incident reviews - Physical security records (if applicable) Phase 4 (Weeks 25+): - Framework-specific artefacts: * Annex IV docs (if EU AI Act) * DHF + process validation (if ISO 13485 / FDA QSR) * Clinical evaluation (if EU MDR) * Model cards + datasheets (if ISO 42001) * FRIA (if EU AI Act public-sector deployer) * Notice of Privacy Practices (if HIPAA) ``` ## Common Mistakes (Anti-Patterns) 1. **Building framework-specific artefacts before top-tier reuse artefacts.** Common when team is led by a single-framework specialist; results in 5x more total effort across the programme. 2. **Separate evidence stores per framework.** Each framework wants the same access-review log; storing it 3 times in 3 systems = stale + inconsistent. 3. **Not citing the same artefact in multiple audit reports.** Different auditors may ask for the same evidence renamed; cite the shared artefact ID in both reports. 4. **Skipping centralized inventory in Phase 1.** Asset inventory is the foundation for risk register, supplier list, data inventory, etc. Without it, everything downstream is incomplete. 5. **Treating evidence as one-time collection rather than continuous artefact.** Quarterly access review records must be produced quarterly, not "fixed for the audit and then ignored". ## Evidence Freshness Discipline Reuse leverage breaks down if evidence is stale. Per-artefact target freshness: | Artefact | Refresh cadence | Stale = ineffective | |---|---|---| | Risk register | Quarterly minimum | Within 90 days | | Asset inventory | Quarterly minimum | Within 90 days | | Access review records | Quarterly | Within 1 quarter | | Incident log + PIRs | Continuous + 30-day PIR | PIR within 30 days | | Supplier reviews | Annually | Within 12 months | | Training records | Annually + new-hire 30 days | Annual completion 100% | | Policy set | Annually reviewed | Within 12 months | | Crypto inventory | Quarterly review | Within 90 days | | DPIA records | At new processing + on material change | Always current | | BCP/DRP exercise records | Annually | Within 12 months | ## Anti-Reuse Patterns to Avoid - **Per-framework reformatting** — collecting an artefact, then reformatting for each framework's report. Cite the shared artefact + map to framework controls instead. - **Per-team ownership without integration** — security owns SOC 2 evidence, DPO owns GDPR evidence, RA/QM owns ISO 13485 evidence, no shared discovery layer. Use compliance-os meta-orchestrator to enforce shared inventory. - **Custodial-only ownership** — artefact lives in one team's drive without index. New audit cycle re-discovers from scratch. ## When This Reference Doesn't Help - **Specific GRC platform configuration.** Tooling decision; see vendor documentation. - **Per-control evidence requirements.** See per-framework skill references. - **Sector-specific evidence (financial NYDFS, energy NERC CIP).** Sectoral; not in 12-framework scope. --- **Source authorities (non-exhaustive):** - **ISO/IEC 27001:2022** + Annex A - **ISO/IEC 42001:2023** + Annex A - **ISO/IEC 19011:2018** — Guidelines for auditing management systems (audit evidence) - **AICPA Trust Services Criteria** (2017 + 2022 update) + SOC 2 Reporting Guide - **Regulation (EU) 2024/1689** — AI Act - **Regulation (EU) 2017/745** — EU MDR - **Regulation (EU) 2016/679** — GDPR - **Regulation (EU) 2022/2555** — NIS2 Directive - **NIST Cybersecurity Framework 2.0** + NIST SP 800-53A Rev 5 assessment procedures - **HIPAA 45 CFR Parts 160 + 164** — Security + Privacy + Breach Notification Rules - **FDA 21 CFR 820** — Quality System Regulation - **ISO 13485:2016** + ISO 14971:2019 - **IIA International Professional Practices Framework** — Performance Standards on engagement records (2330) - **DAMA-DMBOK 2** — Data Management Body of Knowledge (provenance + quality dimensions) - **NIST SP 800-92** — Guide to Computer Security Log Management (retention + integrity) - **Industry retrospectives** — Big 4 + Schellman + Coalfire + A-LIGN published findings on common audit exceptions FILE:references/evidence_management.md # Evidence Management — Unified Pool + Reuse Leverage This reference answers exactly one decision: **how do we collect compliance evidence once and satisfy multiple frameworks, without losing audit-grade traceability?** Pair with `scripts/evidence_pool_generator.py` for the deterministic evidence catalogue. ## The Evidence Reuse Problem Most multi-framework compliance programs accidentally collect the same evidence multiple times. Each framework's auditor wants: - A documented procedure (the "what should happen") - Records that the procedure was followed (the "what actually happened") - Evidence of management oversight (the "did anyone check?") When ISO 27001, SOC 2, and ISO 42001 audits ask for "access review records," teams often produce three different exports of the same Okta data with different formatting because three different control owners assembled them. The fix: a **unified evidence pool** with explicit (artefact, framework, control) mapping. Collect once; cite multiple times. ## The Reuse-Leverage Score Every evidence artefact gets a **reuse-leverage score** = number of distinct (framework, control) tuples it satisfies. Higher score = higher priority to build first. From the `evidence_pool_generator.py` curated catalogue, the top-leverage artefacts (when all 9 frameworks are enabled): | Artefact | Leverage | |---|---| | Risk register | 9+ mappings | | Supplier inventory + reviews + DPAs | 8+ | | Incident log + post-mortems + notifications | 11+ | | Data inventory + provenance + consent | 9+ | | Policy set (AI + info-sec + privacy + code-of-conduct) | 8+ | | Tamper-evident logs centralized | 7+ | | Training records | 6+ | **Implementation order:** build high-leverage artefacts first. The risk register alone unlocks evidence for 9+ controls across 4+ frameworks. ## Evidence Acquisition Cost The catalogue tracks acquisition cost per artefact: low / medium / high. | Cost | Examples | Time to build | |---|---|---| | **Low** | Quarterly access review records, change records, management review records | 1-2 weeks (often automated from existing IT systems) | | **Medium** | Asset register, supplier inventory, training records, crypto records, vuln scans | 2-6 weeks (requires inventory + classification) | | **High** | Risk register, BCP/DR exercises, data inventory + consent register, secure SDLC | 6-12 weeks (requires cross-functional process design) | **Strategy:** in year 1, prioritize low-cost high-leverage artefacts (e.g., management review records, change records). Build high-cost high-leverage artefacts in parallel (risk register, data inventory). ## Retention by Framework Retention requirements vary per framework. Use the longest applicable retention: | Framework | Typical retention | |---|---| | ISO 27001 | 3 years for audit evidence (or as policy specifies) | | SOC 2 | 1 year minimum; 3 years recommended | | ISO 42001 | 3 years (Clause 7.5 documented information) | | EU AI Act | 10 years for declaration of conformity (Article 18); other docs 6 years | | GDPR | Varies by data type; data subject records 3 years; breach records indefinite | | ISO 13485 | Lifecycle of device + period defined by regulator (often 5+ years) | | EU MDR | Device lifetime + 10 years (Article 10) | | FDA QSR | 2 years past commercial distribution (21 CFR 820.180) | **Default policy:** 36 months for most artefacts; 60 months for personal-data and policy-set artefacts; 120 months for EU AI Act declarations of conformity. ## Evidence Freshness Auditors want recent evidence, not stale. Freshness expectations: - Operational records (access reviews, change records, incident records): within last 90-180 days - Quarterly artefacts: at least 1 record from current quarter - Annual artefacts (training records, supplier reviews, BCP exercises): within last 12 months - Policies: reviewed annually (review records demonstrate freshness) **Stale evidence = effective gap.** An ISO 27001 A.5.15 quarterly access review that was last conducted 8 months ago is a major nonconformity even if the review existed historically. ## Evidence Owner Assignment Each artefact has a primary owner. Typical pattern: | Artefact type | Primary owner | Secondary | |---|---|---| | Access reviews | IT / Security | Compliance | | Asset register | Security | DPO | | Risk register | Compliance officer | Risk manager | | Supplier inventory | Procurement | Compliance + DPO | | Incident log | Security / IR team | Compliance | | Logs (centralized) | Platform / SRE | Security | | Change records | Engineering / Platform | Compliance | | BCP/DR | Platform / SRE | Compliance | | Training records | HR / People Ops | Compliance | | Data inventory + consent | DPO / Data team | Engineering | | Internal audit records | Compliance officer | Internal auditor | | Management review records | Compliance officer + Exec | All function heads | | Policy set | Compliance officer + Exec | All policy owners | | Crypto records | Security | Platform | | Vuln scans + patches | Security | Engineering | **Single accountable owner per artefact** is critical. Joint ownership without accountability is the most common cause of stale evidence. ## Evidence Storage Architecture Patterns observed in mature programs: 1. **GRC platform (Drata, Vanta, OneTrust, Hyperproof, etc.)** — the most common pattern; integrates with operational tools (Okta, AWS, GitHub) and auto-pulls evidence. Centralizes audit-trail. 2. **Compliance-team-managed repository** — folder per framework with subdivision per control; manual evidence assembly. Works for small programs; doesn't scale. 3. **Hybrid** — automated evidence (logs, access reviews, change records) in GRC platform; manual evidence (policies, management review minutes, training records) in document management system. Most common at growth-stage. Compliance OS does not prescribe a storage pattern — but it does require: - Single index of evidence (the unified pool) - Per-evidence audit trail (who created, who approved, when) - Per-evidence retention timer - Per-evidence freshness alert ## Evidence Pool Quality Indicators Healthy pool: | Indicator | Healthy value | |---|---| | Average reuse leverage | ≥ 4 | | Stale evidence (past expected freshness) | 0% | | Orphan controls (no evidence assigned) | 0 | | Unowned artefacts | 0 | | Retention compliance | 100% | Unhealthy pool: - Many low-leverage artefacts (each satisfies only 1 framework) — likely silo'd collection - High stale rate — operational discipline broken - Orphan controls — gap in coverage that will surface at next audit ## Evidence Pool Audit (the meta-audit) Once a year, audit the evidence pool itself: 1. Sample 10% of artefacts; verify they exist + are owned + are fresh 2. Sample 10% of controls; verify each has at least one evidence artefact assigned 3. Verify retention compliance — look for old evidence that should be deleted (GDPR retention) and recent evidence that should be retained longer 4. Verify framework coverage — are all enabled frameworks adequately represented? This audit-of-audit is the most underappreciated discipline in mature multi-framework programs. ## When This Reference Doesn't Help - **Specific GRC platform configuration.** Tooling-specific; market evolves rapidly. - **Evidence retention for novel data types (e.g., AI training data).** Sector-specific; engage counsel. - **Cross-framework specific mapping.** See `cross_framework_overlap.md`. --- **Source authorities (non-exhaustive):** - **ISO/IEC 27001:2022 Clause 7.5** — Documented information requirements - **ISO/IEC 42001:2023 Clause 7.5** — AI-specific documented information - **AICPA AT-C 205** — Examination engagements (SOC 2 evidence standards) - **NIST SP 800-53A Rev 5** — Assessing Security and Privacy Controls (per-control evidence types) - **NIST SP 800-92** — Guide to Computer Security Log Management - **ISO/IEC 19011:2018 Clause 6.4** — Conducting audit activities (evidence collection) - **IIA IPPF Performance Standard 2330** — Documenting Information (engagement records) - **GDPR Article 30** — Records of processing activities (retention + evidence) - **EU AI Act Article 18** — Document retention (10 years post-market for declaration of conformity) - **FDA 21 CFR 820.180** — General requirements for records (2 years past commercial distribution) - **DAMA-DMBOK 2** — Data Management Body of Knowledge (data-quality + provenance frameworks) FILE:references/multi_framework_audit_playbook.md # Multi-Framework Audit Playbook — Orchestrating Audits Across N Frameworks This reference answers exactly one decision: **when 2+ frameworks operate simultaneously, how do we run audits in coordinated cycles with minimal duplication?** Pair with `scripts/audit_simulator.py` (multi-framework mock audits) + the per-framework audit playbooks (`isms-audit-expert/references/iso27001_audit_playbook.md`, `qms-audit-expert/references/iso13485_audit_playbook.md`, `gdpr-dsgvo-expert/references/gdpr_audit_playbook.md`, `soc2-compliance/references/soc2_audit_playbook.md`). ## The Multi-Framework Audit Problem Mature multi-framework programs face four orchestration challenges: 1. **Audit calendar conflicts** — surveillance audits stacking in same week, insufficient auditor capacity 2. **Auditor independence across frameworks** — same internal auditor pulled to audit own work in a different framework 3. **Evidence freshness mismatch** — Audit A wants Q3 data; Audit B (3 months later) wants same control's Q3+Q4 data 4. **Finding cross-impact** — a critical finding in ISO 27001 audit triggers compensating questions in SOC 2 audit This playbook describes the integrated audit programme (IAP) pattern that solves these. ## The Integrated Audit Programme ``` Annual Compliance Calendar | ┌─────────────────────┼─────────────────────┐ | | | Q1: ISO 27001 Q2: ISO 42001 Q3: ISO 13485 internal audit internal audit internal audit (auditor pool A) (auditor pool B) (auditor pool A) | Q4: Integrated Management Review (Clause 9.3 across all frameworks) | External surveillance audits scheduled by certification body ``` The IAP coordinates: - **Single audit programme document** covering all applicable frameworks - **Single auditor pool** with skill-based + independence-based assignment - **Single evidence pool** (per `evidence_pool_generator.py`) so audits cite shared evidence - **Single management review** (per Annex SL) covering all frameworks' Clause 9.3 inputs ## The 12-Month Calendar Pattern A typical mid-stage AI SaaS running ISO 27001 + SOC 2 + ISO 42001 + GDPR + EU AI Act: | Quarter | Activity | Frameworks audited internally | |---|---|---| | **Q1** | ISO 27001 internal audit + SOC 2 Type II observation begins | 27001 + SOC 2 | | **Q2** | ISO 42001 internal audit + EU AI Act readiness checkpoint | 42001 + AI Act | | **Q3** | GDPR annual review + SOC 2 mid-period checkpoint | GDPR + SOC 2 | | **Q4** | Integrated management review + SOC 2 Type II field + cert body surveillance audits | all | External audits (certification body + SOC 2 audit firm) typically: - Q1: ISO 27001 surveillance audit (timed to follow Q1 internal audit) - Q3: SOC 2 Type II field testing (timed for Q4 report) - Q4: ISO 42001 surveillance audit (timed to follow Q2 + Q4 internal audits) ## Auditor Independence Across Frameworks ISO management-system standards (Clause 9.2 across 27001 / 42001 / 13485) all require auditor independence: nobody audits their own work. With multiple frameworks running, independence must be tracked **across** frameworks, not just within. **Pattern:** maintain an auditor competence + independence matrix: | Auditor | Owns (cannot audit) | Competent to audit | |---|---|---| | Alice | 27001 A.5.15 (access control); 42001 A.4.4 | 27001 except A.5.15; 42001 except A.4.4; all GDPR; all SOC 2 | | Bob | 42001 A.6 (lifecycle); 13485 7.3 (design) | 27001; GDPR; SOC 2 | | Carol (external) | (none — independent contractor) | All frameworks | | Dave | 27001 A.5.19 (suppliers); GDPR Article 28 | 27001 except A.5.19; 42001; SOC 2; 13485 | Use `aims_audit_scheduler.py` (ISO 42001) + per-framework scheduler patterns to enforce independence. ## Cross-Framework Finding Impact A finding in one framework's audit often affects another. Pattern: - **ISO 27001 A.5.15 finding** → likely SOC 2 CC6.1 finding (same evidence) - **ISO 27001 A.5.19-21 finding** → likely SOC 2 CC9.2 finding + GDPR Article 28 finding - **ISO 42001 Annex A.7.6 finding** → likely GDPR Article 35 DPIA finding - **ISO 13485 Clause 7.3 finding** → likely EU MDR Annex II finding - **GDPR Article 33 breach** → triggers ISO 27001 A.5.24 audit + EU AI Act Article 73 review **Discipline:** when a finding is issued, the issuing auditor flags cross-framework impact in the finding worksheet. The compliance officer reviews and triggers corresponding follow-up across frameworks. ## Shared Evidence Discipline Per `evidence_management.md`, the evidence pool has unified artefacts. Audit work cites these artefacts, not framework-specific copies. **Anti-pattern:** ``` ISO 27001 audit asks for: "ISO 27001 access review records Q3" SOC 2 audit asks for: "SOC 2 access review records Q3" Team produces TWO documents from same Okta export. ``` **Pattern:** ``` Both audits cite: "ev.access_review_quarterly Q3 2026" (single artefact) Audit reports reference the shared artefact ID + framework-control mapping. ``` The audit report shows the auditor consulted the same evidence; framework-specific formatting happens in report assembly. ## Integrated Management Review (Clause 9.3 Across Frameworks) Each management-system standard (27001, 42001, 13485, etc.) requires its own management review with prescribed inputs + outputs. Running 4 separate management reviews per year is unsustainable. **Per Annex SL** (the high-level structure shared across ISO management-system standards), a single integrated management review can satisfy all of them if inputs cover every framework's prescribed list. Required inputs across the 5 most-common frameworks: | Input | 27001 | 42001 | 13485 | 14001 | 9001 | |---|---|---|---|---|---| | Audit results | ✅ | ✅ | ✅ | ✅ | ✅ | | Feedback from interested parties | ✅ | ✅ | ✅ | ✅ | ✅ | | Risk + opportunity changes | ✅ | ✅ | ✅ | ✅ | ✅ | | Performance of processes | ✅ | ✅ | ✅ | ✅ | ✅ | | Nonconformities + CAPA | ✅ | ✅ | ✅ | ✅ | ✅ | | Improvement opportunities | ✅ | ✅ | ✅ | ✅ | ✅ | | AI-specific (drift, incidents, lifecycle) | — | ✅ | — | — | — | | Customer feedback + complaints | — | ✅ | ✅ | — | ✅ | | Resource needs | ✅ | ✅ | ✅ | ✅ | ✅ | Outputs are similarly aligned: decisions on improvement, resource changes, scope adjustments, policy changes. **Cadence:** annual minimum; quarterly preferred for mature multi-framework programs. ## Pre-Audit Readiness Checklist (per framework) Universal pre-audit readiness (apply to each framework's internal audit): - [ ] Scope confirmed (clauses + controls + business units in scope) - [ ] Auditor independence verified (no self-audit; competence covers scope) - [ ] Prior-year findings open list pulled + status reviewed - [ ] Document evidence assembled in advance (auditor reads pre-fieldwork) - [ ] Auditee leadership briefed; team availability confirmed - [ ] Mock audit run via `audit_simulator.py` to surface likely findings - [ ] Cross-framework impact considered (which findings might cascade) - [ ] Audit plan circulated 2 weeks ahead ## Post-Audit Disciplines - Findings logged in unified CAPA system (not framework-siloed) - Corrective action owner named; due date agreed - Cross-framework impact flagged in finding worksheet - Closure verified by evidence + re-test (not self-attestation) - Trend analysis monthly: aging CAPAs > 30 days, repeat findings across frameworks - Inputs prepared for next management review ## When This Reference Doesn't Help - **Single-framework deep audit detail.** See per-framework playbooks. - **External certification body audit process.** Different from internal; see ISO 17021. - **External SOC 2 audit firm engagement.** Different from internal; see `soc2_audit_playbook.md`. - **Sectoral regulatory enforcement.** Out of scope; engage outside counsel. --- **Source authorities (non-exhaustive):** - **ISO/IEC 19011:2018** — Guidelines for auditing management systems - **IIA International Professional Practices Framework (IPPF)** — Performance Standards 2000-2600 - **AICPA AT-C 105** — Attestation engagement standard (SOC 2) - **ISO/IEC 27001:2022 Clause 9.2** — Internal audit programme - **ISO/IEC 42001:2023 Clause 9.2** — Internal audit programme (AI management system) - **ISO 13485:2016 Clause 8.2.4** — Internal audit (medical devices) - **Regulation (EU) 2016/679 Article 24** — Accountability (GDPR — operational discipline for audit prep) - **ISO 17021-1:2015** — Conformity assessment requirements (governs external certification audits; informs internal practice) - **Annex SL of the ISO/IEC Directives** (2024) — high-level structure enabling integrated management systems - **NIST SP 800-53A Rev 5** — Assessing Security and Privacy Controls (multi-framework assessment procedures) - **The Institute of Internal Auditors** — practical guides on integrated audit programme design FILE:scripts/audit_simulator.py #!/usr/bin/env python3 """audit_simulator.py — Mock internal audit generator per ISO 19011 + IIA IPPF. Stdlib-only. Given a framework + scope, generates a realistic mock audit with: - 8-15 finding scenarios per typical ISO 19011 audit depth - Severity distribution matching IIA expectations: observation/OFI: ≥ 40% minor: 20-30% major: 15-25% critical: ≤ 15% - 3-5 interview questions per scoped control - Document-review request list - Walk-through scenarios where applicable Deterministic generation from finding templates. Severity distribution is proportional to the scope size. No randomness, no LLM calls. Input schema (JSON): { "audit_name": "Q3 ISO 27001 internal audit — Platform team", "framework": "iso_27001", "scope_controls": ["A.5.15", "A.8.2", "A.8.15", "A.8.32", "A.5.19"], "auditee_team": "Platform engineering", "prior_year_findings_open": 2 } Usage: python audit_simulator.py python audit_simulator.py path/to/audit_scope.json python audit_simulator.py audit_scope.json --output json """ import argparse import json import sys from typing import Any, Dict, List SAMPLE: Dict[str, Any] = { "audit_name": "Q3 ISO 27001 internal audit — Platform team", "framework": "iso_27001", "scope_controls": ["A.5.15", "A.8.2", "A.8.15", "A.8.32", "A.5.19", "A.5.24", "A.6.8"], "auditee_team": "Platform engineering", "prior_year_findings_open": 2, } # Finding template library (theme -> {severity bucket -> finding patterns}) # Each template produces a finding scenario when invoked. FINDING_TEMPLATES: Dict[str, Dict[str, List[str]]] = { "access_control": { "critical": [ "Privileged access reviewed annually instead of quarterly; orphaned accounts found in production.", ], "major": [ "Quarterly access review evidence present but lacks documented business justification for retained privileges.", "Joiner-mover-leaver workflow does not auto-deprovision on termination; manual gap of 5+ days observed.", ], "minor": [ "Access review records lack documented review-completion timestamps in 2 of 6 sampled reviews.", ], "observation": [ "Consider extending RBAC matrix to include cloud-resource scope (currently application-tier only).", ], }, "logging_monitoring": { "critical": [ "Production application logs disabled in past 30 days; no detection of the gap until audit fieldwork.", ], "major": [ "Log retention configured at 90 days but framework requires 12 months; misalignment not detected.", "Tamper-evident logging not enforced on privileged-user activity logs.", ], "minor": [ "Monitoring alert thresholds not formally documented; reviewed verbally by SRE only.", ], "observation": [ "Centralized log aggregation in place; consider adding anomaly detection.", ], }, "change_management": { "critical": [ "Emergency change procedure not formalized; observed 3 cases of production changes without recorded approval.", ], "major": [ "Change advisory board records show approvals but no post-implementation review of high-risk changes.", ], "minor": [ "Rollback procedure documented but not tested for 2 services in scope.", ], "observation": [ "Consider linking change records to deployment automation for stronger evidence chain.", ], }, "supplier_mgmt": { "critical": [ "Critical SaaS supplier in use without signed DPA + security questionnaire (GDPR exposure).", ], "major": [ "Annual supplier security review not completed for 3 of 8 critical suppliers.", "Sub-processor list not maintained for critical suppliers handling personal data.", ], "minor": [ "Supplier onboarding checklist exists but not consistently applied across business units.", ], "observation": [ "Consider centralizing supplier risk evidence in a single GRC system.", ], }, "incident_response": { "critical": [ "Recent P1 incident lacks documented post-incident review (PIR) within 30-day SLA.", ], "major": [ "Severity definitions documented but inconsistently applied across teams; impact varies.", "Notification SLAs not aligned across frameworks (GDPR 72h, framework X 24h, framework Y 15 days).", ], "minor": [ "Incident commander rotation not documented.", ], "observation": [ "Consider quarterly tabletop exercises to validate runbooks.", ], }, } # Control -> theme mapping (heuristic; deterministic) CONTROL_TO_THEME: Dict[str, str] = { # ISO 27001 mapping "A.5.15": "access_control", "A.8.2": "access_control", "A.8.3": "access_control", "A.5.19": "supplier_mgmt", "A.5.20": "supplier_mgmt", "A.5.21": "supplier_mgmt", "A.5.22": "supplier_mgmt", "A.5.24": "incident_response", "A.5.25": "incident_response", "A.5.26": "incident_response", "A.5.27": "incident_response", "A.6.8": "incident_response", "A.8.15": "logging_monitoring", "A.8.16": "logging_monitoring", "A.8.32": "change_management", # SOC 2 mapping "CC6.1": "access_control", "CC6.2": "access_control", "CC6.3": "access_control", "CC9.2": "supplier_mgmt", "CC7.3": "incident_response", "CC7.4": "incident_response", "CC7.5": "incident_response", "CC7.1": "logging_monitoring", "CC7.2": "logging_monitoring", "CC8.1": "change_management", # ISO 42001 mapping "A.4.4": "access_control", "A.9.3": "logging_monitoring", "A.9.4": "logging_monitoring", "A.6.2.5": "change_management", "A.10.2": "supplier_mgmt", "A.8.4": "incident_response", } def _severity_rotation() -> List[str]: return [ "observation", "observation", "observation", "minor", "major", "observation", "minor", "observation", "major", "critical", "minor", "observation", "minor", "observation", "major", ] def generate_findings(payload: Dict[str, Any]) -> List[Dict[str, Any]]: """Generate finding scenarios deterministically from scope.""" findings: List[Dict[str, Any]] = [] scope = payload.get("scope_controls", []) prior_open = payload.get("prior_year_findings_open", 0) # Rotate severities to hit IIA-target distribution # Target: >= 40% observation, ~25% minor, ~20% major, <= 15% critical severity_order = _severity_rotation() # Pad if scope is large while len(severity_order) < len(scope) + 5: severity_order += severity_order for idx, control in enumerate(scope): theme = CONTROL_TO_THEME.get(control) if theme is None: continue severity = severity_order[idx] # If prior_open > 0, force first finding to be major (follow-up) if idx == 0 and prior_open > 0: severity = "major" templates = FINDING_TEMPLATES.get(theme, {}).get(severity, []) if not templates: severity = "observation" templates = FINDING_TEMPLATES.get(theme, {}).get("observation", ["General observation noted."]) finding_text = templates[idx % len(templates)] findings.append({ "id": f"F-{idx + 1:02d}", "control": control, "theme": theme, "severity": severity, "description": finding_text, "follow_up_from_prior": idx == 0 and prior_open > 0, }) # Add 3-6 additional observations to hit 10-15 total range per ISO 19011 typical depth extras_needed = max(0, 10 - len(findings)) extras_added = 0 for theme in FINDING_TEMPLATES: if extras_added >= extras_needed: break if not any(f["theme"] == theme for f in findings): continue templates = FINDING_TEMPLATES[theme]["observation"] findings.append({ "id": f"F-{len(findings) + 1:02d}", "control": "(general)", "theme": theme, "severity": "observation", "description": templates[(extras_added + 1) % len(templates)], "follow_up_from_prior": False, }) extras_added += 1 return findings def interview_questions(control: str) -> List[str]: """Deterministic 3-5 audit interview questions per control theme.""" theme = CONTROL_TO_THEME.get(control) bank = { "access_control": [ "Walk me through how a new joiner gets access provisioned.", "Show me the last quarterly access review evidence for a privileged role.", "What happens within 24 hours of a termination?", "How is multi-factor authentication enforced for admin access?", ], "logging_monitoring": [ "Show me a sample log entry for a privileged action in the last 30 days.", "What's the log retention configuration, and where is it documented?", "How are tampering attempts detected and alerted?", "Show me a monitoring alert that fired in the last 7 days and how it was triaged.", ], "change_management": [ "Walk me through the change approval workflow for a production deployment.", "Show me a rejected change in the last quarter and the rejection rationale.", "Where is the rollback procedure for service X documented and last tested?", "How are emergency changes handled differently from standard changes?", ], "supplier_mgmt": [ "Show me the supplier inventory and the last review date for 3 critical suppliers.", "How are AI-specific contractual clauses tracked for AI service suppliers?", "Walk me through onboarding of a new critical SaaS supplier.", "Show me where signed DPAs are stored for personal-data sub-processors.", ], "incident_response": [ "Show me the last 3 incidents with severity, root cause, and corrective action.", "Walk me through your serious-incident reporting timing for GDPR + AI Act.", "Where are post-incident reviews documented and tracked to closure?", "How is the on-call rotation defined and communicated?", ], } return bank.get(theme, [ "Walk me through how this control is implemented day-to-day.", "Show me records of the control being operated in the last 90 days.", "How is effectiveness of this control measured?", ]) def document_requests(scope: List[str]) -> List[str]: themes = {CONTROL_TO_THEME.get(c) for c in scope if CONTROL_TO_THEME.get(c)} docs = [] for t in themes: if t == "access_control": docs.append("Access control policy + last 2 quarterly access reviews + RBAC matrix") elif t == "logging_monitoring": docs.append("Logging policy + log retention configuration + last 30 days of sample privileged-action logs") elif t == "change_management": docs.append("Change management procedure + last 90 days change records + rollback procedure") elif t == "supplier_mgmt": docs.append("Supplier inventory + last annual supplier reviews + 3 sample DPAs") elif t == "incident_response": docs.append("Incident response procedure + last 5 incident records + post-incident reviews") return docs def analyze(payload: Dict[str, Any]) -> Dict[str, Any]: findings = generate_findings(payload) by_sev: Dict[str, int] = {"critical": 0, "major": 0, "minor": 0, "observation": 0} for f in findings: by_sev[f["severity"]] += 1 total = len(findings) obs_pct = round((by_sev["observation"] / total) * 100, 1) if total else 0 crit_pct = round((by_sev["critical"] / total) * 100, 1) if total else 0 healthy = (obs_pct >= 40) and (crit_pct <= 15) return { "audit_name": payload.get("audit_name"), "framework": payload.get("framework"), "scope_controls": payload.get("scope_controls", []), "auditee_team": payload.get("auditee_team"), "findings_total": total, "findings_by_severity": by_sev, "severity_distribution_healthy": healthy, "obs_pct": obs_pct, "crit_pct": crit_pct, "findings": findings, "interview_questions_per_control": {c: interview_questions(c) for c in payload.get("scope_controls", [])}, "document_review_requests": document_requests(payload.get("scope_controls", [])), } def render_text(r: Dict[str, Any], source: str) -> str: lines = [] lines.append("=" * 72) lines.append("COMPLIANCE OS — MOCK INTERNAL AUDIT (per ISO 19011 + IIA IPPF)") lines.append(f"Source: {source}") lines.append("=" * 72) lines.append("") lines.append(f"Audit: {r['audit_name']}") lines.append(f"Framework: {r['framework']} | Auditee: {r['auditee_team']}") lines.append(f"Scope controls ({len(r['scope_controls'])}): {', '.join(r['scope_controls'])}") lines.append("") s = r["findings_by_severity"] lines.append(f"Findings total: {r['findings_total']} " f"(critical={s['critical']}, major={s['major']}, minor={s['minor']}, observation={s['observation']})") lines.append(f"Distribution: observation={r['obs_pct']}% critical={r['crit_pct']}% " f"healthy={r['severity_distribution_healthy']}") lines.append("") lines.append("-" * 72) lines.append("FINDINGS:") lines.append("") for f in r["findings"]: marker = "🔥 FOLLOW-UP" if f["follow_up_from_prior"] else "" lines.append(f" [{f['id']}] [{f['severity'].upper():12s}] control={f['control']:12s} theme={f['theme']:20s} {marker}") lines.append(f" {f['description']}") lines.append("") lines.append("-" * 72) lines.append("INTERVIEW QUESTIONS PER CONTROL:") for ctrl, qs in r["interview_questions_per_control"].items(): lines.append(f" {ctrl}:") for q in qs: lines.append(f" - {q}") lines.append("") lines.append("-" * 72) lines.append("DOCUMENT-REVIEW REQUESTS:") for d in r["document_review_requests"]: lines.append(f" - {d}") lines.append("") lines.append("-" * 72) lines.append("HEALTHY-DISTRIBUTION RULE (IIA expectations):") lines.append(" observation/OFI ≥ 40% AND critical ≤ 15%") return "\n".join(lines) def main() -> int: parser = argparse.ArgumentParser( description="Mock internal audit generator per ISO 19011 + IIA IPPF + AICPA AT-C.", formatter_class=argparse.RawDescriptionHelpFormatter, epilog=__doc__, ) parser.add_argument("path", nargs="?", help="Path to audit scope JSON (uses embedded sample if omitted)") parser.add_argument("--output", choices=("text", "json"), default="text", help="Output format") args = parser.parse_args() if args.path: try: with open(args.path, "r", encoding="utf-8") as f: payload = json.load(f) source = args.path except (IOError, OSError) as e: print(f"error: could not read {args.path}: {e}", file=sys.stderr) return 1 except json.JSONDecodeError as e: print(f"error: invalid JSON in {args.path}: {e}", file=sys.stderr) return 1 else: payload = SAMPLE source = "" result = analyze(payload) if args.output == "json": print(json.dumps({"source": source, **result}, indent=2)) else: print(render_text(result, source)) return 0 if __name__ == "__main__": sys.exit(main()) FILE:scripts/cross_framework_mapper.py #!/usr/bin/env python3 """cross_framework_mapper.py — Multi-framework control overlap computation. Stdlib-only. Takes 1+ framework control libraries (control IDs + categories) and computes overlap with mapping confidence (HIGH/MEDIUM/LOW) using a curated ground-truth overlap dictionary distilled from published cross-walks: - ISO 27001 Annex A <-> SOC 2 TSC (the densest known pair) - ISO 27001 <-> ISO 42001 (info-sec reuse for AIMS) - ISO 42001 <-> EU AI Act (Article 17 QMS satisfaction) - GDPR <-> ISO 27001 (privacy controls overlap) - ISO 13485 <-> FDA QSR (harmonised) For each merged control, outputs the participating frameworks + a unified evidence-requirement statement that satisfies all of them. Deterministic ground-truth lookup. No LLM calls. No external dependencies. Input schema (JSON): { "program": "Acme AI Inc. Compliance Program", "enabled_frameworks": ["iso_27001", "soc_2", "iso_42001", "eu_ai_act", "gdpr"] } Usage: python cross_framework_mapper.py # uses embedded 5-framework sample python cross_framework_mapper.py path/to/program.json python cross_framework_mapper.py program.json --output json """ import argparse import json import sys from typing import Any, Dict, List, Set SAMPLE: Dict[str, Any] = { "program": "Acme AI Inc. Compliance Program", "enabled_frameworks": [ "iso_27001", "soc_2", "iso_42001", "eu_ai_act", "gdpr", "nist_csf", "nis2", "hipaa", ], } # Curated overlap database # Each merged control: id, theme, evidence requirement, and per-framework mapping # Mappings: framework_id -> (control_id, confidence) # Confidence: H (high - same evidence satisfies), M (medium - evidence with overlay), L (low - concept overlap only) MERGED_CONTROLS: List[Dict[str, Any]] = [ { "id": "mc.access_control", "theme": "Access control (identity, authentication, authorization)", "evidence": "Documented access-control policy + access provisioning/de-provisioning procedure + quarterly access review records + RBAC matrix", "mappings": { "iso_27001": ("A.5.15 + A.8.2 + A.8.3", "H"), "soc_2": ("CC6.1 + CC6.2 + CC6.3", "H"), "iso_42001": ("A.4.4 (human resources for AI systems)", "M"), "gdpr": ("Article 32(1)(b) integrity and confidentiality", "M"), "nist_csf": ("PR.AA-01 + PR.AA-03 + PR.AA-05 (identities + authentication + authorization)", "H"), "nis2": ("Article 21(2)(i) access control policies", "M"), "hipaa": ("§164.308(a)(3) workforce security + §164.308(a)(4) information access management + §164.312(a)(1) access control", "H"), }, }, { "id": "mc.asset_inventory", "theme": "Asset inventory and classification", "evidence": "Asset register including AI systems + data classification scheme + ownership map", "mappings": { "iso_27001": ("A.5.9 + A.5.10 + A.5.12", "H"), "soc_2": ("CC6.1 + CC3.2", "H"), "iso_42001": ("A.4.2 (data) + A.4.3 (tooling)", "H"), "gdpr": ("Article 30 (records of processing activities)", "M"), "nist_csf": ("ID.AM-01 + ID.AM-02 + ID.AM-04 + ID.AM-05 (assets inventoried + classified)", "H"), "nis2": ("Article 21(2)(b) policies on the use of risk-management measures (implicit: know your assets)", "M"), "hipaa": ("§164.308(a)(1)(ii)(A) risk analysis (requires asset inventory) + §164.310(d) device + media controls", "M"), }, }, { "id": "mc.risk_management", "theme": "Risk management process", "evidence": "Risk methodology + risk register with severity matrix + risk treatment plan + residual-risk acceptance signoff", "mappings": { "iso_27001": ("Clause 6.1 + Clause 8.2", "H"), "soc_2": ("CC3.1 + CC3.2 + CC3.4", "H"), "iso_42001": ("Clause 6.1.2 + A.5", "H"), "eu_ai_act": ("Article 9 (risk management system)", "M"), "gdpr": ("Article 35 (DPIA where applicable)", "M"), "nist_csf": ("GV.RM (risk management strategy) + ID.RA (risk assessment) + ID.IM (improvement)", "H"), "nis2": ("Article 21(2)(a) risk analysis + Article 21(2)(b) policies on risk-management measures", "H"), "hipaa": ("§164.308(a)(1)(ii)(A) risk analysis + §164.308(a)(1)(ii)(B) risk management", "H"), }, }, { "id": "mc.supplier_management", "theme": "Third-party / supplier risk management", "evidence": "Supplier inventory + due-diligence questionnaires + contractual security/privacy/AI clauses + periodic review records", "mappings": { "iso_27001": ("A.5.19 + A.5.20 + A.5.21 + A.5.22", "H"), "soc_2": ("CC9.2", "H"), "iso_42001": ("A.10.2 + A.10.6", "H"), "eu_ai_act": ("Article 25 (responsibilities along the AI value chain)", "M"), "gdpr": ("Article 28 (processor obligations)", "H"), "nist_csf": ("GV.SC (cybersecurity supply chain risk management) + ID.SC", "H"), "nis2": ("Article 21(2)(d) supply-chain security including security-related aspects of relationships with direct suppliers", "H"), "hipaa": ("§164.308(b)(1) business associate contracts + §164.314(a) organizational requirements (BAAs)", "H"), }, }, { "id": "mc.incident_response", "theme": "Incident response + notification", "evidence": "Documented incident response procedure + severity definitions + escalation matrix + notification SLAs + post-incident reviews", "mappings": { "iso_27001": ("A.5.24 + A.5.25 + A.5.26 + A.5.27 + A.6.8", "H"), "soc_2": ("CC7.3 + CC7.4 + CC7.5", "H"), "iso_42001": ("A.8.4 (communication of AI incidents)", "M"), "eu_ai_act": ("Article 73 (serious-incident reporting)", "M"), "gdpr": ("Articles 33 + 34 (breach notification)", "H"), "nist_csf": ("RS.MA + RS.AN + RS.RP + RS.CO (response: management, analysis, reporting, communication)", "H"), "nis2": ("Article 23 incident notification (24h early warning / 72h notification / 1-month final report)", "H"), "hipaa": ("§164.308(a)(6) security incident procedures + §164.400-414 Breach Notification Rule", "H"), }, }, { "id": "mc.monitoring_logging", "theme": "Monitoring + logging", "evidence": "Logging policy + tamper-evident logs + monitoring dashboards + retention compliant with longest applicable framework", "mappings": { "iso_27001": ("A.8.15 + A.8.16", "H"), "soc_2": ("CC7.1 + CC7.2", "H"), "iso_42001": ("A.9.3 + A.9.4", "M"), "eu_ai_act": ("Article 12 (logging) + Article 72 (post-market monitoring)", "M"), "nist_csf": ("DE.CM (continuous monitoring) + DE.AE (anomalies + events)", "H"), "nis2": ("Article 21(2)(h) human resources security + ongoing monitoring expectations", "M"), "hipaa": ("§164.308(a)(1)(ii)(D) information system activity review + §164.312(b) audit controls", "H"), }, }, { "id": "mc.change_management", "theme": "Change management (system + model)", "evidence": "Change approval workflow + version control + rollback procedure + change advisory board records", "mappings": { "iso_27001": ("A.8.32", "H"), "soc_2": ("CC8.1", "H"), "iso_42001": ("A.6.2.5 (deployment)", "M"), "nist_csf": ("PR.PS (platform security including change-mgmt) + ID.IM-03 (improvements identified)", "H"), "nis2": ("Article 21(2)(e) security in network and information systems acquisition, development and maintenance", "M"), "hipaa": ("§164.308(a)(5)(ii)(B) protection from malicious software (implies controlled change) + §164.312(a)(1) access control during change", "M"), }, }, { "id": "mc.business_continuity", "theme": "Business continuity and disaster recovery", "evidence": "BCP/DRP documents + tested recovery objectives (RPO/RTO) + annual exercises + lessons learned", "mappings": { "iso_27001": ("A.5.29 + A.5.30 + A.8.13 + A.8.14", "H"), "soc_2": ("A1.2 + A1.3", "H"), "nist_csf": ("RC.RP (recovery planning) + RC.IM + RC.CO + ID.BE-05 (resilience requirements)", "H"), "nis2": ("Article 21(2)(c) business continuity, such as backup management and disaster recovery, and crisis management", "H"), "hipaa": ("§164.308(a)(7) contingency plan (incl. data backup + disaster recovery + emergency mode operation)", "H"), }, }, { "id": "mc.competence_training", "theme": "Competence + awareness training", "evidence": "Competence requirements per role + training plan + completion records + effectiveness verification", "mappings": { "iso_27001": ("A.6.3", "H"), "soc_2": ("CC1.4 + CC2.2", "H"), "iso_42001": ("Clause 7.2 + Clause 7.3 + A.4.4", "H"), "eu_ai_act": ("Article 4 (AI literacy)", "M"), "nist_csf": ("PR.AT (awareness + training)", "H"), "nis2": ("Article 21(2)(g) basic cyber-hygiene practices and cybersecurity training", "H"), "hipaa": ("§164.308(a)(5) security awareness and training", "H"), }, }, { "id": "mc.data_governance", "theme": "Data governance + data quality", "evidence": "Data inventory + provenance records + quality metrics + retention/deletion schedule + consent/lawful-basis records", "mappings": { "iso_27001": ("A.5.34 (privacy)", "M"), "iso_42001": ("A.7 (full category)", "H"), "eu_ai_act": ("Article 10 (data governance for high-risk)", "H"), "gdpr": ("Articles 5 + 6 + 30", "H"), "nist_csf": ("PR.DS (data security) + ID.AM-07 (data inventories) + GV.PO (policy)", "H"), "nis2": ("Article 21(2)(j) policies and procedures (multi-factor + secure communications) implying data discipline", "M"), "hipaa": ("§164.312(c)(1) integrity + §164.502 uses and disclosures of PHI + §164.514 de-identification", "H"), }, }, { "id": "mc.internal_audit", "theme": "Internal audit programme", "evidence": "Annual audit plan + auditor independence + findings tracking + closure verification", "mappings": { "iso_27001": ("Clause 9.2", "H"), "soc_2": ("CC4.1", "H"), "iso_42001": ("Clause 9.2", "H"), "nist_csf": ("ID.IM (improvement processes including audits)", "M"), "nis2": ("Article 21(2)(b) policies on the use of risk-management measures (implies periodic audit)", "M"), "hipaa": ("§164.308(a)(1)(ii)(D) information system activity review + §164.308(a)(8) periodic evaluation", "H"), }, }, { "id": "mc.management_review", "theme": "Management review", "evidence": "Management review procedure + scheduled inputs + meeting records + action item tracking", "mappings": { "iso_27001": ("Clause 9.3", "H"), "iso_42001": ("Clause 9.3", "H"), "nist_csf": ("GV.OV (oversight) + GV.PO (organizational policy review)", "H"), "nis2": ("Article 20 governance: management bodies must approve cybersecurity risk-management measures and oversee implementation", "H"), "hipaa": ("§164.308(a)(2) assigned security responsibility + §164.308(a)(8) periodic evaluation by senior official", "M"), }, }, { "id": "mc.cryptography", "theme": "Cryptography and key management", "evidence": "Cryptographic policy + algorithm + key length standards + key rotation + HSM/KMS architecture + key custody records", "mappings": { "iso_27001": ("A.8.24", "H"), "soc_2": ("CC6.1 + CC6.7", "H"), "gdpr": ("Article 32(1)(a) pseudonymisation + encryption", "H"), "nist_csf": ("PR.DS-02 (data-in-transit) + PR.DS-01 (data-at-rest) + PR.PS-05 (cryptography)", "H"), "nis2": ("Article 21(2)(h) policies on the use of cryptography and, where appropriate, encryption", "H"), "hipaa": ("§164.312(a)(2)(iv) encryption + decryption (addressable) + §164.312(e)(2)(ii) transmission encryption", "H"), }, }, { "id": "mc.secure_sdlc", "theme": "Secure software development lifecycle", "evidence": "Secure SDLC policy + threat modeling + code review records + SAST/DAST scanning + vulnerability triage", "mappings": { "iso_27001": ("A.8.25 + A.8.26 + A.8.27 + A.8.28 + A.8.29 + A.8.30 + A.8.31", "H"), "soc_2": ("CC8.1 + CC7.1", "H"), "iso_42001": ("A.6.2.2 + A.6.2.3 + A.6.2.4 (AI-specific SDLC)", "M"), "nist_csf": ("PR.PS (platform security including secure development) + ID.RA-08 (vulnerabilities identified)", "H"), "nis2": ("Article 21(2)(e) security in network and information systems acquisition, development and maintenance", "H"), }, }, { "id": "mc.vulnerability_mgmt", "theme": "Vulnerability + patch management", "evidence": "Vulnerability scanning schedule + patch SLAs by severity + exception tracking + remediation evidence", "mappings": { "iso_27001": ("A.8.7 + A.8.8 + A.8.9", "H"), "soc_2": ("CC7.1 + CC7.2 + CC7.4", "H"), "nist_csf": ("ID.RA-01 + ID.RA-08 (vulnerabilities) + PR.PS-02 (patching)", "H"), "nis2": ("Article 21(2)(f) policies and procedures to assess the effectiveness of cybersecurity risk-management measures + vulnerability handling", "H"), "hipaa": ("§164.308(a)(5)(ii)(B) protection from malicious software + §164.308(a)(1)(ii)(A) periodic risk analysis (covers vulnerability identification)", "M"), }, }, { "id": "mc.physical_security", "theme": "Physical security and environmental controls", "evidence": "Facility access controls + visitor log + environmental monitoring + tamper-evident seals on critical assets", "mappings": { "iso_27001": ("A.7.1 + A.7.2 + A.7.3 + A.7.4 + A.7.5 + A.7.6 + A.7.7 + A.7.8", "H"), "soc_2": ("CC6.4 + CC6.5", "H"), "nist_csf": ("PR.AA-06 (physical access) + PR.PS-04 (physical resource security)", "H"), "hipaa": ("§164.310(a)(1) facility access controls + §164.310(b) workstation use + §164.310(c) workstation security + §164.310(d) device + media controls", "H"), }, }, { "id": "mc.data_protection_privacy", "theme": "Personal data protection (privacy by design)", "evidence": "Privacy policy + lawful-basis register + retention/deletion schedule + DPIA records + data-subject rights workflow + DPO appointment (where required)", "mappings": { "iso_27001": ("A.5.34", "H"), "iso_42001": ("A.7.6 (data privacy considerations)", "M"), "gdpr": ("Articles 5 + 6 + 24 + 25 + 30 + 35 + 38", "H"), "nist_csf": ("GV.PO + PR.DS (data security)", "M"), "hipaa": ("§164.502 uses and disclosures (Privacy Rule) + §164.520 notice of privacy practices + §164.530 administrative requirements", "H"), }, }, { "id": "mc.documentation_control", "theme": "Documented information control", "evidence": "Document control procedure + version control + approval workflow + retention + obsolete-doc handling", "mappings": { "iso_27001": ("Clause 7.5", "H"), "soc_2": ("CC4.1 + CC5.1", "H"), "iso_42001": ("Clause 7.5", "H"), "nist_csf": ("GV.PO (policy + documentation) + ID.AM-08 (system and data are documented)", "H"), "nis2": ("Article 21(1) documented cybersecurity risk-management measures", "H"), "hipaa": ("§164.316 policies, procedures, and documentation requirements (retention 6 years)", "H"), }, }, { "id": "mc.continual_improvement", "theme": "Continual improvement + CAPA", "evidence": "Nonconformity tracking + root-cause analysis + corrective action plans + effectiveness verification + trend analysis", "mappings": { "iso_27001": ("Clause 10.1 + 10.2", "H"), "soc_2": ("CC4.1 + CC4.2 + CC5.3", "H"), "iso_42001": ("Clause 10.1 + 10.2", "H"), "nist_csf": ("ID.IM-01 + ID.IM-02 + ID.IM-03 (improvements identified, evaluated, executed)", "H"), "hipaa": ("§164.306(e) review + modify (security measures must be reviewed and modified as needed)", "M"), }, }, ] def merged_in_scope(enabled: Set[str]) -> List[Dict[str, Any]]: """Return merged controls where at least 1 enabled framework maps to them.""" out: List[Dict[str, Any]] = [] for mc in MERGED_CONTROLS: active_maps = {fid: m for fid, m in mc["mappings"].items() if fid in enabled} if active_maps: out.append({ "id": mc["id"], "theme": mc["theme"], "evidence": mc["evidence"], "frameworks_count": len(active_maps), "frameworks": active_maps, }) return out def overlap_summary(merged: List[Dict[str, Any]], enabled: Set[str]) -> Dict[str, Any]: """Compute per-framework coverage and per-pair overlap.""" coverage: Dict[str, int] = {f: 0 for f in enabled} high_confidence: Dict[str, int] = {f: 0 for f in enabled} for mc in merged: for fid in mc["frameworks"]: coverage[fid] += 1 _, conf = mc["frameworks"][fid] if conf == "H": high_confidence[fid] += 1 multi_framework = [mc for mc in merged if mc["frameworks_count"] >= 2] high_reuse = [mc for mc in merged if mc["frameworks_count"] >= 3] return { "total_merged_controls_in_scope": len(merged), "per_framework_coverage": coverage, "per_framework_high_confidence": high_confidence, "multi_framework_count": len(multi_framework), "high_reuse_count_3plus_frameworks": len(high_reuse), } def analyze(payload: Dict[str, Any]) -> Dict[str, Any]: enabled = set(payload.get("enabled_frameworks", [])) merged = merged_in_scope(enabled) summary = overlap_summary(merged, enabled) return { "program": payload.get("program"), "enabled_frameworks": sorted(enabled), "summary": summary, "merged_controls": sorted(merged, key=lambda m: -m["frameworks_count"]), } def render_text(r: Dict[str, Any], source: str) -> str: lines = [] lines.append("=" * 72) lines.append("COMPLIANCE OS — CROSS-FRAMEWORK CONTROL MAPPING") lines.append(f"Source: {source}") lines.append("=" * 72) lines.append("") lines.append(f"Program: {r['program']}") lines.append(f"Enabled frameworks ({len(r['enabled_frameworks'])}): {', '.join(r['enabled_frameworks'])}") lines.append("") s = r["summary"] lines.append(f"Merged controls in scope: {s['total_merged_controls_in_scope']}") lines.append(f"Multi-framework controls (≥ 2): {s['multi_framework_count']}") lines.append(f"High-reuse controls (≥ 3 frameworks): {s['high_reuse_count_3plus_frameworks']}") lines.append("") lines.append("Per-framework coverage in merged catalogue:") for fid in r["enabled_frameworks"]: cov = s["per_framework_coverage"].get(fid, 0) hi = s["per_framework_high_confidence"].get(fid, 0) lines.append(f" {fid:15s} {cov} mappings ({hi} HIGH confidence)") lines.append("") lines.append("-" * 72) lines.append("MERGED CONTROLS (sorted by reuse leverage):") lines.append("") for mc in r["merged_controls"]: lines.append(f" [{mc['id']}] {mc['theme']} ({mc['frameworks_count']} frameworks)") lines.append(f" Evidence: {mc['evidence']}") for fid, (ctrl, conf) in mc["frameworks"].items(): conf_label = {"H": "HIGH ", "M": "MED ", "L": "LOW "}[conf] lines.append(f" [{conf_label}] {fid:12s} -> {ctrl}") lines.append("") lines.append("-" * 72) lines.append("CONFIDENCE LEGEND:") lines.append(" HIGH — same evidence satisfies both (direct overlap)") lines.append(" MED — existing evidence with overlay") lines.append(" LOW — concept overlap; mostly new artefact required") return "\n".join(lines) def main() -> int: parser = argparse.ArgumentParser( description="Multi-framework control overlap computation.", formatter_class=argparse.RawDescriptionHelpFormatter, epilog=__doc__, ) parser.add_argument("path", nargs="?", help="Path to program JSON (uses embedded sample if omitted)") parser.add_argument("--output", choices=("text", "json"), default="text", help="Output format") args = parser.parse_args() if args.path: try: with open(args.path, "r", encoding="utf-8") as f: payload = json.load(f) source = args.path except (IOError, OSError) as e: print(f"error: could not read {args.path}: {e}", file=sys.stderr) return 1 except json.JSONDecodeError as e: print(f"error: invalid JSON in {args.path}: {e}", file=sys.stderr) return 1 else: payload = SAMPLE source = "" result = analyze(payload) if args.output == "json": print(json.dumps({"source": source, **result}, indent=2)) else: print(render_text(result, source)) return 0 if __name__ == "__main__": sys.exit(main()) FILE:scripts/evidence_pool_generator.py #!/usr/bin/env python3 """evidence_pool_generator.py — Consolidated evidence checklist across enabled frameworks. Stdlib-only. Given a multi-framework compliance program config, produces a unified evidence pool that maps each evidence artefact to all the (framework, control) tuples it satisfies. Each artefact gets a reuse-leverage score = number of distinct (framework, control) tuples satisfied. Deterministic. No LLM calls. No external dependencies. Uses a curated evidence catalogue distilled from ISO 27001, ISO 42001, SOC 2, GDPR, EU AI Act published guidance. Input schema (JSON): { "program": "Acme AI Inc. compliance program", "enabled_frameworks": ["iso_27001", "soc_2", "iso_42001", "eu_ai_act", "gdpr"], "audit_cycle_year": "year_1" } Usage: python evidence_pool_generator.py python evidence_pool_generator.py path/to/program.json python evidence_pool_generator.py program.json --output json """ import argparse import json import sys from typing import Any, Dict, List SAMPLE: Dict[str, Any] = { "program": "Acme AI Inc. compliance program", "enabled_frameworks": ["iso_27001", "soc_2", "iso_42001", "eu_ai_act", "gdpr"], "audit_cycle_year": "year_1", } # Evidence catalogue: each artefact + the (framework, control) tuples it satisfies # + acquisition cost (low / medium / high) + retention requirement (months) EVIDENCE_CATALOG: List[Dict[str, Any]] = [ { "id": "ev.access_review_quarterly", "title": "Quarterly access review records (privileged + general access)", "satisfies": [ ("iso_27001", "A.5.15"), ("iso_27001", "A.8.2"), ("iso_27001", "A.8.3"), ("soc_2", "CC6.1"), ("soc_2", "CC6.2"), ("soc_2", "CC6.3"), ("iso_42001", "A.4.4"), ("gdpr", "Article 32(1)(b)"), ], "acquisition_cost": "low", "retention_months": 36, "owner": "IT / Security", }, { "id": "ev.asset_register", "title": "Asset register with AI systems + data classification", "satisfies": [ ("iso_27001", "A.5.9"), ("iso_27001", "A.5.10"), ("iso_27001", "A.5.12"), ("soc_2", "CC6.1"), ("soc_2", "CC3.2"), ("iso_42001", "A.4.2"), ("iso_42001", "A.4.3"), ("gdpr", "Article 30"), ], "acquisition_cost": "medium", "retention_months": 36, "owner": "Security / DPO", }, { "id": "ev.risk_register", "title": "Risk register with severity matrix + treatment + residual signoff", "satisfies": [ ("iso_27001", "Clause 6.1"), ("iso_27001", "Clause 8.2"), ("soc_2", "CC3.1"), ("soc_2", "CC3.2"), ("soc_2", "CC3.4"), ("iso_42001", "Clause 6.1.2"), ("iso_42001", "A.5"), ("eu_ai_act", "Article 9"), ("gdpr", "Article 35"), ], "acquisition_cost": "high", "retention_months": 36, "owner": "Compliance officer", }, { "id": "ev.supplier_inventory_reviews", "title": "Supplier inventory + annual reviews + signed DPAs", "satisfies": [ ("iso_27001", "A.5.19"), ("iso_27001", "A.5.20"), ("iso_27001", "A.5.21"), ("soc_2", "CC9.2"), ("iso_42001", "A.10.2"), ("iso_42001", "A.10.6"), ("eu_ai_act", "Article 25"), ("gdpr", "Article 28"), ], "acquisition_cost": "medium", "retention_months": 36, "owner": "Procurement / Compliance", }, { "id": "ev.incident_log_postmortems", "title": "Incident log + severity classifications + post-incident reviews + notifications sent", "satisfies": [ ("iso_27001", "A.5.24"), ("iso_27001", "A.5.25"), ("iso_27001", "A.5.26"), ("iso_27001", "A.5.27"), ("iso_27001", "A.6.8"), ("soc_2", "CC7.3"), ("soc_2", "CC7.4"), ("soc_2", "CC7.5"), ("iso_42001", "A.8.4"), ("eu_ai_act", "Article 73"), ("gdpr", "Article 33"), ("gdpr", "Article 34"), ], "acquisition_cost": "medium", "retention_months": 36, "owner": "Security / IR team", }, { "id": "ev.logs_aggregated", "title": "Tamper-evident logs centralized with retention", "satisfies": [ ("iso_27001", "A.8.15"), ("iso_27001", "A.8.16"), ("soc_2", "CC7.1"), ("soc_2", "CC7.2"), ("iso_42001", "A.9.3"), ("iso_42001", "A.9.4"), ("eu_ai_act", "Article 12"), ], "acquisition_cost": "high", "retention_months": 12, "owner": "Platform / SRE", }, { "id": "ev.change_records", "title": "Change approval records + rollback procedure + post-implementation reviews", "satisfies": [ ("iso_27001", "A.8.32"), ("soc_2", "CC8.1"), ("iso_42001", "A.6.2.5"), ], "acquisition_cost": "low", "retention_months": 24, "owner": "Engineering / Platform", }, { "id": "ev.bcp_dr_exercises", "title": "BCP/DRP exercise records + RPO/RTO validation", "satisfies": [ ("iso_27001", "A.5.29"), ("iso_27001", "A.5.30"), ("iso_27001", "A.8.13"), ("iso_27001", "A.8.14"), ("soc_2", "A1.2"), ("soc_2", "A1.3"), ], "acquisition_cost": "high", "retention_months": 36, "owner": "Platform / SRE", }, { "id": "ev.training_records", "title": "Competence requirements per role + training completion + effectiveness verification", "satisfies": [ ("iso_27001", "A.6.3"), ("soc_2", "CC1.4"), ("soc_2", "CC2.2"), ("iso_42001", "Clause 7.2"), ("iso_42001", "Clause 7.3"), ("eu_ai_act", "Article 4"), ], "acquisition_cost": "medium", "retention_months": 36, "owner": "HR / People Ops", }, { "id": "ev.data_inventory_consent", "title": "Data inventory + provenance + retention + consent / lawful-basis register", "satisfies": [ ("iso_27001", "A.5.34"), ("iso_42001", "A.7.2"), ("iso_42001", "A.7.3"), ("iso_42001", "A.7.4"), ("iso_42001", "A.7.5"), ("iso_42001", "A.7.6"), ("eu_ai_act", "Article 10"), ("gdpr", "Article 5"), ("gdpr", "Article 6"), ("gdpr", "Article 30"), ], "acquisition_cost": "high", "retention_months": 60, "owner": "DPO / Data team", }, { "id": "ev.internal_audit_records", "title": "Internal audit plan + auditor independence records + findings tracking", "satisfies": [ ("iso_27001", "Clause 9.2"), ("soc_2", "CC4.1"), ("iso_42001", "Clause 9.2"), ], "acquisition_cost": "medium", "retention_months": 36, "owner": "Compliance officer", }, { "id": "ev.management_review_records", "title": "Management review schedule + meeting records + action item tracking", "satisfies": [ ("iso_27001", "Clause 9.3"), ("iso_42001", "Clause 9.3"), ], "acquisition_cost": "low", "retention_months": 36, "owner": "Compliance officer + Exec", }, { "id": "ev.policy_set", "title": "Policy set: AI, info-sec, privacy, code-of-conduct (signed + reviewed annually)", "satisfies": [ ("iso_27001", "A.5.1"), ("soc_2", "CC1.1"), ("soc_2", "CC1.2"), ("iso_42001", "Clause 5.2"), ("iso_42001", "A.2.2"), ("iso_42001", "A.2.3"), ("eu_ai_act", "Article 17(1)(a)"), ("gdpr", "Article 24"), ], "acquisition_cost": "medium", "retention_months": 60, "owner": "Compliance officer + Exec", }, { "id": "ev.crypto_records", "title": "Crypto policy + algorithm/key-length standards + key rotation records", "satisfies": [ ("iso_27001", "A.8.24"), ("soc_2", "CC6.1"), ("soc_2", "CC6.7"), ("gdpr", "Article 32(1)(a)"), ], "acquisition_cost": "medium", "retention_months": 36, "owner": "Security", }, { "id": "ev.vuln_scans_patch", "title": "Vulnerability scan results + patch SLAs + remediation evidence", "satisfies": [ ("iso_27001", "A.8.7"), ("iso_27001", "A.8.8"), ("iso_27001", "A.8.9"), ("soc_2", "CC7.1"), ("soc_2", "CC7.2"), ("soc_2", "CC7.4"), ], "acquisition_cost": "medium", "retention_months": 24, "owner": "Security", }, ] def filter_by_enabled(catalog: List[Dict[str, Any]], enabled: List[str]) -> List[Dict[str, Any]]: """Filter satisfaction tuples to enabled frameworks.""" enabled_set = set(enabled) out = [] for ev in catalog: active = [(f, c) for (f, c) in ev["satisfies"] if f in enabled_set] if not active: continue leverage = len(active) frameworks_satisfied = sorted({f for f, _ in active}) record = {**ev, "active_satisfaction": active, "reuse_leverage": leverage, "frameworks_satisfied": frameworks_satisfied} out.append(record) out.sort(key=lambda x: (-x["reuse_leverage"], x["title"])) return out def analyze(payload: Dict[str, Any]) -> Dict[str, Any]: enabled = payload.get("enabled_frameworks", []) artefacts = filter_by_enabled(EVIDENCE_CATALOG, enabled) total_satisfactions = sum(a["reuse_leverage"] for a in artefacts) by_cost: Dict[str, int] = {"low": 0, "medium": 0, "high": 0} by_owner: Dict[str, int] = {} for a in artefacts: by_cost[a["acquisition_cost"]] += 1 by_owner[a["owner"]] = by_owner.get(a["owner"], 0) + 1 # High-leverage artefacts (satisfy ≥ 5 mappings) high_leverage = [a for a in artefacts if a["reuse_leverage"] >= 5] return { "program": payload.get("program"), "enabled_frameworks": enabled, "audit_cycle_year": payload.get("audit_cycle_year"), "artefact_count": len(artefacts), "total_satisfactions_across_artefacts": total_satisfactions, "high_leverage_count": len(high_leverage), "by_acquisition_cost": by_cost, "by_owner": by_owner, "artefacts": artefacts, } def render_text(r: Dict[str, Any], source: str) -> str: lines = [] lines.append("=" * 72) lines.append("COMPLIANCE OS — UNIFIED EVIDENCE POOL") lines.append(f"Source: {source}") lines.append("=" * 72) lines.append("") lines.append(f"Program: {r['program']}") lines.append(f"Enabled frameworks: {', '.join(r['enabled_frameworks'])}") lines.append(f"Audit cycle phase: {r['audit_cycle_year']}") lines.append(f"Artefacts in scope: {r['artefact_count']}") lines.append(f"Total (framework, control) satisfactions: {r['total_satisfactions_across_artefacts']}") lines.append(f"High-leverage artefacts (≥ 5 mappings): {r['high_leverage_count']}") lines.append("") lines.append(f"By acquisition cost: low={r['by_acquisition_cost']['low']} " f"medium={r['by_acquisition_cost']['medium']} high={r['by_acquisition_cost']['high']}") lines.append(f"By owner: {dict(r['by_owner'])}") lines.append("") lines.append("-" * 72) lines.append("ARTEFACTS (sorted by reuse leverage — highest first):") lines.append("") for a in r["artefacts"]: lines.append(f" [{a['id']}] {a['title']}") lines.append(f" Leverage: {a['reuse_leverage']} mappings across {len(a['frameworks_satisfied'])} frameworks ({', '.join(a['frameworks_satisfied'])})") lines.append(f" Owner: {a['owner']} | Cost: {a['acquisition_cost']} | Retention: {a['retention_months']} months") lines.append(f" Satisfies:") for fid, ctrl in a["active_satisfaction"]: lines.append(f" - {fid:12s} -> {ctrl}") lines.append("") lines.append("-" * 72) lines.append("REUSE-LEVERAGE GUIDANCE:") lines.append(" Build high-leverage artefacts first (single evidence -> ≥ 5 framework controls).") lines.append(" High-leverage examples (depend on enabled frameworks): risk register, supplier inventory, incident log,") lines.append(" data inventory + consent, policy set, training records.") return "\n".join(lines) def main() -> int: parser = argparse.ArgumentParser( description="Unified evidence pool generator across compliance frameworks.", formatter_class=argparse.RawDescriptionHelpFormatter, epilog=__doc__, ) parser.add_argument("path", nargs="?", help="Path to program JSON (uses embedded sample if omitted)") parser.add_argument("--output", choices=("text", "json"), default="text", help="Output format") args = parser.parse_args() if args.path: try: with open(args.path, "r", encoding="utf-8") as f: payload = json.load(f) source = args.path except (IOError, OSError) as e: print(f"error: could not read {args.path}: {e}", file=sys.stderr) return 1 except json.JSONDecodeError as e: print(f"error: invalid JSON in {args.path}: {e}", file=sys.stderr) return 1 else: payload = SAMPLE source = "" result = analyze(payload) if args.output == "json": print(json.dumps({"source": source, **result}, indent=2)) else: print(render_text(result, source)) return 0 if __name__ == "__main__": sys.exit(main()) FILE:scripts/framework_selector.py #!/usr/bin/env python3 """framework_selector.py — Multi-framework compliance applicability selector. Stdlib-only. Takes a company profile and returns the applicable compliance frameworks ranked by priority + dependency graph. Supports 9 frameworks: - ISO 27001 (info-sec ISMS) - ISO 13485 (medical device QMS) - ISO 42001 (AI management system) - ISO 14971 (medical device risk mgmt) - EU AI Act (Regulation 2024/1689) - EU MDR 2017/745 (medical device regulation) - GDPR (Regulation 2016/679) - SOC 2 (Trust Services Criteria) - FDA QSR (21 CFR 820) Deterministic decision tree. No LLM calls. No external dependencies. Input schema (JSON): { "company": "Acme AI Inc.", "industry": "saas", # saas | medical_device | financial | other "products_include_ai": true, "ai_high_risk_per_eu": true, # falls under Annex III, Article 6 "deploys_ai_in_eu": true, "products_are_medical_devices": false, "sells_to_eu_customers": true, "sells_to_us_customers": true, "sells_to_enterprise_b2b": true, "processes_personal_data": true, "processes_eu_personal_data": true, "headcount": 80, "stage": "series_b" } Usage: python framework_selector.py # uses embedded mid-stage AI SaaS sample python framework_selector.py path/to/profile.json python framework_selector.py profile.json --output json """ import argparse import json import sys from typing import Any, Dict, List SAMPLE: Dict[str, Any] = { "company": "Acme AI Inc.", "industry": "saas", "products_include_ai": True, "ai_high_risk_per_eu": True, "deploys_ai_in_eu": True, "products_are_medical_devices": False, "sells_to_eu_customers": True, "sells_to_us_customers": True, "sells_to_enterprise_b2b": True, "processes_personal_data": True, "processes_eu_personal_data": True, "headcount": 80, "stage": "series_b", # Phase 3 additions (defaults false; sample profile does not trigger HIPAA / NIS2 / CSF) "processes_phi": False, "us_healthcare_covered_entity": False, "us_healthcare_business_associate": False, "nis2_essential_entity": False, "nis2_important_entity": False, "adopts_nist_csf": False, "us_government_contractor": False, } # Framework catalogue (id, name, type, certifiable) FRAMEWORKS = { "iso_27001": {"name": "ISO/IEC 27001:2022", "type": "management_system", "certifiable": True, "binding": False}, "iso_13485": {"name": "ISO 13485:2016", "type": "management_system", "certifiable": True, "binding": False}, "iso_42001": {"name": "ISO/IEC 42001:2023", "type": "management_system", "certifiable": True, "binding": False}, "iso_14971": {"name": "ISO 14971:2019", "type": "process_standard", "certifiable": False, "binding": False}, "eu_ai_act": {"name": "Regulation (EU) 2024/1689 (AI Act)", "type": "regulation", "certifiable": False, "binding": True}, "eu_mdr_745": {"name": "Regulation (EU) 2017/745 (MDR)", "type": "regulation", "certifiable": False, "binding": True}, "gdpr": {"name": "Regulation (EU) 2016/679 (GDPR)", "type": "regulation", "certifiable": False, "binding": True}, "soc_2": {"name": "AICPA SOC 2 Trust Services", "type": "attestation", "certifiable": True, "binding": False}, "fda_qsr": {"name": "FDA 21 CFR 820 (QSR)", "type": "regulation", "certifiable": False, "binding": True}, # Phase 3 additions "nist_csf": {"name": "NIST Cybersecurity Framework 2.0", "type": "framework_profile", "certifiable": False, "binding": False}, "nis2": {"name": "Directive (EU) 2022/2555 (NIS2)", "type": "regulation", "certifiable": False, "binding": True}, "hipaa": {"name": "HIPAA Security + Privacy + Breach Notification Rules", "type": "regulation", "certifiable": False, "binding": True}, } # Dependency graph: framework X benefits from framework Y as prerequisite DEPENDENCIES = { "iso_42001": ["iso_27001"], # AIMS reuses ISMS heavily "iso_13485": ["iso_14971"], # QMS uses risk mgmt "eu_mdr_745": ["iso_13485", "iso_14971"], "eu_ai_act": ["iso_42001"], # voluntary AIMS satisfies parts of Article 17 "soc_2": ["iso_27001"], # ISO 27001 controls map to SOC 2 TSC "fda_qsr": ["iso_13485"], # QSR mostly harmonised with 13485 # Phase 3 additions "nist_csf": [], # voluntary framework; no prereqs "nis2": ["iso_27001"], # NIS2 risk-mgmt + reporting maps to 27001 controls "hipaa": ["iso_27001"], # HIPAA Security Rule overlaps ISO 27001 Annex A } def select_frameworks(profile: Dict[str, Any]) -> List[str]: selected: List[str] = [] # GDPR — any EU personal data if profile.get("processes_eu_personal_data") or ( profile.get("processes_personal_data") and profile.get("sells_to_eu_customers") ): selected.append("gdpr") # ISO 27001 — enterprise B2B / mature SaaS if profile.get("sells_to_enterprise_b2b") or profile.get("stage") in ("series_a", "series_b", "series_c", "growth"): selected.append("iso_27001") # SOC 2 — US enterprise B2B if profile.get("sells_to_us_customers") and profile.get("sells_to_enterprise_b2b"): selected.append("soc_2") # ISO 42001 — any AI in products if profile.get("products_include_ai"): selected.append("iso_42001") # EU AI Act — AI deployed in EU if profile.get("products_include_ai") and ( profile.get("deploys_ai_in_eu") or profile.get("sells_to_eu_customers") ): selected.append("eu_ai_act") # ISO 13485 + 14971 — medical device if profile.get("products_are_medical_devices"): selected.append("iso_13485") selected.append("iso_14971") # EU MDR — medical device sold in EU if profile.get("sells_to_eu_customers"): selected.append("eu_mdr_745") # FDA QSR — medical device sold in US if profile.get("sells_to_us_customers"): selected.append("fda_qsr") # HIPAA — any US healthcare PHI processing if profile.get("processes_phi") or profile.get("us_healthcare_covered_entity") or profile.get("us_healthcare_business_associate"): selected.append("hipaa") # NIS2 — operates in EU as essential or important entity per Annex I/II of Directive 2022/2555 if profile.get("nis2_essential_entity") or profile.get("nis2_important_entity"): selected.append("nis2") # NIST CSF — voluntary; recommended for any org with cybersecurity programme (esp. US gov-adjacent) if profile.get("adopts_nist_csf") or profile.get("us_government_contractor"): selected.append("nist_csf") return selected def annotate(profile: Dict[str, Any]) -> Dict[str, Any]: selected = select_frameworks(profile) # Build dependency notes dep_notes: List[Dict[str, Any]] = [] for fid in selected: deps = DEPENDENCIES.get(fid, []) in_program = [d for d in deps if d in selected] missing = [d for d in deps if d not in selected] if in_program or missing: dep_notes.append({ "framework": fid, "satisfied_dependencies": in_program, "missing_dependencies": missing, }) # Priority ranking — bindings first, then certifiable, then reference def priority(fid: str) -> int: f = FRAMEWORKS[fid] if f["binding"]: return 0 if f["certifiable"]: return 1 return 2 ranked = sorted(selected, key=priority) return { "company": profile.get("company"), "industry": profile.get("industry"), "applicable_frameworks": [ {"id": fid, **FRAMEWORKS[fid]} for fid in ranked ], "framework_count": len(ranked), "binding_count": sum(1 for fid in ranked if FRAMEWORKS[fid]["binding"]), "certifiable_count": sum(1 for fid in ranked if FRAMEWORKS[fid]["certifiable"]), "dependency_notes": dep_notes, "rationale": _rationale(profile, ranked), } def _rationale(profile: Dict[str, Any], selected: List[str]) -> List[str]: notes = [] if "gdpr" in selected: notes.append("GDPR: EU personal data processed; binding regardless of certifiable choice.") if "iso_27001" in selected: notes.append("ISO 27001: enterprise B2B procurement frequently requires; foundation for AIMS + SOC 2.") if "soc_2" in selected: notes.append("SOC 2: US enterprise B2B procurement requires Type II audit; overlap with ISO 27001 ~75%.") if "iso_42001" in selected: notes.append("ISO 42001: AI in products; voluntary management system; satisfies Article 17 EU AI Act QMS.") if "eu_ai_act" in selected: notes.append("EU AI Act: AI deployed in EU; binding; Article 5 prohibitions in force; high-risk obligations 2 Aug 2026.") if "iso_13485" in selected: notes.append("ISO 13485: medical device manufacturer; required for MDR / FDA submissions.") if "iso_14971" in selected: notes.append("ISO 14971: medical device risk management; harmonised under MDR.") if "eu_mdr_745" in selected: notes.append("EU MDR 745: medical device sold in EU; binding; mandatory CE marking.") if "fda_qsr" in selected: notes.append("FDA QSR: medical device sold in US; binding; FDA quality system regulation.") if "hipaa" in selected: notes.append("HIPAA: processes US PHI; binding Security Rule (45 CFR 164 Subpart C) + Privacy Rule + Breach Notification.") if "nis2" in selected: notes.append("NIS2: essential or important entity in EU per Directive 2022/2555 Annex I/II; binding; cybersecurity + incident reporting obligations.") if "nist_csf" in selected: notes.append("NIST CSF 2.0: voluntary cybersecurity framework; recommended for US gov-adjacent orgs; cross-walks ISO 27001 + SOC 2 Common Criteria.") return notes def render_text(r: Dict[str, Any], source: str) -> str: lines = [] lines.append("=" * 72) lines.append("COMPLIANCE OS — APPLICABLE FRAMEWORKS") lines.append(f"Source: {source}") lines.append("=" * 72) lines.append("") lines.append(f"Company: {r['company']}") lines.append(f"Industry: {r['industry']}") lines.append(f"Applicable frameworks: {r['framework_count']} " f"({r['binding_count']} binding + {r['certifiable_count']} certifiable)") lines.append("") lines.append("-" * 72) lines.append("RANKED FRAMEWORKS (binding > certifiable > reference):") lines.append("") for f in r["applicable_frameworks"]: kind = [] if f["binding"]: kind.append("BINDING") if f["certifiable"]: kind.append("CERTIFIABLE") kind_str = " | ".join(kind) if kind else "REFERENCE" lines.append(f" [{kind_str:25s}] {f['name']:42s} ({f['id']})") lines.append("") lines.append("-" * 72) lines.append("RATIONALE:") for r_note in r["rationale"]: lines.append(f" - {r_note}") lines.append("") if r["dependency_notes"]: lines.append("-" * 72) lines.append("DEPENDENCIES:") for d in r["dependency_notes"]: if d["satisfied_dependencies"]: lines.append(f" {d['framework']} satisfied by: {', '.join(d['satisfied_dependencies'])}") if d["missing_dependencies"]: lines.append(f" {d['framework']} missing dependency: {', '.join(d['missing_dependencies'])} (consider adding)") lines.append("") lines.append("-" * 72) lines.append("DECISION RULES:") lines.append(" GDPR: any EU personal data processed -> mandatory") lines.append(" ISO 27001: enterprise B2B procurement requirement; foundation for AIMS + SOC 2") lines.append(" SOC 2: US enterprise B2B procurement requirement; overlap ~75% with ISO 27001") lines.append(" ISO 42001: AI in products; voluntary AIMS; satisfies parts of Article 17 AI Act") lines.append(" EU AI Act: AI in EU; binding; phased application through 2027") return "\n".join(lines) def main() -> int: parser = argparse.ArgumentParser( description="Multi-framework compliance applicability selector.", formatter_class=argparse.RawDescriptionHelpFormatter, epilog=__doc__, ) parser.add_argument("path", nargs="?", help="Path to company profile JSON (uses embedded sample if omitted)") parser.add_argument("--output", choices=("text", "json"), default="text", help="Output format") args = parser.parse_args() if args.path: try: with open(args.path, "r", encoding="utf-8") as f: profile = json.load(f) source = args.path except (IOError, OSError) as e: print(f"error: could not read {args.path}: {e}", file=sys.stderr) return 1 except json.JSONDecodeError as e: print(f"error: invalid JSON in {args.path}: {e}", file=sys.stderr) return 1 else: profile = SAMPLE source = "" result = annotate(profile) if args.output == "json": print(json.dumps({"source": source, **result}, indent=2)) else: print(render_text(result, source)) return 0 if __name__ == "__main__": sys.exit(main())

Điều phối tuân thủ đa khung — compliance-os

Bình luận (0)