Implement and maintain compliance with SOC 2, HIPAA, PCI-DSS, and GDPR using unified control mapping, policy-as-code enforcement, and automated evidence collection. Use when building systems requiring regulatory compliance, implementing security controls across multiple frameworks, or automating audit preparation.
Implement continuous compliance with major regulatory frameworks through unified control mapping, policy-as-code enforcement, and automated evidence collection.
Modern compliance is a continuous engineering discipline requiring technical implementation of security controls. This skill provides patterns for SOC 2 Type II, HIPAA, PCI-DSS 4.0, and GDPR compliance using infrastructure-as-code, policy automation, and evidence collection. Focus on unified controls that satisfy multiple frameworks simultaneously to reduce implementation effort by 60-80%.
Invoke when:
SOC 2 Type II
ISO 27001
HIPAA (Healthcare)
PCI-DSS 4.0 (Payment Card Industry)
GDPR (EU Privacy)
CCPA/CPRA (California Privacy)
For detailed framework requirements, see references/soc2-controls.md, references/hipaa-safeguards.md, references/pci-dss-requirements.md, and references/gdpr-articles.md.
Implement controls once, map to multiple frameworks. Reduces effort by 60-80%.
Implementation Priority:
Identity & Access:
Data Protection:
Logging & Monitoring:
Network Security:
Incident Response:
Business Continuity:
For complete control implementations, see references/control-mapping-matrix.md.
Enforce compliance policies in CI/CD before infrastructure deployment.
Architecture:
Git Push → Terraform Plan → JSON → OPA Evaluation
├─► Pass → Deploy
└─► Fail → Block
Example: Encryption Policy
Enforce encryption requirements (SOC 2 CC6.1, HIPAA §164.312(a)(2)(iv), PCI-DSS Req 3.4):
See examples/opa-policies/encryption.rego for complete implementation.
CI/CD Integration:
terraform plan -out=tfplan.binary
terraform show -json tfplan.binary > tfplan.json
opa eval --data policies/ --input tfplan.json 'data.compliance.main.deny'
For complete CI/CD patterns, see references/cicd-integration.md.
Scan IaC with built-in compliance framework support:
checkov -d ./terraform \
--check SOC2 --check HIPAA --check PCI --check GDPR \
--output cli --output json
Create custom policies for organization-specific requirements. See examples/checkov-policies/ for examples.
Integrate compliance validation into test suites:
def test_s3_encrypted(terraform_plan):
"""SOC2:CC6.1, HIPAA:164.312(a)(2)(iv)"""
buckets = get_resources(terraform_plan, "aws_s3_bucket")
encrypted = get_encryption_configs(terraform_plan)
assert all_buckets_encrypted(buckets, encrypted)
def test_opa_policies():
result = subprocess.run(["opa", "eval", "--data", "policies/",
"--input", "tfplan.json", "data.compliance.main.deny"])
assert not json.loads(result.stdout)
For complete test patterns, see references/compliance-testing.md.
Standards: AES-256, managed KMS, automatic rotation
AWS Example:
resource "aws_kms_key" "data" {
enable_key_rotation = true
tags = { Compliance = "ENC-001" }
}
resource "aws_s3_bucket_server_side_encryption_configuration" "data" {
bucket = aws_s3_bucket.data.id
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "aws:kms"
kms_master_key_id = aws_kms_key.data.arn
}
}
}
resource "aws_db_instance" "main" {
storage_encrypted = true
kms_key_id = aws_kms_key.data.arn
}
For complete encryption implementations including Azure and GCP, see references/encryption-implementations.md.
Standards: TLS 1.3 (TLS 1.2 minimum), strong ciphers, HSTS
ALB Example:
resource "aws_lb_listener" "https" {
port = 443
protocol = "HTTPS"
ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06"
}
Standards: TOTP, hardware tokens, biometric for privileged access
AWS IAM Enforcement:
resource "aws_iam_policy" "require_mfa" {
policy = jsonencode({
Statement = [{
Effect = "Deny"
NotAction = ["iam:CreateVirtualMFADevice", "iam:EnableMFADevice"]
Resource = "*"
Condition = {
BoolIfExists = { "aws:MultiFactorAuthPresent" = "false" }
}
}]
})
}
For application-level MFA (TOTP), see examples/mfa-implementation.py.
Standards: Least privilege, job function-based roles, quarterly reviews
Kubernetes Example:
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: developer
namespace: development
rules:
- apiGroups: ["", "apps"]
resources: ["pods", "deployments", "services"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"] # Read-only
For complete RBAC patterns including AWS IAM and OPA policies, see references/access-control-patterns.md.
Standards: Structured JSON, 7-year retention, immutable storage
Required Events: Authentication, authorization, data access, administrative actions, security events
Python Example:
class AuditLogger:
def log_event(self, event_type, user_id, resource_type,
resource_id, action, result, ip_address):
audit_event = {
"timestamp": datetime.utcnow().isoformat() + "Z",
"event_type": event_type.value,
"user_id": user_id,
"action": action,
"result": result,
"resource": {"type": resource_type, "id": resource_id},
"source": {"ip": ip_address}
}
self.logger.info(json.dumps(audit_event))
Log Retention:
resource "aws_cloudwatch_log_group" "audit" {
retention_in_days = 2555 # 7 years
kms_key_id = aws_kms_key.logs.arn
}
resource "aws_s3_bucket_object_lock_configuration" "audit" {
bucket = aws_s3_bucket.audit_logs.id
rule {
default_retention { mode = "COMPLIANCE"; years = 7 }
}
}
For complete audit logging patterns including HIPAA PHI access logging, see references/audit-logging-patterns.md.
Automate evidence collection for continuous compliance validation.
Architecture:
AWS Config → EventBridge → Lambda → S3 (Evidence)
→ DynamoDB (Status)
Evidence Collection:
class EvidenceCollector:
def collect_encryption_evidence(self):
evidence = {
"control_id": "ENC-001",
"frameworks": ["SOC2-CC6.1", "HIPAA-164.312(a)(2)(iv)"],
"timestamp": datetime.utcnow().isoformat(),
"status": "PASS",
"findings": []
}
# Check S3, RDS, EBS encryption status
# Document findings
return evidence
For complete evidence collector, see examples/evidence-collection/evidence_collector.py.
Generate compliance reports automatically:
class AuditReportGenerator:
def generate_soc2_report(self, start_date, end_date):
controls = self.get_control_status("SOC2")
return {
"framework": "SOC 2 Type II",
"compliance_score": self.calculate_score(controls),
"trust_services_criteria": {...},
"controls": self.format_controls(controls)
}
For complete report generator, see examples/evidence-collection/report_generator.py.
Unified control mapping across frameworks:
| Control | SOC 2 | HIPAA | PCI-DSS | GDPR | ISO 27001 | |---------|-------|-------|---------|------|-----------| | MFA | CC6.1 | §164.312(d) | Req 8.3 | Art 32 | A.9.4.2 | | Encryption at Rest | CC6.1 | §164.312(a)(2)(iv) | Req 3.4 | Art 32 | A.10.1.1 | | Encryption in Transit | CC6.1 | §164.312(e)(1) | Req 4.1 | Art 32 | A.13.1.1 | | Audit Logging | CC7.2 | §164.312(b) | Req 10.2 | Art 30 | A.12.4.1 | | Access Reviews | CC6.1 | §164.308(a)(3)(ii)(C) | Req 8.2.4 | Art 32 | A.9.2.5 | | Vulnerability Scanning | CC7.1 | §164.308(a)(8) | Req 11.2 | Art 32 | A.12.6.1 | | Incident Response | CC7.3 | §164.308(a)(6) | Req 12.10 | Art 33 | A.16.1.1 |
Strategy: Implement once with proper tagging, map to all applicable frameworks.
For complete control mapping with 45+ controls, see references/control-mapping-matrix.md.
Framework-Specific Timelines:
Required Elements:
For incident response templates, see references/incident-response-templates.md.
Business Associate Agreements (HIPAA):
Data Processing Agreements (GDPR):
Assessment Process:
For vendor management templates, see references/vendor-management.md.
Policy as Code:
Compliance Automation:
For tool selection guidance, see references/tool-recommendations.md.
Related Skills:
security-hardening: Technical security control implementationsecret-management: Secrets handling per HIPAA/PCI-DSSinfrastructure-as-code: IaC implementing compliance controlskubernetes-operations: K8s RBAC, network policiesbuilding-ci-pipelines: Policy enforcement in CI/CDsiem-logging: Audit logging and monitoringincident-management: Incident response proceduresImplementation Checklist:
Common Mistakes:
Framework Details:
Implementation Patterns:
Automation:
Code Examples:
Consult qualified legal counsel and auditors for legal interpretation and audit preparation.
npx skills add ancoleman/implementing-compliance下载完整 Skill 目录，包含 SKILL.md 及所有相关文件
Category:developer