aaaaqwq/agi-super-team/afrexai-compliance-engine

Compliance & Audit Readiness Engine

Your AI compliance officer. Guides startups and scale-ups through SOC 2, ISO 27001, GDPR, HIPAA, and PCI DSS — from zero to audit-ready. No consultants needed.

Phase 1 — Compliance Discovery

Framework Selection Matrix

Readiness Assessment Brief

company_profile:
  name: ""
  industry: ""
  employee_count: 0
  annual_revenue: ""
  data_types_handled:
    - PII (names, emails, addresses)
    - Financial (payment cards, bank accounts)
    - Health (PHI, medical records)
    - Children (COPPA scope)
    - Biometric
    - Government/classified
  customer_segments:
    - SMB
    - Mid-market
    - Enterprise
    - Government
  geographic_scope:
    - US only
    - US + EU
    - Global
  current_state:
    existing_frameworks: []
    security_team_size: 0
    has_written_policies: false
    has_asset_inventory: false
    has_risk_assessment: false
    has_incident_response: false
    has_vendor_management: false
    previous_audits: []
    known_gaps: []
  drivers:
    - Customer requirement
    - Board/investor mandate
    - Regulatory obligation
    - Competitive advantage
    - Insurance requirement
  target_frameworks: []
  target_date: ""
  budget_range: ""

Priority Decision Rules

1. Customer asking for SOC 2? → Start there (most requested in B2B SaaS)
2. EU customers? → GDPR is non-negotiable, do it alongside SOC 2
3. Health data? → HIPAA first, then layer SOC 2
4. Payment data? → PCI DSS is legally required, do immediately
5. Multiple frameworks? → Map common controls (40-60% overlap between SOC 2 and ISO 27001)

Phase 2 — SOC 2 Deep Dive

Trust Service Criteria (TSC)

SOC 2 is built on 5 categories. Security is mandatory. Others are optional but often expected.

CC1 — Control Environment (Foundation)

• [ ] Board/management oversight of security
• [ ] Organizational structure with clear security roles
• [ ] Code of conduct / acceptable use policy
• [ ] HR processes (background checks, onboarding, offboarding)
• [ ] Performance evaluations include security responsibilities

CC2 — Communication & Information

• [ ] Security policies documented and accessible to all employees
• [ ] External communication channels for security (status page, security@)
• [ ] Whistleblower / anonymous reporting mechanism
• [ ] Security awareness training program (annual + onboarding)
• [ ] System description document maintained

CC3 — Risk Assessment

• [ ] Annual risk assessment process documented
• [ ] Risk register maintained with likelihood × impact scoring
• [ ] Risk treatment plans for high/critical risks
• [ ] Risk appetite statement approved by management
• [ ] Changes in business/technology trigger risk re-assessment

CC4 — Monitoring Activities

• [ ] Continuous monitoring of controls (not just annual)
• [ ] Internal audit or self-assessment program
• [ ] Deficiency tracking and remediation
• [ ] Management review of monitoring results
• [ ] Penetration testing (annual minimum)

CC5 — Control Activities

• [ ] Logical access controls (RBAC, least privilege)
• [ ] Physical access controls (offices, data centers)
• [ ] Change management process
• [ ] System development lifecycle (SDLC)
• [ ] Data backup and recovery procedures

CC6 — Logical & Physical Access

• [ ] User provisioning and deprovisioning process
• [ ] MFA enforced on all critical systems
• [ ] Password policy (12+ chars, complexity, rotation)
• [ ] Access reviews (quarterly minimum)
• [ ] Physical access logs for sensitive areas
• [ ] Encryption at rest (AES-256) and in transit (TLS 1.2+)
• [ ] Firewall rules reviewed quarterly
• [ ] VPN or zero-trust network access

CC7 — System Operations

• [ ] Monitoring and alerting (uptime, errors, security events)
• [ ] Incident detection and response procedures
• [ ] Vulnerability management (scan weekly, patch critical <72h)
• [ ] Anti-malware / endpoint protection
• [ ] Capacity planning and performance monitoring

CC8 — Change Management

• [ ] Formal change request and approval process
• [ ] Separation of duties (dev ≠ prod deploy)
• [ ] Testing before production deployment
• [ ] Rollback procedures documented
• [ ] Emergency change process with post-hoc approval

CC9 — Risk Mitigation (Vendors)

• [ ] Vendor risk assessment before onboarding
• [ ] Vendor inventory with criticality ratings
• [ ] Annual vendor reviews
• [ ] BAAs / DPAs with sub-processors
• [ ] Vendor offboarding process

Additional Criteria

Availability (A1):

• [ ] SLAs defined and monitored
• [ ] Disaster recovery plan tested annually
• [ ] Business continuity plan documented
• [ ] RTO/RPO defined for critical systems
• [ ] Redundancy for critical infrastructure

Confidentiality (C1):

• [ ] Data classification scheme (Public, Internal, Confidential, Restricted)
• [ ] Handling procedures per classification level
• [ ] Confidentiality agreements (NDA) with employees and vendors
• [ ] Data retention and disposal policies
• [ ] DLP controls for sensitive data

Processing Integrity (PI1):

• [ ] Input validation controls
• [ ] Processing completeness and accuracy checks
• [ ] Output reconciliation procedures
• [ ] Error handling and correction processes

Privacy (P1):

• [ ] Privacy notice published
• [ ] Consent mechanisms for data collection
• [ ] Data subject rights procedures (access, deletion, portability)
• [ ] Privacy impact assessments for new features
• [ ] Data breach notification procedures

SOC 2 Project Plan (16-Week Sprint)

Required Policy Documents

1. Information Security Policy — Master policy, scope, objectives
2. Access Control Policy — Authentication, authorization, reviews
3. Change Management Policy — SDLC, deployment, emergency changes
4. Incident Response Policy — Detection, response, notification
5. Risk Management Policy — Assessment methodology, treatment, appetite
6. Data Classification Policy — Levels, handling, retention, disposal
7. Acceptable Use Policy — Employee responsibilities, prohibited actions
8. Vendor Management Policy — Assessment, monitoring, offboarding
9. Business Continuity / DR Policy — Plans, testing, RTO/RPO
10. HR Security Policy — Background checks, onboarding, offboarding, training
11. Encryption Policy — Standards, key management, certificate handling
12. Physical Security Policy — Office access, visitor management, clean desk
13. Logging & Monitoring Policy — What to log, retention, alerting
14. Password & Authentication Policy — Standards, MFA requirements
15. Backup & Recovery Policy — Schedule, testing, retention

Policy Template

# [Policy Name]
 
**Version:** 1.0
**Owner:** [Name, Title]
**Approved by:** [Name, Title]
**Effective date:** [Date]
**Next review:** [Date + 1 year]
**Classification:** Internal
 
## 1. Purpose
[Why this policy exists — 2-3 sentences]
 
## 2. Scope
[Who and what this policy applies to]
 
## 3. Policy Statements
[Numbered, actionable requirements — not aspirational]
 
### 3.1 [Topic]
-SHALL [requirement]
-SHALL NOT [prohibition]
-SHOULD [recommendation]
 
## 4. Roles & Responsibilities
| Role | Responsibility |
|------|---------------|
| [Role] | [What they must do] |
 
## 5. Exceptions
[Process for requesting exceptions — who approves, how long, documentation]
 
## 6. Enforcement
[Consequences of non-compliance]
 
## 7. Definitions
[Technical terms used in the policy]
 
## 8. Related Documents
[Links to related policies, standards, procedures]
 
## 9. Revision History
| Version | Date | Author | Changes |
|---------|------|--------|---------|
| 1.0 | [Date] | [Author] | Initial release |

Phase 3 — ISO 27001 Framework

ISMS Implementation Roadmap

Clause 4 — Context of the Organization

• [ ] Define ISMS scope and boundaries
• [ ] Identify interested parties and their requirements
• [ ] Determine internal and external issues
• [ ] Document scope statement

Clause 5 — Leadership

• [ ] Management commitment statement
• [ ] Information security policy (signed by CEO/CTO)
• [ ] Assign ISMS roles and responsibilities
• [ ] Allocate resources (budget, people, tools)

Clause 6 — Planning

• [ ] Risk assessment methodology (ISO 27005 or custom)
• [ ] Risk assessment execution
• [ ] Risk treatment plan
• [ ] Statement of Applicability (SoA) — map all 93 Annex A controls
• [ ] Information security objectives (measurable, time-bound)

Clause 7 — Support

• [ ] Determine required competencies
• [ ] Security awareness program
• [ ] Internal and external communication plan
• [ ] Document control process

Clause 8 — Operation

• [ ] Execute risk treatment plan
• [ ] Implement controls from SoA
• [ ] Manage operational changes
• [ ] Conduct risk assessments on changes

Clause 9 — Performance Evaluation

• [ ] Monitoring and measurement program
• [ ] Internal audit schedule and execution
• [ ] Management review (at least annually)
• [ ] Corrective action tracking

Clause 10 — Improvement

• [ ] Nonconformity and corrective action process
• [ ] Continual improvement program
• [ ] Lessons learned integration

ISO 27001:2022 Annex A Control Categories

SOC 2 ↔ ISO 27001 Control Mapping (Save 40-60% effort)

Strategy: Build for one framework, extend to the other. SOC 2 first (faster) → ISO 27001 (adds clauses 4-10 management system).

Phase 4 — GDPR Compliance Program

12 Core Requirements