Implement and maintain compliance with SOC 2, HIPAA, PCI-DSS, and GDPR using unified control mapping, policy-as-code enforcement, and automated evidence collection. Use when building systems requiring regulatory compliance, implementing security controls across multiple frameworks, or automating audit preparation.
Implement continuous compliance with major regulatory frameworks through unified control mapping, policy-as-code enforcement, and automated evidence collection.
Modern compliance is a continuous engineering discipline requiring technical implementation of security controls. This skill provides patterns for SOC 2 Type II, HIPAA, PCI-DSS 4.0, and GDPR compliance using infrastructure-as-code, policy automation, and evidence collection. Focus on unified controls that satisfy multiple frameworks simultaneously to reduce implementation effort by 60-80%.
Invoke when:
SOC 2 Type II
ISO 27001
HIPAA (Healthcare)
PCI-DSS 4.0 (Payment Card Industry)
GDPR (EU Privacy)
CCPA/CPRA (California Privacy)
For detailed framework requirements, see references/soc2-controls.md, references/hipaa-safeguards.md, references/pci-dss-requirements.md, and references/gdpr-articles.md.
Implement controls once, map to multiple frameworks. Reduces effort by 60-80%.
Implementation Priority:
Identity & Access:
Data Protection:
Logging & Monitoring:
Network Security:
Incident Response:
Business Continuity:
For complete control implementations, see references/control-mapping-matrix.md.
Enforce compliance policies in CI/CD before infrastructure deployment.
Architecture:
Git Push → Terraform Plan → JSON → OPA Evaluation
├─► Pass → Deploy
└─► Fail → Block
Example: Encryption Policy
Enforce encryption requirements (SOC 2 CC6.1, HIPAA §164.312(a)(2)(iv), PCI-DSS Req 3.4):
See examples/opa-policies/encryption.rego for complete implementation.
CI/CD Integration:
terraform plan -out=tfplan.binary
terraform show -json tfplan.binary > tfplan.json
opa eval --data policies/ --input tfplan.json 'data.compliance.main.deny'
For complete CI/CD patterns, see references/cicd-integration.md.
Scan IaC with built-in compliance framework support:
checkov -d ./terraform \
--check SOC2 --check HIPAA --check PCI --check GDPR \
--output cli --output json
Create custom policies for organization-specific requirements. See examples/checkov-policies/ for examples.
Integrate compliance validation into test suites:
def test_s3_encrypted(terraform_plan):
"""SOC2:CC6.1, HIPAA:164.312(a)(2)(iv)"""
buckets = get_resources(terraform_plan, "aws_s3_bucket")
encrypted = get_encryption_configs(terraform_plan)
assert all_buckets_encrypted(buckets, encrypted)
def test_opa_policies():
result = subprocess.run(["opa", "eval", "--data", "policies/",
"--input", "tfplan.json", "data.compliance.main.deny"])
assert not json.loads(result.stdout)
For complete test patterns, see references/compliance-testing.md.
Standards: AES-256, managed KMS, automatic rotation
AWS Example:
resource "aws_kms_key" "data" {
enable_key_rotation = true
tags = { Compliance = "ENC-001" }
}
resource "aws_s3_bucket_server_side_encryption_configuration" "data" {
bucket = aws_s3_bucket.data.id
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "aws:kms"
kms_master_key_id = aws_kms_key.data.arn
}
}
}
resource "aws_db_instance" "main" {
storage_encrypted = true
kms_key_id = aws_kms_key.data.arn
}
For complete encryption implementations including Azure and GCP, see references/encryption-implementations.md.
Standards: TLS 1.3 (TLS 1.2 minimum), strong ciphers, HSTS
ALB Example:
resource "aws_lb_listener" "https" {
port = 443
protocol = "HTTPS"
ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06"
}
Standards: TOTP, hardware tokens, biometric for privileged access
AWS IAM Enforcement:
resource "aws_iam_policy" "require_mfa" {
policy = jsonencode({
Statement = [{
Effect = "Deny"
NotAction = ["iam:CreateVirtualMFADevice", "iam:EnableMFADevice"]
Resource = "*"
Condition = {
BoolIfExists = { "aws:MultiFactorAuthPresent" = "false" }
}
}]
})
}
For application-level MFA (TOTP), see examples/mfa-implementation.py.
Standards: Least privilege, job function-based roles, quarterly reviews
Kubernetes Example:
apiVersion: rbac.authorization.k8s.io/v1