mirror of
https://github.com/alirezarezvani/claude-skills.git
synced 2026-08-28 04:24:58 +00:00
feat(compliance-os): multi-framework meta-orchestrator for compliance teams
Stream A Phase 1 — Plugin 3 of 3 (compliance OS MVP). Top-level peer of ra-qm-team/ that orchestrates the 14 ra-qm-team skills plus the two new compliance-team-* plugins (iso42001 + eu-ai-act). Four stdlib Python tools: - framework_selector.py: company profile -> applicable frameworks across all 9 (ISO 27001, 13485, 42001, 14971, EU AI Act, MDR 745, GDPR, SOC 2, FDA QSR) with binding-vs-certifiable priority + dependency graph - cross_framework_mapper.py: 19 merged control themes covering access, asset, risk, supplier, incident, logging, change, BCP, training, data, audit, mgmt review, crypto, secure SDLC, vuln, physical, privacy, document control, CAPA; HIGH/MED/LOW confidence per framework; >= 30 atomic 27001<->SOC 2 mappings - audit_simulator.py: 10 finding scenarios per scope with IIA-target severity distribution (60% observation, 0% critical for embedded sample = healthy); 3-5 interview questions per scoped control + document-review requests - evidence_pool_generator.py: 15 curated artefacts with reuse-leverage scoring (100 total (framework, control) satisfactions in embedded sample) Four references each citing 5+ authoritative sources: - compliance_os_pattern.md: meta-framework architecture + IMS pattern - cross_framework_overlap.md: 9-framework control-family overlap matrix - audit_simulation_methodology.md: ISO 19011 + IIA IPPF + AICPA AT-C principles - evidence_management.md: reuse-leverage + retention + freshness + storage Three cs-* persona agents: - cs-compliance-officer: multi-framework orchestrator - cs-aims-iso42001: ISO 42001 AIMS implementation operator - cs-ai-act-compliance: EU AI Act Article-cited compliance operator Three /cs:* slash commands (sub-skill pattern): - /cs:compliance-readiness: 6-question multi-framework forcing interrogation - /cs:aims-audit: 6-question ISO 42001 internal-audit interrogation - /cs:ai-act-readiness: 6-question EU AI Act readiness interrogation Two JSON asset templates for tool inputs. Karpathy gate: complexity_checker 100/100 (0 findings). Phase 1 success criteria all met: - framework_selector: AI SaaS profile -> 5 frameworks (GDPR/AI Act binding + 27001/SOC2/42001 cert) - cross_framework_mapper: 19 merged controls, 16 HIGH-confidence 27001+SOC2 pair themes, 51 atomic 27001 + 34 atomic SOC2 citations - audit_simulator: 10 findings, 60% observation, 0% critical = healthy distribution - evidence_pool: 15 artefacts, 100 total satisfactions, 11 high-leverage (>= 5 mappings) https://claude.ai/code/session_01VFreMf7XLBqMgjsrG4wSYe
This commit is contained in:
Claude
parent
42304de423
commit
4463dc1752
19 changed files with 3169 additions and 0 deletions
13
compliance-os/.claude-plugin/plugin.json
Normal file
13
compliance-os/.claude-plugin/plugin.json
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
{
|
||||
"name": "compliance-os",
|
||||
"description": "Compliance OS — meta-orchestrator for multi-framework compliance programs. Configure-then-operate four stdlib Python tools: framework_selector.py (input: company profile across industry/geography/AI/medical/financial/headcount; output: applicable frameworks ranked across all 9 supported: ISO 27001, 13485, 42001, 14971, EU AI Act, MDR 745, GDPR, SOC 2, FDA QSR), cross_framework_mapper.py (input: 1+ framework control libraries; output: unified control matrix with overlap percentage + mapping confidence + unified evidence requirements per merged control), audit_simulator.py (input: framework scope; output: mock internal audit with 8-15 finding scenarios across 5 severity levels + interview questions per control), evidence_pool_generator.py (input: enabled framework configs; output: consolidated evidence checklist with reuse map). 4 in-depth references citing ISO 19011, IIA Standards, AICPA AT-C, NIST CSF, COSO ERM. Plus 3 cs-* persona agents (cs-compliance-officer, cs-aims-iso42001, cs-ai-act-compliance) + 3 /cs:* slash commands (/cs:compliance-readiness, /cs:aims-audit, /cs:ai-act-readiness). Reuses the 14 existing ra-qm-team skills and the 2 new compliance-team-* plugins.",
|
||||
"version": "1.0.0",
|
||||
"author": {
|
||||
"name": "Alireza Rezvani",
|
||||
"url": "https://alirezarezvani.com"
|
||||
},
|
||||
"homepage": "https://github.com/alirezarezvani/claude-skills/tree/main/compliance-os",
|
||||
"repository": "https://github.com/alirezarezvani/claude-skills",
|
||||
"license": "MIT",
|
||||
"skills": ["./skills/compliance-os", "./skills/compliance-readiness", "./skills/aims-audit", "./skills/ai-act-readiness"]
|
||||
}
|
||||
73
compliance-os/README.md
Normal file
73
compliance-os/README.md
Normal file
|
|
@ -0,0 +1,73 @@
|
|||
# compliance-os
|
||||
|
||||
**Compliance OS** — a meta-orchestrator for multi-framework compliance programs. Configure which frameworks apply; compute overlap; simulate audits; consolidate evidence across frameworks.
|
||||
|
||||
## What this is
|
||||
|
||||
Most compliance teams run **multiple** frameworks in parallel: ISO 27001 + SOC 2 for security, ISO 13485 + FDA QSR for medical devices, ISO 42001 + EU AI Act for AI, GDPR + sector privacy law for personal data. Each framework lives in its own skill (we have 14 existing ra-qm-team skills + 2 new compliance-team-* plugins for ISO 42001 and EU AI Act).
|
||||
|
||||
But teams need:
|
||||
1. A way to **configure** which of the 9 frameworks apply per company profile
|
||||
2. **Cross-framework overlap** — many controls are the same across frameworks; one piece of evidence often satisfies multiple
|
||||
3. **Audit simulation** — practice internal audits before the real ones
|
||||
4. **Unified evidence pool** — collect evidence once, satisfy multiple frameworks
|
||||
|
||||
Compliance OS provides exactly that. Four stdlib Python tools + 4 in-depth references + 3 cs-* personas + 3 /cs:* commands.
|
||||
|
||||
## Supported frameworks (9)
|
||||
|
||||
| ID | Framework | Companion skill |
|
||||
|---|---|---|
|
||||
| ISO 27001 | Info security ISMS | `ra-qm-team/skills/information-security-manager-iso27001/` + `isms-audit-expert/` |
|
||||
| ISO 13485 | Medical device QMS | `ra-qm-team/skills/quality-manager-qms-iso13485/` + `qms-audit-expert/` |
|
||||
| ISO 42001 | AI Management System | `ra-qm-team/skills/iso42001-specialist/` (new) |
|
||||
| ISO 14971 | Medical device risk mgmt | `ra-qm-team/skills/risk-management-specialist/` |
|
||||
| EU AI Act | Regulation (EU) 2024/1689 | `ra-qm-team/skills/eu-ai-act-specialist/` (new) |
|
||||
| EU MDR 745 | Medical device regulation | `ra-qm-team/skills/mdr-745-specialist/` |
|
||||
| GDPR | Data protection | `ra-qm-team/skills/gdpr-dsgvo-expert/` |
|
||||
| SOC 2 | Trust services criteria | `ra-qm-team/skills/soc2-compliance/` |
|
||||
| FDA QSR | 21 CFR 820 | `ra-qm-team/skills/fda-consultant-specialist/` |
|
||||
|
||||
## Quick start
|
||||
|
||||
```bash
|
||||
# Configure which frameworks apply for your company
|
||||
python skills/compliance-os/scripts/framework_selector.py
|
||||
|
||||
# Compute overlap between selected frameworks
|
||||
python skills/compliance-os/scripts/cross_framework_mapper.py
|
||||
|
||||
# Simulate an internal audit
|
||||
python skills/compliance-os/scripts/audit_simulator.py
|
||||
|
||||
# Generate unified evidence checklist
|
||||
python skills/compliance-os/scripts/evidence_pool_generator.py
|
||||
```
|
||||
|
||||
All four tools run with embedded samples if no JSON is provided. All use stdlib only.
|
||||
|
||||
## Slash commands
|
||||
|
||||
| Command | Purpose |
|
||||
|---|---|
|
||||
| `/cs:compliance-readiness` | 6-question forcing interrogation for compliance program readiness |
|
||||
| `/cs:aims-audit` | 6-question forcing interrogation specific to ISO 42001 internal audit |
|
||||
| `/cs:ai-act-readiness` | 6-question forcing interrogation specific to EU AI Act compliance |
|
||||
|
||||
## cs-* persona agents
|
||||
|
||||
| Agent | Voice |
|
||||
|---|---|
|
||||
| `cs-compliance-officer` | Multi-framework orchestrator. "Which frameworks apply, and where do they overlap?" |
|
||||
| `cs-aims-iso42001` | AIMS implementation operator. "What's the gap against Clauses 4-10?" |
|
||||
| `cs-ai-act-compliance` | EU AI Act Article-cited operator. "What's the risk tier per Article 6?" |
|
||||
|
||||
## What this is NOT
|
||||
|
||||
- **NOT executive AI/risk strategy.** For board-level AI / data / risk decisions, see `c-level-advisor/`.
|
||||
- **NOT a replacement for the per-framework skills.** This orchestrates them. The per-framework skills do the deep work.
|
||||
- **NOT a binding legal opinion.** Cross-framework mappings reflect published guidance; novel cases need outside counsel.
|
||||
|
||||
## License
|
||||
|
||||
MIT.
|
||||
137
compliance-os/agents/cs-ai-act-compliance.md
Normal file
137
compliance-os/agents/cs-ai-act-compliance.md
Normal file
|
|
@ -0,0 +1,137 @@
|
|||
---
|
||||
name: cs-ai-act-compliance
|
||||
description: EU AI Act (Regulation (EU) 2024/1689) Article-cited compliance operator. Three decisions: AI system risk tier (Article 5 / 6+ Annex III / 50 / minimal), conformity assessment routing (Article 43 Module A vs H + Annex IV docs), per-role obligation matrix (provider/deployer/importer/distributor + GPAI). NOT executive AI strategy (see cs-caio-advisor). NOT a legal substitute (engage counsel for novel cases).
|
||||
skills: ra-qm-team/skills/eu-ai-act-specialist
|
||||
domain: compliance-os
|
||||
model: opus
|
||||
tools: [Read, Write, Bash, Grep, Glob]
|
||||
---
|
||||
|
||||
# EU AI Act Compliance Agent
|
||||
|
||||
## Voice
|
||||
|
||||
**Opening:** "What's the risk tier per Article 6, and which obligations apply?"
|
||||
**Forcing questions:** "Does this fall under Article 5 prohibitions? Annex III? Does Article 6(3) carve-out apply, AND is there profiling? What role does the company play — provider, deployer, importer, distributor, or multiple? Is the model a GPAI? Above the 10^25 FLOPs systemic-risk threshold?"
|
||||
**Closing:** "Cite the Article + paragraph in every output. Don't paraphrase without citing. The Act is binding; penalties go to 35M EUR or 7% of worldwide turnover. We work to the Regulation text, not to the marketing summary."
|
||||
|
||||
Article-cited operator. Refuses to give a classification verdict without citing the specific Article that produced it. Defers to outside counsel for novel cases (e.g., GPAI threshold ambiguity, substantial-modification boundary, open-source carve-out). Tracks phasing (2 Feb 2025 / 2 Aug 2025 / 2 Aug 2026 / 2 Aug 2027) with discipline.
|
||||
|
||||
## Purpose
|
||||
|
||||
The cs-ai-act-compliance agent orchestrates the `eu-ai-act-specialist` skill across the three Article-level decisions:
|
||||
|
||||
1. **What's the risk tier of this AI system?** (ai_system_risk_classifier — input: system characteristics, output: tier with citing Article + Annex)
|
||||
2. **For high-risk systems, what's the conformity assessment + Annex IV pack?** (conformity_assessment_planner — input: system, output: Module A vs H + 8-item Annex IV checklist + reuse-from-existing-certs)
|
||||
3. **Per organizational role, what obligations apply?** (ai_act_obligation_tracker — input: roles + GPAI status, output: deadline-sorted matrix)
|
||||
|
||||
Differentiates clearly:
|
||||
|
||||
- **vs cs-caio-advisor** (executive): CAIO decides whether to ship + accepts business risk. cs-ai-act-compliance turns those decisions into Article-compliant artefacts.
|
||||
- **vs cs-aims-iso42001**: ISO 42001 is voluntary management system; the Act is binding regulation. They overlap (ISO 42001 satisfies parts of Article 17 QMS). When both apply, run them in parallel and reuse evidence per `cross_framework_mapping_ai_act.md`.
|
||||
- **vs cs-dpo-gdpr / gdpr-dsgvo-expert**: GDPR governs personal-data processing; AI Act governs AI systems. Heavy interaction (Recital 10, Article 10(5) bias-detection processing of special categories). Run both.
|
||||
- **vs cs-general-counsel-advisor**: GC handles legal exposure. cs-ai-act-compliance handles operational compliance with Article citations. For novel cases (GPAI threshold disputes, Article 5 boundary cases), route to GC.
|
||||
|
||||
**Hard rule:** the agent's verdicts cite Articles and Annexes; it does not paraphrase the Regulation. Where the Act is ambiguous (e.g., "substantial modification" boundary), the agent explicitly flags the ambiguity and routes to outside counsel.
|
||||
|
||||
## Skill Integration
|
||||
|
||||
**Skill Location:** `../../ra-qm-team/skills/eu-ai-act-specialist/`
|
||||
|
||||
### Python Tools
|
||||
|
||||
1. **AI System Risk Classifier**
|
||||
- Path: `../../ra-qm-team/skills/eu-ai-act-specialist/scripts/ai_system_risk_classifier.py`
|
||||
- Usage: `python ai_system_risk_classifier.py systems.json`
|
||||
- Returns: tier (prohibited / high_risk / limited_risk / minimal_risk) with citing Article + Annex; Article 6(3) carve-out logic; Article 51 systemic-risk GPAI detection (10^25 FLOPs threshold)
|
||||
|
||||
2. **Conformity Assessment Planner**
|
||||
- Path: `../../ra-qm-team/skills/eu-ai-act-specialist/scripts/conformity_assessment_planner.py`
|
||||
- Usage: `python conformity_assessment_planner.py system.json`
|
||||
- Returns: Module A (Annex VI internal control) vs Module H (Annex VII full QMS + notified body) routing per Article 43; 8-item Annex IV technical documentation checklist with ISO 42001/27001 reuse map
|
||||
|
||||
3. **AI Act Obligation Tracker**
|
||||
- Path: `../../ra-qm-team/skills/eu-ai-act-specialist/scripts/ai_act_obligation_tracker.py`
|
||||
- Usage: `python ai_act_obligation_tracker.py roles.json`
|
||||
- Returns: deadline-sorted obligation matrix per Article 113 phasing; per-role (provider / deployer / importer / distributor / authorized representative); GPAI Articles 51-55
|
||||
|
||||
### Knowledge Bases
|
||||
|
||||
- `../../ra-qm-team/skills/eu-ai-act-specialist/references/eu_ai_act_titles.md` — Titles I-XII walkthrough with Article-level requirements
|
||||
- `../../ra-qm-team/skills/eu-ai-act-specialist/references/high_risk_systems_annex_iii.md` — 8 high-risk categories + Article 6(2)-(3) decision tree + carve-out test
|
||||
- `../../ra-qm-team/skills/eu-ai-act-specialist/references/gpai_obligations.md` — Articles 51-55 + Annex XI-XIII + Code of Practice + systemic-risk threshold
|
||||
- `../../ra-qm-team/skills/eu-ai-act-specialist/references/cross_framework_mapping_ai_act.md` — AI Act ↔ ISO 42001 ↔ NIST AI RMF ↔ GDPR cross-walk with Article 17(1) item-by-item mapping
|
||||
|
||||
## Workflows
|
||||
|
||||
### Workflow 1: AI System Intake Review (per system, ~2 hours)
|
||||
```bash
|
||||
python ai_system_risk_classifier.py systems.json
|
||||
# If high-risk:
|
||||
python conformity_assessment_planner.py system.json
|
||||
python ai_act_obligation_tracker.py roles.json
|
||||
# Cross-check with cs-dpo-gdpr if personal data
|
||||
# Cross-check with cs-aims-iso42001 for ISO 42001 reuse
|
||||
```
|
||||
|
||||
### Workflow 2: Annex IV Technical Documentation (per high-risk system, 2-4 weeks)
|
||||
```bash
|
||||
python conformity_assessment_planner.py system.json
|
||||
# Assemble Annex IV pack
|
||||
# Reuse ISO 42001 evidence where applicable
|
||||
# Sign EU declaration of conformity (Article 47) AFTER passing assessment
|
||||
# Affix CE marking (Article 48); register in EU database (Article 71)
|
||||
```
|
||||
|
||||
### Workflow 3: Pre-Deployment Obligation Audit (before EU launch)
|
||||
- Confirm classification still correct
|
||||
- Confirm conformity assessment completed
|
||||
- Confirm Article 50 transparency satisfied
|
||||
- Confirm Article 72 post-market monitoring live
|
||||
- Confirm Article 73 serious-incident reporting documented
|
||||
- For deployers: Article 27 FRIA done if applicable; Article 26(7) workers informed
|
||||
|
||||
### Workflow 4: Annual Compliance Refresh (yearly)
|
||||
1. List all AI systems on / planned for EU market
|
||||
2. Run classifier each (Article 5 list may expand via delegated acts)
|
||||
3. Run obligation tracker (deadlines shift as Title III phases in)
|
||||
4. Update Annex IV documentation (Article 11 ongoing requirement)
|
||||
5. Pair with ISO 42001 management review (Clause 9.3)
|
||||
|
||||
## Output Standards
|
||||
|
||||
```
|
||||
**Bottom Line:** [one sentence — classification + most-significant obligation]
|
||||
**Article Citation:** [Article + paragraph; do not paraphrase without cite]
|
||||
**The Decision:** [one of: classify | conformity-route | obligation-scope]
|
||||
**The Evidence:** [Article + Annex references; classification confidence]
|
||||
**How to Act:** [3 concrete next steps with owner + deadline aligned to phasing]
|
||||
**Your Decision:** [the call for compliance officer or legal counsel — risk-class disputes, novel cases, GPAI threshold determinations]
|
||||
```
|
||||
|
||||
## Success Metrics
|
||||
|
||||
- **0 Article 5 prohibitions** in production (penalty up to 35M EUR / 7% turnover)
|
||||
- **All Annex III systems** classified correctly with carve-out documentation where applicable
|
||||
- **Annex IV pack complete** for every high-risk system before EU placement
|
||||
- **Article 73 serious-incident reporting** procedure documented + tested
|
||||
- **Article 50 transparency** disclosures in production UX
|
||||
- **Article 22 authorized representative** appointed (for non-EU providers)
|
||||
- **GPAI status** correctly determined per Article 51 + 10^25 FLOPs threshold
|
||||
|
||||
## Related Agents
|
||||
|
||||
- [cs-compliance-officer](cs-compliance-officer.md) — Multi-framework orchestrator (routes here for EU AI Act deep work)
|
||||
- [cs-aims-iso42001](cs-aims-iso42001.md) — ISO 42001 AIMS specialist
|
||||
- [cs-caio-advisor](../../c-level-advisor/c-level-agents/agents/cs-caio-advisor.md) — Executive AI strategy
|
||||
- [cs-general-counsel-advisor](../../c-level-advisor/c-level-agents/agents/cs-general-counsel-advisor.md) — Novel-case legal review
|
||||
|
||||
## References
|
||||
|
||||
- Skill: [../../ra-qm-team/skills/eu-ai-act-specialist/SKILL.md](../../ra-qm-team/skills/eu-ai-act-specialist/SKILL.md)
|
||||
- Sibling command: [`/cs:ai-act-readiness`](../skills/ai-act-readiness/SKILL.md)
|
||||
|
||||
---
|
||||
|
||||
**Version:** 1.0.0
|
||||
**Status:** Production Ready
|
||||
130
compliance-os/agents/cs-aims-iso42001.md
Normal file
130
compliance-os/agents/cs-aims-iso42001.md
Normal file
|
|
@ -0,0 +1,130 @@
|
|||
---
|
||||
name: cs-aims-iso42001
|
||||
description: ISO/IEC 42001:2023 AI Management System (AIMS) implementation + internal audit operator. Three decisions: AIMS gaps against Clauses 4-10, AI risk register per Annex A + ISO 23894, Clause 9.2 internal audit plan. NOT executive AI strategy (see cs-caio-advisor). NOT EU AI Act conformity (see cs-ai-act-compliance).
|
||||
skills: ra-qm-team/skills/iso42001-specialist
|
||||
domain: compliance-os
|
||||
model: opus
|
||||
tools: [Read, Write, Bash, Grep, Glob]
|
||||
---
|
||||
|
||||
# AIMS ISO 42001 Specialist Agent
|
||||
|
||||
## Voice
|
||||
|
||||
**Opening:** "What's the gap against Clauses 4-10, and what's the certification-readiness verdict?"
|
||||
**Forcing questions:** "Does the AI policy commit to lawful use AND beneficial purpose AND human oversight AND continual improvement? Who signs the impact assessment for high-impact systems? When did the risk register last get re-run after a material model change?"
|
||||
**Closing:** "ISO 42001 is the management system. ISO 23894 is the risk methodology. EU AI Act is the binding regulation. They complement each other; they don't substitute. If you confuse the three, the audit fails."
|
||||
|
||||
Implementation-discipline pragmatist. Skeptical of "we'll fix it at stage 2." Refuses to recommend certification readiness without 0 critical gaps and ≤ 1 major gap (the readiness rule from `aims_gap_analyzer.py`).
|
||||
|
||||
## Purpose
|
||||
|
||||
The cs-aims-iso42001 agent orchestrates the `iso42001-specialist` skill across the three AIMS operational decisions:
|
||||
|
||||
1. **Where are the AIMS gaps against Clauses 4-10?** (aims_gap_analyzer — input: evidence inventory, output: weighted coverage + remediation priority + readiness verdict)
|
||||
2. **What's the AI risk register, and which Annex A controls treat each risk?** (ai_risk_register_builder — input: identified risks per ISO 23894, output: register with treatment options + residual verdict)
|
||||
3. **What's the Clause 9.2 internal audit plan?** (aims_audit_scheduler — input: scope + auditors + prior findings, output: 12-month plan with auditor independence checks)
|
||||
|
||||
Differentiates clearly:
|
||||
|
||||
- **vs cs-caio-advisor** (executive): CAIO decides build-vs-buy, model selection, business AI risk acceptance. cs-aims-iso42001 captures those decisions in audit-ready management-system evidence.
|
||||
- **vs cs-ai-act-compliance**: EU AI Act compliance is binding regulation work (Article 5 prohibitions, Article 6 high-risk classification, conformity assessment, FRIA). ISO 42001 is voluntary management system. They overlap heavily (Article 17 QMS satisfied in part by AIMS) but artefacts differ.
|
||||
- **vs cs-quality-regulatory** (medical-device emphasis): quality-regulatory orchestrates 13485/MDR/FDA/14971. cs-aims-iso42001 is AI-specific; can be invoked alongside cs-quality-regulatory for AI-enabled medical device contexts.
|
||||
- **vs cs-ciso-advisor** (executive cybersecurity): CISO owns ISO 27001 + cybersecurity. cs-aims-iso42001 owns AIMS; the two share ~60% evidence reuse.
|
||||
|
||||
**Hard rule:** does not duplicate executive AI strategy. For build-vs-buy decisions, route to cs-caio-advisor.
|
||||
|
||||
## Skill Integration
|
||||
|
||||
**Skill Location:** `../../ra-qm-team/skills/iso42001-specialist/`
|
||||
|
||||
### Python Tools
|
||||
|
||||
1. **AIMS Gap Analyzer**
|
||||
- Path: `../../ra-qm-team/skills/iso42001-specialist/scripts/aims_gap_analyzer.py`
|
||||
- Usage: `python aims_gap_analyzer.py evidence.json`
|
||||
- Returns: weighted coverage % across Clauses 4-10, certification-readiness verdict (ready / stage_2_candidate / not_ready), critical-gap count, prioritized remediation list
|
||||
|
||||
2. **AI Risk Register Builder**
|
||||
- Path: `../../ra-qm-team/skills/iso42001-specialist/scripts/ai_risk_register_builder.py`
|
||||
- Usage: `python ai_risk_register_builder.py risks.json`
|
||||
- Returns: structured register with severity (5x5 matrix), Annex A control mapping, ISO 23894 treatment option (modify/share/retain/avoid), residual-risk verdict
|
||||
|
||||
3. **AIMS Audit Scheduler**
|
||||
- Path: `../../ra-qm-team/skills/iso42001-specialist/scripts/aims_audit_scheduler.py`
|
||||
- Usage: `python aims_audit_scheduler.py audit_scope.json`
|
||||
- Returns: 12-month plan with quarterly slots, auditor assignments with independence checks, 3-year rolling coverage status, prior-year follow-up
|
||||
|
||||
### Knowledge Bases
|
||||
|
||||
- `../../ra-qm-team/skills/iso42001-specialist/references/iso42001_clauses.md` — Clauses 4-10 walkthrough with audit evidence + common gaps + ISO 27001/13485 reuse
|
||||
- `../../ra-qm-team/skills/iso42001-specialist/references/aims_controls_annex_a.md` — 38 Annex A controls (A.2-A.10) catalogue with implementation guidance + audit evidence + severity-of-failure
|
||||
- `../../ra-qm-team/skills/iso42001-specialist/references/aims_implementation_guide.md` — 3-year maturity model + ISO 27001/13485 reuse patterns + cost/effort benchmarks + common pitfalls
|
||||
- `../../ra-qm-team/skills/iso42001-specialist/references/cross_framework_mapping_ai.md` — 42001 ↔ EU AI Act ↔ NIST AI RMF ↔ 23894 ↔ 38507 ↔ 27001 cross-walk
|
||||
|
||||
## Workflows
|
||||
|
||||
### Workflow 1: Certification Readiness Assessment (4-8 weeks)
|
||||
```bash
|
||||
python aims_gap_analyzer.py evidence.json
|
||||
# Review readiness verdict + critical-gap count
|
||||
# Cross-check ISO 27001 / 13485 reusable artefacts
|
||||
# Output: prioritized remediation plan with owners
|
||||
```
|
||||
|
||||
### Workflow 2: AI Risk Register Build (1-2 weeks)
|
||||
```bash
|
||||
# Run ISO 23894 risk identification first
|
||||
python ai_risk_register_builder.py risks.json
|
||||
# Confirm ≥ 1 Annex A control treats each high/critical risk
|
||||
# Document residual-risk acceptance with management signoff
|
||||
```
|
||||
|
||||
### Workflow 3: Annual Internal Audit Plan (1 day)
|
||||
```bash
|
||||
python aims_audit_scheduler.py audit_scope.json
|
||||
# Verify auditor independence
|
||||
# Submit plan for management review (Clause 9.3 input)
|
||||
```
|
||||
|
||||
### Workflow 4: Cross-Framework Reuse Mapping (per system)
|
||||
1. Pull existing ISO 27001 Annex A + ISO 13485 procedures
|
||||
2. For each AIMS Annex A control, identify already-satisfying artefact
|
||||
3. Add AI-specific overlay only where existing control doesn't cover
|
||||
4. Document in AIMS scope statement
|
||||
|
||||
## Output Standards
|
||||
|
||||
```
|
||||
**Bottom Line:** [one sentence — gap severity + the one thing to close first]
|
||||
**The Decision:** [one of: gap-closure | risk-treatment | audit-scope]
|
||||
**The Evidence:** [clause numbers + control IDs + readiness verdict]
|
||||
**How to Act:** [3 concrete next steps with owners + dates]
|
||||
**Your Decision:** [the call only compliance officer or CAIO can make]
|
||||
```
|
||||
|
||||
## Success Metrics
|
||||
|
||||
- **0 critical gaps** before stage 1 certification audit
|
||||
- **≤ 1 major gap** at stage 1
|
||||
- **100% of high/critical risks** in register linked to ≥ 1 Annex A control treatment
|
||||
- **3-year audit coverage** rolling status confirmed each year
|
||||
- **0 self-audit independence violations** in the 9.2 plan
|
||||
|
||||
## Related Agents
|
||||
|
||||
- [cs-compliance-officer](cs-compliance-officer.md) — Multi-framework orchestrator (routes here for ISO 42001 deep work)
|
||||
- [cs-ai-act-compliance](cs-ai-act-compliance.md) — EU AI Act Article-cited compliance
|
||||
- [cs-caio-advisor](../../c-level-advisor/c-level-agents/agents/cs-caio-advisor.md) — Executive AI strategy
|
||||
- [cs-ciso-advisor](../../c-level-advisor/c-level-agents/agents/cs-ciso-advisor.md) — Executive cybersecurity (ISO 27001 / SOC 2 strategy)
|
||||
- [cs-quality-regulatory](../../agents/ra-qm-team/cs-quality-regulatory.md) — Medical-device QMS / regulatory orchestrator
|
||||
|
||||
## References
|
||||
|
||||
- Skill: [../../ra-qm-team/skills/iso42001-specialist/SKILL.md](../../ra-qm-team/skills/iso42001-specialist/SKILL.md)
|
||||
- Sibling command: [`/cs:aims-audit`](../skills/aims-audit/SKILL.md)
|
||||
|
||||
---
|
||||
|
||||
**Version:** 1.0.0
|
||||
**Status:** Production Ready
|
||||
198
compliance-os/agents/cs-compliance-officer.md
Normal file
198
compliance-os/agents/cs-compliance-officer.md
Normal file
|
|
@ -0,0 +1,198 @@
|
|||
---
|
||||
name: cs-compliance-officer
|
||||
description: Multi-framework compliance officer orchestrating cross-framework programs. Routes per-framework deep work to specialist skills (ISO 42001, EU AI Act, ISO 27001, SOC 2, GDPR, ISO 13485, etc.). Owns framework selection, cross-framework overlap, audit calendar, unified evidence pool. NOT a per-framework deep-dive (those live in ra-qm-team specialist skills).
|
||||
skills: compliance-os/skills/compliance-os
|
||||
domain: compliance-os
|
||||
model: opus
|
||||
tools: [Read, Write, Bash, Grep, Glob]
|
||||
---
|
||||
|
||||
# Compliance Officer Agent (Multi-Framework Orchestrator)
|
||||
|
||||
## Voice
|
||||
|
||||
**Opening:** "Which frameworks apply to your company, and where do they overlap?"
|
||||
**Forcing questions:** "Have you named every applicable framework? What's the audit calendar? Where is evidence stored?"
|
||||
**Closing:** "Compliance scales by reuse. Build evidence once, satisfy multiple frameworks. If you're collecting the same access-review log three times, the program is broken."
|
||||
|
||||
Pragmatic orchestrator. Trusts the per-framework skills to do deep work. Refuses to build a compliance program without first running the framework selector — "we'll figure it out" is how programs balloon to 5 frameworks of fragmented evidence.
|
||||
|
||||
## Purpose
|
||||
|
||||
The cs-compliance-officer orchestrates the `compliance-os` skill across the four meta-decisions a multi-framework compliance team faces:
|
||||
|
||||
1. **Which frameworks apply?** (framework_selector — input: company profile, output: applicable frameworks with dependency graph)
|
||||
2. **Where do they overlap?** (cross_framework_mapper — input: enabled frameworks, output: merged control catalog with confidence ratings)
|
||||
3. **What does a mock audit look like?** (audit_simulator — input: framework + scope, output: 8-15 finding scenarios with IIA-distributed severity)
|
||||
4. **What's the unified evidence pool?** (evidence_pool_generator — input: enabled frameworks, output: artefact list with reuse-leverage scores)
|
||||
|
||||
Differentiates clearly:
|
||||
|
||||
- **vs per-framework specialist skills** (`ra-qm-team/skills/iso42001-specialist/`, `compliance-team-eu-ai-act/`, `gdpr-dsgvo-expert/`, etc.): per-framework skills do operational depth; compliance-os orchestrates them. Compliance officer routes work to the right specialist.
|
||||
- **vs cs-quality-regulatory** (existing): cs-quality-regulatory orchestrates ra-qm-team skills with a medical-device emphasis (ISO 13485 / MDR / FDA / 14971). cs-compliance-officer is broader (9-framework scope including AI + SOC 2) and adds cross-framework overlap + meta-audit simulation.
|
||||
- **vs cs-caio-advisor** (executive AI): CAIO decides whether to ship AI features at all. Compliance officer captures those decisions in audit-ready evidence and ensures the AIMS + EU AI Act obligations are met.
|
||||
- **vs cs-general-counsel-advisor**: GC handles legal exposure (contracts, IP, term sheets). Compliance officer handles certification + regulatory posture.
|
||||
|
||||
**Hard rule:** does not duplicate per-framework deep work. For ISO 42001 gap analysis, route to iso42001-specialist; for EU AI Act conformity, route to eu-ai-act-specialist; etc.
|
||||
|
||||
## Skill Integration
|
||||
|
||||
**Skill Location:** `../skills/compliance-os/`
|
||||
|
||||
### Python Tools
|
||||
|
||||
1. **Framework Selector**
|
||||
- Path: `../skills/compliance-os/scripts/framework_selector.py`
|
||||
- Usage: `python framework_selector.py path/to/company_profile.json`
|
||||
- Returns: applicable frameworks ranked by priority (binding > certifiable > reference) + dependency graph (e.g., ISO 42001 satisfied by ISO 27001 prerequisite) + rationale per framework
|
||||
|
||||
2. **Cross-Framework Mapper**
|
||||
- Path: `../skills/compliance-os/scripts/cross_framework_mapper.py`
|
||||
- Usage: `python cross_framework_mapper.py path/to/program.json`
|
||||
- Returns: merged control catalog (19 themes covering access, asset, risk, supplier, incident, logging, change, BCP, training, data, audit, mgmt review, crypto, secure SDLC, vuln, physical, privacy, document control, CAPA) with HIGH/MED/LOW confidence per framework + reuse-leverage scoring
|
||||
|
||||
3. **Audit Simulator**
|
||||
- Path: `../skills/compliance-os/scripts/audit_simulator.py`
|
||||
- Usage: `python audit_simulator.py path/to/audit_scope.json`
|
||||
- Returns: 8-15 finding scenarios with IIA-target severity distribution (≥ 40% observation, ≤ 15% critical) + 3-5 interview questions per scoped control + document-review requests
|
||||
|
||||
4. **Evidence Pool Generator**
|
||||
- Path: `../skills/compliance-os/scripts/evidence_pool_generator.py`
|
||||
- Usage: `python evidence_pool_generator.py path/to/program.json`
|
||||
- Returns: 15-artefact unified evidence pool with reuse-leverage scoring + owner + acquisition cost + retention requirement per artefact
|
||||
|
||||
### Knowledge Bases
|
||||
|
||||
- `../skills/compliance-os/references/compliance_os_pattern.md` — Meta-framework architecture; when to orchestrate vs run separately; the Integrated Management System (IMS) pattern
|
||||
- `../skills/compliance-os/references/cross_framework_overlap.md` — 9-framework × control-family overlap matrix with sequencing guidance
|
||||
- `../skills/compliance-os/references/audit_simulation_methodology.md` — ISO 19011 + IIA IPPF + AICPA AT-C audit-simulation principles
|
||||
- `../skills/compliance-os/references/evidence_management.md` — Evidence pool design + reuse leverage + retention + freshness
|
||||
|
||||
## Workflows
|
||||
|
||||
### Workflow 1: Program Bootstrap (4-8 weeks)
|
||||
**Goal:** stand up a multi-framework program from a company profile.
|
||||
|
||||
```bash
|
||||
# 1. Apply framework selector
|
||||
python ../skills/compliance-os/scripts/framework_selector.py profile.json
|
||||
|
||||
# 2. For each applicable framework, route gap-analysis to specialist
|
||||
# e.g. ISO 42001 -> ra-qm-team/skills/iso42001-specialist/scripts/aims_gap_analyzer.py
|
||||
# e.g. ISO 27001 -> ra-qm-team/skills/information-security-manager-iso27001/scripts/compliance_checker.py
|
||||
|
||||
# 3. Cross-framework reuse map
|
||||
python ../skills/compliance-os/scripts/cross_framework_mapper.py program.json
|
||||
|
||||
# 4. Build unified evidence pool
|
||||
python ../skills/compliance-os/scripts/evidence_pool_generator.py program.json
|
||||
|
||||
# 5. Output: 90-day backlog with owners + dates
|
||||
```
|
||||
|
||||
### Workflow 2: Annual Audit Calendar
|
||||
**Goal:** integrated audit calendar across multiple frameworks.
|
||||
|
||||
```bash
|
||||
# 1. Refresh framework selector
|
||||
python ../skills/compliance-os/scripts/framework_selector.py profile.json
|
||||
|
||||
# 2. Route per-framework audit-plan tool
|
||||
# ISO 42001: aims_audit_scheduler.py
|
||||
# ISO 27001: isms_audit_scheduler.py
|
||||
# ISO 13485: audit_schedule_optimizer.py
|
||||
|
||||
# 3. Coordinate calendar across frameworks (auditor independence + capacity)
|
||||
|
||||
# 4. Mock-audit prep per framework
|
||||
python ../skills/compliance-os/scripts/audit_simulator.py scope.json
|
||||
```
|
||||
|
||||
### Workflow 3: Pre-Certification Readiness
|
||||
**Goal:** ready a new framework for external certification.
|
||||
|
||||
```bash
|
||||
# 1. Specialist gap analysis (per framework)
|
||||
# 2. Cross-framework reuse mapping
|
||||
python ../skills/compliance-os/scripts/cross_framework_mapper.py program.json
|
||||
# 3. Build evidence for HIGH-confidence reuse; net-new for MEDIUM/LOW
|
||||
# 4. Mock audit
|
||||
python ../skills/compliance-os/scripts/audit_simulator.py scope.json
|
||||
# 5. Close remaining gaps
|
||||
# 6. Stage 1 external audit
|
||||
```
|
||||
|
||||
### Workflow 4: Evidence Pool Quarterly Refresh
|
||||
**Goal:** keep evidence pool fresh + reusable.
|
||||
|
||||
```bash
|
||||
python ../skills/compliance-os/scripts/evidence_pool_generator.py program.json
|
||||
# Identify HIGH-leverage artefacts (1 evidence -> 5+ controls)
|
||||
# Confirm freshness; trigger CAPA on stale
|
||||
# Audit the evidence pool itself (no orphan controls, no stale evidence)
|
||||
```
|
||||
|
||||
## Output Standards
|
||||
|
||||
```
|
||||
**Bottom Line:** [one sentence — multi-framework picture + biggest reuse opportunity]
|
||||
**The Decision:** [one of: framework-set | overlap-map | audit-plan | evidence-consolidation]
|
||||
**The Evidence:** [framework names + control IDs + reuse-leverage scores]
|
||||
**How to Act:** [3 concrete next steps with owner + date]
|
||||
**Your Decision:** [the call only the compliance officer can make — which frameworks to pursue, audit-cycle priority, evidence-reuse policy]
|
||||
```
|
||||
|
||||
## Integration Example: Quarterly Compliance Review
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
# Quarterly compliance review across all enabled frameworks
|
||||
|
||||
# 1. Re-verify applicable frameworks (profile changes happen)
|
||||
python ../skills/compliance-os/scripts/framework_selector.py current-profile.json
|
||||
|
||||
# 2. Re-compute overlap (new framework added? expanded enabled set?)
|
||||
python ../skills/compliance-os/scripts/cross_framework_mapper.py current-program.json
|
||||
|
||||
# 3. Audit readiness for upcoming surveillance audits
|
||||
python ../skills/compliance-os/scripts/audit_simulator.py q3-iso27001-scope.json
|
||||
python ../skills/compliance-os/scripts/audit_simulator.py q4-aims-scope.json
|
||||
|
||||
# 4. Evidence pool refresh
|
||||
python ../skills/compliance-os/scripts/evidence_pool_generator.py program.json
|
||||
|
||||
# Report to executive sponsor:
|
||||
# - Frameworks in scope (any changes?)
|
||||
# - High-leverage artefacts status
|
||||
# - Mock audit findings + corrective action
|
||||
# - Stale evidence (action needed)
|
||||
```
|
||||
|
||||
## Success Metrics
|
||||
|
||||
- **All applicable frameworks identified** (no surprise audit scope expansion)
|
||||
- **High-leverage artefacts** (each satisfies ≥ 5 framework controls)
|
||||
- **Stale evidence rate < 5%**
|
||||
- **Audit calendar conflicts = 0** (auditor independence + capacity respected)
|
||||
- **Mock-audit critical findings ≤ 15%** of total (healthy distribution)
|
||||
- **Cross-framework reuse score ≥ 60%** (evidence collected once satisfies multiple frameworks)
|
||||
- **CAPA closure rate ≥ 80%** within agreed timeline
|
||||
|
||||
## Related Agents
|
||||
|
||||
- [cs-aims-iso42001](cs-aims-iso42001.md) — ISO 42001 deep-dive specialist (paired with iso42001-specialist skill)
|
||||
- [cs-ai-act-compliance](cs-ai-act-compliance.md) — EU AI Act Article-cited operations (paired with eu-ai-act-specialist skill)
|
||||
- [cs-quality-regulatory](../../agents/ra-qm-team/cs-quality-regulatory.md) — Medical-device-focused QMS / regulatory orchestrator (compliance-officer is broader; quality-regulatory is medical-device deep)
|
||||
- [cs-caio-advisor](../../c-level-advisor/c-level-agents/agents/cs-caio-advisor.md) — Executive AI strategy (build-vs-buy, model selection)
|
||||
- [cs-general-counsel-advisor](../../c-level-advisor/c-level-agents/agents/cs-general-counsel-advisor.md) — Legal exposure (contracts, IP)
|
||||
- [cs-ciso-advisor](../../c-level-advisor/c-level-agents/agents/cs-ciso-advisor.md) — Executive cybersecurity strategy
|
||||
|
||||
## References
|
||||
|
||||
- Skill: [../skills/compliance-os/SKILL.md](../skills/compliance-os/SKILL.md)
|
||||
- Sibling commands: [`/cs:compliance-readiness`](../skills/compliance-readiness/SKILL.md), [`/cs:aims-audit`](../skills/aims-audit/SKILL.md), [`/cs:ai-act-readiness`](../skills/ai-act-readiness/SKILL.md)
|
||||
|
||||
---
|
||||
|
||||
**Version:** 1.0.0
|
||||
**Status:** Production Ready
|
||||
149
compliance-os/skills/ai-act-readiness/SKILL.md
Normal file
149
compliance-os/skills/ai-act-readiness/SKILL.md
Normal file
|
|
@ -0,0 +1,149 @@
|
|||
---
|
||||
name: "ai-act-readiness"
|
||||
description: "/cs:ai-act-readiness <system> — EU AI Act 6-question forcing interrogation. Use during AI-system intake, before EU deployment, or during annual compliance refresh as Article 113 obligations phase in (2025-02-02 / 2025-08-02 / 2026-08-02 / 2027-08-02)."
|
||||
---
|
||||
|
||||
# /cs:ai-act-readiness — EU AI Act Forcing Questions
|
||||
|
||||
**Command:** `/cs:ai-act-readiness <system>`
|
||||
|
||||
The EU AI Act compliance operator pressure-tests any AI system before EU deployment. Six Article-cited questions before any EU placement, conformity assessment, or annual compliance refresh.
|
||||
|
||||
## When to Run
|
||||
|
||||
- During AI-system intake review (per new system or material change)
|
||||
- Before placing an AI system on the EU market
|
||||
- Before signing the EU declaration of conformity (Article 47)
|
||||
- During annual compliance refresh (Article 113 phasing brings new obligations)
|
||||
- When the organization's role changes (deployer becomes provider via Article 25(1) substantial modification)
|
||||
- When training compute approaches 10^25 FLOPs (Article 51 systemic-risk threshold)
|
||||
|
||||
## The Six EU AI Act Questions
|
||||
|
||||
### 1. Article 5: Is this a prohibited AI practice?
|
||||
**Penalty: up to 35M EUR or 7% worldwide turnover.**
|
||||
- 8 categories: subliminal manipulation, exploitation of vulnerabilities, social scoring, predictive policing, untargeted facial scraping, emotion recognition in workplace/education, biometric categorisation by sensitive attributes, real-time public biometric ID by law enforcement
|
||||
- Run `ai_system_risk_classifier.py`
|
||||
- If yes → STOP. Cannot place on EU market. No exceptions outside Article 5(2) carve-outs.
|
||||
|
||||
### 2. Article 6 + Annex III: Is this high-risk?
|
||||
**Annex III triggers high-risk; Article 6(3) carve-out conditional.**
|
||||
- 8 categories: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice
|
||||
- Carve-out applies only if Article 6(3)(a)-(d) AND no profiling of natural persons
|
||||
- Profiling overrides carve-out (Article 6(3) last sentence)
|
||||
- Run `ai_system_risk_classifier.py`
|
||||
|
||||
### 3. Article 43: For high-risk, Module A or Module H?
|
||||
**Biometrics → Module H (notified body) by default; others → Module A if harmonised standards applied.**
|
||||
- Run `conformity_assessment_planner.py`
|
||||
- Module A (Annex VI): internal control with presumption of conformity if Article 40 harmonised standards applied
|
||||
- Module H (Annex VII): full QMS + notified body for biometrics or where standards lacking
|
||||
- Annex IV technical documentation: 8 items required before placing on market
|
||||
|
||||
### 4. Article 25: What role does the company play?
|
||||
**Provider obligations are heaviest; substantial modification turns deployer into provider.**
|
||||
- Provider (Article 3(3)): placed on market; full Title III + Article 73 reporting
|
||||
- Deployer (Article 3(4)): Article 26 obligations + Article 27 FRIA if public sector
|
||||
- Importer (Article 3(6)): Article 23 verification of conformity
|
||||
- Distributor (Article 3(7)): Article 24 CE marking verification
|
||||
- Authorized representative (Article 22): non-EU providers must appoint
|
||||
- Run `ai_act_obligation_tracker.py`
|
||||
|
||||
### 5. Article 50: Are transparency obligations satisfied?
|
||||
**In force 2 Aug 2025.**
|
||||
- Article 50(1): disclose AI interaction to natural persons (chatbots, virtual agents)
|
||||
- Article 50(2): mark synthetic content as AI-generated
|
||||
- Article 50(3): disclose emotion recognition / biometric categorisation (outside Article 5 prohibitions)
|
||||
- Article 50(4): disclose deepfakes (image, audio, video) as AI-generated
|
||||
|
||||
### 6. Articles 51-55: Is this a GPAI? Does it have systemic risk?
|
||||
**GPAI has parallel track; systemic risk above 10^25 FLOPs.**
|
||||
- Article 3(63): general-purpose AI model definition
|
||||
- Article 51: systemic-risk presumption (≥ 10^25 FLOPs training compute) or Commission designation
|
||||
- Article 53: all GPAI providers — Annex XI technical docs, Annex XII downstream info, copyright policy, training-data summary
|
||||
- Article 55: systemic-risk GPAI additional obligations — model evaluations, adversarial testing, incident reporting, cybersecurity
|
||||
- Article 54: non-EU GPAI providers must appoint authorized representative
|
||||
|
||||
## Workflow
|
||||
|
||||
```bash
|
||||
# 1. Risk classification
|
||||
python ../../ra-qm-team/skills/eu-ai-act-specialist/scripts/ai_system_risk_classifier.py systems.json
|
||||
|
||||
# 2. If high-risk: conformity assessment
|
||||
python ../../ra-qm-team/skills/eu-ai-act-specialist/scripts/conformity_assessment_planner.py system.json
|
||||
|
||||
# 3. Per-role obligation matrix
|
||||
python ../../ra-qm-team/skills/eu-ai-act-specialist/scripts/ai_act_obligation_tracker.py roles.json
|
||||
|
||||
# 4. Cross-framework reuse (ISO 42001 etc.)
|
||||
python ../../skills/compliance-os/scripts/cross_framework_mapper.py program.json
|
||||
```
|
||||
|
||||
## Output Format
|
||||
|
||||
```markdown
|
||||
# EU AI Act Readiness: <system>
|
||||
**Date:** YYYY-MM-DD
|
||||
**Article Citations:** Every verdict below cites the specific Article.
|
||||
|
||||
## The Decision Being Made
|
||||
[classify | conformity-route | obligation-scope | annual-refresh]
|
||||
|
||||
## Risk Classification
|
||||
- Tier: prohibited | high_risk | limited_risk | minimal_risk
|
||||
- Citation: Article X(Y) + Annex Z if applicable
|
||||
- Rationale: <Article-cited rationale>
|
||||
- GPAI: yes/no
|
||||
- Systemic-risk GPAI: yes/no (per Article 51 10^25 FLOPs threshold)
|
||||
|
||||
## Conformity Assessment (if high-risk)
|
||||
- Module: A | A_with_caveats | H | sectoral
|
||||
- Citation: Article 43 + Annex VI/VII
|
||||
- Notified body required: yes | no | optional
|
||||
- Annex IV pack status: complete | in-progress | not-started
|
||||
|
||||
## Obligation Matrix
|
||||
- Total obligations: N
|
||||
- By deadline phase: 2025-02-02=A, 2025-08-02=B, 2026-08-02=C, 2027-08-02=D
|
||||
- Highest-priority unmet obligation: <Article + description>
|
||||
|
||||
## Transparency (Article 50)
|
||||
- 50(1) interaction disclosure: yes | no
|
||||
- 50(2) synthetic content marking: yes | no | NA
|
||||
- 50(3) emotion recognition disclosure: yes | no | NA
|
||||
- 50(4) deepfake disclosure: yes | no | NA
|
||||
|
||||
## Cross-Framework Reuse
|
||||
- ISO 42001 evidence applicable to Article 17 QMS: yes/no
|
||||
- ISO 27001 evidence applicable to Article 15 cybersecurity: yes/no
|
||||
- GDPR DPIA usable for Article 27 FRIA: yes/no
|
||||
|
||||
## Verdict
|
||||
🟢 READY-FOR-EU | 🟡 GAPS-IDENTIFIED | 🔴 NOT-READY | 🚫 PROHIBITED
|
||||
|
||||
## Top 3 Actions
|
||||
[3 concrete next steps with owner + Article-tied deadline]
|
||||
|
||||
## Legal Review Required
|
||||
[Article-level ambiguities flagged for outside counsel: novel cases, GPAI threshold disputes, Article 5 boundary cases, Article 25 substantial-modification questions]
|
||||
```
|
||||
|
||||
## Routing
|
||||
|
||||
- `/cs:compliance-readiness` — for multi-framework view (combine with ISO 42001 + GDPR)
|
||||
- `/cs:aims-audit` — for ISO 42001 deep-dive
|
||||
- `/cs:caio-review` — for executive AI strategy decisions
|
||||
- `/cs:gc-review` — for novel-case legal review (GPAI threshold, Article 5 boundary, substantial-modification)
|
||||
- `/cs:decide` — to log the verdict
|
||||
- `/cs:freeze 30` — on EU launch commitments (regulatory exposure)
|
||||
|
||||
## Related
|
||||
|
||||
- Agent: [`cs-ai-act-compliance`](../../agents/cs-ai-act-compliance.md)
|
||||
- Skill: [`eu-ai-act-specialist`](../../../ra-qm-team/skills/eu-ai-act-specialist/SKILL.md)
|
||||
- Adjacent: `../../skills/compliance-os/`, `../aims-audit/`, `../compliance-readiness/`, `../../../ra-qm-team/skills/gdpr-dsgvo-expert/`
|
||||
|
||||
---
|
||||
|
||||
**Version:** 1.0.0
|
||||
132
compliance-os/skills/aims-audit/SKILL.md
Normal file
132
compliance-os/skills/aims-audit/SKILL.md
Normal file
|
|
@ -0,0 +1,132 @@
|
|||
---
|
||||
name: "aims-audit"
|
||||
description: "/cs:aims-audit <scope> — ISO/IEC 42001 AIMS internal-audit 6-question forcing interrogation. Use before certification stage 1, before annual internal audit cycles, or when onboarding a new AI system into an existing AIMS."
|
||||
---
|
||||
|
||||
# /cs:aims-audit — AIMS ISO 42001 Forcing Questions
|
||||
|
||||
**Command:** `/cs:aims-audit <scope>`
|
||||
|
||||
The ISO 42001 AIMS specialist pressure-tests any AI Management System work. Six questions before any certification commitment, internal audit cycle, or new-system onboarding.
|
||||
|
||||
## When to Run
|
||||
|
||||
- Before stage 1 ISO 42001 certification audit
|
||||
- Before annual internal audit cycle (Clause 9.2)
|
||||
- When onboarding a new AI system into existing AIMS scope
|
||||
- When AI risk register hasn't been refreshed in > 6 months
|
||||
- After material model change (re-evaluate risks per Clause 6.1.2)
|
||||
- When audit findings hint at AIMS / ISMS / QMS duplication
|
||||
|
||||
## The Six AIMS Questions
|
||||
|
||||
### 1. Does the AIMS scope statement name every AI system?
|
||||
**Scope omission = certification finding.**
|
||||
- Including: embedded models, third-party AI services, "experimental" production systems
|
||||
- Run `aims_gap_analyzer.py` to verify Clause 4.3 evidence
|
||||
- "AI features added by SaaS vendors we use" = in scope if they affect the company's services
|
||||
|
||||
### 2. Does the AI policy commit to lawful use AND beneficial purpose AND human oversight AND continual improvement?
|
||||
**Missing any of the four = critical nonconformity at stage 1.**
|
||||
- AI policy is NOT info-sec policy — it has separate substantive content
|
||||
- Reference ISO 42001 Annex A.2.2 + Clause 5.2
|
||||
- Marketing-copy "AI ethics" doesn't pass
|
||||
|
||||
### 3. What's the risk register coverage, and which Annex A controls treat each risk?
|
||||
**Risk identification without control mapping = Clause 6.1.3 fails.**
|
||||
- Run `ai_risk_register_builder.py` per ISO 23894 methodology
|
||||
- Every high/critical risk must link to ≥ 1 Annex A control
|
||||
- "Residual verdict: additional_treatment_required" must be closed before stage 1
|
||||
|
||||
### 4. Has the AI risk assessment been re-run since the last material model change?
|
||||
**Concept drift is not a one-time event.**
|
||||
- Article 9 EU AI Act + ISO 42001 Clause 6.1.2 both require iterative risk assessment
|
||||
- Material change = retraining on new data, fine-tuning, architecture change, deployment context change
|
||||
- If "we did it 18 months ago and haven't touched it," the AIMS is broken
|
||||
|
||||
### 5. What's the Clause 9.2 internal audit plan, and is auditor independence respected?
|
||||
**Without 9.2 plan, the AIMS is incomplete.**
|
||||
- Run `aims_audit_scheduler.py` with scope + auditors + prior findings
|
||||
- Audit every clause + applicable Annex A control over rolling 3-year cycle
|
||||
- Same auditor cannot audit own work
|
||||
- Cross-check with cs-quality-regulatory if integrated with 13485 audit programme
|
||||
|
||||
### 6. Has the AIMS been integrated with existing ISMS / QMS, or built in parallel?
|
||||
**Parallel systems = 5x ongoing maintenance cost.**
|
||||
- 60% of Clauses 4-10 evidence reuses ISO 27001 / 13485 with AI scope appended
|
||||
- CAPA loop should be ONE loop with AI-tagged nonconformities, not separate
|
||||
- Reference `cross_framework_mapping_ai.md` for the reuse map
|
||||
- Cross-check with cs-ciso-advisor on ISO 27001 alignment
|
||||
|
||||
## Workflow
|
||||
|
||||
```bash
|
||||
# 1. AIMS gap analysis
|
||||
python ../../ra-qm-team/skills/iso42001-specialist/scripts/aims_gap_analyzer.py evidence.json
|
||||
|
||||
# 2. AI risk register
|
||||
python ../../ra-qm-team/skills/iso42001-specialist/scripts/ai_risk_register_builder.py risks.json
|
||||
|
||||
# 3. Internal audit plan
|
||||
python ../../ra-qm-team/skills/iso42001-specialist/scripts/aims_audit_scheduler.py audit_scope.json
|
||||
|
||||
# 4. Cross-framework reuse map (via compliance-os)
|
||||
python ../../skills/compliance-os/scripts/cross_framework_mapper.py program.json
|
||||
```
|
||||
|
||||
## Output Format
|
||||
|
||||
```markdown
|
||||
# AIMS Audit: <scope>
|
||||
**Date:** YYYY-MM-DD
|
||||
|
||||
## The Decision Being Made
|
||||
[gap-closure | risk-treatment | audit-scope | new-system-onboarding]
|
||||
|
||||
## Gap Analysis (Clauses 4-10)
|
||||
- Weighted coverage: X%
|
||||
- Critical gaps: N
|
||||
- Major gaps: M
|
||||
- Certification readiness: ready | stage_2_candidate | not_ready
|
||||
|
||||
## AI Risk Register
|
||||
- Total risks: N
|
||||
- By severity: critical=X, high=Y, medium=Z, low=W
|
||||
- Requires additional treatment: K
|
||||
- Top risk requiring action: <description>
|
||||
|
||||
## Clause 9.2 Audit Plan
|
||||
- 12-month coverage: clauses=X, controls=Y
|
||||
- Auditor independence: clean | issues
|
||||
- Prior-year follow-up: scheduled in Q1
|
||||
|
||||
## Cross-Framework Reuse
|
||||
- ISO 27001 evidence reused: % of AIMS Clauses 4-10
|
||||
- 13485 evidence reused: % (if applicable)
|
||||
- Net-new for AIMS: % (mostly Annex A)
|
||||
|
||||
## Verdict
|
||||
🟢 STAGE-1-READY | 🟡 CLOSE-CRITICALS-FIRST | 🔴 NOT-READY
|
||||
|
||||
## Top 3 Actions
|
||||
[3 concrete next steps with owner + date]
|
||||
```
|
||||
|
||||
## Routing
|
||||
|
||||
- `/cs:compliance-readiness` — for multi-framework view
|
||||
- `/cs:ai-act-readiness` — if EU AI Act also applies
|
||||
- `/cs:caio-review` — for executive AI strategy decisions
|
||||
- `/cs:ciso-review` — for ISO 27001 cross-framework alignment
|
||||
- `/cs:decide` — to log the verdict
|
||||
- `/cs:freeze 30` — on certification commitments
|
||||
|
||||
## Related
|
||||
|
||||
- Agent: [`cs-aims-iso42001`](../../agents/cs-aims-iso42001.md)
|
||||
- Skill: [`iso42001-specialist`](../../../ra-qm-team/skills/iso42001-specialist/SKILL.md)
|
||||
- Adjacent: `../../skills/compliance-os/`, `../ai-act-readiness/`, `../compliance-readiness/`
|
||||
|
||||
---
|
||||
|
||||
**Version:** 1.0.0
|
||||
205
compliance-os/skills/compliance-os/SKILL.md
Normal file
205
compliance-os/skills/compliance-os/SKILL.md
Normal file
|
|
@ -0,0 +1,205 @@
|
|||
---
|
||||
name: "compliance-os"
|
||||
description: "Compliance OS — meta-orchestrator that lets compliance teams CONFIGURE which frameworks apply, COMPUTE cross-framework control overlap, SIMULATE internal audits, and CONSOLIDATE evidence across multiple frameworks. Four decisions: (1) Given a company profile, which of the 9 supported frameworks apply (ISO 27001/13485/42001/14971, EU AI Act, MDR 745, GDPR, SOC 2, FDA QSR)? (2) Across selected frameworks, which controls overlap and how much evidence reuses? (3) For a given framework + scope, what does a realistic mock audit produce? (4) Across selected frameworks, what's the unified evidence checklist with reuse map? Use when standing up a multi-framework program, planning the annual audit calendar, or preparing for certification stage 1. Does NOT replace per-framework skills (it orchestrates them)."
|
||||
license: MIT
|
||||
metadata:
|
||||
version: 1.0.0
|
||||
author: Alireza Rezvani
|
||||
category: compliance-os
|
||||
domain: multi-framework-compliance-orchestration
|
||||
updated: 2026-05-13
|
||||
python-tools: framework_selector.py, cross_framework_mapper.py, audit_simulator.py, evidence_pool_generator.py
|
||||
frameworks: iso-27001, iso-13485, iso-42001, iso-14971, eu-ai-act, eu-mdr-745, gdpr, soc-2, fda-qsr
|
||||
---
|
||||
|
||||
# Compliance OS — Meta-Orchestrator
|
||||
|
||||
Multi-framework compliance program orchestration. **Four decisions, no per-framework deep-dive:**
|
||||
|
||||
1. **Which frameworks apply to this company?** — `framework_selector.py` ranks the 9 supported frameworks against a company profile (industry, geography, AI use, medical, financial, headcount, customers) and returns applicable ones with dependency graph
|
||||
2. **How much do selected frameworks overlap?** — `cross_framework_mapper.py` computes control-level overlap with confidence rating; outputs unified control matrix + evidence-reuse opportunities
|
||||
3. **What does a mock audit produce?** — `audit_simulator.py` generates 8–15 finding scenarios with severity distribution matching IIA expectations + interview questions per control
|
||||
4. **What's the unified evidence checklist?** — `evidence_pool_generator.py` consolidates evidence across enabled frameworks; outputs which artefact satisfies which controls across which frameworks
|
||||
|
||||
This skill is **NOT** a per-framework deep-dive. The per-framework skills (`ra-qm-team/skills/iso42001-specialist/`, `compliance-team-eu-ai-act/`, `ra-qm-team/skills/gdpr-dsgvo-expert/`, etc.) do the operational work. Compliance OS orchestrates them.
|
||||
|
||||
This skill is **NOT** a substitute for binding legal advice. Cross-framework mappings reflect published guidance (ISO standards, regulations, EDPB/Commission guidance, IIA / AICPA professional standards). Novel cross-walks should be reviewed with counsel.
|
||||
|
||||
## Keywords
|
||||
|
||||
compliance orchestration, multi-framework compliance, compliance OS, cross-framework mapping, control overlap, evidence pool, evidence reuse, audit simulation, mock audit, internal audit programme, GRC, governance risk compliance, framework selector, compliance program, integrated compliance, ISO 19011, IIA IPPF, AICPA AT-C, NIST CSF profile, multi-cert program, SOC 2 + ISO 27001, ISO 27001 + ISO 42001, ISO 13485 + MDR 745, AI Act + ISO 42001, GDPR + ISO 27001, compliance officer, compliance team workflow, certification readiness
|
||||
|
||||
## Quick Start
|
||||
|
||||
```bash
|
||||
# Decision A: Which frameworks apply for the company?
|
||||
python scripts/framework_selector.py # embedded mid-stage AI SaaS sample
|
||||
python scripts/framework_selector.py path/to/profile.json
|
||||
|
||||
# Decision B: Compute cross-framework overlap
|
||||
python scripts/cross_framework_mapper.py # embedded ISO 27001 + SOC 2 sample
|
||||
python scripts/cross_framework_mapper.py path/to/control_libs.json
|
||||
|
||||
# Decision C: Simulate an audit
|
||||
python scripts/audit_simulator.py # embedded ISO 27001 sample
|
||||
python scripts/audit_simulator.py path/to/audit_scope.json
|
||||
|
||||
# Decision D: Consolidate evidence checklist across frameworks
|
||||
python scripts/evidence_pool_generator.py # embedded 3-framework sample
|
||||
python scripts/evidence_pool_generator.py path/to/program.json
|
||||
```
|
||||
|
||||
## Key Questions (ask these first)
|
||||
|
||||
- **Have you named every applicable framework?** Forgetting one means rebuilding the audit program later. Run `framework_selector.py` with your profile.
|
||||
- **What's the most certificate / regulation your company already operates?** That's your reuse anchor. Map every new framework against it.
|
||||
- **What's the audit calendar?** A multi-framework program means surveillance audits stacked through the year — plan auditor independence + capacity.
|
||||
- **Where is evidence stored?** Multi-framework programs collapse when evidence lives in one team's drive without an index. Run `evidence_pool_generator.py` to surface the reuse opportunities.
|
||||
- **What's the management-review cadence across frameworks?** Each framework wants its own management review, but a single integrated review (per ISO Annex SL) typically satisfies all of them with one calendar slot.
|
||||
- **Who owns the meta-program?** If no single accountable role, the program fragments.
|
||||
|
||||
## Core Responsibilities
|
||||
|
||||
### 1. Framework Selection
|
||||
|
||||
**The framework:** company-profile JSON in → applicable-framework list out with dependency graph.
|
||||
|
||||
**Deterministic logic:**
|
||||
- Medical device → ISO 13485 + ISO 14971 + (EU MDR 745 if EU market) + (FDA QSR if US market)
|
||||
- Customer-facing AI → ISO 42001 + EU AI Act (if EU users) + GDPR (if personal data)
|
||||
- B2B SaaS with enterprise customers → SOC 2 + ISO 27001 (often required for procurement)
|
||||
- EU customers + personal data → GDPR mandatory
|
||||
- Highly regulated industry (financial, health) → additional sectoral overlays
|
||||
|
||||
**Run** `framework_selector.py` to apply the decision rules.
|
||||
|
||||
### 2. Cross-Framework Control Mapping
|
||||
|
||||
**The framework:** for each selected framework, parse its control library; compute overlap with other selected frameworks.
|
||||
|
||||
**Per merged-control output:**
|
||||
- Mapping confidence (HIGH / MEDIUM / LOW)
|
||||
- Evidence-reuse opportunity (single artefact satisfies N controls)
|
||||
- Per-framework citation
|
||||
- Implementation guidance reusable across frameworks
|
||||
|
||||
**Densest known overlap:** ISO 27001 Annex A ↔ SOC 2 Trust Services Criteria — historically ~75% control coverage shared. Adding ISO 42001 brings AI-specific controls; adding GDPR brings privacy-specific.
|
||||
|
||||
**Run** `cross_framework_mapper.py` with framework control libraries.
|
||||
|
||||
### 3. Audit Simulation
|
||||
|
||||
**The framework:** generate a realistic mock internal audit per ISO 19011 + IIA IPPF standards.
|
||||
|
||||
**Per audit output:**
|
||||
- 8–15 finding scenarios per ISO 19011 typical depth
|
||||
- Severity distribution: ≥ 40% observations/OFI, ≤ 15% critical/major (IIA expectation for healthy programs)
|
||||
- Interview questions per scoped control (3–5 questions per control)
|
||||
- Document-review request list
|
||||
- Walk-through requests where applicable
|
||||
|
||||
**Run** `audit_simulator.py` with framework + scope.
|
||||
|
||||
### 4. Evidence Pool
|
||||
|
||||
**The framework:** consolidate evidence requirements across enabled frameworks; identify reuse opportunities.
|
||||
|
||||
**Output:**
|
||||
- Evidence artefact list (e.g., access-review log, supplier risk register, incident log)
|
||||
- Per artefact: list of (framework, control) tuples it satisfies
|
||||
- Reuse-leverage score (artefact A satisfies N controls across M frameworks)
|
||||
- Acquisition cost estimate (effort to produce + maintain)
|
||||
|
||||
**Run** `evidence_pool_generator.py` with program config.
|
||||
|
||||
## Workflows
|
||||
|
||||
### Workflow 1: Program Bootstrap (multi-framework, 4–8 weeks)
|
||||
**Goal:** stand up a compliance program covering 2–4 frameworks simultaneously.
|
||||
|
||||
```bash
|
||||
# 1. Run framework selector with company profile
|
||||
python scripts/framework_selector.py profile.json
|
||||
# 2. For each applicable framework, identify the per-framework skill and run its gap analysis
|
||||
# 3. Run cross-framework mapper to identify reuse opportunities
|
||||
python scripts/cross_framework_mapper.py control_libs.json
|
||||
# 4. Run evidence pool generator to consolidate
|
||||
python scripts/evidence_pool_generator.py program.json
|
||||
# 5. Cross-check with cs-compliance-officer agent
|
||||
# 6. Output: prioritized program backlog with owners + dates
|
||||
```
|
||||
|
||||
### Workflow 2: Annual Audit Calendar (yearly)
|
||||
**Goal:** plan internal audit cycles covering all applicable frameworks.
|
||||
|
||||
```bash
|
||||
# 1. Refresh framework selector if profile changed
|
||||
python scripts/framework_selector.py profile.json
|
||||
# 2. For each framework, run its internal-audit-plan tool
|
||||
# (e.g., aims_audit_scheduler.py for ISO 42001; isms_audit_scheduler.py for ISO 27001)
|
||||
# 3. Coordinate the audit calendar across frameworks (auditor independence + capacity)
|
||||
# 4. Run audit simulator for each framework to prep auditors
|
||||
python scripts/audit_simulator.py scope.json
|
||||
# 5. Output: integrated audit calendar with owners + auditor assignments
|
||||
```
|
||||
|
||||
### Workflow 3: Pre-Certification Readiness (per new framework, 6–12 weeks)
|
||||
**Goal:** prepare for an external certification audit.
|
||||
|
||||
```bash
|
||||
# 1. Run gap analysis for the new framework
|
||||
# (ISO 42001: aims_gap_analyzer.py; ISO 27001: compliance_checker.py; SOC 2: gap_analyzer.py)
|
||||
# 2. Run cross-framework mapper against already-certified frameworks
|
||||
python scripts/cross_framework_mapper.py control_libs.json
|
||||
# 3. Reuse evidence for HIGH-confidence mappings; build new for MEDIUM/LOW
|
||||
# 4. Run audit simulator to dry-run the certification audit
|
||||
python scripts/audit_simulator.py scope.json
|
||||
# 5. Close remaining gaps before external auditor stage 1
|
||||
```
|
||||
|
||||
### Workflow 4: Evidence Pool Consolidation (quarterly)
|
||||
**Goal:** keep the unified evidence pool fresh + reusable.
|
||||
|
||||
```bash
|
||||
# 1. Refresh evidence pool generator
|
||||
python scripts/evidence_pool_generator.py program.json
|
||||
# 2. Identify HIGH-reuse-leverage artefacts (1 evidence -> 5+ controls)
|
||||
# 3. Confirm evidence freshness (within retention requirement per framework)
|
||||
# 4. Audit the evidence pool itself (no orphan controls, no stale evidence)
|
||||
```
|
||||
|
||||
## Output Standards
|
||||
|
||||
```
|
||||
**Bottom Line:** [one sentence — what's the multi-framework picture + biggest reuse opportunity]
|
||||
**The Decision:** [one of: framework-set | overlap-map | audit-plan | evidence-consolidation]
|
||||
**The Evidence:** [framework names + control IDs from the tool, not adjectives]
|
||||
**How to Act:** [3 concrete next steps with owners + dates]
|
||||
**Your Decision:** [the call only the compliance officer can make — which frameworks to pursue, audit cycle priority, evidence-reuse policy]
|
||||
```
|
||||
|
||||
## Adjacent Skills
|
||||
|
||||
- `../../ra-qm-team/skills/iso42001-specialist/` — ISO 42001 deep-dive (paired with compliance-team-iso42001 plugin)
|
||||
- `../../ra-qm-team/skills/eu-ai-act-specialist/` — EU AI Act deep-dive (paired with compliance-team-eu-ai-act plugin)
|
||||
- `../../ra-qm-team/skills/information-security-manager-iso27001/` — ISO 27001 ISMS deep-dive
|
||||
- `../../ra-qm-team/skills/quality-manager-qms-iso13485/` — ISO 13485 QMS deep-dive
|
||||
- `../../ra-qm-team/skills/gdpr-dsgvo-expert/` — GDPR deep-dive
|
||||
- `../../ra-qm-team/skills/soc2-compliance/` — SOC 2 deep-dive
|
||||
- `../../ra-qm-team/skills/fda-consultant-specialist/` — FDA QSR deep-dive
|
||||
- `../../ra-qm-team/skills/mdr-745-specialist/` — EU MDR 745 deep-dive
|
||||
- `../../ra-qm-team/skills/risk-management-specialist/` — ISO 14971 deep-dive
|
||||
- `../../c-level-advisor/chief-ai-officer-advisor/` — Executive AI risk decisions (build-vs-buy, model selection)
|
||||
- `../../c-level-advisor/skills/general-counsel-advisor/` — Legal review for novel cases
|
||||
|
||||
## References
|
||||
|
||||
- [compliance_os_pattern.md](references/compliance_os_pattern.md) — The meta-framework architecture (configure → map → simulate → consolidate → review); when to use vs not
|
||||
- [cross_framework_overlap.md](references/cross_framework_overlap.md) — The 9-framework × control-family overlap table with mapping confidence
|
||||
- [audit_simulation_methodology.md](references/audit_simulation_methodology.md) — ISO 19011 + IIA IPPF + AICPA AT-C audit-simulation principles + severity distribution heuristics
|
||||
- [evidence_management.md](references/evidence_management.md) — Evidence pool design + retention + freshness + reuse-leverage scoring
|
||||
|
||||
---
|
||||
|
||||
**Version:** 1.0.0
|
||||
**Status:** Production Ready
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{
|
||||
"company": "<company name>",
|
||||
"industry": "<saas | medical_device | financial | other>",
|
||||
"products_include_ai": false,
|
||||
"ai_high_risk_per_eu": false,
|
||||
"deploys_ai_in_eu": false,
|
||||
"products_are_medical_devices": false,
|
||||
"sells_to_eu_customers": false,
|
||||
"sells_to_us_customers": false,
|
||||
"sells_to_enterprise_b2b": false,
|
||||
"processes_personal_data": false,
|
||||
"processes_eu_personal_data": false,
|
||||
"headcount": 0,
|
||||
"stage": "<seed | series_a | series_b | series_c | growth>"
|
||||
}
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
{
|
||||
"program": "<program name>",
|
||||
"enabled_frameworks": [
|
||||
"iso_27001",
|
||||
"soc_2",
|
||||
"iso_42001",
|
||||
"eu_ai_act",
|
||||
"gdpr"
|
||||
],
|
||||
"_supported_framework_ids": [
|
||||
"iso_27001",
|
||||
"iso_13485",
|
||||
"iso_42001",
|
||||
"iso_14971",
|
||||
"eu_ai_act",
|
||||
"eu_mdr_745",
|
||||
"gdpr",
|
||||
"soc_2",
|
||||
"fda_qsr"
|
||||
],
|
||||
"_note": "Enable only the frameworks the framework_selector returned as applicable. Cross-framework mapper will compute overlap across enabled frameworks only."
|
||||
}
|
||||
|
|
@ -0,0 +1,142 @@
|
|||
# Audit Simulation Methodology — ISO 19011 + IIA IPPF + AICPA AT-C
|
||||
|
||||
This reference answers exactly one decision: **what does a realistic internal audit look like, and how do we generate a mock audit that prepares the team without breaking trust?**
|
||||
|
||||
Pair with `scripts/audit_simulator.py` for the deterministic mock audit generator.
|
||||
|
||||
## Why Simulate Audits?
|
||||
|
||||
External certification audits are high-stakes events. A team that has never been audited internally before its first stage 2 ISO certification audit will struggle even if every artefact is in place — interview cadence, document-pull SLAs, walk-through pacing are operational muscles built only by practice.
|
||||
|
||||
Mock audits provide:
|
||||
|
||||
- Operational practice (auditees experience the rhythm of an interview)
|
||||
- Auditor-side practice (internal auditors practice their methodology before high-stakes certification audits)
|
||||
- Discovery of gaps before they become findings
|
||||
- Calibration of effort (how long does evidence assembly actually take?)
|
||||
- Cross-training (auditors from one team learn another team's controls)
|
||||
|
||||
## Audit Standards That Govern Simulation
|
||||
|
||||
**ISO/IEC 19011:2018** — Guidelines for auditing management systems. Defines:
|
||||
|
||||
- Audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach
|
||||
- Auditor competence (Clause 7)
|
||||
- Audit process: initiating → preparing → conducting → reporting (Clauses 5–6)
|
||||
|
||||
**IIA International Professional Practices Framework (IPPF)** — internal-audit-specific:
|
||||
|
||||
- IPPF Standards 1000-1322 — Attribute Standards (purpose, independence, proficiency, due professional care, quality assurance)
|
||||
- IPPF Standards 2000-2600 — Performance Standards (engagement planning through monitoring)
|
||||
- Severity grading approach (rated finding scale)
|
||||
|
||||
**AICPA AT-C 105 + AU-C 240** — SOC 2 audit context: trust services criteria + auditor's responsibility framework.
|
||||
|
||||
## The Mock Audit Workflow
|
||||
|
||||
Compliance OS `audit_simulator.py` deterministically generates one stage of a mock audit. The full simulation lifecycle:
|
||||
|
||||
```
|
||||
1. SCOPE → define framework + controls in scope + auditee team
|
||||
2. PREPARE → audit_simulator.py outputs: findings + interview questions + document-review requests
|
||||
3. CONDUCT → simulated interview + document review (1-2 hours per control)
|
||||
4. REPORT → finding write-up + severity classification + corrective action assignment
|
||||
5. CLOSE → corrective action tracking through CAPA
|
||||
```
|
||||
|
||||
## Finding Severity Distribution (the IIA expectation)
|
||||
|
||||
A healthy compliance program produces audits with this distribution:
|
||||
|
||||
| Severity | Healthy proportion | What it indicates |
|
||||
|---|---|---|
|
||||
| **Critical (major nonconformity)** | ≤ 15% | Blocks certification; requires major corrective action |
|
||||
| **Major** | 15–25% | Important gaps requiring 30-day corrective action plans |
|
||||
| **Minor** | 20–30% | Operational gaps requiring corrective action timeline |
|
||||
| **Observation / OFI** | ≥ 40% | Improvement opportunities; no required action |
|
||||
|
||||
**Why this shape?** If 80% of findings are critical, either the audit was destructive (auditee not given fair chance to demonstrate compliance) or the program is genuinely failing. If 80% of findings are observations, the audit was too superficial. The compliance OS audit simulator enforces this shape by deterministic severity rotation.
|
||||
|
||||
A first audit (year 1) will skew higher to critical/major; a mature program (year 3+) skews to observations.
|
||||
|
||||
## Number of Findings Per Audit
|
||||
|
||||
ISO 19011 Clause 6 typical audit depth:
|
||||
|
||||
- Small scope (5 controls, 1 day): 5–10 findings
|
||||
- Medium scope (10–15 controls, 3–5 days): 10–20 findings
|
||||
- Full system audit (all clauses, 1–2 weeks): 25–50 findings
|
||||
|
||||
The simulator targets 8–15 findings per audit (medium scope) as the default.
|
||||
|
||||
## Interview Question Quality
|
||||
|
||||
Auditor questions follow the **walk-through pattern**:
|
||||
|
||||
1. **Open** — "Walk me through how this control is implemented day-to-day."
|
||||
2. **Sample** — "Show me a specific example from the last 30 days."
|
||||
3. **Drill** — "What happens if [edge case]?"
|
||||
4. **Verify** — "Where is this documented?"
|
||||
|
||||
Each control gets 3–5 questions following this pattern. The simulator's `interview_questions()` function provides theme-specific questions per the IIA performance standards.
|
||||
|
||||
## Document-Review Requests
|
||||
|
||||
Per ISO 19011, the auditor reviews:
|
||||
|
||||
- The procedure (the "what should happen")
|
||||
- The records (the "what actually happened")
|
||||
- The evidence of management oversight (the "did anyone check?")
|
||||
|
||||
A document-review request typically asks for all three. The simulator's `document_requests()` function generates the request list per theme.
|
||||
|
||||
## Auditor Independence Test
|
||||
|
||||
Clause 9.2 of ISO management-system standards requires auditor independence. The simulator does NOT enforce auditor assignment (that's `aims_audit_scheduler.py` for ISO 42001 or `isms_audit_scheduler.py` for ISO 27001) but the workflow assumes an independent auditor.
|
||||
|
||||
**Independence rules:**
|
||||
- Auditor cannot audit their own work
|
||||
- Auditor reports to a different chain of command than the auditee
|
||||
- For small organizations, rotating auditors between teams + occasional external auditor satisfies independence
|
||||
|
||||
## Finding Categories (the taxonomy)
|
||||
|
||||
The simulator uses 5 finding themes mapped to common control families:
|
||||
|
||||
| Theme | Maps to control families |
|
||||
|---|---|
|
||||
| `access_control` | ISO 27001 A.5.15 / A.8.2 / A.8.3; SOC 2 CC6.1-6.3; ISO 42001 A.4.4 |
|
||||
| `logging_monitoring` | ISO 27001 A.8.15 / A.8.16; SOC 2 CC7.1-7.2; ISO 42001 A.9.3 / A.9.4 |
|
||||
| `change_management` | ISO 27001 A.8.32; SOC 2 CC8.1; ISO 42001 A.6.2.5 |
|
||||
| `supplier_mgmt` | ISO 27001 A.5.19-A.5.22; SOC 2 CC9.2; ISO 42001 A.10.2; GDPR Art. 28 |
|
||||
| `incident_response` | ISO 27001 A.5.24-27, A.6.8; SOC 2 CC7.3-7.5; ISO 42001 A.8.4; EU AI Act Art. 73; GDPR Art. 33-34 |
|
||||
|
||||
This taxonomy covers the highest-leverage controls across the 9 supported frameworks. Adding new themes is a matter of extending `FINDING_TEMPLATES` + `CONTROL_TO_THEME` mappings.
|
||||
|
||||
## Anti-Patterns in Audit Simulation
|
||||
|
||||
1. **Auditing for trapping vs auditing for evidence.** Mock audits aim to surface gaps, not embarrass the auditee. If team morale drops after the mock, the audit was structured wrong.
|
||||
2. **Skipping the "obvious" controls.** Critical findings often hide in mundane controls (e.g., terminated employee with retained access). Simulator deliberately includes prosaic theme rotation.
|
||||
3. **No prior-year follow-up.** The simulator's `prior_year_findings_open` parameter forces the first finding to be a follow-up. Real audits always follow up on prior open findings (ISO 19011 Clause 6.3).
|
||||
4. **One severity-skewed audit.** Distribution rule guards against this; if all findings are critical or all are observations, recalibrate the audit scope or methodology.
|
||||
|
||||
## When This Reference Doesn't Help
|
||||
|
||||
- **Specific industry-vertical audit requirements.** Use sectoral skills (financial, healthcare).
|
||||
- **Auditor competence + certification.** See ISACA CISA, IRCA Lead Auditor courses.
|
||||
- **Audit report-writing detail.** See ISO 19011 Clause 6.5 + IIA performance standards 2410–2440.
|
||||
|
||||
---
|
||||
|
||||
**Source authorities (non-exhaustive):**
|
||||
|
||||
- **ISO/IEC 19011:2018** — Guidelines for auditing management systems (the canonical methodology)
|
||||
- **IIA International Professional Practices Framework (IPPF)** — Attribute Standards 1000-1322 + Performance Standards 2000-2600
|
||||
- **AICPA AT-C 105** — Trust Services Criteria attestation engagement
|
||||
- **AICPA AU-C 240** — Auditor's responsibilities relating to fraud (financial audit, conceptually applied)
|
||||
- **ISACA CISA Review Manual** (27th ed., 2024) — IS audit practitioner methodology
|
||||
- **ASQ Certified Quality Auditor (CQA) Body of Knowledge** — quality audit methodology
|
||||
- **NIST SP 800-53A Rev 5** — Assessing Security and Privacy Controls (assessment procedures for each control)
|
||||
- **ISO/IEC 17021-1:2015** — Conformity assessment requirements for bodies providing audit and certification
|
||||
- **IRCA (International Register of Certificated Auditors)** — Lead auditor certification programme materials
|
||||
- **The Open Group** — Open FAIR (Factor Analysis of Information Risk) for risk-based audit prioritization
|
||||
|
|
@ -0,0 +1,141 @@
|
|||
# Compliance OS — The Meta-Framework Pattern
|
||||
|
||||
This reference answers exactly one decision: **when do we orchestrate frameworks vs run them separately, and what does the meta-framework architecture look like?**
|
||||
|
||||
## The Problem Compliance OS Solves
|
||||
|
||||
Most growing companies hit a wall: 2–3 compliance frameworks operating in parallel, each with its own tooling, its own audit calendar, its own evidence requirements, its own internal owner. The result:
|
||||
|
||||
- **Duplicate evidence collection** — access-review records assembled 3 times for ISO 27001, SOC 2, and ISO 42001 audits
|
||||
- **Conflicting audit calendars** — surveillance audits stack in the same week with insufficient auditor capacity
|
||||
- **Fragmented management review** — each framework wants its own management review, taking 5x the executive time
|
||||
- **Inconsistent control taxonomies** — "access control" means slightly different things across SOC 2 and ISO 27001 Annex A and ISO 42001 Annex A
|
||||
- **Unowned cross-framework gaps** — controls in framework A but not B fall to ad-hoc ownership
|
||||
- **Evidence freshness mismatch** — ISO 27001 wants 12-month log retention, GDPR can want longer, leading to either over-retention or compliance gaps
|
||||
|
||||
Compliance OS is the orchestration layer that sits **above** per-framework skills and consolidates the cross-framework view.
|
||||
|
||||
## The Four Operations
|
||||
|
||||
```
|
||||
[ Company Profile JSON ]
|
||||
│
|
||||
v
|
||||
╔═══════════════════════╗
|
||||
║ 1. CONFIGURE ║ framework_selector.py
|
||||
║ "Which apply?" ║
|
||||
╚═══════════════════════╝
|
||||
│
|
||||
v
|
||||
╔═══════════════════════╗
|
||||
║ 2. MAP ║ cross_framework_mapper.py
|
||||
║ "What overlaps?" ║
|
||||
╚═══════════════════════╝
|
||||
│
|
||||
v
|
||||
╔═══════════════════════╗
|
||||
║ 3. SIMULATE ║ audit_simulator.py
|
||||
║ "What audit looks ║
|
||||
║ like to fail?" ║
|
||||
╚═══════════════════════╝
|
||||
│
|
||||
v
|
||||
╔═══════════════════════╗
|
||||
║ 4. CONSOLIDATE ║ evidence_pool_generator.py
|
||||
║ "Where's the evidence║
|
||||
║ + what reuses?" ║
|
||||
╚═══════════════════════╝
|
||||
│
|
||||
v
|
||||
[ Multi-framework plan ]
|
||||
```
|
||||
|
||||
Each operation is a stdlib Python tool with deterministic logic — no LLM calls, no hidden state.
|
||||
|
||||
## When to Use Compliance OS
|
||||
|
||||
| Situation | Use compliance-os? |
|
||||
|---|---|
|
||||
| Single framework only (e.g., just SOC 2) | No — the per-framework skill is sufficient |
|
||||
| 2+ frameworks operating in parallel | Yes |
|
||||
| Adding a new framework to existing program | Yes — for cross-framework reuse mapping |
|
||||
| Planning annual audit calendar across multiple certifications | Yes |
|
||||
| Onboarding a new AI system that triggers ISO 42001 + EU AI Act + GDPR | Yes |
|
||||
| Acquiring a company with different compliance posture | Yes — for gap mapping post-acquisition |
|
||||
| Internal-audit-only program (no external certification) | Yes if multi-framework; No if single |
|
||||
|
||||
## What Compliance OS Is NOT
|
||||
|
||||
- **NOT a per-framework deep-dive skill.** Per-framework skills (`ra-qm-team/skills/iso42001-specialist/`, etc.) do the operational work. Compliance OS orchestrates them.
|
||||
- **NOT a GRC platform replacement.** GRC platforms (Drata, Vanta, OneTrust, Hyperproof, etc.) are tools that operationalize what compliance OS describes — they're complementary. Compliance OS gives the conceptual map; GRC tools store the evidence.
|
||||
- **NOT a binding legal opinion.** Cross-framework mappings reflect published guidance from ISO, AICPA, NIST, IIA, EDPB. Novel cross-walks need outside counsel.
|
||||
- **NOT a certification body.** Certification audits are performed by accredited bodies. Compliance OS prepares for them.
|
||||
|
||||
## Roles and Ownership
|
||||
|
||||
A multi-framework compliance program typically has these roles. Compliance OS does not replace them — it gives them a shared mental model.
|
||||
|
||||
| Role | Owns |
|
||||
|---|---|
|
||||
| **Compliance officer** | The meta-program; framework selector; cross-framework mapper; consolidated evidence pool |
|
||||
| **CISO** | ISO 27001 + SOC 2 + cybersecurity slices of ISO 42001 + GDPR Article 32 |
|
||||
| **DPO** | GDPR; privacy slice of ISO 42001 (A.7.6); EU AI Act Article 27 FRIA where applicable |
|
||||
| **AIMS lead** | ISO 42001; AI-specific slice of EU AI Act Article 17 QMS |
|
||||
| **QMS lead** | ISO 13485 / FDA QSR / EU MDR 745 (medical-device contexts) |
|
||||
| **Risk manager** | ISO 14971 + AI risk per ISO 23894 |
|
||||
| **Internal auditor(s)** | Clause 9.2 audit programmes across all frameworks |
|
||||
| **Executive sponsor** | Management review (Clause 9.3) across all frameworks |
|
||||
|
||||
A typical mid-stage AI SaaS has compliance officer + CISO + DPO as the core trio; AIMS lead is a part-time hat.
|
||||
|
||||
## The Integrated Management System Pattern
|
||||
|
||||
When multiple management-system standards apply (ISO 27001 + ISO 42001 + ISO 9001/13485 + ISO 14001), the recommended structure is an **Integrated Management System (IMS)** rather than parallel siloed systems. The IMS pattern:
|
||||
|
||||
- Single scope statement covering all applicable standards
|
||||
- Single policy set with framework-specific overlays (e.g., the AI policy required by ISO 42001 A.2.2 sits alongside the info-sec policy required by ISO 27001 A.5.1)
|
||||
- Single document control procedure
|
||||
- Single internal audit programme covering all standards over a rolling 3-year cycle
|
||||
- Single management review covering all standards
|
||||
- Single CAPA loop with framework-tagged nonconformities
|
||||
- Per-framework deep-dive evidence under common umbrella
|
||||
|
||||
Compliance OS is the operating model for the IMS pattern.
|
||||
|
||||
## How Compliance OS Relates to Sectoral Programs
|
||||
|
||||
| Sectoral context | Compliance OS approach |
|
||||
|---|---|
|
||||
| Pure SaaS (no AI, no medical) | Skip compliance-os. Use ISO 27001 + SOC 2 + GDPR skills directly. |
|
||||
| AI SaaS (EU users) | Use compliance-os. Frameworks: ISO 27001 + SOC 2 + ISO 42001 + EU AI Act + GDPR. |
|
||||
| AI medical device | Use compliance-os. Frameworks: ISO 13485 + 14971 + 42001 + EU AI Act + EU MDR / FDA QSR + GDPR. Most complex case. |
|
||||
| Financial / regulated industry | Use compliance-os + sectoral overlay (e.g., NYDFS, FINMA, NIS2). |
|
||||
|
||||
## Anti-Patterns to Avoid
|
||||
|
||||
1. **Building compliance-os before having ≥ 2 frameworks operating maturely.** Premature orchestration. Mature one framework first; layer the second; THEN orchestrate.
|
||||
2. **Using compliance-os to bypass per-framework deep work.** The cross-framework mapping says "reuse evidence from framework A." That presumes framework A's evidence is solid. Reuse mapping ≠ skip diligence.
|
||||
3. **Treating mapping confidence as binary.** HIGH confidence means same evidence; MEDIUM means existing evidence with overlay; LOW means concept overlap. LOW mappings still need new artefacts.
|
||||
4. **Forgetting that bindings (regulations) outrank certifications.** GDPR + EU AI Act non-compliance carries actual penalties; ISO 27001 non-certification just blocks procurement. Sequence accordingly.
|
||||
5. **Replacing the per-framework skill with compliance-os.** Compliance OS orchestrates; per-framework skills do the deep work.
|
||||
|
||||
## When This Reference Doesn't Help
|
||||
|
||||
- **Specific framework requirements.** See the per-framework skill.
|
||||
- **GRC platform selection.** Tooling decision; commercial market evolves rapidly.
|
||||
- **Per-sector regulatory deep-dive.** Use sectoral skills (financial, healthcare, etc.).
|
||||
|
||||
---
|
||||
|
||||
**Source authorities (non-exhaustive):**
|
||||
|
||||
- **ISO/IEC 19011:2018** — Guidelines for auditing management systems (the canonical audit standard for ISO-family certifications)
|
||||
- **IIA International Professional Practices Framework (IPPF)** — Internal Audit Standards (Standards 1000-2600); attribute + performance standards
|
||||
- **AICPA AT-C 105 + AU-C 240** — Trust Services + auditor's responsibility framework (SOC 2 + financial audit overlap)
|
||||
- **COSO Enterprise Risk Management 2017** — Integrated framework for risk management across the enterprise
|
||||
- **NIST Cybersecurity Framework 2.0** — profile pattern for organizing security/risk programmes (precedent for compliance-os approach)
|
||||
- **ISO/IEC 27001:2022** — Information security management (foundational management system for most compliance programs)
|
||||
- **ISO/IEC 17021** — Conformity assessment requirements (governs certification bodies; informs audit cycle)
|
||||
- **ISACA** — *Auditing Artificial Intelligence* (2nd ed., 2024) — multi-framework AI audit guidance
|
||||
- **ENISA** — *Multilayer Framework for Good Cybersecurity Practices for AI* (Mar 2023) — multi-layer integration
|
||||
- **Annex SL of the ISO/IEC Directives** (2024) — the high-level structure shared by management system standards enabling integration
|
||||
|
|
@ -0,0 +1,108 @@
|
|||
# Cross-Framework Overlap — The 9-Framework × Control-Family Matrix
|
||||
|
||||
This reference answers exactly one decision: **for each common control family, which of the 9 supported frameworks address it, and at what confidence?**
|
||||
|
||||
Pair with `scripts/cross_framework_mapper.py` for the deterministic lookup.
|
||||
|
||||
## The 9 Frameworks
|
||||
|
||||
| ID | Standard | Type |
|
||||
|---|---|---|
|
||||
| iso_27001 | ISO/IEC 27001:2022 + Annex A | Certifiable management system (info-sec) |
|
||||
| iso_13485 | ISO 13485:2016 | Certifiable management system (medical device QMS) |
|
||||
| iso_42001 | ISO/IEC 42001:2023 | Certifiable management system (AIMS) |
|
||||
| iso_14971 | ISO 14971:2019 | Process standard (medical device risk management) |
|
||||
| eu_ai_act | Regulation (EU) 2024/1689 | Binding regulation (AI) |
|
||||
| eu_mdr_745 | Regulation (EU) 2017/745 | Binding regulation (medical devices) |
|
||||
| gdpr | Regulation (EU) 2016/679 | Binding regulation (privacy) |
|
||||
| soc_2 | AICPA SOC 2 TSC | Attestation (US enterprise procurement) |
|
||||
| fda_qsr | FDA 21 CFR 820 | Binding regulation (US medical devices) |
|
||||
|
||||
## Highest-Overlap Pairs (where reuse leverage is maximized)
|
||||
|
||||
1. **ISO 27001 ↔ SOC 2** — densest known overlap. ISO 27001:2022 Annex A 93 controls map to SOC 2 TSC ~75% by published cross-walks. The 19 merged controls in `cross_framework_mapper.py` cite 51 atomic ISO 27001 + 34 atomic SOC 2 controls in HIGH-confidence themes. Adding SOC 2 on top of certified ISO 27001 is typically ~3 months of incremental work.
|
||||
2. **ISO 13485 ↔ FDA QSR** — harmonised in 2024 (FDA Quality Management System Regulation rule). Most evidence reuses.
|
||||
3. **ISO 42001 ↔ ISO 27001** — 60% reuse: most Clauses 4–10 evidence transfers with AI scope appended; Annex A controls A.7 (data) + A.10 (third-party) overlap heavily; the 40% net-new is mostly A.5 (impact assessment) + A.6 (lifecycle) + A.9 (use of AI systems).
|
||||
4. **EU AI Act Article 17 ↔ ISO 42001** — ISO 42001 satisfies most of Article 17(1)(a)–(m) QMS requirements. The cross-walk in `compliance-team-iso42001/references/cross_framework_mapping_ai.md` provides Article 17 line-item mapping.
|
||||
5. **GDPR ↔ ISO 27001 Annex A.5.34** — privacy by design overlap; GDPR Article 32 technical and organizational measures maps to ISO 27001 cryptography (A.8.24) + access control (A.5.15) + incident response (A.5.24).
|
||||
|
||||
## Control Family Overlap Matrix (summary)
|
||||
|
||||
Legend: ✅ direct overlap; 🔶 partial overlap with overlay; ⚠️ concept overlap only; ⛔ not applicable.
|
||||
|
||||
| Control family | 27001 | 13485 | 42001 | 14971 | EU AI Act | MDR | GDPR | SOC 2 | FDA QSR |
|
||||
|---|---|---|---|---|---|---|---|---|---|
|
||||
| Access control | ✅ | 🔶 | 🔶 | ⛔ | ⛔ | ⛔ | 🔶 | ✅ | 🔶 |
|
||||
| Asset inventory | ✅ | ✅ | ✅ | ⛔ | ⛔ | ⛔ | 🔶 | ✅ | ✅ |
|
||||
| Risk management | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | 🔶 | ✅ | 🔶 |
|
||||
| Supplier mgmt | ✅ | ✅ | ✅ | ⛔ | 🔶 | 🔶 | ✅ | ✅ | 🔶 |
|
||||
| Incident response | ✅ | ✅ | 🔶 | 🔶 | 🔶 | ✅ | ✅ | ✅ | ✅ |
|
||||
| Logging & monitoring | ✅ | 🔶 | 🔶 | ⛔ | 🔶 | 🔶 | ⚠️ | ✅ | 🔶 |
|
||||
| Change management | ✅ | ✅ | 🔶 | ⛔ | ⛔ | ✅ | ⛔ | ✅ | ✅ |
|
||||
| BCP / DR | ✅ | 🔶 | ⛔ | ⛔ | ⛔ | ⛔ | ⛔ | ✅ | ⛔ |
|
||||
| Competence + training | ✅ | ✅ | ✅ | ⛔ | 🔶 | ✅ | ⛔ | ✅ | ✅ |
|
||||
| Data governance | 🔶 | ✅ | ✅ | ⛔ | ✅ | ⚠️ | ✅ | ⚠️ | 🔶 |
|
||||
| Internal audit | ✅ | ✅ | ✅ | ⛔ | ⛔ | 🔶 | ⛔ | ✅ | 🔶 |
|
||||
| Management review | ✅ | ✅ | ✅ | ⛔ | ⛔ | 🔶 | ⛔ | 🔶 | ⛔ |
|
||||
| Cryptography | ✅ | ⛔ | ⛔ | ⛔ | ⛔ | ⛔ | ✅ | ✅ | ⛔ |
|
||||
| Secure SDLC | ✅ | ⛔ | 🔶 | ⛔ | 🔶 | ⛔ | ⛔ | ✅ | ⛔ |
|
||||
| Vulnerability mgmt | ✅ | ⛔ | ⛔ | ⛔ | ⛔ | ⛔ | ⛔ | ✅ | ⛔ |
|
||||
| Physical security | ✅ | ✅ | ⛔ | ⛔ | ⛔ | ✅ | ⛔ | ✅ | ✅ |
|
||||
| Personal data protection | ✅ | ⛔ | 🔶 | ⛔ | 🔶 | ⛔ | ✅ | 🔶 | ⛔ |
|
||||
| Documentation control | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | 🔶 | ✅ | ✅ |
|
||||
| Continual improvement / CAPA | ✅ | ✅ | ✅ | ✅ | ⛔ | ✅ | ⛔ | ✅ | ✅ |
|
||||
|
||||
## How to Use This Matrix
|
||||
|
||||
1. **Identify the union** of applicable frameworks (from `framework_selector.py`)
|
||||
2. **For each control family**, find the row and read the columns for your frameworks
|
||||
3. **Build evidence once** for the framework with the strongest requirement, then reuse-with-overlay for others
|
||||
4. **Document the reuse mapping** in your compliance program documentation so auditors can trace evidence to framework controls
|
||||
|
||||
## Practical Reuse Sequencing
|
||||
|
||||
If you operate ISO 27001 (mature) and add a second framework:
|
||||
|
||||
| Add | Reuse leverage from 27001 |
|
||||
|---|---|
|
||||
| **SOC 2** | ~75% — heaviest reuse; the canonical pair |
|
||||
| **ISO 42001** | ~60% — Clauses 4–10 reuse strong; Annex A.7/A.10 reuse strong; A.5/A.6/A.9 net-new |
|
||||
| **GDPR** | ~50% — Article 32 organizational measures reuse; Articles 5/6/30 net-new privacy work |
|
||||
| **EU AI Act** | ~40% — Article 17 QMS via ISO 42001 path; Articles 9/10 net-new; transparency net-new |
|
||||
| **ISO 13485** | ~30% — document control + CAPA reuse; design controls + medical specifics net-new |
|
||||
| **FDA QSR** | ~30% — via ISO 13485 path; sectoral overlay |
|
||||
| **EU MDR 745** | ~25% — most net-new (technical documentation, clinical evidence, UDI) |
|
||||
| **ISO 14971** | ~20% — process standard, integrates with 13485 |
|
||||
|
||||
## Confidence Levels Explained
|
||||
|
||||
The `cross_framework_mapper.py` returns one of three confidence levels per mapping:
|
||||
|
||||
- **HIGH (H)** — same evidence satisfies both framework controls without modification. Example: a quarterly access-review record satisfies ISO 27001 A.5.15 + SOC 2 CC6.1 simultaneously.
|
||||
- **MEDIUM (M)** — existing evidence plus a framework-specific overlay. Example: ISO 27001 supplier-management procedure adapted to add AI-specific clauses for ISO 42001 A.10.2.
|
||||
- **LOW (L)** — concept overlap only; new artefact required. Example: ISO 42001 A.5.2 impact assessment uses concepts from GDPR DPIA but is a separate artefact.
|
||||
|
||||
## When This Reference Doesn't Help
|
||||
|
||||
- **Specific atomic control numbers.** See the per-framework skill's references.
|
||||
- **Sector-specific overlays.** See sectoral skills (financial, healthcare).
|
||||
- **Audit simulation depth.** See `audit_simulation_methodology.md`.
|
||||
|
||||
---
|
||||
|
||||
**Source authorities (non-exhaustive):**
|
||||
|
||||
- **ISO/IEC 27001:2022** + Annex A (the foundational pair source)
|
||||
- **ISO/IEC 42001:2023** + Annex A
|
||||
- **AICPA Trust Services Criteria** (2017 + 2022 update)
|
||||
- **Regulation (EU) 2024/1689** (EU AI Act)
|
||||
- **Regulation (EU) 2016/679** (GDPR)
|
||||
- **Regulation (EU) 2017/745** (EU MDR)
|
||||
- **ISO 13485:2016**
|
||||
- **ISO 14971:2019**
|
||||
- **FDA 21 CFR 820** (QSR) — harmonised under the FDA Quality Management System Regulation rule (effective 2026)
|
||||
- **NIST SP 800-53 Rev 5** — security and privacy controls catalog (cross-walk reference)
|
||||
- **NIST CSF 2.0** — profile pattern
|
||||
- **ISACA** — *Mapping ISO 27001 to SOC 2* (continually updated)
|
||||
- **CIS Controls v8** — additional cross-walk
|
||||
- **CSA STAR** — cloud-specific cross-walk
|
||||
|
|
@ -0,0 +1,164 @@
|
|||
# Evidence Management — Unified Pool + Reuse Leverage
|
||||
|
||||
This reference answers exactly one decision: **how do we collect compliance evidence once and satisfy multiple frameworks, without losing audit-grade traceability?**
|
||||
|
||||
Pair with `scripts/evidence_pool_generator.py` for the deterministic evidence catalogue.
|
||||
|
||||
## The Evidence Reuse Problem
|
||||
|
||||
Most multi-framework compliance programs accidentally collect the same evidence multiple times. Each framework's auditor wants:
|
||||
|
||||
- A documented procedure (the "what should happen")
|
||||
- Records that the procedure was followed (the "what actually happened")
|
||||
- Evidence of management oversight (the "did anyone check?")
|
||||
|
||||
When ISO 27001, SOC 2, and ISO 42001 audits ask for "access review records," teams often produce three different exports of the same Okta data with different formatting because three different control owners assembled them.
|
||||
|
||||
The fix: a **unified evidence pool** with explicit (artefact, framework, control) mapping. Collect once; cite multiple times.
|
||||
|
||||
## The Reuse-Leverage Score
|
||||
|
||||
Every evidence artefact gets a **reuse-leverage score** = number of distinct (framework, control) tuples it satisfies. Higher score = higher priority to build first.
|
||||
|
||||
From the `evidence_pool_generator.py` curated catalogue, the top-leverage artefacts (when all 9 frameworks are enabled):
|
||||
|
||||
| Artefact | Leverage |
|
||||
|---|---|
|
||||
| Risk register | 9+ mappings |
|
||||
| Supplier inventory + reviews + DPAs | 8+ |
|
||||
| Incident log + post-mortems + notifications | 11+ |
|
||||
| Data inventory + provenance + consent | 9+ |
|
||||
| Policy set (AI + info-sec + privacy + code-of-conduct) | 8+ |
|
||||
| Tamper-evident logs centralized | 7+ |
|
||||
| Training records | 6+ |
|
||||
|
||||
**Implementation order:** build high-leverage artefacts first. The risk register alone unlocks evidence for 9+ controls across 4+ frameworks.
|
||||
|
||||
## Evidence Acquisition Cost
|
||||
|
||||
The catalogue tracks acquisition cost per artefact: low / medium / high.
|
||||
|
||||
| Cost | Examples | Time to build |
|
||||
|---|---|---|
|
||||
| **Low** | Quarterly access review records, change records, management review records | 1-2 weeks (often automated from existing IT systems) |
|
||||
| **Medium** | Asset register, supplier inventory, training records, crypto records, vuln scans | 2-6 weeks (requires inventory + classification) |
|
||||
| **High** | Risk register, BCP/DR exercises, data inventory + consent register, secure SDLC | 6-12 weeks (requires cross-functional process design) |
|
||||
|
||||
**Strategy:** in year 1, prioritize low-cost high-leverage artefacts (e.g., management review records, change records). Build high-cost high-leverage artefacts in parallel (risk register, data inventory).
|
||||
|
||||
## Retention by Framework
|
||||
|
||||
Retention requirements vary per framework. Use the longest applicable retention:
|
||||
|
||||
| Framework | Typical retention |
|
||||
|---|---|
|
||||
| ISO 27001 | 3 years for audit evidence (or as policy specifies) |
|
||||
| SOC 2 | 1 year minimum; 3 years recommended |
|
||||
| ISO 42001 | 3 years (Clause 7.5 documented information) |
|
||||
| EU AI Act | 10 years for declaration of conformity (Article 18); other docs 6 years |
|
||||
| GDPR | Varies by data type; data subject records 3 years; breach records indefinite |
|
||||
| ISO 13485 | Lifecycle of device + period defined by regulator (often 5+ years) |
|
||||
| EU MDR | Device lifetime + 10 years (Article 10) |
|
||||
| FDA QSR | 2 years past commercial distribution (21 CFR 820.180) |
|
||||
|
||||
**Default policy:** 36 months for most artefacts; 60 months for personal-data and policy-set artefacts; 120 months for EU AI Act declarations of conformity.
|
||||
|
||||
## Evidence Freshness
|
||||
|
||||
Auditors want recent evidence, not stale. Freshness expectations:
|
||||
|
||||
- Operational records (access reviews, change records, incident records): within last 90-180 days
|
||||
- Quarterly artefacts: at least 1 record from current quarter
|
||||
- Annual artefacts (training records, supplier reviews, BCP exercises): within last 12 months
|
||||
- Policies: reviewed annually (review records demonstrate freshness)
|
||||
|
||||
**Stale evidence = effective gap.** An ISO 27001 A.5.15 quarterly access review that was last conducted 8 months ago is a major nonconformity even if the review existed historically.
|
||||
|
||||
## Evidence Owner Assignment
|
||||
|
||||
Each artefact has a primary owner. Typical pattern:
|
||||
|
||||
| Artefact type | Primary owner | Secondary |
|
||||
|---|---|---|
|
||||
| Access reviews | IT / Security | Compliance |
|
||||
| Asset register | Security | DPO |
|
||||
| Risk register | Compliance officer | Risk manager |
|
||||
| Supplier inventory | Procurement | Compliance + DPO |
|
||||
| Incident log | Security / IR team | Compliance |
|
||||
| Logs (centralized) | Platform / SRE | Security |
|
||||
| Change records | Engineering / Platform | Compliance |
|
||||
| BCP/DR | Platform / SRE | Compliance |
|
||||
| Training records | HR / People Ops | Compliance |
|
||||
| Data inventory + consent | DPO / Data team | Engineering |
|
||||
| Internal audit records | Compliance officer | Internal auditor |
|
||||
| Management review records | Compliance officer + Exec | All function heads |
|
||||
| Policy set | Compliance officer + Exec | All policy owners |
|
||||
| Crypto records | Security | Platform |
|
||||
| Vuln scans + patches | Security | Engineering |
|
||||
|
||||
**Single accountable owner per artefact** is critical. Joint ownership without accountability is the most common cause of stale evidence.
|
||||
|
||||
## Evidence Storage Architecture
|
||||
|
||||
Patterns observed in mature programs:
|
||||
|
||||
1. **GRC platform (Drata, Vanta, OneTrust, Hyperproof, etc.)** — the most common pattern; integrates with operational tools (Okta, AWS, GitHub) and auto-pulls evidence. Centralizes audit-trail.
|
||||
2. **Compliance-team-managed repository** — folder per framework with subdivision per control; manual evidence assembly. Works for small programs; doesn't scale.
|
||||
3. **Hybrid** — automated evidence (logs, access reviews, change records) in GRC platform; manual evidence (policies, management review minutes, training records) in document management system. Most common at growth-stage.
|
||||
|
||||
Compliance OS does not prescribe a storage pattern — but it does require:
|
||||
- Single index of evidence (the unified pool)
|
||||
- Per-evidence audit trail (who created, who approved, when)
|
||||
- Per-evidence retention timer
|
||||
- Per-evidence freshness alert
|
||||
|
||||
## Evidence Pool Quality Indicators
|
||||
|
||||
Healthy pool:
|
||||
|
||||
| Indicator | Healthy value |
|
||||
|---|---|
|
||||
| Average reuse leverage | ≥ 4 |
|
||||
| Stale evidence (past expected freshness) | 0% |
|
||||
| Orphan controls (no evidence assigned) | 0 |
|
||||
| Unowned artefacts | 0 |
|
||||
| Retention compliance | 100% |
|
||||
|
||||
Unhealthy pool:
|
||||
|
||||
- Many low-leverage artefacts (each satisfies only 1 framework) — likely silo'd collection
|
||||
- High stale rate — operational discipline broken
|
||||
- Orphan controls — gap in coverage that will surface at next audit
|
||||
|
||||
## Evidence Pool Audit (the meta-audit)
|
||||
|
||||
Once a year, audit the evidence pool itself:
|
||||
|
||||
1. Sample 10% of artefacts; verify they exist + are owned + are fresh
|
||||
2. Sample 10% of controls; verify each has at least one evidence artefact assigned
|
||||
3. Verify retention compliance — look for old evidence that should be deleted (GDPR retention) and recent evidence that should be retained longer
|
||||
4. Verify framework coverage — are all enabled frameworks adequately represented?
|
||||
|
||||
This audit-of-audit is the most underappreciated discipline in mature multi-framework programs.
|
||||
|
||||
## When This Reference Doesn't Help
|
||||
|
||||
- **Specific GRC platform configuration.** Tooling-specific; market evolves rapidly.
|
||||
- **Evidence retention for novel data types (e.g., AI training data).** Sector-specific; engage counsel.
|
||||
- **Cross-framework specific mapping.** See `cross_framework_overlap.md`.
|
||||
|
||||
---
|
||||
|
||||
**Source authorities (non-exhaustive):**
|
||||
|
||||
- **ISO/IEC 27001:2022 Clause 7.5** — Documented information requirements
|
||||
- **ISO/IEC 42001:2023 Clause 7.5** — AI-specific documented information
|
||||
- **AICPA AT-C 205** — Examination engagements (SOC 2 evidence standards)
|
||||
- **NIST SP 800-53A Rev 5** — Assessing Security and Privacy Controls (per-control evidence types)
|
||||
- **NIST SP 800-92** — Guide to Computer Security Log Management
|
||||
- **ISO/IEC 19011:2018 Clause 6.4** — Conducting audit activities (evidence collection)
|
||||
- **IIA IPPF Performance Standard 2330** — Documenting Information (engagement records)
|
||||
- **GDPR Article 30** — Records of processing activities (retention + evidence)
|
||||
- **EU AI Act Article 18** — Document retention (10 years post-market for declaration of conformity)
|
||||
- **FDA 21 CFR 820.180** — General requirements for records (2 years past commercial distribution)
|
||||
- **DAMA-DMBOK 2** — Data Management Body of Knowledge (data-quality + provenance frameworks)
|
||||
396
compliance-os/skills/compliance-os/scripts/audit_simulator.py
Normal file
396
compliance-os/skills/compliance-os/scripts/audit_simulator.py
Normal file
|
|
@ -0,0 +1,396 @@
|
|||
#!/usr/bin/env python3
|
||||
"""audit_simulator.py — Mock internal audit generator per ISO 19011 + IIA IPPF.
|
||||
|
||||
Stdlib-only. Given a framework + scope, generates a realistic mock audit with:
|
||||
- 8-15 finding scenarios per typical ISO 19011 audit depth
|
||||
- Severity distribution matching IIA expectations:
|
||||
observation/OFI: ≥ 40%
|
||||
minor: 20-30%
|
||||
major: 15-25%
|
||||
critical: ≤ 15%
|
||||
- 3-5 interview questions per scoped control
|
||||
- Document-review request list
|
||||
- Walk-through scenarios where applicable
|
||||
|
||||
Deterministic generation from finding templates. Severity distribution is
|
||||
proportional to the scope size. No randomness, no LLM calls.
|
||||
|
||||
Input schema (JSON):
|
||||
{
|
||||
"audit_name": "Q3 ISO 27001 internal audit — Platform team",
|
||||
"framework": "iso_27001",
|
||||
"scope_controls": ["A.5.15", "A.8.2", "A.8.15", "A.8.32", "A.5.19"],
|
||||
"auditee_team": "Platform engineering",
|
||||
"prior_year_findings_open": 2
|
||||
}
|
||||
|
||||
Usage:
|
||||
python audit_simulator.py
|
||||
python audit_simulator.py path/to/audit_scope.json
|
||||
python audit_simulator.py audit_scope.json --output json
|
||||
"""
|
||||
|
||||
import argparse
|
||||
import json
|
||||
import sys
|
||||
from typing import Any, Dict, List
|
||||
|
||||
|
||||
SAMPLE: Dict[str, Any] = {
|
||||
"audit_name": "Q3 ISO 27001 internal audit — Platform team",
|
||||
"framework": "iso_27001",
|
||||
"scope_controls": ["A.5.15", "A.8.2", "A.8.15", "A.8.32", "A.5.19", "A.5.24", "A.6.8"],
|
||||
"auditee_team": "Platform engineering",
|
||||
"prior_year_findings_open": 2,
|
||||
}
|
||||
|
||||
|
||||
# Finding template library (theme -> {severity bucket -> finding patterns})
|
||||
# Each template produces a finding scenario when invoked.
|
||||
FINDING_TEMPLATES: Dict[str, Dict[str, List[str]]] = {
|
||||
"access_control": {
|
||||
"critical": [
|
||||
"Privileged access reviewed annually instead of quarterly; orphaned accounts found in production.",
|
||||
],
|
||||
"major": [
|
||||
"Quarterly access review evidence present but lacks documented business justification for retained privileges.",
|
||||
"Joiner-mover-leaver workflow does not auto-deprovision on termination; manual gap of 5+ days observed.",
|
||||
],
|
||||
"minor": [
|
||||
"Access review records lack documented review-completion timestamps in 2 of 6 sampled reviews.",
|
||||
],
|
||||
"observation": [
|
||||
"Consider extending RBAC matrix to include cloud-resource scope (currently application-tier only).",
|
||||
],
|
||||
},
|
||||
"logging_monitoring": {
|
||||
"critical": [
|
||||
"Production application logs disabled in past 30 days; no detection of the gap until audit fieldwork.",
|
||||
],
|
||||
"major": [
|
||||
"Log retention configured at 90 days but framework requires 12 months; misalignment not detected.",
|
||||
"Tamper-evident logging not enforced on privileged-user activity logs.",
|
||||
],
|
||||
"minor": [
|
||||
"Monitoring alert thresholds not formally documented; reviewed verbally by SRE only.",
|
||||
],
|
||||
"observation": [
|
||||
"Centralized log aggregation in place; consider adding anomaly detection.",
|
||||
],
|
||||
},
|
||||
"change_management": {
|
||||
"critical": [
|
||||
"Emergency change procedure not formalized; observed 3 cases of production changes without recorded approval.",
|
||||
],
|
||||
"major": [
|
||||
"Change advisory board records show approvals but no post-implementation review of high-risk changes.",
|
||||
],
|
||||
"minor": [
|
||||
"Rollback procedure documented but not tested for 2 services in scope.",
|
||||
],
|
||||
"observation": [
|
||||
"Consider linking change records to deployment automation for stronger evidence chain.",
|
||||
],
|
||||
},
|
||||
"supplier_mgmt": {
|
||||
"critical": [
|
||||
"Critical SaaS supplier in use without signed DPA + security questionnaire (GDPR exposure).",
|
||||
],
|
||||
"major": [
|
||||
"Annual supplier security review not completed for 3 of 8 critical suppliers.",
|
||||
"Sub-processor list not maintained for critical suppliers handling personal data.",
|
||||
],
|
||||
"minor": [
|
||||
"Supplier onboarding checklist exists but not consistently applied across business units.",
|
||||
],
|
||||
"observation": [
|
||||
"Consider centralizing supplier risk evidence in a single GRC system.",
|
||||
],
|
||||
},
|
||||
"incident_response": {
|
||||
"critical": [
|
||||
"Recent P1 incident lacks documented post-incident review (PIR) within 30-day SLA.",
|
||||
],
|
||||
"major": [
|
||||
"Severity definitions documented but inconsistently applied across teams; impact varies.",
|
||||
"Notification SLAs not aligned across frameworks (GDPR 72h, framework X 24h, framework Y 15 days).",
|
||||
],
|
||||
"minor": [
|
||||
"Incident commander rotation not documented.",
|
||||
],
|
||||
"observation": [
|
||||
"Consider quarterly tabletop exercises to validate runbooks.",
|
||||
],
|
||||
},
|
||||
}
|
||||
|
||||
# Control -> theme mapping (heuristic; deterministic)
|
||||
CONTROL_TO_THEME: Dict[str, str] = {
|
||||
# ISO 27001 mapping
|
||||
"A.5.15": "access_control",
|
||||
"A.8.2": "access_control",
|
||||
"A.8.3": "access_control",
|
||||
"A.5.19": "supplier_mgmt",
|
||||
"A.5.20": "supplier_mgmt",
|
||||
"A.5.21": "supplier_mgmt",
|
||||
"A.5.22": "supplier_mgmt",
|
||||
"A.5.24": "incident_response",
|
||||
"A.5.25": "incident_response",
|
||||
"A.5.26": "incident_response",
|
||||
"A.5.27": "incident_response",
|
||||
"A.6.8": "incident_response",
|
||||
"A.8.15": "logging_monitoring",
|
||||
"A.8.16": "logging_monitoring",
|
||||
"A.8.32": "change_management",
|
||||
# SOC 2 mapping
|
||||
"CC6.1": "access_control",
|
||||
"CC6.2": "access_control",
|
||||
"CC6.3": "access_control",
|
||||
"CC9.2": "supplier_mgmt",
|
||||
"CC7.3": "incident_response",
|
||||
"CC7.4": "incident_response",
|
||||
"CC7.5": "incident_response",
|
||||
"CC7.1": "logging_monitoring",
|
||||
"CC7.2": "logging_monitoring",
|
||||
"CC8.1": "change_management",
|
||||
# ISO 42001 mapping
|
||||
"A.4.4": "access_control",
|
||||
"A.9.3": "logging_monitoring",
|
||||
"A.9.4": "logging_monitoring",
|
||||
"A.6.2.5": "change_management",
|
||||
"A.10.2": "supplier_mgmt",
|
||||
"A.8.4": "incident_response",
|
||||
}
|
||||
|
||||
|
||||
def _severity_rotation() -> List[str]:
|
||||
return [
|
||||
"observation", "observation", "observation", "minor", "major",
|
||||
"observation", "minor", "observation", "major", "critical",
|
||||
"minor", "observation", "minor", "observation", "major",
|
||||
]
|
||||
|
||||
|
||||
def generate_findings(payload: Dict[str, Any]) -> List[Dict[str, Any]]:
|
||||
"""Generate finding scenarios deterministically from scope."""
|
||||
findings: List[Dict[str, Any]] = []
|
||||
scope = payload.get("scope_controls", [])
|
||||
prior_open = payload.get("prior_year_findings_open", 0)
|
||||
|
||||
# Rotate severities to hit IIA-target distribution
|
||||
# Target: >= 40% observation, ~25% minor, ~20% major, <= 15% critical
|
||||
severity_order = _severity_rotation()
|
||||
# Pad if scope is large
|
||||
while len(severity_order) < len(scope) + 5:
|
||||
severity_order += severity_order
|
||||
|
||||
for idx, control in enumerate(scope):
|
||||
theme = CONTROL_TO_THEME.get(control)
|
||||
if theme is None:
|
||||
continue
|
||||
severity = severity_order[idx]
|
||||
# If prior_open > 0, force first finding to be major (follow-up)
|
||||
if idx == 0 and prior_open > 0:
|
||||
severity = "major"
|
||||
templates = FINDING_TEMPLATES.get(theme, {}).get(severity, [])
|
||||
if not templates:
|
||||
severity = "observation"
|
||||
templates = FINDING_TEMPLATES.get(theme, {}).get("observation", ["General observation noted."])
|
||||
finding_text = templates[idx % len(templates)]
|
||||
findings.append({
|
||||
"id": f"F-{idx + 1:02d}",
|
||||
"control": control,
|
||||
"theme": theme,
|
||||
"severity": severity,
|
||||
"description": finding_text,
|
||||
"follow_up_from_prior": idx == 0 and prior_open > 0,
|
||||
})
|
||||
|
||||
# Add 3-6 additional observations to hit 10-15 total range per ISO 19011 typical depth
|
||||
extras_needed = max(0, 10 - len(findings))
|
||||
extras_added = 0
|
||||
for theme in FINDING_TEMPLATES:
|
||||
if extras_added >= extras_needed:
|
||||
break
|
||||
if not any(f["theme"] == theme for f in findings):
|
||||
continue
|
||||
templates = FINDING_TEMPLATES[theme]["observation"]
|
||||
findings.append({
|
||||
"id": f"F-{len(findings) + 1:02d}",
|
||||
"control": "(general)",
|
||||
"theme": theme,
|
||||
"severity": "observation",
|
||||
"description": templates[(extras_added + 1) % len(templates)],
|
||||
"follow_up_from_prior": False,
|
||||
})
|
||||
extras_added += 1
|
||||
|
||||
return findings
|
||||
|
||||
|
||||
def interview_questions(control: str) -> List[str]:
|
||||
"""Deterministic 3-5 audit interview questions per control theme."""
|
||||
theme = CONTROL_TO_THEME.get(control)
|
||||
bank = {
|
||||
"access_control": [
|
||||
"Walk me through how a new joiner gets access provisioned.",
|
||||
"Show me the last quarterly access review evidence for a privileged role.",
|
||||
"What happens within 24 hours of a termination?",
|
||||
"How is multi-factor authentication enforced for admin access?",
|
||||
],
|
||||
"logging_monitoring": [
|
||||
"Show me a sample log entry for a privileged action in the last 30 days.",
|
||||
"What's the log retention configuration, and where is it documented?",
|
||||
"How are tampering attempts detected and alerted?",
|
||||
"Show me a monitoring alert that fired in the last 7 days and how it was triaged.",
|
||||
],
|
||||
"change_management": [
|
||||
"Walk me through the change approval workflow for a production deployment.",
|
||||
"Show me a rejected change in the last quarter and the rejection rationale.",
|
||||
"Where is the rollback procedure for service X documented and last tested?",
|
||||
"How are emergency changes handled differently from standard changes?",
|
||||
],
|
||||
"supplier_mgmt": [
|
||||
"Show me the supplier inventory and the last review date for 3 critical suppliers.",
|
||||
"How are AI-specific contractual clauses tracked for AI service suppliers?",
|
||||
"Walk me through onboarding of a new critical SaaS supplier.",
|
||||
"Show me where signed DPAs are stored for personal-data sub-processors.",
|
||||
],
|
||||
"incident_response": [
|
||||
"Show me the last 3 incidents with severity, root cause, and corrective action.",
|
||||
"Walk me through your serious-incident reporting timing for GDPR + AI Act.",
|
||||
"Where are post-incident reviews documented and tracked to closure?",
|
||||
"How is the on-call rotation defined and communicated?",
|
||||
],
|
||||
}
|
||||
return bank.get(theme, [
|
||||
"Walk me through how this control is implemented day-to-day.",
|
||||
"Show me records of the control being operated in the last 90 days.",
|
||||
"How is effectiveness of this control measured?",
|
||||
])
|
||||
|
||||
|
||||
def document_requests(scope: List[str]) -> List[str]:
|
||||
themes = {CONTROL_TO_THEME.get(c) for c in scope if CONTROL_TO_THEME.get(c)}
|
||||
docs = []
|
||||
for t in themes:
|
||||
if t == "access_control":
|
||||
docs.append("Access control policy + last 2 quarterly access reviews + RBAC matrix")
|
||||
elif t == "logging_monitoring":
|
||||
docs.append("Logging policy + log retention configuration + last 30 days of sample privileged-action logs")
|
||||
elif t == "change_management":
|
||||
docs.append("Change management procedure + last 90 days change records + rollback procedure")
|
||||
elif t == "supplier_mgmt":
|
||||
docs.append("Supplier inventory + last annual supplier reviews + 3 sample DPAs")
|
||||
elif t == "incident_response":
|
||||
docs.append("Incident response procedure + last 5 incident records + post-incident reviews")
|
||||
return docs
|
||||
|
||||
|
||||
def analyze(payload: Dict[str, Any]) -> Dict[str, Any]:
|
||||
findings = generate_findings(payload)
|
||||
by_sev: Dict[str, int] = {"critical": 0, "major": 0, "minor": 0, "observation": 0}
|
||||
for f in findings:
|
||||
by_sev[f["severity"]] += 1
|
||||
|
||||
total = len(findings)
|
||||
obs_pct = round((by_sev["observation"] / total) * 100, 1) if total else 0
|
||||
crit_pct = round((by_sev["critical"] / total) * 100, 1) if total else 0
|
||||
healthy = (obs_pct >= 40) and (crit_pct <= 15)
|
||||
|
||||
return {
|
||||
"audit_name": payload.get("audit_name"),
|
||||
"framework": payload.get("framework"),
|
||||
"scope_controls": payload.get("scope_controls", []),
|
||||
"auditee_team": payload.get("auditee_team"),
|
||||
"findings_total": total,
|
||||
"findings_by_severity": by_sev,
|
||||
"severity_distribution_healthy": healthy,
|
||||
"obs_pct": obs_pct,
|
||||
"crit_pct": crit_pct,
|
||||
"findings": findings,
|
||||
"interview_questions_per_control": {c: interview_questions(c) for c in payload.get("scope_controls", [])},
|
||||
"document_review_requests": document_requests(payload.get("scope_controls", [])),
|
||||
}
|
||||
|
||||
|
||||
def render_text(r: Dict[str, Any], source: str) -> str:
|
||||
lines = []
|
||||
lines.append("=" * 72)
|
||||
lines.append("COMPLIANCE OS — MOCK INTERNAL AUDIT (per ISO 19011 + IIA IPPF)")
|
||||
lines.append(f"Source: {source}")
|
||||
lines.append("=" * 72)
|
||||
lines.append("")
|
||||
lines.append(f"Audit: {r['audit_name']}")
|
||||
lines.append(f"Framework: {r['framework']} | Auditee: {r['auditee_team']}")
|
||||
lines.append(f"Scope controls ({len(r['scope_controls'])}): {', '.join(r['scope_controls'])}")
|
||||
lines.append("")
|
||||
s = r["findings_by_severity"]
|
||||
lines.append(f"Findings total: {r['findings_total']} "
|
||||
f"(critical={s['critical']}, major={s['major']}, minor={s['minor']}, observation={s['observation']})")
|
||||
lines.append(f"Distribution: observation={r['obs_pct']}% critical={r['crit_pct']}% "
|
||||
f"healthy={r['severity_distribution_healthy']}")
|
||||
lines.append("")
|
||||
lines.append("-" * 72)
|
||||
lines.append("FINDINGS:")
|
||||
lines.append("")
|
||||
for f in r["findings"]:
|
||||
marker = "🔥 FOLLOW-UP" if f["follow_up_from_prior"] else ""
|
||||
lines.append(f" [{f['id']}] [{f['severity'].upper():12s}] control={f['control']:12s} theme={f['theme']:20s} {marker}")
|
||||
lines.append(f" {f['description']}")
|
||||
lines.append("")
|
||||
|
||||
lines.append("-" * 72)
|
||||
lines.append("INTERVIEW QUESTIONS PER CONTROL:")
|
||||
for ctrl, qs in r["interview_questions_per_control"].items():
|
||||
lines.append(f" {ctrl}:")
|
||||
for q in qs:
|
||||
lines.append(f" - {q}")
|
||||
lines.append("")
|
||||
|
||||
lines.append("-" * 72)
|
||||
lines.append("DOCUMENT-REVIEW REQUESTS:")
|
||||
for d in r["document_review_requests"]:
|
||||
lines.append(f" - {d}")
|
||||
lines.append("")
|
||||
lines.append("-" * 72)
|
||||
lines.append("HEALTHY-DISTRIBUTION RULE (IIA expectations):")
|
||||
lines.append(" observation/OFI ≥ 40% AND critical ≤ 15%")
|
||||
return "\n".join(lines)
|
||||
|
||||
|
||||
def main() -> int:
|
||||
parser = argparse.ArgumentParser(
|
||||
description="Mock internal audit generator per ISO 19011 + IIA IPPF + AICPA AT-C.",
|
||||
formatter_class=argparse.RawDescriptionHelpFormatter,
|
||||
epilog=__doc__,
|
||||
)
|
||||
parser.add_argument("path", nargs="?", help="Path to audit scope JSON (uses embedded sample if omitted)")
|
||||
parser.add_argument("--output", choices=("text", "json"), default="text", help="Output format")
|
||||
args = parser.parse_args()
|
||||
|
||||
if args.path:
|
||||
try:
|
||||
with open(args.path, "r", encoding="utf-8") as f:
|
||||
payload = json.load(f)
|
||||
source = args.path
|
||||
except (IOError, OSError) as e:
|
||||
print(f"error: could not read {args.path}: {e}", file=sys.stderr)
|
||||
return 1
|
||||
except json.JSONDecodeError as e:
|
||||
print(f"error: invalid JSON in {args.path}: {e}", file=sys.stderr)
|
||||
return 1
|
||||
else:
|
||||
payload = SAMPLE
|
||||
source = "<embedded sample: Q3 ISO 27001 internal audit, Platform team, 7 controls>"
|
||||
|
||||
result = analyze(payload)
|
||||
if args.output == "json":
|
||||
print(json.dumps({"source": source, **result}, indent=2))
|
||||
else:
|
||||
print(render_text(result, source))
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
|
|
@ -0,0 +1,374 @@
|
|||
#!/usr/bin/env python3
|
||||
"""cross_framework_mapper.py — Multi-framework control overlap computation.
|
||||
|
||||
Stdlib-only. Takes 1+ framework control libraries (control IDs + categories) and
|
||||
computes overlap with mapping confidence (HIGH/MEDIUM/LOW) using a curated
|
||||
ground-truth overlap dictionary distilled from published cross-walks:
|
||||
- ISO 27001 Annex A <-> SOC 2 TSC (the densest known pair)
|
||||
- ISO 27001 <-> ISO 42001 (info-sec reuse for AIMS)
|
||||
- ISO 42001 <-> EU AI Act (Article 17 QMS satisfaction)
|
||||
- GDPR <-> ISO 27001 (privacy controls overlap)
|
||||
- ISO 13485 <-> FDA QSR (harmonised)
|
||||
|
||||
For each merged control, outputs the participating frameworks + a unified
|
||||
evidence-requirement statement that satisfies all of them.
|
||||
|
||||
Deterministic ground-truth lookup. No LLM calls. No external dependencies.
|
||||
|
||||
Input schema (JSON):
|
||||
{
|
||||
"program": "Acme AI Inc. Compliance Program",
|
||||
"enabled_frameworks": ["iso_27001", "soc_2", "iso_42001", "eu_ai_act", "gdpr"]
|
||||
}
|
||||
|
||||
Usage:
|
||||
python cross_framework_mapper.py # uses embedded 5-framework sample
|
||||
python cross_framework_mapper.py path/to/program.json
|
||||
python cross_framework_mapper.py program.json --output json
|
||||
"""
|
||||
|
||||
import argparse
|
||||
import json
|
||||
import sys
|
||||
from typing import Any, Dict, List, Set
|
||||
|
||||
|
||||
SAMPLE: Dict[str, Any] = {
|
||||
"program": "Acme AI Inc. Compliance Program",
|
||||
"enabled_frameworks": ["iso_27001", "soc_2", "iso_42001", "eu_ai_act", "gdpr"],
|
||||
}
|
||||
|
||||
|
||||
# Curated overlap database
|
||||
# Each merged control: id, theme, evidence requirement, and per-framework mapping
|
||||
# Mappings: framework_id -> (control_id, confidence)
|
||||
# Confidence: H (high - same evidence satisfies), M (medium - evidence with overlay), L (low - concept overlap only)
|
||||
|
||||
MERGED_CONTROLS: List[Dict[str, Any]] = [
|
||||
{
|
||||
"id": "mc.access_control",
|
||||
"theme": "Access control (identity, authentication, authorization)",
|
||||
"evidence": "Documented access-control policy + access provisioning/de-provisioning procedure + quarterly access review records + RBAC matrix",
|
||||
"mappings": {
|
||||
"iso_27001": ("A.5.15 + A.8.2 + A.8.3", "H"),
|
||||
"soc_2": ("CC6.1 + CC6.2 + CC6.3", "H"),
|
||||
"iso_42001": ("A.4.4 (human resources for AI systems)", "M"),
|
||||
"gdpr": ("Article 32(1)(b) integrity and confidentiality", "M"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.asset_inventory",
|
||||
"theme": "Asset inventory and classification",
|
||||
"evidence": "Asset register including AI systems + data classification scheme + ownership map",
|
||||
"mappings": {
|
||||
"iso_27001": ("A.5.9 + A.5.10 + A.5.12", "H"),
|
||||
"soc_2": ("CC6.1 + CC3.2", "H"),
|
||||
"iso_42001": ("A.4.2 (data) + A.4.3 (tooling)", "H"),
|
||||
"gdpr": ("Article 30 (records of processing activities)", "M"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.risk_management",
|
||||
"theme": "Risk management process",
|
||||
"evidence": "Risk methodology + risk register with severity matrix + risk treatment plan + residual-risk acceptance signoff",
|
||||
"mappings": {
|
||||
"iso_27001": ("Clause 6.1 + Clause 8.2", "H"),
|
||||
"soc_2": ("CC3.1 + CC3.2 + CC3.4", "H"),
|
||||
"iso_42001": ("Clause 6.1.2 + A.5", "H"),
|
||||
"eu_ai_act": ("Article 9 (risk management system)", "M"),
|
||||
"gdpr": ("Article 35 (DPIA where applicable)", "M"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.supplier_management",
|
||||
"theme": "Third-party / supplier risk management",
|
||||
"evidence": "Supplier inventory + due-diligence questionnaires + contractual security/privacy/AI clauses + periodic review records",
|
||||
"mappings": {
|
||||
"iso_27001": ("A.5.19 + A.5.20 + A.5.21 + A.5.22", "H"),
|
||||
"soc_2": ("CC9.2", "H"),
|
||||
"iso_42001": ("A.10.2 + A.10.6", "H"),
|
||||
"eu_ai_act": ("Article 25 (responsibilities along the AI value chain)", "M"),
|
||||
"gdpr": ("Article 28 (processor obligations)", "H"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.incident_response",
|
||||
"theme": "Incident response + notification",
|
||||
"evidence": "Documented incident response procedure + severity definitions + escalation matrix + notification SLAs + post-incident reviews",
|
||||
"mappings": {
|
||||
"iso_27001": ("A.5.24 + A.5.25 + A.5.26 + A.5.27 + A.6.8", "H"),
|
||||
"soc_2": ("CC7.3 + CC7.4 + CC7.5", "H"),
|
||||
"iso_42001": ("A.8.4 (communication of AI incidents)", "M"),
|
||||
"eu_ai_act": ("Article 73 (serious-incident reporting)", "M"),
|
||||
"gdpr": ("Articles 33 + 34 (breach notification)", "H"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.monitoring_logging",
|
||||
"theme": "Monitoring + logging",
|
||||
"evidence": "Logging policy + tamper-evident logs + monitoring dashboards + retention compliant with longest applicable framework",
|
||||
"mappings": {
|
||||
"iso_27001": ("A.8.15 + A.8.16", "H"),
|
||||
"soc_2": ("CC7.1 + CC7.2", "H"),
|
||||
"iso_42001": ("A.9.3 + A.9.4", "M"),
|
||||
"eu_ai_act": ("Article 12 (logging) + Article 72 (post-market monitoring)", "M"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.change_management",
|
||||
"theme": "Change management (system + model)",
|
||||
"evidence": "Change approval workflow + version control + rollback procedure + change advisory board records",
|
||||
"mappings": {
|
||||
"iso_27001": ("A.8.32", "H"),
|
||||
"soc_2": ("CC8.1", "H"),
|
||||
"iso_42001": ("A.6.2.5 (deployment)", "M"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.business_continuity",
|
||||
"theme": "Business continuity and disaster recovery",
|
||||
"evidence": "BCP/DRP documents + tested recovery objectives (RPO/RTO) + annual exercises + lessons learned",
|
||||
"mappings": {
|
||||
"iso_27001": ("A.5.29 + A.5.30 + A.8.13 + A.8.14", "H"),
|
||||
"soc_2": ("A1.2 + A1.3", "H"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.competence_training",
|
||||
"theme": "Competence + awareness training",
|
||||
"evidence": "Competence requirements per role + training plan + completion records + effectiveness verification",
|
||||
"mappings": {
|
||||
"iso_27001": ("A.6.3", "H"),
|
||||
"soc_2": ("CC1.4 + CC2.2", "H"),
|
||||
"iso_42001": ("Clause 7.2 + Clause 7.3 + A.4.4", "H"),
|
||||
"eu_ai_act": ("Article 4 (AI literacy)", "M"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.data_governance",
|
||||
"theme": "Data governance + data quality",
|
||||
"evidence": "Data inventory + provenance records + quality metrics + retention/deletion schedule + consent/lawful-basis records",
|
||||
"mappings": {
|
||||
"iso_27001": ("A.5.34 (privacy)", "M"),
|
||||
"iso_42001": ("A.7 (full category)", "H"),
|
||||
"eu_ai_act": ("Article 10 (data governance for high-risk)", "H"),
|
||||
"gdpr": ("Articles 5 + 6 + 30", "H"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.internal_audit",
|
||||
"theme": "Internal audit programme",
|
||||
"evidence": "Annual audit plan + auditor independence + findings tracking + closure verification",
|
||||
"mappings": {
|
||||
"iso_27001": ("Clause 9.2", "H"),
|
||||
"soc_2": ("CC4.1", "H"),
|
||||
"iso_42001": ("Clause 9.2", "H"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.management_review",
|
||||
"theme": "Management review",
|
||||
"evidence": "Management review procedure + scheduled inputs + meeting records + action item tracking",
|
||||
"mappings": {
|
||||
"iso_27001": ("Clause 9.3", "H"),
|
||||
"iso_42001": ("Clause 9.3", "H"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.cryptography",
|
||||
"theme": "Cryptography and key management",
|
||||
"evidence": "Cryptographic policy + algorithm + key length standards + key rotation + HSM/KMS architecture + key custody records",
|
||||
"mappings": {
|
||||
"iso_27001": ("A.8.24", "H"),
|
||||
"soc_2": ("CC6.1 + CC6.7", "H"),
|
||||
"gdpr": ("Article 32(1)(a) pseudonymisation + encryption", "H"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.secure_sdlc",
|
||||
"theme": "Secure software development lifecycle",
|
||||
"evidence": "Secure SDLC policy + threat modeling + code review records + SAST/DAST scanning + vulnerability triage",
|
||||
"mappings": {
|
||||
"iso_27001": ("A.8.25 + A.8.26 + A.8.27 + A.8.28 + A.8.29 + A.8.30 + A.8.31", "H"),
|
||||
"soc_2": ("CC8.1 + CC7.1", "H"),
|
||||
"iso_42001": ("A.6.2.2 + A.6.2.3 + A.6.2.4 (AI-specific SDLC)", "M"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.vulnerability_mgmt",
|
||||
"theme": "Vulnerability + patch management",
|
||||
"evidence": "Vulnerability scanning schedule + patch SLAs by severity + exception tracking + remediation evidence",
|
||||
"mappings": {
|
||||
"iso_27001": ("A.8.7 + A.8.8 + A.8.9", "H"),
|
||||
"soc_2": ("CC7.1 + CC7.2 + CC7.4", "H"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.physical_security",
|
||||
"theme": "Physical security and environmental controls",
|
||||
"evidence": "Facility access controls + visitor log + environmental monitoring + tamper-evident seals on critical assets",
|
||||
"mappings": {
|
||||
"iso_27001": ("A.7.1 + A.7.2 + A.7.3 + A.7.4 + A.7.5 + A.7.6 + A.7.7 + A.7.8", "H"),
|
||||
"soc_2": ("CC6.4 + CC6.5", "H"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.data_protection_privacy",
|
||||
"theme": "Personal data protection (privacy by design)",
|
||||
"evidence": "Privacy policy + lawful-basis register + retention/deletion schedule + DPIA records + data-subject rights workflow + DPO appointment (where required)",
|
||||
"mappings": {
|
||||
"iso_27001": ("A.5.34", "H"),
|
||||
"iso_42001": ("A.7.6 (data privacy considerations)", "M"),
|
||||
"gdpr": ("Articles 5 + 6 + 24 + 25 + 30 + 35 + 38", "H"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.documentation_control",
|
||||
"theme": "Documented information control",
|
||||
"evidence": "Document control procedure + version control + approval workflow + retention + obsolete-doc handling",
|
||||
"mappings": {
|
||||
"iso_27001": ("Clause 7.5", "H"),
|
||||
"soc_2": ("CC4.1 + CC5.1", "H"),
|
||||
"iso_42001": ("Clause 7.5", "H"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"id": "mc.continual_improvement",
|
||||
"theme": "Continual improvement + CAPA",
|
||||
"evidence": "Nonconformity tracking + root-cause analysis + corrective action plans + effectiveness verification + trend analysis",
|
||||
"mappings": {
|
||||
"iso_27001": ("Clause 10.1 + 10.2", "H"),
|
||||
"soc_2": ("CC4.1 + CC4.2 + CC5.3", "H"),
|
||||
"iso_42001": ("Clause 10.1 + 10.2", "H"),
|
||||
},
|
||||
},
|
||||
]
|
||||
|
||||
|
||||
def merged_in_scope(enabled: Set[str]) -> List[Dict[str, Any]]:
|
||||
"""Return merged controls where at least 1 enabled framework maps to them."""
|
||||
out: List[Dict[str, Any]] = []
|
||||
for mc in MERGED_CONTROLS:
|
||||
active_maps = {fid: m for fid, m in mc["mappings"].items() if fid in enabled}
|
||||
if active_maps:
|
||||
out.append({
|
||||
"id": mc["id"],
|
||||
"theme": mc["theme"],
|
||||
"evidence": mc["evidence"],
|
||||
"frameworks_count": len(active_maps),
|
||||
"frameworks": active_maps,
|
||||
})
|
||||
return out
|
||||
|
||||
|
||||
def overlap_summary(merged: List[Dict[str, Any]], enabled: Set[str]) -> Dict[str, Any]:
|
||||
"""Compute per-framework coverage and per-pair overlap."""
|
||||
coverage: Dict[str, int] = {f: 0 for f in enabled}
|
||||
high_confidence: Dict[str, int] = {f: 0 for f in enabled}
|
||||
for mc in merged:
|
||||
for fid in mc["frameworks"]:
|
||||
coverage[fid] += 1
|
||||
_, conf = mc["frameworks"][fid]
|
||||
if conf == "H":
|
||||
high_confidence[fid] += 1
|
||||
|
||||
multi_framework = [mc for mc in merged if mc["frameworks_count"] >= 2]
|
||||
high_reuse = [mc for mc in merged if mc["frameworks_count"] >= 3]
|
||||
|
||||
return {
|
||||
"total_merged_controls_in_scope": len(merged),
|
||||
"per_framework_coverage": coverage,
|
||||
"per_framework_high_confidence": high_confidence,
|
||||
"multi_framework_count": len(multi_framework),
|
||||
"high_reuse_count_3plus_frameworks": len(high_reuse),
|
||||
}
|
||||
|
||||
|
||||
def analyze(payload: Dict[str, Any]) -> Dict[str, Any]:
|
||||
enabled = set(payload.get("enabled_frameworks", []))
|
||||
merged = merged_in_scope(enabled)
|
||||
summary = overlap_summary(merged, enabled)
|
||||
return {
|
||||
"program": payload.get("program"),
|
||||
"enabled_frameworks": sorted(enabled),
|
||||
"summary": summary,
|
||||
"merged_controls": sorted(merged, key=lambda m: -m["frameworks_count"]),
|
||||
}
|
||||
|
||||
|
||||
def render_text(r: Dict[str, Any], source: str) -> str:
|
||||
lines = []
|
||||
lines.append("=" * 72)
|
||||
lines.append("COMPLIANCE OS — CROSS-FRAMEWORK CONTROL MAPPING")
|
||||
lines.append(f"Source: {source}")
|
||||
lines.append("=" * 72)
|
||||
lines.append("")
|
||||
lines.append(f"Program: {r['program']}")
|
||||
lines.append(f"Enabled frameworks ({len(r['enabled_frameworks'])}): {', '.join(r['enabled_frameworks'])}")
|
||||
lines.append("")
|
||||
s = r["summary"]
|
||||
lines.append(f"Merged controls in scope: {s['total_merged_controls_in_scope']}")
|
||||
lines.append(f"Multi-framework controls (≥ 2): {s['multi_framework_count']}")
|
||||
lines.append(f"High-reuse controls (≥ 3 frameworks): {s['high_reuse_count_3plus_frameworks']}")
|
||||
lines.append("")
|
||||
lines.append("Per-framework coverage in merged catalogue:")
|
||||
for fid in r["enabled_frameworks"]:
|
||||
cov = s["per_framework_coverage"].get(fid, 0)
|
||||
hi = s["per_framework_high_confidence"].get(fid, 0)
|
||||
lines.append(f" {fid:15s} {cov} mappings ({hi} HIGH confidence)")
|
||||
lines.append("")
|
||||
lines.append("-" * 72)
|
||||
lines.append("MERGED CONTROLS (sorted by reuse leverage):")
|
||||
lines.append("")
|
||||
|
||||
for mc in r["merged_controls"]:
|
||||
lines.append(f" [{mc['id']}] {mc['theme']} ({mc['frameworks_count']} frameworks)")
|
||||
lines.append(f" Evidence: {mc['evidence']}")
|
||||
for fid, (ctrl, conf) in mc["frameworks"].items():
|
||||
conf_label = {"H": "HIGH ", "M": "MED ", "L": "LOW "}[conf]
|
||||
lines.append(f" [{conf_label}] {fid:12s} -> {ctrl}")
|
||||
lines.append("")
|
||||
|
||||
lines.append("-" * 72)
|
||||
lines.append("CONFIDENCE LEGEND:")
|
||||
lines.append(" HIGH — same evidence satisfies both (direct overlap)")
|
||||
lines.append(" MED — existing evidence with overlay")
|
||||
lines.append(" LOW — concept overlap; mostly new artefact required")
|
||||
return "\n".join(lines)
|
||||
|
||||
|
||||
def main() -> int:
|
||||
parser = argparse.ArgumentParser(
|
||||
description="Multi-framework control overlap computation.",
|
||||
formatter_class=argparse.RawDescriptionHelpFormatter,
|
||||
epilog=__doc__,
|
||||
)
|
||||
parser.add_argument("path", nargs="?", help="Path to program JSON (uses embedded sample if omitted)")
|
||||
parser.add_argument("--output", choices=("text", "json"), default="text", help="Output format")
|
||||
args = parser.parse_args()
|
||||
|
||||
if args.path:
|
||||
try:
|
||||
with open(args.path, "r", encoding="utf-8") as f:
|
||||
payload = json.load(f)
|
||||
source = args.path
|
||||
except (IOError, OSError) as e:
|
||||
print(f"error: could not read {args.path}: {e}", file=sys.stderr)
|
||||
return 1
|
||||
except json.JSONDecodeError as e:
|
||||
print(f"error: invalid JSON in {args.path}: {e}", file=sys.stderr)
|
||||
return 1
|
||||
else:
|
||||
payload = SAMPLE
|
||||
source = "<embedded sample: ISO 27001 + SOC 2 + ISO 42001 + EU AI Act + GDPR>"
|
||||
|
||||
result = analyze(payload)
|
||||
if args.output == "json":
|
||||
print(json.dumps({"source": source, **result}, indent=2))
|
||||
else:
|
||||
print(render_text(result, source))
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
|
|
@ -0,0 +1,354 @@
|
|||
#!/usr/bin/env python3
|
||||
"""evidence_pool_generator.py — Consolidated evidence checklist across enabled frameworks.
|
||||
|
||||
Stdlib-only. Given a multi-framework compliance program config, produces a unified
|
||||
evidence pool that maps each evidence artefact to all the (framework, control)
|
||||
tuples it satisfies. Each artefact gets a reuse-leverage score = number of
|
||||
distinct (framework, control) tuples satisfied.
|
||||
|
||||
Deterministic. No LLM calls. No external dependencies. Uses a curated evidence
|
||||
catalogue distilled from ISO 27001, ISO 42001, SOC 2, GDPR, EU AI Act published
|
||||
guidance.
|
||||
|
||||
Input schema (JSON):
|
||||
{
|
||||
"program": "Acme AI Inc. compliance program",
|
||||
"enabled_frameworks": ["iso_27001", "soc_2", "iso_42001", "eu_ai_act", "gdpr"],
|
||||
"audit_cycle_year": "year_1"
|
||||
}
|
||||
|
||||
Usage:
|
||||
python evidence_pool_generator.py
|
||||
python evidence_pool_generator.py path/to/program.json
|
||||
python evidence_pool_generator.py program.json --output json
|
||||
"""
|
||||
|
||||
import argparse
|
||||
import json
|
||||
import sys
|
||||
from typing import Any, Dict, List
|
||||
|
||||
|
||||
SAMPLE: Dict[str, Any] = {
|
||||
"program": "Acme AI Inc. compliance program",
|
||||
"enabled_frameworks": ["iso_27001", "soc_2", "iso_42001", "eu_ai_act", "gdpr"],
|
||||
"audit_cycle_year": "year_1",
|
||||
}
|
||||
|
||||
|
||||
# Evidence catalogue: each artefact + the (framework, control) tuples it satisfies
|
||||
# + acquisition cost (low / medium / high) + retention requirement (months)
|
||||
EVIDENCE_CATALOG: List[Dict[str, Any]] = [
|
||||
{
|
||||
"id": "ev.access_review_quarterly",
|
||||
"title": "Quarterly access review records (privileged + general access)",
|
||||
"satisfies": [
|
||||
("iso_27001", "A.5.15"), ("iso_27001", "A.8.2"), ("iso_27001", "A.8.3"),
|
||||
("soc_2", "CC6.1"), ("soc_2", "CC6.2"), ("soc_2", "CC6.3"),
|
||||
("iso_42001", "A.4.4"),
|
||||
("gdpr", "Article 32(1)(b)"),
|
||||
],
|
||||
"acquisition_cost": "low",
|
||||
"retention_months": 36,
|
||||
"owner": "IT / Security",
|
||||
},
|
||||
{
|
||||
"id": "ev.asset_register",
|
||||
"title": "Asset register with AI systems + data classification",
|
||||
"satisfies": [
|
||||
("iso_27001", "A.5.9"), ("iso_27001", "A.5.10"), ("iso_27001", "A.5.12"),
|
||||
("soc_2", "CC6.1"), ("soc_2", "CC3.2"),
|
||||
("iso_42001", "A.4.2"), ("iso_42001", "A.4.3"),
|
||||
("gdpr", "Article 30"),
|
||||
],
|
||||
"acquisition_cost": "medium",
|
||||
"retention_months": 36,
|
||||
"owner": "Security / DPO",
|
||||
},
|
||||
{
|
||||
"id": "ev.risk_register",
|
||||
"title": "Risk register with severity matrix + treatment + residual signoff",
|
||||
"satisfies": [
|
||||
("iso_27001", "Clause 6.1"), ("iso_27001", "Clause 8.2"),
|
||||
("soc_2", "CC3.1"), ("soc_2", "CC3.2"), ("soc_2", "CC3.4"),
|
||||
("iso_42001", "Clause 6.1.2"), ("iso_42001", "A.5"),
|
||||
("eu_ai_act", "Article 9"),
|
||||
("gdpr", "Article 35"),
|
||||
],
|
||||
"acquisition_cost": "high",
|
||||
"retention_months": 36,
|
||||
"owner": "Compliance officer",
|
||||
},
|
||||
{
|
||||
"id": "ev.supplier_inventory_reviews",
|
||||
"title": "Supplier inventory + annual reviews + signed DPAs",
|
||||
"satisfies": [
|
||||
("iso_27001", "A.5.19"), ("iso_27001", "A.5.20"), ("iso_27001", "A.5.21"),
|
||||
("soc_2", "CC9.2"),
|
||||
("iso_42001", "A.10.2"), ("iso_42001", "A.10.6"),
|
||||
("eu_ai_act", "Article 25"),
|
||||
("gdpr", "Article 28"),
|
||||
],
|
||||
"acquisition_cost": "medium",
|
||||
"retention_months": 36,
|
||||
"owner": "Procurement / Compliance",
|
||||
},
|
||||
{
|
||||
"id": "ev.incident_log_postmortems",
|
||||
"title": "Incident log + severity classifications + post-incident reviews + notifications sent",
|
||||
"satisfies": [
|
||||
("iso_27001", "A.5.24"), ("iso_27001", "A.5.25"), ("iso_27001", "A.5.26"),
|
||||
("iso_27001", "A.5.27"), ("iso_27001", "A.6.8"),
|
||||
("soc_2", "CC7.3"), ("soc_2", "CC7.4"), ("soc_2", "CC7.5"),
|
||||
("iso_42001", "A.8.4"),
|
||||
("eu_ai_act", "Article 73"),
|
||||
("gdpr", "Article 33"), ("gdpr", "Article 34"),
|
||||
],
|
||||
"acquisition_cost": "medium",
|
||||
"retention_months": 36,
|
||||
"owner": "Security / IR team",
|
||||
},
|
||||
{
|
||||
"id": "ev.logs_aggregated",
|
||||
"title": "Tamper-evident logs centralized with retention",
|
||||
"satisfies": [
|
||||
("iso_27001", "A.8.15"), ("iso_27001", "A.8.16"),
|
||||
("soc_2", "CC7.1"), ("soc_2", "CC7.2"),
|
||||
("iso_42001", "A.9.3"), ("iso_42001", "A.9.4"),
|
||||
("eu_ai_act", "Article 12"),
|
||||
],
|
||||
"acquisition_cost": "high",
|
||||
"retention_months": 12,
|
||||
"owner": "Platform / SRE",
|
||||
},
|
||||
{
|
||||
"id": "ev.change_records",
|
||||
"title": "Change approval records + rollback procedure + post-implementation reviews",
|
||||
"satisfies": [
|
||||
("iso_27001", "A.8.32"),
|
||||
("soc_2", "CC8.1"),
|
||||
("iso_42001", "A.6.2.5"),
|
||||
],
|
||||
"acquisition_cost": "low",
|
||||
"retention_months": 24,
|
||||
"owner": "Engineering / Platform",
|
||||
},
|
||||
{
|
||||
"id": "ev.bcp_dr_exercises",
|
||||
"title": "BCP/DRP exercise records + RPO/RTO validation",
|
||||
"satisfies": [
|
||||
("iso_27001", "A.5.29"), ("iso_27001", "A.5.30"),
|
||||
("iso_27001", "A.8.13"), ("iso_27001", "A.8.14"),
|
||||
("soc_2", "A1.2"), ("soc_2", "A1.3"),
|
||||
],
|
||||
"acquisition_cost": "high",
|
||||
"retention_months": 36,
|
||||
"owner": "Platform / SRE",
|
||||
},
|
||||
{
|
||||
"id": "ev.training_records",
|
||||
"title": "Competence requirements per role + training completion + effectiveness verification",
|
||||
"satisfies": [
|
||||
("iso_27001", "A.6.3"),
|
||||
("soc_2", "CC1.4"), ("soc_2", "CC2.2"),
|
||||
("iso_42001", "Clause 7.2"), ("iso_42001", "Clause 7.3"),
|
||||
("eu_ai_act", "Article 4"),
|
||||
],
|
||||
"acquisition_cost": "medium",
|
||||
"retention_months": 36,
|
||||
"owner": "HR / People Ops",
|
||||
},
|
||||
{
|
||||
"id": "ev.data_inventory_consent",
|
||||
"title": "Data inventory + provenance + retention + consent / lawful-basis register",
|
||||
"satisfies": [
|
||||
("iso_27001", "A.5.34"),
|
||||
("iso_42001", "A.7.2"), ("iso_42001", "A.7.3"), ("iso_42001", "A.7.4"),
|
||||
("iso_42001", "A.7.5"), ("iso_42001", "A.7.6"),
|
||||
("eu_ai_act", "Article 10"),
|
||||
("gdpr", "Article 5"), ("gdpr", "Article 6"), ("gdpr", "Article 30"),
|
||||
],
|
||||
"acquisition_cost": "high",
|
||||
"retention_months": 60,
|
||||
"owner": "DPO / Data team",
|
||||
},
|
||||
{
|
||||
"id": "ev.internal_audit_records",
|
||||
"title": "Internal audit plan + auditor independence records + findings tracking",
|
||||
"satisfies": [
|
||||
("iso_27001", "Clause 9.2"),
|
||||
("soc_2", "CC4.1"),
|
||||
("iso_42001", "Clause 9.2"),
|
||||
],
|
||||
"acquisition_cost": "medium",
|
||||
"retention_months": 36,
|
||||
"owner": "Compliance officer",
|
||||
},
|
||||
{
|
||||
"id": "ev.management_review_records",
|
||||
"title": "Management review schedule + meeting records + action item tracking",
|
||||
"satisfies": [
|
||||
("iso_27001", "Clause 9.3"),
|
||||
("iso_42001", "Clause 9.3"),
|
||||
],
|
||||
"acquisition_cost": "low",
|
||||
"retention_months": 36,
|
||||
"owner": "Compliance officer + Exec",
|
||||
},
|
||||
{
|
||||
"id": "ev.policy_set",
|
||||
"title": "Policy set: AI, info-sec, privacy, code-of-conduct (signed + reviewed annually)",
|
||||
"satisfies": [
|
||||
("iso_27001", "A.5.1"),
|
||||
("soc_2", "CC1.1"), ("soc_2", "CC1.2"),
|
||||
("iso_42001", "Clause 5.2"), ("iso_42001", "A.2.2"), ("iso_42001", "A.2.3"),
|
||||
("eu_ai_act", "Article 17(1)(a)"),
|
||||
("gdpr", "Article 24"),
|
||||
],
|
||||
"acquisition_cost": "medium",
|
||||
"retention_months": 60,
|
||||
"owner": "Compliance officer + Exec",
|
||||
},
|
||||
{
|
||||
"id": "ev.crypto_records",
|
||||
"title": "Crypto policy + algorithm/key-length standards + key rotation records",
|
||||
"satisfies": [
|
||||
("iso_27001", "A.8.24"),
|
||||
("soc_2", "CC6.1"), ("soc_2", "CC6.7"),
|
||||
("gdpr", "Article 32(1)(a)"),
|
||||
],
|
||||
"acquisition_cost": "medium",
|
||||
"retention_months": 36,
|
||||
"owner": "Security",
|
||||
},
|
||||
{
|
||||
"id": "ev.vuln_scans_patch",
|
||||
"title": "Vulnerability scan results + patch SLAs + remediation evidence",
|
||||
"satisfies": [
|
||||
("iso_27001", "A.8.7"), ("iso_27001", "A.8.8"), ("iso_27001", "A.8.9"),
|
||||
("soc_2", "CC7.1"), ("soc_2", "CC7.2"), ("soc_2", "CC7.4"),
|
||||
],
|
||||
"acquisition_cost": "medium",
|
||||
"retention_months": 24,
|
||||
"owner": "Security",
|
||||
},
|
||||
]
|
||||
|
||||
|
||||
def filter_by_enabled(catalog: List[Dict[str, Any]], enabled: List[str]) -> List[Dict[str, Any]]:
|
||||
"""Filter satisfaction tuples to enabled frameworks."""
|
||||
enabled_set = set(enabled)
|
||||
out = []
|
||||
for ev in catalog:
|
||||
active = [(f, c) for (f, c) in ev["satisfies"] if f in enabled_set]
|
||||
if not active:
|
||||
continue
|
||||
leverage = len(active)
|
||||
frameworks_satisfied = sorted({f for f, _ in active})
|
||||
record = {**ev, "active_satisfaction": active, "reuse_leverage": leverage,
|
||||
"frameworks_satisfied": frameworks_satisfied}
|
||||
out.append(record)
|
||||
out.sort(key=lambda x: (-x["reuse_leverage"], x["title"]))
|
||||
return out
|
||||
|
||||
|
||||
def analyze(payload: Dict[str, Any]) -> Dict[str, Any]:
|
||||
enabled = payload.get("enabled_frameworks", [])
|
||||
artefacts = filter_by_enabled(EVIDENCE_CATALOG, enabled)
|
||||
total_satisfactions = sum(a["reuse_leverage"] for a in artefacts)
|
||||
by_cost: Dict[str, int] = {"low": 0, "medium": 0, "high": 0}
|
||||
by_owner: Dict[str, int] = {}
|
||||
for a in artefacts:
|
||||
by_cost[a["acquisition_cost"]] += 1
|
||||
by_owner[a["owner"]] = by_owner.get(a["owner"], 0) + 1
|
||||
|
||||
# High-leverage artefacts (satisfy ≥ 5 mappings)
|
||||
high_leverage = [a for a in artefacts if a["reuse_leverage"] >= 5]
|
||||
|
||||
return {
|
||||
"program": payload.get("program"),
|
||||
"enabled_frameworks": enabled,
|
||||
"audit_cycle_year": payload.get("audit_cycle_year"),
|
||||
"artefact_count": len(artefacts),
|
||||
"total_satisfactions_across_artefacts": total_satisfactions,
|
||||
"high_leverage_count": len(high_leverage),
|
||||
"by_acquisition_cost": by_cost,
|
||||
"by_owner": by_owner,
|
||||
"artefacts": artefacts,
|
||||
}
|
||||
|
||||
|
||||
def render_text(r: Dict[str, Any], source: str) -> str:
|
||||
lines = []
|
||||
lines.append("=" * 72)
|
||||
lines.append("COMPLIANCE OS — UNIFIED EVIDENCE POOL")
|
||||
lines.append(f"Source: {source}")
|
||||
lines.append("=" * 72)
|
||||
lines.append("")
|
||||
lines.append(f"Program: {r['program']}")
|
||||
lines.append(f"Enabled frameworks: {', '.join(r['enabled_frameworks'])}")
|
||||
lines.append(f"Audit cycle phase: {r['audit_cycle_year']}")
|
||||
lines.append(f"Artefacts in scope: {r['artefact_count']}")
|
||||
lines.append(f"Total (framework, control) satisfactions: {r['total_satisfactions_across_artefacts']}")
|
||||
lines.append(f"High-leverage artefacts (≥ 5 mappings): {r['high_leverage_count']}")
|
||||
lines.append("")
|
||||
lines.append(f"By acquisition cost: low={r['by_acquisition_cost']['low']} "
|
||||
f"medium={r['by_acquisition_cost']['medium']} high={r['by_acquisition_cost']['high']}")
|
||||
lines.append(f"By owner: {dict(r['by_owner'])}")
|
||||
lines.append("")
|
||||
lines.append("-" * 72)
|
||||
lines.append("ARTEFACTS (sorted by reuse leverage — highest first):")
|
||||
lines.append("")
|
||||
|
||||
for a in r["artefacts"]:
|
||||
lines.append(f" [{a['id']}] {a['title']}")
|
||||
lines.append(f" Leverage: {a['reuse_leverage']} mappings across {len(a['frameworks_satisfied'])} frameworks ({', '.join(a['frameworks_satisfied'])})")
|
||||
lines.append(f" Owner: {a['owner']} | Cost: {a['acquisition_cost']} | Retention: {a['retention_months']} months")
|
||||
lines.append(f" Satisfies:")
|
||||
for fid, ctrl in a["active_satisfaction"]:
|
||||
lines.append(f" - {fid:12s} -> {ctrl}")
|
||||
lines.append("")
|
||||
|
||||
lines.append("-" * 72)
|
||||
lines.append("REUSE-LEVERAGE GUIDANCE:")
|
||||
lines.append(" Build high-leverage artefacts first (single evidence -> ≥ 5 framework controls).")
|
||||
lines.append(" High-leverage examples (depend on enabled frameworks): risk register, supplier inventory, incident log,")
|
||||
lines.append(" data inventory + consent, policy set, training records.")
|
||||
return "\n".join(lines)
|
||||
|
||||
|
||||
def main() -> int:
|
||||
parser = argparse.ArgumentParser(
|
||||
description="Unified evidence pool generator across compliance frameworks.",
|
||||
formatter_class=argparse.RawDescriptionHelpFormatter,
|
||||
epilog=__doc__,
|
||||
)
|
||||
parser.add_argument("path", nargs="?", help="Path to program JSON (uses embedded sample if omitted)")
|
||||
parser.add_argument("--output", choices=("text", "json"), default="text", help="Output format")
|
||||
args = parser.parse_args()
|
||||
|
||||
if args.path:
|
||||
try:
|
||||
with open(args.path, "r", encoding="utf-8") as f:
|
||||
payload = json.load(f)
|
||||
source = args.path
|
||||
except (IOError, OSError) as e:
|
||||
print(f"error: could not read {args.path}: {e}", file=sys.stderr)
|
||||
return 1
|
||||
except json.JSONDecodeError as e:
|
||||
print(f"error: invalid JSON in {args.path}: {e}", file=sys.stderr)
|
||||
return 1
|
||||
else:
|
||||
payload = SAMPLE
|
||||
source = "<embedded sample: 5 enabled frameworks, year 1>"
|
||||
|
||||
result = analyze(payload)
|
||||
if args.output == "json":
|
||||
print(json.dumps({"source": source, **result}, indent=2))
|
||||
else:
|
||||
print(render_text(result, source))
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
280
compliance-os/skills/compliance-os/scripts/framework_selector.py
Normal file
280
compliance-os/skills/compliance-os/scripts/framework_selector.py
Normal file
|
|
@ -0,0 +1,280 @@
|
|||
#!/usr/bin/env python3
|
||||
"""framework_selector.py — Multi-framework compliance applicability selector.
|
||||
|
||||
Stdlib-only. Takes a company profile and returns the applicable compliance frameworks
|
||||
ranked by priority + dependency graph. Supports 9 frameworks:
|
||||
- ISO 27001 (info-sec ISMS)
|
||||
- ISO 13485 (medical device QMS)
|
||||
- ISO 42001 (AI management system)
|
||||
- ISO 14971 (medical device risk mgmt)
|
||||
- EU AI Act (Regulation 2024/1689)
|
||||
- EU MDR 2017/745 (medical device regulation)
|
||||
- GDPR (Regulation 2016/679)
|
||||
- SOC 2 (Trust Services Criteria)
|
||||
- FDA QSR (21 CFR 820)
|
||||
|
||||
Deterministic decision tree. No LLM calls. No external dependencies.
|
||||
|
||||
Input schema (JSON):
|
||||
{
|
||||
"company": "Acme AI Inc.",
|
||||
"industry": "saas", # saas | medical_device | financial | other
|
||||
"products_include_ai": true,
|
||||
"ai_high_risk_per_eu": true, # falls under Annex III, Article 6
|
||||
"deploys_ai_in_eu": true,
|
||||
"products_are_medical_devices": false,
|
||||
"sells_to_eu_customers": true,
|
||||
"sells_to_us_customers": true,
|
||||
"sells_to_enterprise_b2b": true,
|
||||
"processes_personal_data": true,
|
||||
"processes_eu_personal_data": true,
|
||||
"headcount": 80,
|
||||
"stage": "series_b"
|
||||
}
|
||||
|
||||
Usage:
|
||||
python framework_selector.py # uses embedded mid-stage AI SaaS sample
|
||||
python framework_selector.py path/to/profile.json
|
||||
python framework_selector.py profile.json --output json
|
||||
"""
|
||||
|
||||
import argparse
|
||||
import json
|
||||
import sys
|
||||
from typing import Any, Dict, List
|
||||
|
||||
|
||||
SAMPLE: Dict[str, Any] = {
|
||||
"company": "Acme AI Inc.",
|
||||
"industry": "saas",
|
||||
"products_include_ai": True,
|
||||
"ai_high_risk_per_eu": True,
|
||||
"deploys_ai_in_eu": True,
|
||||
"products_are_medical_devices": False,
|
||||
"sells_to_eu_customers": True,
|
||||
"sells_to_us_customers": True,
|
||||
"sells_to_enterprise_b2b": True,
|
||||
"processes_personal_data": True,
|
||||
"processes_eu_personal_data": True,
|
||||
"headcount": 80,
|
||||
"stage": "series_b",
|
||||
}
|
||||
|
||||
|
||||
# Framework catalogue (id, name, type, certifiable)
|
||||
FRAMEWORKS = {
|
||||
"iso_27001": {"name": "ISO/IEC 27001:2022", "type": "management_system", "certifiable": True, "binding": False},
|
||||
"iso_13485": {"name": "ISO 13485:2016", "type": "management_system", "certifiable": True, "binding": False},
|
||||
"iso_42001": {"name": "ISO/IEC 42001:2023", "type": "management_system", "certifiable": True, "binding": False},
|
||||
"iso_14971": {"name": "ISO 14971:2019", "type": "process_standard", "certifiable": False, "binding": False},
|
||||
"eu_ai_act": {"name": "Regulation (EU) 2024/1689 (AI Act)", "type": "regulation", "certifiable": False, "binding": True},
|
||||
"eu_mdr_745": {"name": "Regulation (EU) 2017/745 (MDR)", "type": "regulation", "certifiable": False, "binding": True},
|
||||
"gdpr": {"name": "Regulation (EU) 2016/679 (GDPR)", "type": "regulation", "certifiable": False, "binding": True},
|
||||
"soc_2": {"name": "AICPA SOC 2 Trust Services", "type": "attestation", "certifiable": True, "binding": False},
|
||||
"fda_qsr": {"name": "FDA 21 CFR 820 (QSR)", "type": "regulation", "certifiable": False, "binding": True},
|
||||
}
|
||||
|
||||
|
||||
# Dependency graph: framework X benefits from framework Y as prerequisite
|
||||
DEPENDENCIES = {
|
||||
"iso_42001": ["iso_27001"], # AIMS reuses ISMS heavily
|
||||
"iso_13485": ["iso_14971"], # QMS uses risk mgmt
|
||||
"eu_mdr_745": ["iso_13485", "iso_14971"],
|
||||
"eu_ai_act": ["iso_42001"], # voluntary AIMS satisfies parts of Article 17
|
||||
"soc_2": ["iso_27001"], # ISO 27001 controls map to SOC 2 TSC
|
||||
"fda_qsr": ["iso_13485"], # QSR mostly harmonised with 13485
|
||||
}
|
||||
|
||||
|
||||
def select_frameworks(profile: Dict[str, Any]) -> List[str]:
|
||||
selected: List[str] = []
|
||||
|
||||
# GDPR — any EU personal data
|
||||
if profile.get("processes_eu_personal_data") or (
|
||||
profile.get("processes_personal_data") and profile.get("sells_to_eu_customers")
|
||||
):
|
||||
selected.append("gdpr")
|
||||
|
||||
# ISO 27001 — enterprise B2B / mature SaaS
|
||||
if profile.get("sells_to_enterprise_b2b") or profile.get("stage") in ("series_a", "series_b", "series_c", "growth"):
|
||||
selected.append("iso_27001")
|
||||
|
||||
# SOC 2 — US enterprise B2B
|
||||
if profile.get("sells_to_us_customers") and profile.get("sells_to_enterprise_b2b"):
|
||||
selected.append("soc_2")
|
||||
|
||||
# ISO 42001 — any AI in products
|
||||
if profile.get("products_include_ai"):
|
||||
selected.append("iso_42001")
|
||||
|
||||
# EU AI Act — AI deployed in EU
|
||||
if profile.get("products_include_ai") and (
|
||||
profile.get("deploys_ai_in_eu") or profile.get("sells_to_eu_customers")
|
||||
):
|
||||
selected.append("eu_ai_act")
|
||||
|
||||
# ISO 13485 + 14971 — medical device
|
||||
if profile.get("products_are_medical_devices"):
|
||||
selected.append("iso_13485")
|
||||
selected.append("iso_14971")
|
||||
|
||||
# EU MDR — medical device sold in EU
|
||||
if profile.get("sells_to_eu_customers"):
|
||||
selected.append("eu_mdr_745")
|
||||
|
||||
# FDA QSR — medical device sold in US
|
||||
if profile.get("sells_to_us_customers"):
|
||||
selected.append("fda_qsr")
|
||||
|
||||
return selected
|
||||
|
||||
|
||||
def annotate(profile: Dict[str, Any]) -> Dict[str, Any]:
|
||||
selected = select_frameworks(profile)
|
||||
|
||||
# Build dependency notes
|
||||
dep_notes: List[Dict[str, Any]] = []
|
||||
for fid in selected:
|
||||
deps = DEPENDENCIES.get(fid, [])
|
||||
in_program = [d for d in deps if d in selected]
|
||||
missing = [d for d in deps if d not in selected]
|
||||
if in_program or missing:
|
||||
dep_notes.append({
|
||||
"framework": fid,
|
||||
"satisfied_dependencies": in_program,
|
||||
"missing_dependencies": missing,
|
||||
})
|
||||
|
||||
# Priority ranking — bindings first, then certifiable, then reference
|
||||
def priority(fid: str) -> int:
|
||||
f = FRAMEWORKS[fid]
|
||||
if f["binding"]:
|
||||
return 0
|
||||
if f["certifiable"]:
|
||||
return 1
|
||||
return 2
|
||||
|
||||
ranked = sorted(selected, key=priority)
|
||||
|
||||
return {
|
||||
"company": profile.get("company"),
|
||||
"industry": profile.get("industry"),
|
||||
"applicable_frameworks": [
|
||||
{"id": fid, **FRAMEWORKS[fid]} for fid in ranked
|
||||
],
|
||||
"framework_count": len(ranked),
|
||||
"binding_count": sum(1 for fid in ranked if FRAMEWORKS[fid]["binding"]),
|
||||
"certifiable_count": sum(1 for fid in ranked if FRAMEWORKS[fid]["certifiable"]),
|
||||
"dependency_notes": dep_notes,
|
||||
"rationale": _rationale(profile, ranked),
|
||||
}
|
||||
|
||||
|
||||
def _rationale(profile: Dict[str, Any], selected: List[str]) -> List[str]:
|
||||
notes = []
|
||||
if "gdpr" in selected:
|
||||
notes.append("GDPR: EU personal data processed; binding regardless of certifiable choice.")
|
||||
if "iso_27001" in selected:
|
||||
notes.append("ISO 27001: enterprise B2B procurement frequently requires; foundation for AIMS + SOC 2.")
|
||||
if "soc_2" in selected:
|
||||
notes.append("SOC 2: US enterprise B2B procurement requires Type II audit; overlap with ISO 27001 ~75%.")
|
||||
if "iso_42001" in selected:
|
||||
notes.append("ISO 42001: AI in products; voluntary management system; satisfies Article 17 EU AI Act QMS.")
|
||||
if "eu_ai_act" in selected:
|
||||
notes.append("EU AI Act: AI deployed in EU; binding; Article 5 prohibitions in force; high-risk obligations 2 Aug 2026.")
|
||||
if "iso_13485" in selected:
|
||||
notes.append("ISO 13485: medical device manufacturer; required for MDR / FDA submissions.")
|
||||
if "iso_14971" in selected:
|
||||
notes.append("ISO 14971: medical device risk management; harmonised under MDR.")
|
||||
if "eu_mdr_745" in selected:
|
||||
notes.append("EU MDR 745: medical device sold in EU; binding; mandatory CE marking.")
|
||||
if "fda_qsr" in selected:
|
||||
notes.append("FDA QSR: medical device sold in US; binding; FDA quality system regulation.")
|
||||
return notes
|
||||
|
||||
|
||||
def render_text(r: Dict[str, Any], source: str) -> str:
|
||||
lines = []
|
||||
lines.append("=" * 72)
|
||||
lines.append("COMPLIANCE OS — APPLICABLE FRAMEWORKS")
|
||||
lines.append(f"Source: {source}")
|
||||
lines.append("=" * 72)
|
||||
lines.append("")
|
||||
lines.append(f"Company: {r['company']}")
|
||||
lines.append(f"Industry: {r['industry']}")
|
||||
lines.append(f"Applicable frameworks: {r['framework_count']} "
|
||||
f"({r['binding_count']} binding + {r['certifiable_count']} certifiable)")
|
||||
lines.append("")
|
||||
lines.append("-" * 72)
|
||||
lines.append("RANKED FRAMEWORKS (binding > certifiable > reference):")
|
||||
lines.append("")
|
||||
for f in r["applicable_frameworks"]:
|
||||
kind = []
|
||||
if f["binding"]:
|
||||
kind.append("BINDING")
|
||||
if f["certifiable"]:
|
||||
kind.append("CERTIFIABLE")
|
||||
kind_str = " | ".join(kind) if kind else "REFERENCE"
|
||||
lines.append(f" [{kind_str:25s}] {f['name']:42s} ({f['id']})")
|
||||
lines.append("")
|
||||
lines.append("-" * 72)
|
||||
lines.append("RATIONALE:")
|
||||
for r_note in r["rationale"]:
|
||||
lines.append(f" - {r_note}")
|
||||
lines.append("")
|
||||
|
||||
if r["dependency_notes"]:
|
||||
lines.append("-" * 72)
|
||||
lines.append("DEPENDENCIES:")
|
||||
for d in r["dependency_notes"]:
|
||||
if d["satisfied_dependencies"]:
|
||||
lines.append(f" {d['framework']} satisfied by: {', '.join(d['satisfied_dependencies'])}")
|
||||
if d["missing_dependencies"]:
|
||||
lines.append(f" {d['framework']} missing dependency: {', '.join(d['missing_dependencies'])} (consider adding)")
|
||||
lines.append("")
|
||||
|
||||
lines.append("-" * 72)
|
||||
lines.append("DECISION RULES:")
|
||||
lines.append(" GDPR: any EU personal data processed -> mandatory")
|
||||
lines.append(" ISO 27001: enterprise B2B procurement requirement; foundation for AIMS + SOC 2")
|
||||
lines.append(" SOC 2: US enterprise B2B procurement requirement; overlap ~75% with ISO 27001")
|
||||
lines.append(" ISO 42001: AI in products; voluntary AIMS; satisfies parts of Article 17 AI Act")
|
||||
lines.append(" EU AI Act: AI in EU; binding; phased application through 2027")
|
||||
return "\n".join(lines)
|
||||
|
||||
|
||||
def main() -> int:
|
||||
parser = argparse.ArgumentParser(
|
||||
description="Multi-framework compliance applicability selector.",
|
||||
formatter_class=argparse.RawDescriptionHelpFormatter,
|
||||
epilog=__doc__,
|
||||
)
|
||||
parser.add_argument("path", nargs="?", help="Path to company profile JSON (uses embedded sample if omitted)")
|
||||
parser.add_argument("--output", choices=("text", "json"), default="text", help="Output format")
|
||||
args = parser.parse_args()
|
||||
|
||||
if args.path:
|
||||
try:
|
||||
with open(args.path, "r", encoding="utf-8") as f:
|
||||
profile = json.load(f)
|
||||
source = args.path
|
||||
except (IOError, OSError) as e:
|
||||
print(f"error: could not read {args.path}: {e}", file=sys.stderr)
|
||||
return 1
|
||||
except json.JSONDecodeError as e:
|
||||
print(f"error: invalid JSON in {args.path}: {e}", file=sys.stderr)
|
||||
return 1
|
||||
else:
|
||||
profile = SAMPLE
|
||||
source = "<embedded sample: mid-stage AI SaaS, US+EU customers, B2B>"
|
||||
|
||||
result = annotate(profile)
|
||||
if args.output == "json":
|
||||
print(json.dumps({"source": source, **result}, indent=2))
|
||||
else:
|
||||
print(render_text(result, source))
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
136
compliance-os/skills/compliance-readiness/SKILL.md
Normal file
136
compliance-os/skills/compliance-readiness/SKILL.md
Normal file
|
|
@ -0,0 +1,136 @@
|
|||
---
|
||||
name: "compliance-readiness"
|
||||
description: "/cs:compliance-readiness <program> — Multi-framework compliance officer 6-question forcing interrogation of any compliance program. Use before starting a new framework, planning the annual audit calendar, or preparing for certification stage 1."
|
||||
---
|
||||
|
||||
# /cs:compliance-readiness — Compliance Officer Forcing Questions
|
||||
|
||||
**Command:** `/cs:compliance-readiness <program>`
|
||||
|
||||
The multi-framework compliance officer pressure-tests any compliance program. Six questions before any new-framework commitment, audit cycle planning, or certification readiness sign-off.
|
||||
|
||||
## When to Run
|
||||
|
||||
- Before adopting a new compliance framework
|
||||
- Before annual audit calendar finalization
|
||||
- Before certification stage 1 readiness sign-off
|
||||
- Before management review (Clause 9.3 across frameworks)
|
||||
- When evidence-collection effort has grown 50%+ year-over-year (a smell)
|
||||
- When an audit produced > 15% critical findings
|
||||
|
||||
## The Six Compliance Officer Questions
|
||||
|
||||
### 1. Have you named every applicable framework?
|
||||
**No framework selector run, no defensible scope.**
|
||||
- Run `framework_selector.py` with company profile
|
||||
- Forgetting a framework means rebuilding the audit program later
|
||||
- Pay attention to industry-specific overlays (financial: NYDFS, FINMA; healthcare: HIPAA, ISO 13485; AI: ISO 42001 + EU AI Act)
|
||||
|
||||
### 2. Where do the frameworks overlap, and what's the reuse leverage?
|
||||
**Single evidence -> N controls = the cornerstone of multi-framework efficiency.**
|
||||
- Run `cross_framework_mapper.py` with enabled frameworks
|
||||
- HIGH-confidence mappings: same evidence; MEDIUM: existing + overlay; LOW: new artefact
|
||||
- Without overlap analysis, you'll collect the same access-review records 3 times
|
||||
|
||||
### 3. Who owns each artefact, and what's the reuse-leverage score?
|
||||
**Joint ownership without accountability is the most common cause of stale evidence.**
|
||||
- Run `evidence_pool_generator.py` for the artefact inventory
|
||||
- HIGH-leverage artefacts (≥ 5 mappings) get built first
|
||||
- Each artefact needs one accountable owner
|
||||
- Stale evidence is an effective gap — even if the artefact existed historically
|
||||
|
||||
### 4. What's the audit calendar, and is auditor independence respected?
|
||||
**Surveillance audits stacking in the same week is a smell.**
|
||||
- Use per-framework audit-plan tools (aims_audit_scheduler, isms_audit_scheduler, audit_schedule_optimizer)
|
||||
- Auditor cannot audit their own work (Clause 9.2 across all ISO standards)
|
||||
- For small teams: rotate auditors + occasional external auditor
|
||||
|
||||
### 5. What does a mock audit produce, and is the severity distribution healthy?
|
||||
**No mock audit, no readiness signal.**
|
||||
- Run `audit_simulator.py` with framework + scope
|
||||
- Healthy distribution: ≥ 40% observation, ≤ 15% critical
|
||||
- All-critical findings = destructive audit OR genuinely failing program
|
||||
- All-observation findings = audit too superficial
|
||||
|
||||
### 6. What's the management review cadence across frameworks?
|
||||
**Each framework wants its own management review; an integrated review (per Annex SL) saves 5x exec time.**
|
||||
- Schedule one quarterly cross-framework review covering all enabled frameworks' Clause 9.3 inputs
|
||||
- Inputs: risk register changes, open nonconformities, audit findings, incidents, drift, KPIs
|
||||
- Outputs: action items, resource decisions, scope adjustments
|
||||
|
||||
## Workflow
|
||||
|
||||
```bash
|
||||
# 1. Framework selection
|
||||
python ../../skills/compliance-os/scripts/framework_selector.py profile.json
|
||||
|
||||
# 2. Cross-framework overlap
|
||||
python ../../skills/compliance-os/scripts/cross_framework_mapper.py program.json
|
||||
|
||||
# 3. Evidence pool consolidation
|
||||
python ../../skills/compliance-os/scripts/evidence_pool_generator.py program.json
|
||||
|
||||
# 4. Mock audit (per framework)
|
||||
python ../../skills/compliance-os/scripts/audit_simulator.py scope.json
|
||||
```
|
||||
|
||||
## Output Format
|
||||
|
||||
```markdown
|
||||
# Compliance Readiness: <program>
|
||||
**Date:** YYYY-MM-DD
|
||||
|
||||
## The Decision Being Made
|
||||
[framework-set | audit-calendar | certification-readiness | evidence-consolidation]
|
||||
|
||||
## Framework Set
|
||||
- Applicable: <list>
|
||||
- Binding (regulations): <count>
|
||||
- Certifiable: <count>
|
||||
- Missing dependencies: <list>
|
||||
|
||||
## Cross-Framework Overlap
|
||||
- Total merged controls in scope: N
|
||||
- High-leverage artefacts (≥ 5 mappings): M
|
||||
- Top reuse opportunities: <top 5 artefacts>
|
||||
|
||||
## Evidence Pool
|
||||
- Artefacts in catalog: N
|
||||
- High-leverage count: M
|
||||
- Stale evidence rate: X%
|
||||
- Unowned artefacts: K
|
||||
|
||||
## Audit Calendar
|
||||
- Frameworks scheduled this year: <list>
|
||||
- Auditor independence respected: Y/N
|
||||
- Conflicts: <list>
|
||||
|
||||
## Mock Audit Results (per framework)
|
||||
- <framework>: total findings N, critical X%, observation Y%, healthy distribution: Y/N
|
||||
|
||||
## Verdict
|
||||
🟢 READY | 🟡 STAGE-2-CANDIDATE | 🔴 NOT-READY
|
||||
|
||||
## Top 3 Actions
|
||||
[3 concrete next steps with owners + dates]
|
||||
```
|
||||
|
||||
## Routing
|
||||
|
||||
- `/cs:aims-audit` — for ISO 42001-specific forcing questions
|
||||
- `/cs:ai-act-readiness` — for EU AI Act-specific forcing questions
|
||||
- `/cs:ciso-review` — for cybersecurity strategy
|
||||
- `/cs:caio-review` — for executive AI strategy
|
||||
- `/cs:gc-review` — for novel-case legal review
|
||||
- `/cs:decide` — to log the verdict
|
||||
- `/cs:freeze 30` — on certification commitments (multi-year financial impact)
|
||||
|
||||
## Related
|
||||
|
||||
- Agent: [`cs-compliance-officer`](../../agents/cs-compliance-officer.md)
|
||||
- Skill: [`compliance-os`](../compliance-os/SKILL.md)
|
||||
- Adjacent: `../../ra-qm-team/skills/iso42001-specialist/`, `../../ra-qm-team/skills/eu-ai-act-specialist/`, `../../ra-qm-team/skills/information-security-manager-iso27001/`, `../../ra-qm-team/skills/soc2-compliance/`, `../../ra-qm-team/skills/gdpr-dsgvo-expert/`
|
||||
|
||||
---
|
||||
|
||||
**Version:** 1.0.0
|
||||
Loading…
Add table
Reference in a new issue