> ## Documentation Index > Fetch the complete documentation index at: https://docs.aiptx.io/llms.txt > Use this file to discover all available pages before exploring further. # Compliance Frameworks > Map security findings to compliance requirements # Compliance Frameworks AIPTx maps security findings to major compliance frameworks, helping you demonstrate security posture for audits and certifications. ## Supported Frameworks Service Organization Control 2 - Trust Service Criteria International information security standard Payment Card Industry Data Security Standard Health Insurance Portability and Accountability Act General Data Protection Regulation National Institute of Standards and Technology ## SOC 2 Mapping ### Trust Service Criteria Coverage | Criteria | Category | AIPTx Coverage | | -------- | -------- | ------------------------ | | CC6.1 | Security | Access control testing | | CC6.2 | Security | Authentication testing | | CC6.3 | Security | Authorization testing | | CC6.6 | Security | Encryption validation | | CC6.7 | Security | Vulnerability management | | CC7.1 | Security | Configuration analysis | | CC7.2 | Security | Change management | ### Example Report Section ``` SOC 2 Control Assessment CC6.1 - Logical Access Security Status: ⚠️ Gaps Identified Findings: - IDOR vulnerability allows unauthorized data access (Finding #12) - Missing MFA on admin accounts (Finding #8) Evidence: - 3 access control vulnerabilities identified - 2 authentication weaknesses found Remediation Required: 1. Implement proper authorization checks 2. Enable MFA for all privileged accounts ``` ## PCI DSS Mapping ### Requirements Coverage | Requirement | Description | AIPTx Tests | | ----------- | ---------------------------- | ----------------------------- | | 6.5.1 | Injection flaws | SQL, NoSQL, Command injection | | 6.5.2 | Buffer overflows | Memory safety testing | | 6.5.3 | Insecure crypto | Encryption analysis | | 6.5.4 | Insecure communications | TLS/SSL validation | | 6.5.5 | Improper error handling | Error message analysis | | 6.5.6 | Vulnerability identification | CVE scanning | | 6.5.7 | XSS vulnerabilities | Cross-site scripting tests | | 6.5.8 | Access control | Authorization testing | | 6.5.9 | CSRF vulnerabilities | CSRF protection analysis | | 6.5.10 | Authentication flaws | Auth mechanism testing | ### Compliance Report ``` PCI DSS v4.0 Compliance Assessment Requirement 6: Develop and Maintain Secure Systems 6.5.1 - Injection Vulnerabilities Status: ❌ Non-Compliant Findings: 2 SQL injection vulnerabilities identified - Finding #5: SQL Injection in search API (Critical) - Finding #7: SQL Injection in report filter (High) Action Required: Implement parameterized queries 6.5.7 - Cross-Site Scripting Status: ⚠️ Partially Compliant Findings: 1 stored XSS vulnerability - Finding #12: Stored XSS in comments (High) Action Required: Implement output encoding ``` ## ISO 27001 Mapping ### Annex A Controls | Control | Description | Assessment | | ------- | ------------------------ | --------------- | | A.9.1 | Access control policy | ✅ Compliant | | A.9.2 | User access management | ⚠️ Gaps found | | A.9.4 | System access control | ❌ Non-compliant | | A.10.1 | Cryptographic controls | ✅ Compliant | | A.12.6 | Vulnerability management | ✅ Compliant | | A.14.1 | Security requirements | ⚠️ Gaps found | | A.14.2 | Security in development | ⚠️ Gaps found | ## HIPAA Mapping ### Security Rule Requirements | Specification | Type | AIPTx Assessment | | --------------------- | -------- | ----------------------- | | Access Control | Required | Authorization testing | | Audit Controls | Required | Logging analysis | | Integrity | Required | Data protection testing | | Authentication | Required | Auth mechanism review | | Transmission Security | Required | Encryption validation | ### PHI Protection Assessment ``` HIPAA Security Assessment §164.312(a)(1) - Access Control Status: ⚠️ Gaps Identified Findings affecting PHI access: - IDOR in patient records API (Critical) - Missing session timeout on EHR portal (Medium) - Weak password policy (Medium) Risk to ePHI: HIGH Recommended Actions: 1. Implement proper access controls on patient data endpoints 2. Add session timeout after 15 minutes of inactivity 3. Enforce strong password requirements ``` ## GDPR Mapping ### Article Requirements | Article | Requirement | AIPTx Testing | | ------- | ------------------------- | ---------------------------- | | Art. 25 | Data protection by design | Security architecture review | | Art. 32 | Security of processing | Vulnerability assessment | | Art. 33 | Breach notification | Incident response capability | | Art. 35 | Impact assessment | Risk analysis | ### Data Protection Assessment ``` GDPR Compliance Assessment Article 32 - Security of Processing (a) Encryption of personal data Status: ✅ Compliant - TLS 1.3 in use for data in transit - AES-256 encryption for data at rest (b) Confidentiality and integrity Status: ⚠️ Gaps Identified - 2 access control vulnerabilities found - 1 data exposure risk identified (d) Regular testing and assessment Status: ✅ Compliant - Automated security scanning in place - Quarterly penetration testing scheduled ``` ## NIST Cybersecurity Framework ### Function Mapping | Function | Category | AIPTx Coverage | | -------- | ------------------- | ------------------------- | | Identify | Asset Management | Discovery and enumeration | | Protect | Access Control | Authorization testing | | Protect | Data Security | Encryption validation | | Detect | Security Monitoring | Vulnerability detection | | Respond | Analysis | Finding prioritization | ## Generating Compliance Reports ### Single Framework ```bash theme={null} aiptx report generate \ --scan-id scan_abc123 \ --template compliance \ --compliance soc2 ``` ### Multiple Frameworks ```bash theme={null} aiptx report generate \ --scan-id scan_abc123 \ --template compliance \ --compliance soc2,pci,hipaa ``` ### Configuration File ```yaml theme={null} report: template: compliance compliance_frameworks: - soc2 - pci_dss_v4 - iso27001 include_evidence: true include_remediation: true executive_summary: true ``` ## Audit Evidence ### Evidence Package AIPTx can generate an evidence package for auditors: ```bash theme={null} aiptx report evidence --scan-id scan_abc123 --framework soc2 ``` Includes: * Scan configuration and scope * Complete findings with timestamps * Proof of concept evidence * Remediation tracking * Historical trend data ### Continuous Compliance Track compliance status over time: ``` Compliance Trend (Last 6 Months) SOC 2 CC6.1 (Access Control): Jan: 85% → Feb: 87% → Mar: 92% → Apr: 95% → May: 98% → Jun: 99% PCI DSS 6.5 (Secure Development): Jan: 78% → Feb: 82% → Mar: 85% → Apr: 90% → May: 93% → Jun: 96% ```