policy-check

When checking compliance:

1. Identify Applicable Policies

Determine which frameworks and regulations apply:

• Data privacy: GDPR, CCPA, HIPAA
• Security: SOC 2, ISO 27001, NIST
• Industry: PCI-DSS (payments), FERPA (education), FINRA (finance)
• Internal: Company security policies, data handling procedures

2. Audit Checklist

For each applicable policy, check:

• Data collection: Is consent obtained? Is purpose stated?
• Data storage: Is data encrypted at rest? Is retention policy defined?
• Data transfer: Is data encrypted in transit? Are cross-border transfers compliant?
• Access control: Is principle of least privilege applied?
• Logging: Are access and changes audited?
• Incident response: Is there a documented process?

3. Report

For each finding:

• Policy: Which regulation or standard.
• Requirement: What is required.
• Status: ✅ Compliant / ⚠️ Partial / ❌ Non-compliant
• Evidence: What was reviewed.
• Remediation: Steps to achieve compliance.