compliance-controls

Compliance Controls

Ortak Doktrin

agents/shared/severity-rubric.md ve agents/shared/escalation-matrix.md default-load sayılır (agents/coordination.md §11). Bu skill'in çıktısı Critical / High / Medium / Low + kanıt formatında olmak zorunda — spekülatif Critical yasak. Sahiplik dışı bulgu ilgili agent'a delege; karar yetkisi eşiği aşılırsa kullanıcı onayı zorunlu.

Felsefe

• Compliance code'da yaşar. Pre-commit + CI + IaC policy as code (OPA/Sentinel). Runtime gözlem değil tasarım disiplini.
• Evidence-first. Audit log, change log, CloudTrail, signed commit > manual policy doc. "X yapıyoruz" demek yerine "X yaptık, log şurada".
• Continuous audit prep. Yıllık denetim öncesi panik değil; sürekli evidence collection + gap tracking.
• Engineer-friendly. Auditor sorduğunda mühendis cevap verir. Compliance team-only sürece olmadığı zaman tutarlı.

Ne Zaman Kullanılır

• SOC 2 Type II audit prep (90 gün öncesi başla)
• GDPR DPIA / RoPA hazırlama
• PCI DSS QSA review (yıllık)
• HIPAA risk assessment
• ISO 27001 sertifikasyon ilk hazırlık veya yenileme
• B2B customer security review (anketler)
• Vendor due diligence (3rd party risk)
• Breach response (GDPR 72 saat, HIPAA 60 gün)
• DSR queue (data subject request)
• New region/market launch (CCPA, LGPD, APRA…)

Workflow

1) Scope tanımla

• Hangi framework? SOC 2 / GDPR / PCI / HIPAA / ISO 27001 / multi.
• Audience: internal / customer / external auditor.
• Service-in-scope: tüm production, sadece payment, sadece EU users, vb.
• Trust principles (SOC 2): hangi prensiple denetlenecek (Security default; Availability/Confidentiality/Privacy ek).

2) Asset + data inventory

Asset	Veri Tipi	Hassasiyet	Lokasyon	Compliance Scope
Customer DB	PII (email, address, phone)	High	RDS eu-west-1	GDPR, SOC 2 CC6.6
Payment DB	PCI (last 4, token)	Critical	RDS eu-west-1 (encrypted)	PCI DSS Req 3
Audit log	Access + change events	Medium	Loki + S3 1y	SOC 2 CC7, PCI Req 10
Backup	Encrypted snapshot	High	S3 cross-region	SOC 2 A1, GDPR Art. 32
Logs	Application + PII redact	Medium	Datadog 30d hot, S3 1y	SOC 2 CC7.2

3) Control mapping

Her kontrol için plugin yüzey + evidence kaynak + status:

| Control | Description | Plugin Surface | Evidence | Status |
|---|---|---|---|---|
| SOC 2 CC6.1 | Logical access controlled | `/threat-model`, RBAC IaC | CloudTrail + Terraform state diff | Implemented |
| SOC 2 CC6.6 | PII confidentiality | `/observe-bootstrap` PII redact | log-search "email" → masked | Implemented |
| SOC 2 CC7.1 | Vulnerability detection | gitleaks + tfsec + dependabot | CI artifact + Slack alert | Implemented |
| SOC 2 CC7.2 | Risk identification | `/threat-model` STRIDE | docs/threat-model/ markdown | Implemented |
| SOC 2 CC8.1 | Change mgmt | `/release-plan`, `agents/coordination.md` §6 | GitHub PR + sign-off | Implemented |
| SOC 2 CC9 | 3rd party risk | dependency-risk-auditor + vendor inventory | docs/vendor-inventory.md | Partial (BAA gap 2 vendor) |
| GDPR Art. 30 | RoPA (record of processing) | `/threat-model` asset inventory | docs/data-inventory.md | Partial (frontend RoPA missing) |
| GDPR Art. 32 | Security of processing | `/iac-review`, `/security-audit`, `/observe-bootstrap` | KMS rotation log + audit log | Implemented |
| GDPR Art. 33 | Breach notification 72h | `/postmortem`, incident runbook | Test drill log | Gap (drill yok) |
| GDPR Art. 17 | Right to erasure | DSR flow + `/data-migration` deleted_users | DSR ticket queue + completion log | Partial (manual fulfilment) |
| PCI Req 3.4 | PAN encryption | `/threat-model` + `/iac-review` KMS | Tokenization (Stripe) — full PAN yok | Implemented |
| PCI Req 8.4 | MFA admin | RBAC + IAM IdP | IdP audit log + access review | Implemented |
| PCI Req 10.2 | Audit log | `/observe-bootstrap` retention 1y | S3 lifecycle policy + access log | Implemented |
| HIPAA Security | PHI safeguards | (proje uygulanmıyor) | n/a | Not applicable |

Status: Implemented / Partial / Gap / Not applicable.

4) Evidence collection (automated)

Control	Automated evidence komut
Access change	aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=AssumeRole
Code change	git log --since=90d --pretty='%h %s %an %ai' --signature
Deploy change	argocd app history <app> + release-manager PR audit
Config change	terraform state list + state diff history
Secret rotation	KMS aws kms list-key-rotations + sealed-secret commit log
Vulnerability scan	CI artifact retention (tfsec.json, gitleaks.json, trivy.json)
Backup + restore	aws backup list-backup-jobs + drill log Datadog event
Access review	quarterly script audit-access-review.py (group + role)
Vendor BAA/DPA	docs/vendor-inventory.md expiry tracker (CI alert 30 gün önce)
Incident response	PagerDuty + runbooks/postmortems/
DSR fulfilment	DSR queue (Linear / Jira) + completion timestamp

5) DSR (Data Subject Request) flow

[Customer Request] ──→ [DSR Inbox]
                          │
                          ▼
                    [Identity Verification]  (KYC standartı)
                          │
                          ▼
            ┌─────────────┴─────────────┐
            │                            │
       [Access (Art. 15)]         [Erasure (Art. 17)]
            │                            │
            ▼                            ▼
    [Cross-system search]      [Cascade delete script]
    - app DB                   - app DB (cascade FK)
    - analytics                - analytics (anonymize)
    - logs (rolling 30-90d)    - logs (retention exception?)
    - backups                  - backups (logical delete pointer)
    - 3rd party (Stripe, ...)  - 3rd party API call
            │                            │
            ▼                            ▼
    [JSON/CSV bundle export]   [Confirmation + audit log]
            │                            │
            └─────────────┬──────────────┘
                          ▼
                  [Response < 30 gün]
                  [Audit log entry]

Tooling:

• Privacy automation: BigID, Securiti, OneTrust (enterprise).
• Open-source: custom Python + DB schema introspection.
• Audit: DSR queue retention 7 yıl; her DSR için completion proof.

6) Vendor risk (3rd party / supply chain)

| Vendor | Service | Data shared | DPA/BAA | Renewal | Risk |
|---|---|---|---|---|---|
| Stripe | Payment processing | Tokenized payment data | DPA signed 2026-01-15, expiry 2027-01-15 | 11 ay | Low |
| Datadog | Logging + APM | Logs (PII redact) + traces | DPA signed 2025-08-01, expiry 2026-08-01 | 3 ay (renewal!) | Medium |
| Cloudflare | CDN + WAF | Request metadata | DPA standard | 6 ay | Low |
| ... |

Action:

• Inventory docs/vendor-inventory.md.
• Expiry tracking: 30 gün öncesi alert (CI cron).
• BAA (HIPAA): vendor-list zorunlu PHI işleyenler için.
• Sub-processor list GDPR Art. 28 — customer-facing transparency.

7) Gap analysis + remediation

## Gap Tablosu (current snapshot)

| Control | Status | Gap | Mitigation | Sahip | Bitiş |
|---|---|---|---|---|---|
| GDPR Art. 33 (breach 72h) | Gap | Drill yapılmamış | Tabletop exercise + runbook | @sre | 2026-06-15 |
| SOC 2 CC9 | Partial | 2 vendor BAA expire 30 gün | Vendor renewal | @procurement | 2026-06-01 |
| GDPR Art. 17 | Partial | Manual DSR fulfilment | DSR automation script | @data | 2026-08-01 |
| ISO 27001 A.12.6 | Implemented | — | — | — | — |

Ekibe atanmış gap'ler issue olarak açık (tracking).

8) Continuous audit prep

Cadence	Aksiyon
Weekly	Vulnerability scan rapor review; vendor expiry check
Monthly	Access review (group membership); audit log spot-check
Quarterly	Backup restore drill; gap analysis update
Semi-annual	Pentest (external); BCP drill
Annual	Full SOC 2 / PCI audit; tabletop exercise

9) Audit response

Auditor sorgu örneği + cevap pattern:

Auditor: "How do you ensure access changes are logged for SOC 2 CC6.3?"

Engineer: Tüm AWS access change CloudTrail'de log'lanır; 1 yıl S3 + 7 yıl Glacier retention. Slack alert privileged operasyon. Quarterly access review script (audit-access-review.py) IdP group membership doğrular. Evidence: bu CloudTrail query, bu Slack alert, bu access review log."

Cevap: kanıt + sistem + log retention + automation.

Checklist

• Scope: framework + audience + service-in-scope
• Asset + data inventory (PII / PCI / PHI tag)
• Control map: plugin yüzey + evidence + status
• Automated evidence collection (CloudTrail / git / IaC / scan)
• DSR flow (Identity → Search → Fulfilment → Response)
• Vendor inventory + DPA/BAA expiry tracker
• Gap analysis tablosu (issue açık)
• Continuous audit prep cadence
• Tabletop exercise / drill plan
• Sub-processor list (GDPR transparency)
• Engineer-friendly audit response (mühendis cevap verebilir)

Antipattern

• Compliance kutucuk sadece — gerçek kontrol yok.
• Manual policy doc only — evidence automated değil.
• Compliance team-only — mühendis cevap veremiyor.
• Audit prep yıl sonu sıkıştırma.
• 3rd party risk ignore.
• Breach 72h aşıldı GDPR Art. 33.
• PAN log'da plaintext PCI scope büyür.
• DSR > 30 gün GDPR fine.
• Audit log retention < 1y PCI Req 10.7.
• MFA opsiyonel admin.
• Cross-border SCC olmadan.
• Vendor BAA expiry track edilmedi.
• DSR manual — automated tooling şart (queue 100+).
• Encryption-at-rest only — in-transit + key rotation eksik.
• Tabletop drill yok — incident response yetersiz.

Örnek Agent Davranışı

User: /compliance-review soc2-type2
Agent (security-reviewer):
1. Scope: SOC 2 Type II, Security + Confidentiality + Availability principles.
   12 ay denetim period (2025-06-01 → 2026-05-31).
2. Asset inventory: 5 ana asset (customer DB, payment DB, audit log, backup, logs).
3. Control map: 15 CC kontrol; 11 Implemented, 3 Partial, 1 Gap.
4. Evidence:
   - CC6.1 access: CloudTrail 12 ay full retention ✓
   - CC6.6 PII: log search masked email ✓
   - CC7.1 vulnerability: gitleaks + tfsec + dependabot CI artifact ✓
   - CC7.2 risk: docs/threat-model/ 3 servis ✓
   - CC8.1 change: GitHub PR + ArgoCD history + release notes ✓
   - CC9 3rd party: vendor inventory ✓ ama 2 vendor DPA expire 30 gün → Critical
5. Gap: GDPR Art. 33 breach drill yok (denetim kapsamında olmasa da customer
   sorduğunda).
6. Action: 8 issue açıldı (sahip + tarih).
7. Auditor response prep: 5 sample sorgu + cevap pattern dokumented.
8. Continuous prep: weekly + monthly + quarterly cadence aktive.

Çıktı Formatı

# Compliance Review: <framework>

## Scope
- Framework + Audience + Service + Period

## Asset Inventory
| Asset | Data Type | Sensitivity | Compliance Scope |

## Control Mapping
| Control | Plugin Surface | Evidence | Status |

## Critical / High / Medium / Low (Gaps)

## DSR Flow
- (varsa)

## Vendor Risk
| Vendor | DPA/BAA | Expiry | Risk |

## Continuous Audit Prep
| Cadence | Aksiyon |

## Action Items
| P | Aksiyon | Sahip | Bitiş | Issue |