Compliance

Compliance & Security Standards Skill

Framework-specific compliance guidance for regulated industries: SOC2 Type II, HIPAA, GDPR, and PCI DSS. Includes control mappings, audit logging patterns, data residency rules, and scope reduction strategies.

Overview

Compliance is a multi-layer problem: legal obligations (what must be done), technical controls (how to implement), and operational processes (who does it). This skill focuses on technical controls and their code-level implementation.

Framework Mapping

SOC2 Type II

Security (CC — Common Criteria)

Availability (A — Availability and Resilience)

Confidentiality (C — Confidentiality)

Integrity (I — Integrity)

HIPAA (Health Insurance Portability and Accountability Act)

Key Definitions

• PHI (Protected Health Information): Any health information linked to an individual (medical record, payment info, biometric data)
• HIPAA Minimum Necessary: Limit collection, use, and sharing of PHI to what is required
• BAA (Business Associate Agreement): Required if a third party processes PHI on your behalf

Technical Safeguards (Required)

Code-Level Implementation

Patient data segregation:

// Mark all PHI fields explicitly
interface Patient {
  id: string; // Not PHI
  email: string; // PHI: emails can identify
  ssn: string; // PHI: highly sensitive
  medicalRecord: string; // PHI: diagnosis, treatment
  createdAt: Date; // Not PHI
}

// Enforce access control on PHI fields
@RequireRole('healthcare-provider')
app.get('/patients/:id', (req, res) => {
  const patient = await db.patient.findUnique({
    where: { id: req.params.id }
  });
  
  // Log PHI access for audit
  auditLog.record({
    action: 'PHI_READ',
    user_id: req.user.id,
    patient_id: patient.id,
    timestamp: new Date(),
    ip_address: req.ip
  });
  
  res.json(patient);
});

Encryption:

// Encrypt sensitive fields at rest
const encryptedSSN = encrypt(patient.ssn, process.env.ENCRYPTION_KEY);
await db.patient.update({
  where: { id: patient.id },
  data: { ssn: encryptedSSN }
});

Audit logging (immutable):

// Append-only audit log (never update/delete)
interface AuditLog {
  id: string;
  action: 'PHI_READ' | 'PHI_CREATE' | 'PHI_UPDATE' | 'PHI_DELETE';
  user_id: string;
  patient_id: string;
  timestamp: Date; // Server time, not client
  ip_address: string;
  user_agent: string;
  phiFields: string[]; // Which fields were accessed
}

// Store in dedicated immutable table
await db.auditLog.create({ data: auditEntry });

GDPR (General Data Protection Regulation)

Key Principles

1. Lawfulness, Fairness, Transparency — Must have legal basis for processing personal data
2. Purpose Limitation — Can only use data for declared purpose
3. Data Minimization — Collect only what is necessary
4. Accuracy — Keep personal data accurate and up-to-date
5. Storage Limitation — Don't keep longer than necessary
6. Integrity & Confidentiality — Protect against unauthorized access
7. Accountability — Document why/how data is processed

Data Rights (User-Facing Features)

Code Implementation

Data export (Right to Access):

app.get('/api/users/:id/export', @Authenticated, async (req, res) => {
  // Verify user is requesting their own data
  if (req.user.id !== req.params.id) throw new UnauthorizedError();
  
  const userData = await db.user.findUnique({
    where: { id: req.params.id },
    include: {
      orders: true,
      addresses: true,
      profile: true
    }
  });
  
  // Log data access for GDPR compliance
  auditLog.record({
    action: 'GDPR_DATA_EXPORT',
    user_id: req.user.id,
    timestamp: new Date()
  });
  
  // Return in machine-readable format
  res.json({
    user: userData,
    exportedAt: new Date().toISOString(),
    dataControllerContact: 'privacy@example.com'
  });
});

Right to Erasure:

app.delete('/api/users/:id', @Authenticated, async (req, res) => {
  if (req.user.id !== req.params.id) throw new UnauthorizedError();
  
  const user = await db.user.findUnique({ where: { id: req.params.id } });
  
  // Log deletion request
  auditLog.record({
    action: 'GDPR_ERASURE_REQUEST',
    user_id: req.user.id,
    timestamp: new Date()
  });
  
  // Soft delete: mark as erased, but keep for audit trail
  await db.user.update({
    where: { id: req.params.id },
    data: {
      deletedAt: new Date(),
      email: '[ERASED]',
      firstName: '[ERASED]',
      lastName: '[ERASED]',
      // Clear all personal data
    }
  });
  
  res.sendStatus(204);
});

Consent management:

interface UserConsent {
  user_id: string;
  marketing_emails: boolean; // Opt-in
  analytics: boolean; // Opt-in
  third_party_sharing: boolean; // Opt-in
  timestamp: Date;
  ip_address: string;
  user_agent: string;
}

// Always ask before collecting data
app.post('/api/users/{id}/consent', async (req, res) => {
  await db.userConsent.create({
    data: {
      user_id: req.user.id,
      marketing_emails: req.body.marketingEmails,
      analytics: req.body.analytics,
      timestamp: new Date(),
      ip_address: req.ip
    }
  });
  
  // Only send marketing emails if user consented
  if (consent.marketing_emails) {
    await sendMarketingEmail(user);
  }
});

Data retention:

// Schedule job to delete data older than retention period
// GDPR principle: "Storage Limitation"
schedule.every().day.at('02:00').do(async () => {
  const thirtyDaysAgo = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
  
  // Delete soft-deleted users after 30 days
  await db.user.deleteMany({
    where: {
      deletedAt: { lt: thirtyDaysAgo }
    }
  });
  
  // Delete old audit logs (keep for 1 year for compliance)
  const Date(Date.now() - 365 * 24 * 60 * 60 * 1000);
  await db.auditLog.deleteMany({
    where: {
      timestamp: { lt: oneYearAgo }
    }
  });
});

PCI DSS (Payment Card Industry Data Security Standard)

Scope Reduction Strategy

Golden Rule: Don't store card data. Use a payment processor (Stripe, Square, PayPal) to tokenize and store; keep only the token.

Minimal Implementation (Scope Reduced)

Code Pattern

Stripe Tokenization (Recommended):

// Frontend: Use Stripe Elements (handles PCI compliance)
const stripe = require('@stripe/stripe-js');
const card = elements.create('card');
card.mount('#card-element');

// When user submits form
const { token } = await stripe.createToken(card);
// Token is sent to backend, NOT card number
await fetch('/api/payment', {
  method: 'POST',
  body: JSON.stringify({ token: token.id })
});

Backend: Process Token (Not Card Data):

const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);

app.post('/api/payment', async (req, res) => {
  // req.body.token is a Stripe token, not card data
  const charge = await stripe.charges.create({
    amount: 9999, // in cents
    currency: 'usd',
    source: req.body.token, // Token, not card
    metadata: {
      order_id: req.body.orderId,
      user_id: req.user.id
    }
  });
  
  // Log transaction (NO card data logged)
  auditLog.record({
    action: 'PAYMENT',
    user_id: req.user.id,
    amount: 9999,
    charge_id: charge.id,
    timestamp: new Date()
  });
  
  res.json({ success: true, charge_id: charge.id });
});

What NOT to Do (PCI Violations)

// ❌ DO NOT store card data
app.post('/api/payment', async (req, res) => {
  await db.payment.create({
    cardNumber: req.body.cardNumber, // ❌ VIOLATION
    cvv: req.body.cvv, // ❌ VIOLATION
    expiryDate: req.body.expiryDate // ❌ VIOLATION
  });
});

// ❌ DO NOT log card data
logger.info(`Payment for user ${userId} with card ${cardNumber}`); // ❌ VIOLATION

// ❌ DO NOT send card data over HTTP
app.post('http://api.example.com/payment', { cardNumber: '...' }); // ❌ VIOLATION (HTTP not HTTPS)

Compliance Audit Checklist

Pre-Audit Preparation

• Data classification complete (mark all fields as PII, PHI, payment data, etc.)
• Audit logging implemented (immutable, tamper-proof, all access logged)
• Encryption enabled (at rest: database; in transit: TLS 1.2+)
• Access control implemented (RBAC, MFA for admin, session management)
• Backup & recovery tested (RTO/RPO documented, restore tested)
• Incident response plan documented (runbooks, on-call escalation, notification procedures)
• Data retention policies defined (how long to keep what data)
• Vendor/third-party BAAs in place (if using cloud services)
• Vulnerability scanning automated (SAST, dependency scanning)
• Penetration testing scheduled (annual for most frameworks)

Evidence Collection

For each control, prepare evidence:

• Code: GitHub links to implementation (e.g., encryption middleware)
• Configuration: Screenshots of security settings (e.g., TLS version, MFA)
• Logs: Sample audit logs showing access control in action
• Policies: Document data classification, retention, incident response
• Test Results: Vulnerability scans, penetration test reports

Multi-Framework Compliance

HIPAA + GDPR

Both require strong encryption, audit logging, and user data rights. Overlap on:

• Encryption at rest and in transit
• User right to access their data
• Audit trail of all access

Difference: HIPAA focuses on healthcare industry; GDPR applies to EU personal data globally.

SOC2 + PCI DSS

SOC2 is a trust framework (controls and processes); PCI DSS is payment-specific.

SOC2 covers: Security, availability, confidentiality, integrity, privacy
PCI DSS covers: Only payment card data

Compliance Scoring

Control Assessment Matrix

Gap Scoring

Critical (Must Fix Before Production):

• No encryption in transit (HTTP instead of HTTPS)
• No authentication on sensitive endpoints
• Credentials hardcoded or in logs
• Direct database access from frontend

High (Must Fix Before Audit):

• Audit logging not comprehensive
• Data retention policy undefined
• Backup testing not documented
• No incident response plan

Medium (Should Fix):

• Some fields not encrypted at rest
• Rate limiting missing
• Monitoring gaps

Low (Nice to Have):

• Enhanced monitoring and alerting
• Additional redundancy (multi-AZ, failover)
• Advanced threat detection