# Security Compliance

> Implements security compliance frameworks (SOC2, HIPAA, PCI-DSS) with implementation patterns, audit procedures, and compliance automation for Kubernetes and cloud environments

- Skill: `paulpas/security-compliance` (Agent Skill)
- Install (CLI): `npx skillmds@latest add paulpas/security-compliance`
- Raw SKILL.md: https://api.skillmd.com/api/skills/paulpas/security-compliance/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: paulpas (https://skillmd.com/u/paulpas)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/paulpas/security-compliance

---





# Security Compliance and Auditing

Implements comprehensive security compliance frameworks including SOC2, HIPAA, and PCI-DSS controls with automated audit procedures, evidence collection, and regulatory documentation for Kubernetes environments and cloud infrastructure.

## TL;DR Checklist

- [ ] Identify applicable compliance framework (SOC2 Type II, HIPAA, PCI-DSS v4.0)
- [ ] Map controls to technical implementations (CC6, CC7, CC8 for SOC2)
- [ ] Deploy automated compliance scanning (Trivy, OpenSCAP, Klar)
- [ ] Implement audit trail collection with log aggregation
- [ ] Configure access control policies (RBAC, IAM, network policies)
- [ ] Generate compliance evidence packages for auditor review
- [ ] Schedule quarterly compliance assessments and remediation
- [ ] Document compensating controls for any identified gaps

---

## When to Use

Use this skill when:

- Conducting SOC2 Type II audit preparation and evidence collection
- Implementing HIPAA security rules for healthcare data in Kubernetes
- Meeting PCI-DSS requirements for payment card data processing
- Performing regulatory compliance assessments for cloud workloads
- Generating audit trails and compliance evidence for external auditors
- Implementing security controls for regulated industry environments
- Creating compliance automation pipelines for continuous monitoring

---

## When NOT to Use

Avoid this skill for:

- Basic security vulnerability scanning (use `cncf-security-scanning` instead)
- General security awareness training (use `coding-security-basics`)
- Non-regulatory compliance checks (use `coding-code-review`)
- Legal compliance for non-technical domains (use `agent-legal-compliance`)

---

## Core Workflow

1. **Framework Identification** — Determine which compliance framework applies (SOC2 Type II, HIPAA, PCI-DSS v4.0, GDPR, etc.). **Checkpoint:** Confirm framework version and auditor requirements before proceeding.

2. **Control Mapping** — Map regulatory controls to technical implementations. SOC2: CC6 (logical access), CC7 (system monitoring), CC8 (change management). **Checkpoint:** Verify control mapping completeness against auditor criteria.

3. **Tool Deployment** — Install and configure compliance scanning tools (Trivy for container scanning, OpenSCAP for system hardening, Klar for Clair integration). **Checkpoint:** Validate tool installation and connectivity to vulnerability databases.

4. **Evidence Collection** — Configure automated evidence gathering for audit trails, access logs, change records, and security metrics. **Checkpoint:** Confirm evidence retention meets minimum requirements (SOC2: 90 days, HIPAA: 6 years).

5. **Remediation Planning** — Document gaps, implement compensating controls, and prioritize remediation. **Checkpoint:** Ensure all high-severity findings have documented remediation timelines.

6. **Reporting** — Generate compliance reports with evidence packages for auditor review. **Checkpoint:** Verify report includes all required control evidence and meets auditor formatting requirements.

---

## Implementation Patterns

### Pattern 1: SOC2 Compliance Framework Implementation

SOC2 requires five trust service principles: Security, Availability, Processing Integrity, Confidentiality, and Privacy. This pattern implements the Security principle controls.

```yaml
# SOC2 Control CC6: Logical Access Security
# Requires restrictions on system access and logical access security

apiVersion: v1
kind: ConfigMap
metadata:
  name: soc2-cc6-controls
  namespace: compliance
data:
  control-id: "CC6"
  control-name: "Logical Access Security"
  requirements: |
    - System software and associated services are protected from unauthorized access, use, modification, impairment, or loss
    - Logical access security software, operating systems, applications, and services are protected throughout their life cycle
  controls:
    rbac_enabled: true
    network_policies_enabled: true
    secret_encryption_enabled: true
    iam_role_separation: true
```

```bash
# SOC2 Control CC7: System Monitoring - Audit Trail Collection
# Requires monitoring of system components and events for security anomalies

cat > /etc/audit/rules.d/99-soc2-cc7.rules <<'EOF'
# SOC2 CC7: System Monitoring Audit Rules
# Monitor access to sensitive files and security events

-w /etc/passwd -p wa -k identity_changes
-w /etc/shadow -p wa -k identity_changes
-w /etc/group -p wa -k identity_changes
-w /etc/sudoers -p wa -k privilege_escalation

-w /etc/ssh/sshd_config -p wa -k ssh_config_changes

-w /var/log/ -p wa -k log_modification

-w /etc/audit/ -p wa -k audit_config_changes

-a always,exit -F arch=b64 -S execve -F exe=/bin/su -k privilege_escalation
-a always,exit -F arch=b32 -S execve -F exe=/bin/su -k privilege_escalation

-a always,exit -F arch=b64 -S setuid -F a0=0 -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -F a0=0 -k privilege_escalation
EOF

# Restart audit daemon
systemctl restart auditd

# Verify audit rules are loaded
auditctl -l
```

```bash
# SOC2 Control CC8: Change Management - Change Tracking
# Requires tracking of changes to system components

#!/bin/bash
# soc2-cc8-change-tracking.sh
# Implements change management for SOC2 CC8 compliance

CONFIG_DIR="/etc/soc2/change-management"
EVIDENCE_DIR="/var/evidence/soc2/cc8"

# Track file integrity changes using AIDE or custom implementation
track_changes() {
    local file_path="$1"
    local timestamp=$(date -Iseconds)
    local checksum=$(sha256sum "$file_path" | awk '{print $1}')
    local event_id=$(uuidgen)
    
    echo "{\"event_id\": \"$event_id\", \"timestamp\": \"$timestamp\", \"file\": \"$file_path\", \"checksum\": \"$checksum\", \"event_type\": \"file_changed\"}" >> "$EVIDENCE_DIR/file_changes.json"
}

# Log all system changes
log_system_changes() {
    # Track package manager changes
    case "$(command -v apt-get)" in
        *apt-get*) apt-get history | tee -a "$EVIDENCE_DIR/package_changes.log" ;;
        *yum*) yum history | tee -a "$EVIDENCE_DIR/package_changes.log" ;;
        *dnf*) dnf history | tee -a "$EVIDENCE_DIR/package_changes.log" ;;
    esac
}

# Generate change audit report
generate_audit_report() {
    local start_date="$1"
    local end_date="$2"
    
    echo "=== SOC2 CC8 Change Audit Report ==="
    echo "Period: $start_date to $end_date"
    echo ""
    echo "File Integrity Changes:"
    jq -r "select(.timestamp >= \"$start_date\" and .timestamp <= \"$end_date\") | \"\(.timestamp) - \(.file)\"" "$EVIDENCE_DIR/file_changes.json"
    
    echo ""
    echo "Package Changes:"
    tail -n 50 "$EVIDENCE_DIR/package_changes.log"
}

# Schedule change tracking (add to crontab)
echo "*/5 * * * * $0 track" >> /etc/crontab
```

---

### Pattern 2: HIPAA Security Rules Implementation

HIPAA Security Rule requires administrative, physical, and technical safeguards for Electronic Protected Health Information (ePHI).

```yaml
# HIPAA Administrative Safeguards - Access Control
apiVersion: v1
kind: ConfigMap
metadata:
  name: hipaa-access-control
  namespace: healthcare-compliance
data:
  control-id: "HIPAA-164.312(a)"
  control-name: "Access Control"
  requirements: |
    - Implement technical policies and procedures for electronic information systems
    - Maintain a record of who accesses ePHI
    - Implement procedures to authorize and monitor access
  controls:
    unique_user_identifier: true
    emergency_access_procedure: true
    automatic_logoff: true
    encryption_decryption: true
```

```yaml
# HIPAA Technical Safeguards - Audit Controls
apiVersion: v1
kind: ConfigMap
metadata:
  name: hipaa-audit-controls
  namespace: healthcare-compliance
data:
  control-id: "HIPAA-164.308(a)(1)(ii)(D)"
  control-name: "Audit Controls"
  requirements: |
    - Implement hardware, software, and procedural mechanisms
    - Record and examine activity in information systems
    - Retain audit logs for minimum 6 years
  controls:
    audit_logging_enabled: true
    log_aggregation_enabled: true
    log_retention_days: 2190  # 6 years
    anomaly_detection_enabled: true
```

```bash
# HIPAA Audit Control Implementation - System-Wide Logging
# Implements audit logging for HIPAA compliance

cat > /etc/rsyslog.d/99-hipaa-audit.conf <<'EOF'
# HIPAA Audit Controls - System Logging
# Ensure all security-relevant events are logged

# Enable module for structured logging
module(load="imuxsock" SysSock.Use="on")
module(load="imklog" permitnonkernelfacility="on")

# Define templates for structured JSON logging
template(name="HIPAAJsonFormat" type="string"
    string="{\"timestamp\":\"%timestamp:::date-rfc3339%\",\"host\":\"%HOSTNAME%\",\"severity\":\"%syslogseverity-text%\",\"facility\":\"%syslogfacility-text%\",\"program\":\"%programname%\",\"pid\":\"%procid%\",\"message\":\"%msg%\",\"tag\":\"hipaa-audit\"}\n")

# Route security events to dedicated audit log
:programname, isequal, "sshd" action(type="omfile" file="/var/log/hipaa/ssh-audit.log" template="HIPAAJsonFormat")
:programname, isequal, "sudo" action(type="omfile" file="/var/log/hipaa/sudo-audit.log" template="HIPAAJsonFormat")
:programname, isequal, "systemd" action(type="omfile" file="/var/log/hipaa/system-audit.log" template="HIPAAJsonFormat")

# Log all security-related syslog facilities
auth,authpriv.* /var/log/hipaa/security-audit.log;HIPAAJsonFormat

# Forward logs to centralized SIEM
*.* action(type="omfwd" target="siem.internal.domain" port="514" protocol="tcp" template="HIPAAJsonFormat")
EOF

# Create audit log directory with proper permissions
mkdir -p /var/log/hipaa
chown root:root /var/log/hipaa
chmod 700 /var/log/hipaa
touch /var/log/hipaa/ssh-audit.log
touch /var/log/hipaa/sudo-audit.log
touch /var/log/hipaa/system-audit.log
touch /var/log/hipaa/security-audit.log
chmod 600 /var/log/hipaa/*

# Restart rsyslog
systemctl restart rsyslog

# Verify audit logging is working
logger -p auth.info "HIPAA audit test - $(date)"
tail -n 5 /var/log/hipaa/security-audit.log
```

```bash
# HIPAA Security Rule - Encryption at Rest
# Implement encryption for ePHI stored on disk

#!/bin/bash
# hipaa-encryption-at-rest.sh
# Implements encryption for HIPAA compliance

set -euo pipefail

# Check if LUKS encryption is available
if ! command -v cryptsetup &> /dev/null; then
    echo "ERROR: cryptsetup not found. Install for disk encryption."
    exit 1
fi

# Function to check encryption status
check_encryption() {
    local device="$1"
    if cryptsetup isLuks "$device" 2>/dev/null; then
        echo "✓ $device is encrypted"
        return 0
    else
        echo "✗ $device is NOT encrypted"
        return 1
    fi
}

# Function to encrypt a volume (requires backup)
encrypt_volume() {
    local device="$1"
    local mount_point="$2"
    
    echo "WARNING: This will destroy all data on $device"
    read -p "Are you sure? Type 'YES' to confirm: " confirmation
    
    if [[ "$confirmation" != "YES" ]]; then
        echo "Encryption cancelled"
        exit 1
    fi
    
    # Backup existing data
    echo "Backing up data..."
    local backup_dir="/backup/$(date +%Y%m%d)_$(basename "$device")"
    mkdir -p "$backup_dir"
    cp -r "$mount_point"/* "$backup_dir/" 2>/dev/null || true
    
    # Encrypt the volume
    echo "Encrypting volume..."
    cryptsetup luksFormat "$device"
    
    # Open encrypted volume
    cryptsetup luksOpen "$device" encrypted_volume
    
    # Create filesystem
    mkfs.ext4 /dev/mapper/encrypted_volume
    
    # Mount and restore data
    mount /dev/mapper/encrypted_volume "$mount_point"
    cp -r "$backup_dir"/* "$mount_point/" 2>/dev/null || true
    
    echo "Volume encrypted successfully"
}

# Validate HIPAA encryption compliance
validate_encryption() {
    local vulnerable_mounts=()
    
    # Check all mounted filesystems
    while read -r mount; do
        if [[ "$mount" != *"tmpfs"* && "$mount" != *"devtmpfs"* ]]; then
            device=$(echo "$mount" | awk '{print $1}')
            mount_point=$(echo "$mount" | awk '{print $3}')
            
            if ! check_encryption "$device"; then
                vulnerable_mounts+=("$mount_point")
            fi
        fi
    done < <(mount | grep -v "cgroup")
    
    if [[ ${#vulnerable_mounts[@]} -gt 0 ]]; then
        echo "ERROR: Unencrypted volumes found:"
        printf '  - %s\n' "${vulnerable_mounts[@]}"
        exit 1
    else
        echo "✓ All volumes are encrypted"
    fi
}
```

---

### Pattern 3: PCI-DSS Requirements Implementation

PCI-DSS v4.0 requires 12 control objectives across 4 categories for payment card data protection.

```yaml
# PCI-DSS Requirement 1 - Install and Maintain Network Security Controls
apiVersion: v1
kind: ConfigMap
metadata:
  name: pci-dss-req1-network-security
  namespace: payment-compliance
data:
  requirement-id: "1"
  requirement-name: "Install and Maintain Network Security Controls"
  subrequirements: |
    1.1 - Install and maintain firewall configuration
    1.2 - Restrict connections between untrusted networks and cardholder data
    1.3 - Prohibit direct public access between cardholder data and internet
  controls:
    firewall_enabled: true
    dmz_segmentation: true
    default-deny-policy: true
    network-segmentation-enabled: true
```

```yaml
# PCI-DSS Requirement 7 - Limit Access to System Components
apiVersion: v1
kind: ConfigMap
metadata:
  name: pci-dss-req7-access-control
  namespace: payment-compliance
data:
  requirement-id: "7"
  requirement-name: "Limit Access to System Components"
  subrequirements: |
    7.1 - Implement access restrictions based on need-to-know
    7.2 - Limit and control access to cardholder data
    7.3 - Document access control methods
  controls:
    rbac_enabled: true
    least-privilege-enforced: true
    access-logging-enabled: true
    cardholder-data-access-restricted: true
```

```yaml
# PCI-DSS Requirement 8 - Identify and Authenticate Access
apiVersion: v1
kind: ConfigMap
metadata:
  name: pci-dss-req8-authentication
  namespace: payment-compliance
data:
  requirement-id: "8"
  requirement-name: "Identify and Authenticate Access"
  subrequirements: |
    8.1 - Unique initial authentication passwords
    8.2 - Strong password requirements
    8.3 - Multi-factor authentication for remote access
    8.5 - Protection of authentication credentials
  controls:
    password_policy:
      min_length: 14
      require_uppercase: true
      require_lowercase: true
      require_numbers: true
      require_special_chars: true
      history: 12
      expiration_days: 90
    mfa_enabled: true
    credential_encryption: true
```

```bash
# PCI-DSS Requirement 10 - Audit Trail Implementation
# Implement comprehensive logging for PCI-DSS compliance

cat > /etc/rsyslog.d/99-pci-dss-audit.conf <<'EOF'
# PCI-DSS Audit Trail - Comprehensive Logging
# Requirements 10.1-10.8: Track all access to cardholder data

# Define PCI-DSS specific log format
template(name="PCIJSONFormat" type="string"
    string="{\"timestamp\":\"%timestamp:::date-rfc3339%\",\"host\":\"%HOSTNAME%\",\"severity\":\"%syslogseverity-text%\",\"facility\":\"%syslogfacility-text%\",\"program\":\"%programname%\",\"pid\":\"%procid%\",\"message\":\"%msg%\",\"tag\":\"pci-dss-audit\",\"pci_requirement\":\"10\"}\n")

# Requirement 10.2 - Log all individual user accesses to cardholder data
:programname, isequal, "sshd" action(type="omfile" file="/var/log/pci/ssh-audit.log" template="PCIJSONFormat")
:programname, isequal, "sudo" action(type="omfile" file="/var/log/pci/sudo-audit.log" template="PCIJSONFormat")

# Requirement 10.3 - Log all system-level events
auth,authpriv.* /var/log/pci/security-audit.log;PCIJSONFormat

# Requirement 10.4 - Implement log integrity controls
# Log rotation with verification
$CycleLogIndex 1
$CycleLogTimestampFormat %Y%m%d

# Requirement 10.5 - Protect log data
:programname, startswith, "payment" action(type="omfile" file="/var/log/pci/payment-audit.log" template="PCIJSONFormat")

# Requirement 10.7 - Retain audit logs for 12 months
# Log rotation configuration
$WorkDirectory /var/lib/rsyslog
$ActionQueueType LinkedList
$ActionQueueFileName pciAudit
$ActionQueueMaxDiskSpace 10g
$ActionQueueSaveOnShutdown on
$ActionResumeRetryCount -1
EOF

# PCI-DSS Requirement 10.3 - Create and maintain audit trail
# Implement comprehensive file access logging

cat > /etc/audit/rules.d/99-pci-dss.rules <<'EOF'
# PCI-DSS Requirement 10 - Audit Trail Rules
# Track all access to cardholder data environment

# Critical system files monitoring
-w /etc/passwd -p wa -k cde_changes
-w /etc/shadow -p wa -k cde_changes
-w /etc/group -p wa -k cde_changes
-w /etc/sudoers -p wa -k cde_changes
-w /etc/sudoers.d/ -p wa -k cde_changes

# Payment application files
-w /etc/payment/ -p wa -k payment_config
-w /opt/payment/ -p wa -k payment_app

# Cardholder data files
-w /var/log/payment/ -p wa -k cardholder_data
-w /var/opt/pci/ -p wa -k cardholder_data

# Authentication files
-w /etc/ssh/sshd_config -p wa -k ssh_config
-w /etc/pam.d/ -p wa -k pam_config

#PCI-DSS Requirement 10.2.1 - Log all user activities
-a always,exit -F arch=b64 -S creat -F dir=/var/log/audit -k file_creation
-a always,exit -F arch=b32 -S creat -F dir=/var/log/audit -k file_creation

#PCI-DSS Requirement 10.2.5 - Log all access to cardholder data
-a always,exit -F arch=b64 -S open -F path=/var/opt/pci/ -k cardholder_access
-a always,exit -F arch=b32 -S open -F path=/var/opt/pci/ -k cardholder_access
-a always,exit -F arch=b64 -S openat -F path=/var/opt/pci/ -k cardholder_access
-a always,exit -F arch=b32 -S openat -F path=/var/opt/pci/ -k cardholder_access

#PCI-DSS Requirement 10.3 - Log all system-level events
-a always,exit -F arch=b64 -S chmod -F dir=/etc/ -k permission_changes
-a always,exit -F arch=b32 -S chmod -F dir=/etc/ -k permission_changes
-a always,exit -F arch=b64 -S chown -F dir=/etc/ -k permission_changes
-a always,exit -F arch=b32 -S chown -F dir=/etc/ -k permission_changes

#PCI-DSS Requirement 10.2.4 - Log all failed access attempts
-a always,exit -F arch=b64 -S open -F exit=-EACCES -k access_denied
-a always,exit -F arch=b32 -S open -F exit=-EACCES -k access_denied
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -k access_denied
-a always,exit -F arch=b32 -S openat -F exit=-EACCES -k access_denied
EOF

# PCI-DSS Requirement 10.7 - Retain audit logs for at least 12 months
# Create log rotation configuration

cat > /etc/logrotate.d/pci-audit <<'EOF'
/var/log/pci/*.log {
    daily
    missingok
    rotate 365
    compress
    delaycompress
    notifempty
    create 0640 root adm
    dateext
    dateformat -%Y%m%d
    sharedscripts
    postrotate
        /usr/bin/systemctl reload rsyslog > /dev/null 2>&1 || true
    endscript
}

/var/log/audit/audit.log {
    daily
    missingok
    rotate 365
    compress
    delaycompress
    notifempty
    create 0600 root root
    dateext
    sharedscripts
    postrotate
        /sbin/ausearch --start today > /dev/null 2>&1 || true
    endscript
}
EOF

# Validate PCI-DSS audit configuration
validate_pci_audit() {
    local errors=0
    
    # Check audit rules are loaded
    if ! auditctl -l | grep -q "pci"; then
        echo "ERROR: PCI-DSS audit rules not loaded"
        errors=$((errors + 1))
    fi
    
    # Check log rotation configured
    if [[ ! -f /etc/logrotate.d/pci-audit ]]; then
        echo "ERROR: PCI-DSS log rotation not configured"
        errors=$((errors + 1))
    fi
    
    # Check log directory permissions
    if [[ ! -d /var/log/pci ]]; then
        echo "ERROR: PCI-DSS log directory not created"
        errors=$((errors + 1))
    fi
    
    if [[ $? -ne 0 ]]; then
        echo "PCI-DSS audit validation: FAILED ($errors errors)"
        exit 1
    else
        echo "PCI-DSS audit validation: PASSED"
    fi
}
```

---

### Pattern 4: Compliance Automation with OpenSCAP

OpenSCAP provides automated compliance scanning for security policies and regulations.

```bash
# OpenSCAP Installation and Configuration for PCI-DSS Scanning
#!/bin/bash
# openscap-pci-dss-scanner.sh
# Automates PCI-DSS compliance scanning using OpenSCAP

set -euo pipefail

# Install OpenSCAP tools
install_openscap() {
    echo "Installing OpenSCAP tools..."
    
    case "$(command -v apt-get)" in
        *apt-get*)
            apt-get update && apt-get install -y \
                openscap-scanner \
                oscap-augeas \
                scap-security-guide \
                scap-security-guide-doc
            ;;
        *yum*|*dnf*)
            yum install -y \
                openscap \
                openscap-utils \
                scap-security-guide
            ;;
    esac
}

# Download PCI-DSS SCAP content
download_pci_scap_content() {
    echo "Downloading PCI-DSS SCAP content..."
    
    local content_dir="/usr/share/xml/scap/ssg/content"
    local pci_content="ssg-openscap-pci-dss.xml"
    
    if [[ ! -f "$content_dir/$pci_content" ]]; then
        echo "PCI-DSS SCAP content not found, installing scap-security-guide..."
        install_openscap
    fi
    
    echo "$content_dir"
}

# Run PCI-DSS compliance scan
run_pci_scan() {
    local target_host="${1:-localhost}"
    local output_dir="${2:-/var/openscap/pci-results}"
    
    echo "Running PCI-DSS compliance scan on $target_host..."
    
    # Create output directory
    mkdir -p "$output_dir"
    
    # Run SCAP scan
    oscap xccdf eval \
        --profile pci-dss \
        --report "$output_dir/pci-dss-report.html" \
        --results-arf "$output_dir/pci-dss-results.xml" \
        /usr/share/xml/scap/ssg/content/ssg-openscap-pci-dss.xml
    
    # Generate JSON summary for automation
    oscap xccdf eval \
        --profile pci-dss \
        --fetch-remote-resources \
        --json-results "$output_dir/pci-dss-results.json" \
        /usr/share/xml/scap/ssg/content/ssg-openscap-pci-dss.xml
    
    echo "Scan complete. Results in $output_dir"
}

# Validate PCI-DSS compliance
validate_pci_compliance() {
    local results_file="/var/openscap/pci-results/pci-dss-results.json"
    
    if [[ ! -f "$results_file" ]]; then
        echo "ERROR: PCI-DSS scan results not found"
        exit 1
    fi
    
    # Check for passing controls
    local passing=$(jq '.total_passed_checks' "$results_file")
    local failing=$(jq '.total_failed_checks' "$results_file")
    local total=$(jq '.total_checks' "$results_file")
    
    echo "PCI-DSS Compliance Summary:"
    echo "  Passing: $passing / $total"
    echo "  Failing: $failing"
    
    if [[ $failing -gt 0 ]]; then
        echo "PCI-DSS Compliance: FAILED"
        echo "Failed controls:"
        jq -r '.checks[] | select(.result == "fail") | "  - \(.benchmark_id)"' "$results_file"
        exit 1
    else
        echo "PCI-DSS Compliance: PASSED"
    fi
}

# Generate compliance evidence package
generate_evidence_package() {
    local scan_date=$(date +%Y%m%d)
    local evidence_dir="/var/evidence/pci-dss/$scan_date"
    
    mkdir -p "$evidence_dir"
    
    # Copy scan results
    cp -r /var/openscap/pci-results/* "$evidence_dir/"
    
    # Generate metadata
    cat > "$evidence_dir/metadata.json" <<EOF
{
  "evidence_type": "pci-dss-scan",
  "scan_date": "$(date -Iseconds)",
  "scanned_host": "$(hostname)",
  "scap_profile": "pci-dss",
  "scap_version": "1.3",
  "scanner": "OpenSCAP",
  "scanner_version": "$(oscap --version | head -1)"
}
EOF
    
    # Create evidence archive
    tar -czf "$evidence_dir/evidence-package.tar.gz" -C "$evidence_dir" .
    
    echo "Evidence package generated: $evidence_dir/evidence-package.tar.gz"
}

# Main execution
case "${1:-scan}" in
    install)
        install_openscap
        ;;
    scan)
        run_pci_scan "${2:-localhost}" "${3:-/var/openscap/pci-results}"
        ;;
    validate)
        validate_pci_compliance
        ;;
    evidence)
        generate_evidence_package
        ;;
    *)
        echo "Usage: $0 {install|scan [host] [output-dir]|validate|evidence}"
        exit 1
        ;;
esac
```

---

### Pattern 5: Compliance Automation with Trivy

Trivy provides container image scanning for security vulnerabilities and compliance checks.

```bash
# Trivy Configuration for PCI-DSS and SOC2 Compliance
#!/bin/bash
# trivy-compliance-scanner.sh
# Automates container compliance scanning for PCI-DSS and SOC2

set -euo pipefail

# Install Trivy
install_trivy() {
    echo "Installing Trivy..."
    
    # Download and install Trivy
    curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
    
    # Verify installation
    trivy --version
    
    # Download vulnerability database
    trivy image --download-db-only
}

# Configure Trivy for PCI-DSS scanning
configure_pci_trivy() {
    cat > /etc/trivy/pci-dss.yaml <<'EOF'
# Trivy PCI-DSS Configuration
# Custom configuration for PCI-DSS compliance scanning

scan:
  RemovedPackages: false
  Misconfigurations: true
  Secrets: true
  VulnerabilityType:
    - OS
    - Library

severity:
  - HIGH
  - CRITICAL

format: table

# PCI-DSS specific misconfigurations
misconfiguration:
  check:
    - PCI-DSS-1.1  # Firewall configuration
    - PCI-DSS-1.2  # Network segmentation
    - PCI-DSS-1.3  # Prohibit direct public access
    - PCI-DSS-2.1  # Default accounts removed
    - PCI-DSS-2.2  # Only necessary services enabled
    - PCI-DSS-6.1  # Security patches applied
    - PCI-DSS-6.5  # Secure coding practices
    - PCI-DSS-6.6  # Web application security
    - PCI-DSS-8.1  # Unique user identification
    - PCI-DSS-8.2  # Strong password requirements
    - PCI-DSS-8.3  # Multi-factor authentication
    - PCI-DSS-8.5  # Protection of authentication credentials
    - PCI-DSS-10.1 # Audit trail implementation
    - PCI-DSS-10.2 # Access logging
    - PCI-DSS-10.3 # Log integrity controls
    - PCI-DSS-10.7 # Log retention (12 months)
EOF

    echo "Trivy PCI-DSS configuration created at /etc/trivy/pci-dss.yaml"
}

# Scan container image for PCI-DSS compliance
scan_pci_image() {
    local image="${1:?Image name required}"
    local output_dir="${2:-/var/trivy/pci-results}"
    local scan_date=$(date +%Y%m%d)
    
    mkdir -p "$output_dir/$scan_date"
    
    echo "Scanning image: $image for PCI-DSS compliance..."
    
    # Run Trivy PCI-DSS scan
    trivy image \
        --config /etc/trivy/pci-dss.yaml \
        --severity HIGH,CRITICAL \
        --format table \
        --output "$output_dir/$scan_date/pci-dss-report.txt" \
        "$image"
    
    # Generate JSON results for automation
    trivy image \
        --config /etc/trivy/pci-dss.yaml \
        --severity HIGH,CRITICAL \
        --format json \
        --output "$output_dir/$scan_date/pci-dss-results.json" \
        "$image"
    
    # Check for compliance failures
    if grep -q "FAILED" "$output_dir/$scan_date/pci-dss-report.txt"; then
        echo "PCI-DSS Compliance: FAILED"
        grep "FAILED" "$output_dir/$scan_date/pci-dss-report.txt"
        exit 1
    else
        echo "PCI-DSS Compliance: PASSED"
    fi
}

# Scan for SOC2 compliance
scan_soc2_image() {
    local image="${1:?Image name required}"
    local output_dir="${2:-/var/trivy/soc2-results}"
    local scan_date=$(date +%Y%m%d)
    
    mkdir -p "$output_dir/$scan_date"
    
    echo "Scanning image: $image for SOC2 compliance..."
    
    # Create SOC2 configuration
    cat > /tmp/soc2-config.yaml <<'EOF'
# Trivy SOC2 Configuration

misconfiguration:
  check:
    - SOC2-CC1.1  # Control environment
    - SOC2-CC2.1  # Communication and information
    - SOC2-CC3.1  # Risk assessment
    - SOC2-CC4.1  # Monitoring and evaluation
    - SOC2-CC5.1  # Access control
    - SOC2-CC6.1  # Logical access security
    - SOC2-CC6.2  # Network security
    - SOC2-CC7.1  # System monitoring
    - SOC2-CC7.2  # Alerting
    - SOC2-CC8.1  # Change management
    - SOC2-CC8.2  # Configuration management
EOF
    
    trivy image \
        --config /tmp/soc2-config.yaml \
        --severity HIGH,CRITICAL \
        --format json \
        --output "$output_dir/$scan_date/soc2-results.json" \
        "$image"
    
    echo "SOC2 scan complete: $output_dir/$scan_date/soc2-results.json"
}

# Generate compliance evidence package
generate_trivy_evidence() {
    local image="${1:?Image name required}"
    local evidence_dir="/var/evidence/trivy/$(date +%Y%m%d)"
    
    mkdir -p "$evidence_dir"
    
    # Run multiple scans
    scan_pci_image "$image" /var/trivy/pci-results
    scan_soc2_image "$image" /var/trivy/soc2-results
    
    # Copy all results to evidence directory
    cp -r /var/trivy/pci-results/* "$evidence_dir/pci/"
    cp -r /var/trivy/soc2-results/* "$evidence_dir/soc2/"
    
    # Generate metadata
    cat > "$evidence_dir/metadata.json" <<EOF
{
  "evidence_type": "container-compliance",
  "scan_date": "$(date -Iseconds)",
  "scanned_image": "$image",
  "scanned_host": "$(hostname)",
  "scanner": "Trivy",
  "scanner_version": "$(trivy --version | head -1)"
}
EOF
    
    # Create evidence archive
    tar -czf "$evidence_dir/evidence-package.tar.gz" -C "$evidence_dir" .
    
    echo "Evidence package generated: $evidence_dir/evidence-package.tar.gz"
}

# Run compliance checks in CI/CD pipeline
ci_pipeline_check() {
    local image="${1:-app:latest}"
    
    echo "Running CI/CD compliance check..."
    
    # Check for critical vulnerabilities
    trivy image \
        --severity CRITICAL,HIGH \
        --exit-code 1 \
        "$image" && {
        echo "✓ No critical vulnerabilities found"
    } || {
        echo "✗ Critical vulnerabilities found"
        exit 1
    }
    
    # Check for PCI-DSS misconfigurations
    trivy config \
        --config /etc/trivy/pci-dss.yaml \
        --severity HIGH,CRITICAL \
        --exit-code 1 \
        --scanners misconfig \
        . && {
        echo "✓ No PCI-DSS misconfigurations found"
    } || {
        echo "✗ PCI-DSS misconfigurations found"
        exit 1
    }
    
    echo "CI/CD Compliance Check: PASSED"
}

# Main execution
case "${1:-scan}" in
    install)
        install_trivy
        configure_pci_trivy
        ;;
    scan-pci)
        scan_pci_image "${2:-app:latest}" "${3:-/var/trivy/pci-results}"
        ;;
    scan-soc2)
        scan_soc2_image "${2:-app:latest}" "${3:-/var/trivy/soc2-results}"
        ;;
    evidence)
        generate_trivy_evidence "${2:-app:latest}"
        ;;
    ci)
        ci_pipeline_check "${2:-app:latest}"
        ;;
    *)
        echo "Usage: $0 {install|scan-pci [image] [output-dir]|scan-soc2 [image] [output-dir]|evidence [image]|ci [image]}"
        exit 1
        ;;
esac
```

---

### Pattern 6: Compliance Automation with Klar (Clair Integration)

Klar integrates with Clair for container vulnerability scanning with compliance reporting.

```bash
# Klar Configuration for Compliance Scanning
#!/bin/bash
# klar-compliance-scanner.sh
# Automates Clair-based container vulnerability scanning for compliance

set -euo pipefail

# Install Klar
install_klar() {
    echo "Installing Klar..."
    
    local version="2.6.1"
    local os="linux"
    local arch="amd64"
    
    curl -L "https://github.com/optiopay/klar/releases/download/v${version}/klar-${version}-${os}-${arch}.tar.gz" \
        | tar -xz -C /tmp &&
    mv /tmp/klar /usr/local/bin/
    
    echo "Klar installed successfully"
}

# Configure Clair API endpoint
configure_clair() {
    local clair_url="${CLAIR_URL:-http://clair.local:6060}"
    local namespace="${CLAIR_NAMESPACE:-default}"
    
    cat > /etc/klar/klar.yml <<EOF
clair_url: $clair_url
clair_api_version: 3
namespace: $namespace
output: text
format: table
severity: HIGH,CRITICAL
EOF

    echo "Klar configured with Clair at $clair_url"
}

# Scan image with Klar for PCI-DSS compliance
scan_pci_with_klar() {
    local image="${1:?Image name required}"
    local output_dir="${2:-/var/klar/pci-results}"
    local scan_date=$(date +%Y%m%d)
    
    mkdir -p "$output_dir/$scan_date"
    
    echo "Scanning $image with Klar for PCI-DSS compliance..."
    
    # Set Docker registry credentials
    export CLAIR_USER="${DOCKER_REGISTRY_USER:-}"
    export CLAIR_PASS="${DOCKER_REGISTRY_PASSWORD:-}"
    
    # Run Klar scan
    klar status \
        --output "$output_dir/$scan_date/klar-results.txt" \
        "$image" > "$output_dir/$scan_date/klar-output.txt"
    
    # Parse results
    local critical=$(grep -c "Critical" "$output_dir/$scan_date/klar-results.txt" || true)
    local high=$(grep -c "High" "$output_dir/$scan/results.txt" || true)
    
    echo "PCI-DSS Vulnerability Summary:"
    echo "  Critical: $critical"
    echo "  High: $high"
    
    if [[ $critical -gt 0 ]]; then
        echo "PCI-DSS Compliance: FAILED (Critical vulnerabilities found)"
        exit 1
    fi
    
    echo "PCI-DSS Compliance: PASSED"
}

# Scan image with Klar for SOC2 compliance
scan_soc2_with_klar() {
    local image="${1:?Image name required}"
    local output_dir="${2:-/var/klar/soc2-results}"
    local scan_date=$(date +%Y%m%d)
    
    mkdir -p "$output_dir/$scan_date"
    
    echo "Scanning $image with Klar for SOC2 compliance..."
    
    # Run Klar scan with security focus
    klar status \
        --severity HIGH,CRITICAL \
        --output "$output_dir/$scan_date/klar-results.txt" \
        "$image" > "$output_dir/$scan_date/klar-output.txt"
    
    echo "SOC2 scan complete: $output_dir/$scan_date/klar-results.txt"
}

# Generate compliance report
generate_klar_report() {
    local image="${1:?Image name required}"
    local report_dir="/var/reports/klar/$(date +%Y%m%d)"
    
    mkdir -p "$report_dir"
    
    # Run both scans
    scan_pci_with_klar "$image" /var/klar/pci-results
    scan_soc2_with_klar "$image" /var/klar/soc2-results
    
    # Generate combined report
    cat > "$report_dir/compliance-report.md" <<EOF
# Container Compliance Report

## Image: $image
## Scan Date: $(date -Iseconds)
## Scanner: Klar (Clair)

## PCI-DSS Compliance

### Critical Vulnerabilities: $(grep -c "Critical" /var/klar/pci-results/$(date +%Y%m%d)/*-results.txt 2>/dev/null || echo 0)
### High Vulnerabilities: $(grep -c "High" /var/klar/pci-results/$(date +%Y%m%d)/*-results.txt 2>/dev/null || echo 0)

$(cat /var/klar/pci-results/$(date +%Y%m%d)/*-results.txt 2>/dev/null || echo "No PCI-DSS results available")

## SOC2 Compliance

### Critical Vulnerabilities: $(grep -c "Critical" /var/klar/soc2-results/$(date +%Y%m%d)/*-results.txt 2>/dev/null || echo 0)
### High Vulnerabilities: $(grep -c "High" /var/klar/soc2-results/$(date +%Y%m%d)/*-results.txt 2>/dev/null || echo 0)

$(cat /var/klar/soc2-results/$(date +%Y%m%d)/*-results.txt 2>/dev/null || echo "No SOC2 results available")

## Conclusion

EOF

    echo "Report generated: $report_dir/compliance-report.md"
}

# CI/CD integration check
klar_ci_check() {
    local image="${1:-app:latest}"
    
    echo "Running CI/CD compliance check with Klar..."
    
    # Run Klar with exit on critical vulnerabilities
    if klar status --severity CRITICAL "$image" 2>/dev/null; then
        echo "✓ No critical vulnerabilities found"
    else
        echo "✗ Critical vulnerabilities found"
        klar status --severity CRITICAL "$image" 2>&1 | grep -A5 "Critical"
        exit 1
    fi
    
    # Check for high severity vulnerabilities
    if klar status --severity HIGH "$image" 2>/dev/null; then
        echo "✓ No high severity vulnerabilities found"
    else
        echo "✗ High severity vulnerabilities found"
        klar status --severity HIGH "$image" 2>&1 | grep -A5 "High"
        exit 1
    fi
    
    echo "CI/CD Compliance Check: PASSED"
}

# Main execution
case "${1:-scan}" in
    install)
        install_klar
        configure_clair
        ;;
    scan-pci)
        scan_pci_with_klar "${2:-app:latest}" "${3:-/var/klar/pci-results}"
        ;;
    scan-soc2)
        scan_soc2_with_klar "${2:-app:latest}" "${3:-/var/klar/soc2-results}"
        ;;
    report)
        generate_klar_report "${2:-app:latest}"
        ;;
    ci)
        klar_ci_check "${2:-app:latest}"
        ;;
    *)
        echo "Usage: $0 {install|scan-pci [image] [output-dir]|scan-soc2 [image] [output-dir]|report [image]|ci [image]}"
        exit 1
        ;;
esac
```

---

### Pattern 7: Audit Trail Implementation

Comprehensive audit trail implementation for compliance evidence collection.

```yaml
# Audit Trail Configuration - SOC2/PCI-DSS/HIPAA
apiVersion: v1
kind: ConfigMap
metadata:
  name: audit-trail-configuration
  namespace: compliance
data:
  framework: "SOC2, PCI-DSS, HIPAA"
  requirements: |
    - SOC2 CC7: System monitoring and audit trails
    - PCI-DSS Requirement 10: Audit trail implementation
    - HIPAA Audit Controls: 164.308(a)(1)(ii)(D)
  controls:
    audit_logging_enabled: true
    log_retention_days: 365
    log_encryption_enabled: true
    log_integrity_enabled: true
    anomaly_detection_enabled: true
    real_time_alerting_enabled: true
```

```bash
# Comprehensive Audit Trail Implementation
#!/bin/bash
# audit-trail-implementer.sh
# Implements comprehensive audit trails for compliance

set -euo pipefail

# Install audit tools
install_audit_tools() {
    echo "Installing audit tools..."
    
    case "$(command -v apt-get)" in
        *apt-get*)
            apt-get update && apt-get install -y \
                auditd \
                ausearch \
                aureport \
                logwatch \
                fail2ban \
                rsyslog
            ;;
        *yum*|*dnf*)
            yum install -y \
                audit \
                audit-libs \
                rsyslog \
                logwatch \
                fail2ban
            ;;
    esac
    
    # Enable auditd
    systemctl enable auditd
    systemctl start auditd
}

# Configure audit rules for SOC2 compliance
configure_soc2_audit_rules() {
    cat > /etc/audit/rules.d/99-soc2.rules <<'EOF'
# SOC2 Audit Rules - CC6, CC7, CC8
# CC6: Logical Access Security
# CC7: System Monitoring
# CC8: Change Management

# File access monitoring
-w /etc/passwd -p wa -k identity_access
-w /etc/shadow -p wa -k identity_access
-w /etc/group -p wa -k identity_access

# Authentication events
-a always,exit -F arch=b64 -S login -k authentication
-a always,exit -F arch=b32 -S login -k authentication
-a always,exit -F arch=b64 -S acct -k user_modifications
-a always,exit -F arch=b32 -S acct -k user_modifications

# Privilege escalation
-a always,exit -F arch=b64 -S setuid -F a0=0 -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -F a0=0 -k privilege_escalation
-a always,exit -F arch=b64 -S setgid -F a0=0 -k privilege_escalation
-a always,exit -F arch=b32 -S setgid -F a0=0 -k privilege_escalation

# System configuration changes
-w /etc/audit/ -p wa -k config_changes
-w /etc/ssh/ -p wa -k ssh_config_changes
-w /etc/sudoers -p wa -k sudo_config_changes

# Service management
-a always,exit -F arch=b64 -S init_module -k module_loading
-a always,exit -F arch=b32 -S init_module -k module_loading
-a always,exit -F arch=b64 -S delete_module -k module_loading
-a always,exit -F arch=b32 -S delete_module -k module_loading

# Network changes
-w /etc/hosts -p wa -k network_changes
-w /etc/sysconfig/network-scripts/ -p wa -k network_changes
-w /etc/resolv.conf -p wa -k network_changes

# Time changes
-a always,exit -F arch=b64 -S sethostname -k time_changes
-a always,exit -F arch=b32 -S sethostname -k time_changes
-a always,exit -F arch=b64 -S setdomainname -k time_changes
-a always,exit -F arch=b32 -S setdomainname -k time_changes

# File integrity
-w /usr/bin/ -p x -k system_binaries
-w /usr/sbin/ -p x -k system_binaries
-w /bin/ -p x -k system_binaries
-w /sbin/ -p x -k system_binaries
EOF
}

# Configure audit rules for PCI-DSS compliance
configure_pci_audit_rules() {
    cat > /etc/audit/rules.d/99-pci-dss.rules <<'EOF'
# PCI-DSS Audit Rules - Requirement 10
# 10.1 - Implement audit trails
# 10.2 - Implement procedures for audit log generation
# 10.3 - Protect audit trail
# 10.4 - Correlate audit logs
# 10.5 - Use secure storage
# 1

…(truncated)