compliance-automation（合规自动化）

Compliance Automation Skill

Overview

Automate compliance checking, monitoring, and reporting for regulatory frameworks including GDPR, HIPAA, SOC2, and CCPA.

Compliance Frameworks

GDPR (General Data Protection Regulation)

class GDPRComplianceChecker:
    def check_all_requirements(self, catalog: str) -> dict:
        """Check all GDPR requirements."""
        return {
            "data_inventory": self.check_data_inventory(catalog),
            "legal_basis": self.check_legal_basis(catalog),
            "consent_management": self.check_consent(catalog),
            "right_to_access": self.check_sar_process(),
            "right_to_erasure": self.check_deletion_workflow(),
            "right_to_portability": self.check_export_capability(),
            "data_minimization": self.check_data_minimization(catalog),
            "security_measures": self.check_security(catalog),
            "breach_notification": self.check_breach_process()
        }

    def check_right_to_erasure(self) -> dict:
        """Article 17: Right to erasure."""
        has_deletion_api = self.verify_deletion_api_exists()
        has_lineage = self.verify_lineage_for_cascade()
        response_time_ok = self.verify_30day_sla()

        return {
            "compliant": all([has_deletion_api, has_lineage, response_time_ok]),
            "gaps": self.identify_gaps([has_deletion_api, has_lineage, response_time_ok])
        }

HIPAA (Health Insurance Portability)

class HIPAAComplianceChecker:
    def check_technical_safeguards(self, catalog: str) -> dict:
        """Check HIPAA technical safeguards."""
        return {
            "access_control": self.check_unique_user_id(),
            "audit_controls": self.check_audit_logs(),
            "integrity_controls": self.check_data_integrity(),
            "transmission_security": self.check_encryption_transit(),
            "encryption_at_rest": self.check_encryption_rest(catalog)
        }

    def check_audit_controls(self) -> dict:
        """45 CFR § 164.312(b) - Audit controls."""
        logs_enabled = self.verify_audit_logs_enabled()
        retention_ok = self.verify_log_retention_6years()
        comprehensive = self.verify_phi_access_logged()

        return {
            "compliant": all([logs_enabled, retention_ok, comprehensive]),
            "requirement": "45 CFR § 164.312(b)"
        }

SOC2 (Service Organization Control 2)

class SOC2ComplianceChecker:
    def check_trust_services_criteria(self, catalog: str) -> dict:
        """Check SOC2 trust services criteria."""
        return {
            "security": self.check_security_principle(catalog),
            "availability": self.check_availability_principle(),
            "processing_integrity": self.check_processing_integrity(catalog),
            "confidentiality": self.check_confidentiality(catalog),
            "privacy": self.check_privacy_principle(catalog)
        }

Continuous Monitoring

Real-time Compliance Monitoring

def continuous_compliance_monitor(interval_minutes: int = 60):
    """Monitor compliance continuously."""
    while True:
        # Check all compliance frameworks
        gdpr_status = GDPRComplianceChecker().check_all_requirements("production")
        hipaa_status = HIPAAComplianceChecker().check_technical_safeguards("production")
        soc2_status = SOC2ComplianceChecker().check_trust_services_criteria("production")

        # Identify violations
        violations = identify_violations([gdpr_status, hipaa_status, soc2_status])

        if violations:
            # Alert and remediate
            send_compliance_alerts(violations)
            auto_remediate_violations(violations)

        # Log compliance status
        log_compliance_status(gdpr_status, hipaa_status, soc2_status)

        # Wait for next check
        time.sleep(interval_minutes * 60)

Automated Remediation

def auto_remediate_compliance_violations(violations: list):
    """Automatically fix compliance violations."""
    for violation in violations:
        if violation["type"] == "unencrypted_pii":
            enable_encryption(violation["table"])
            apply_masking(violation["columns"])

        elif violation["type"] == "excessive_access":
            revoke_excessive_permissions(violation["grants"])

        elif violation["type"] == "missing_audit_logs":
            enable_audit_logging(violation["catalog"])

        elif violation["type"] == "retention_violation":
            execute_retention_policy(violation["table"])

        # Log remediation
        log_remediation(violation)

Compliance Reporting

Generate Compliance Report

def generate_compliance_report(standard: str, catalog: str) -> dict:
    """Generate comprehensive compliance report."""
    if standard == "gdpr":
        checker = GDPRComplianceChecker()
        results = checker.check_all_requirements(catalog)
    elif standard == "hipaa":
        checker = HIPAAComplianceChecker()
        results = checker.check_technical_safeguards(catalog)

    report = {
        "standard": standard,
        "catalog": catalog,
        "date": datetime.now(),
        "overall_score": calculate_compliance_score(results),
        "compliant_controls": count_compliant(results),
        "non_compliant_controls": count_non_compliant(results),
        "findings": extract_findings(results),
        "remediation_plan": generate_remediation_plan(results)
    }

    return report

Best Practices

1. Automate Everything: Manual checks are error-prone
2. Monitor Continuously: Real-time compliance monitoring
3. Alert Proactively: Notify before violations escalate
4. Auto-Remediate: Fix violations automatically where possible
5. Document Evidence: Maintain audit trail for regulators
6. Regular Testing: Test compliance controls quarterly

Templates

• gdpr-checklist.yaml: GDPR compliance checklist
• hipaa-controls.yaml: HIPAA control validation
• soc2-audit.yaml: SOC2 audit procedures
• compliance-monitor.py: Continuous monitoring script

Examples

• gdpr-compliance-check: Complete GDPR audit
• hipaa-phi-protection: PHI protection validation
• soc2-security-controls: Security control testing