[FEATURE]: Support industry regulatory compliance checks (pre-set templates)

[larsgeorge]

Is there an existing issue for this?

• I have searched the existing issues

Problem statement

For specific industry regulations we need pre-set complaince checks.

Proposed Solution

Implement a repository of pre-built compliance checks that can be imported into the app. For example, for GDPR we have to ensure data is accessed with reason and expiration time. Here some ideas:

Implementable Compliance Checks for Ontos

1. GDPR (General Data Protection Regulation)

✅ Implementable Checks:

1. Access Grant Expiration Dates
   - Verify all grants to PII tables have expiration dates via tags
   - Check: HAS_TAG('access_expiration') for tables tagged with contains_pii
2. Data Minimization Verification
   - Ensure tables with PII only grant access to necessary columns
   - Check: Tables with contains_pii tag must have minimized_columns tag or justification
3. Purpose Limitation
   - Verify data access grants include purpose documentation
   - Check: HAS_TAG('access_purpose') for sensitive data
4. Lawful Basis Documentation
   - Ensure tables with PII have documented lawful basis
   - Check: TAG('lawful_basis') IN ['consent', 'contract', 'legal_obligation', 'vital_interests', 'public_task', 'legitimate_interests']
5. Data Retention Policies
   - Verify retention periods are defined
   - Check: HAS_TAG('retention_period') for all production tables
6. Right to Erasure Support
   - Ensure tables with PII are tagged as supporting deletion
   - Check: TAG('supports_deletion') = 'true' for PII tables
7. Data Portability Support
   - Verify export capability is documented
   - Check: TAG('supports_export') = 'true' for customer data
8. Cross-Border Transfer Documentation
   - Check international storage locations are documented
   - Check: Tables in non-EU catalogs with EU data have transfer_mechanism tag
9. Data Processing Agreement Tracking
   - Verify third-party processor agreements are documented
   - Check: Schemas shared with external groups have processor_agreement_id tag
10. Consent Tracking
    - Ensure consent-based data has consent tracking table references
    - Check: TAG('consent_table') exists for consent-based PII

❌ Cannot Implement:

• DPIA (requires manual assessment)
• Actual breach detection (requires monitoring tools)
• Real-time 72-hour breach notification (requires incident management system)

---

2. CCPA/CPRA (California Consumer Privacy Act)

✅ Implementable Checks:

1. Data Sale/Share Tracking
   - Verify tables shared externally are tagged
   - Check: TAG('data_sharing') IN ['sale', 'share', 'internal'] for all tables
2. Purpose Disclosure
   - Ensure collection purposes are documented
   - Check: HAS_TAG('collection_purpose') for customer data tables
3. Third-Party Disclosure Tracking
   - Verify third-party recipients are documented
   - Check: Schemas with external access have third_party_recipients tag
4. Sensitive Personal Information Handling
   - Identify and tag sensitive PI per CPRA definition
   - Check: TAG('data_sensitivity') IN ['public', 'internal', 'confidential', 'sensitive_pi']
5. Data Retention Limits
   - Verify maximum retention periods are defined
   - Check: HAS_TAG('max_retention_days')
6. Consumer Request Capability
   - Ensure tables support deletion and export
   - Check: TAG('supports_dsar') = 'true' for customer tables

❌ Cannot Implement:

• Opt-out mechanism enforcement (application logic)
• 45-day response tracking (requires ITSM integration)

---

3. HIPAA (Health Insurance Portability and Accountability Act)

✅ Implementable Checks:

1. Minimum Necessary Access
   - Verify PHI tables have access justifications
   - Check: Grants to PHI tables have access_justification tag
2. Audit Trail Requirements
   - Ensure PHI tables have audit logging enabled
   - Check: TAG('audit_enabled') = 'true' for PHI tables
3. Authorization Tracking
   - Verify patient authorization is documented
   - Check: HAS_TAG('authorization_ref') for PHI tables
4. Emergency Access Documentation
   - Ensure emergency access procedures are documented
   - Check: HAS_TAG('emergency_access_procedure') for PHI schemas
5. Access Termination
   - Verify access grants have end dates
   - Check: HAS_TAG('access_expiration') for PHI tables
6. De-identification Tracking
   - Mark de-identified datasets
   - Check: PHI tables must have TAG('phi_status') IN ['identified', 'deidentified', 'limited_dataset']
7. Business Associate Agreement (BAA) Tracking
   - Verify BAAs for external data sharing
   - Check: External schemas have baa_agreement_id tag

❌ Cannot Implement:

• Encryption verification (infrastructure level)
• Physical safeguards (not data-level)
• Workforce training tracking (HR system)
• Actual breach notification (requires incident system)

---

4. SOX (Sarbanes-Oxley Act)

✅ Implementable Checks:

1. Segregation of Duties (SoD)
   - Detect conflicting access combinations on financial tables
   - Check: Users with both write and approve privileges on same financial data
2. Access Certification Requirements
   - Verify access reviews are documented
   - Check: TAG('last_access_review') within last 90 days for financial tables
3. Change Management Documentation
   - Ensure schema changes have approval tracking
   - Check: HAS_TAG('change_approval_id') for production financial schemas
4. Financial Data Lineage
   - Verify lineage documentation exists
   - Check: Financial tables have HAS_TAG('data_lineage') or HAS_TAG('source_system')
5. Access Revocation Tracking
   - Ensure terminated user access is logged
   - Check: Access grants have revocation_date when status changes
6. Data Integrity Controls
   - Verify write access restrictions on financial tables
   - Check: Financial tables have TAG('write_protected') = 'true' or limited write grants
7. Privileged Access Monitoring
   - Identify and track privileged users
   - Check: Admin access to financial data has TAG('privileged_access_justification')
8. IT General Controls (ITGC)
   - Verify control documentation for critical systems
   - Check: Production catalogs have TAG('itgc_control_id')

❌ Cannot Implement:

• Actual audit log immutability (storage level)
• Disaster recovery testing (operational)

---

5. PCI DSS (Payment Card Industry Data Security Standard)

✅ Implementable Checks:

1. Cardholder Data Environment (CDE) Identification
   - Mark and restrict CDE tables
   - Check: TAG('pci_scope') = 'cde' for cardholder data
2. Unique User ID Requirements
   - Verify no shared accounts have CDE access
   - Check: CDE tables do not have group-level write access
3. Access Log Retention
   - Verify audit retention tags (1 year minimum)
   - Check: TAG('audit_retention_days') >= '365' for CDE tables
4. Quarterly Access Reviews
   - Ensure regular review schedule
   - Check: TAG('last_access_review') within last 90 days for CDE
5. Access Revocation for Terminated Users
   - Verify immediate revocation documented
   - Check: CDE access grants have expiration dates
6. Data Retention Policies
   - Verify no storage beyond business need
   - Check: HAS_TAG('retention_period') and TAG('retention_justification') for CDE
7. PAN Masking Requirements
   - Ensure masking is documented
   - Check: TAG('pan_masked') = 'true' for CDE tables or views

❌ Cannot Implement:

• Encryption verification (infrastructure level)
• Multi-factor authentication (auth system)
• Vulnerability scanning (security tools)
• Physical access controls (facility level)

---

6. SOC 2 (Service Organization Control 2)

✅ Implementable Checks:

1. Security - Access Controls
   - Verify access restrictions are documented
   - Check: All production tables have defined ownership and access policies
2. Confidentiality - Data Classification
   - Ensure proper classification tags
   - Check: TAG('data_classification') IN ['public', 'internal', 'confidential', 'restricted']
3. Privacy - Collection Notice Alignment
   - Verify privacy notice references
   - Check: Customer data tables have privacy_notice_version tag
4. Processing Integrity - Data Quality
   - Ensure quality metrics are tracked
   - Check: Critical tables have TAG('quality_score') or TAG('data_quality_checks')
5. Availability - Asset Criticality
   - Identify and tag critical assets
   - Check: Production tables have TAG('criticality') IN ['low', 'medium', 'high', 'critical']
6. Change Management
   - Track change approvals
   - Check: Production schemas have last_change_approval tag
7. Vendor Management
   - Document third-party data sharing
   - Check: External access has vendor_name and vendor_risk_assessment tags

❌ Cannot Implement:

• System uptime monitoring (infrastructure)
• Disaster recovery testing (operational)
• Incident response execution (security tools)

---

7. GLBA (Gramm-Leach-Bliley Act)

✅ Implementable Checks:

1. NPI Access Restrictions
   - Verify restricted access to nonpublic personal information
   - Check: TAG('contains_npi') = 'true' tables have limited access grants
2. Privacy Notice References
   - Ensure privacy notices are documented
   - Check: NPI tables have privacy_notice_url or privacy_notice_version tag
3. Information Sharing Tracking
   - Document data sharing arrangements
   - Check: HAS_TAG('sharing_arrangement') for NPI tables
4. Opt-Out Support
   - Verify opt-out capability is documented
   - Check: TAG('supports_optout') = 'true' for shared NPI
5. Service Provider Oversight
   - Track third-party processors
   - Check: External schemas have service_provider_agreement tag
6. Disposal Procedures
   - Document secure disposal capability
   - Check: HAS_TAG('disposal_procedure') for NPI tables

❌ Cannot Implement:

• Information security program audit (organizational)
• Pretexting protections (application/process level)

---

8. FERPA (Family Educational Rights and Privacy Act)

✅ Implementable Checks:

1. Legitimate Educational Interest
   - Verify access justifications
   - Check: Education record tables have access_justification tag for all grants
2. Consent Tracking
   - Document consent for non-exception disclosures
   - Check: HAS_TAG('disclosure_consent') or TAG('disclosure_exception') for education records
3. Directory Information Opt-Out
   - Mark directory information tables
   - Check: TAG('directory_info') = 'true' and TAG('supports_optout') = 'true'
4. Access Logging Requirements
   - Ensure audit trails exist
   - Check: TAG('audit_enabled') = 'true' for education records
5. Third-Party Disclosure Tracking
   - Document external disclosures
   - Check: HAS_TAG('disclosure_log_table') for education records
6. Amendment Request Support
   - Verify update capability
   - Check: TAG('supports_amendments') = 'true' for student records

❌ Cannot Implement:

• Annual notification process (organizational)

---

9. LGPD (Lei Geral de Proteção de Dados) - Brazil

✅ Implementable Checks:

• Similar to GDPR - reuse GDPR checks with LGPD-specific adjustments
• Lawful basis (10 legal bases): TAG('lgpd_legal_basis')
• Data Protection Agent designation: TAG('data_protection_agent')
• International transfer safeguards: TAG('international_transfer_mechanism')

---

10. PIPEDA (Canada)

✅ Implementable Checks:

• Similar to GDPR/CCPA - reuse consent and purpose checks
• Consent documentation: TAG('pipeda_consent')
• Purpose identification: TAG('collection_purpose')
• Safeguards documentation: TAG('safeguard_level')
• Cross-border transfer: TAG('cross_border_transfer_doc')

---

11. FINRA/SEC Regulations

✅ Implementable Checks:

1. Books and Records Retention
   - Verify immutable storage tags (SEC Rule 17a-4)
   - Check: Financial records have TAG('immutable_storage') = 'true'
2. Record Retention Periods
   - Ensure minimum retention (6 years for most records)
   - Check: TAG('retention_period_years') >= '6' for financial records
3. Segregation of Duties - Trading
   - Detect conflicting trading system access
   - Check: No user has both trade_execution and trade_approval on same tables
4. KYC Data Access Controls
   - Restrict Know Your Customer data access
   - Check: KYC tables have strict access controls and TAG('pii_type') = 'kyc'
5. Supervision Documentation
   - Verify communications data lineage
   - Check: Communications tables have supervision_policy_id tag

❌ Cannot Implement:

• Best execution monitoring (trading system)
• Insider trading surveillance (requires trading data analysis)
• Market manipulation detection (complex analytics)

---

12. BCBS 239 (Basel Committee - Banking)

✅ Implementable Checks:

1. Data Lineage Tracking
   - Ensure lineage is documented
   - Check: Risk data tables have HAS_TAG('data_lineage') or lineage_documented = true
2. Data Quality Metrics
   - Verify quality scoring exists
   - Check: Risk tables have TAG('accuracy_score'), TAG('completeness_score'), TAG('timeliness_sla')
3. Data Governance Framework
   - Ensure ownership and stewardship
   - Check: All risk data has defined owner and data steward
4. Historical Data Retention
   - Verify historical data availability
   - Check: Risk tables have TAG('historical_retention_years')
5. Reconciliation Controls
   - Document reconciliation processes
   - Check: Aggregated risk tables have reconciliation_table_ref tag
6. Data Architecture Documentation
   - Ensure source system documentation
   - Check: Risk data has source_system and data_architecture_doc tags

❌ Cannot Implement:

• Actual data quality measurement (requires profiling tools)
• Aggregation accuracy testing (requires calculation verification)

---

13. NIST Frameworks

✅ Implementable Checks:

1. Asset Inventory
   - Verify all assets are cataloged
   - Check: All catalogs/schemas/tables have metadata and ownership
2. Data Classification
   - Ensure classification tags exist
   - Check: HAS_TAG('data_classification')
3. Access Control Policy Enforcement
   - Verify access policies are documented
   - Check: Sensitive data has access_policy_id tag
4. Privacy Risk Assessment
   - Document PIA completion
   - Check: PII tables have privacy_impact_assessment_id tag
5. Supply Chain Risk Management
   - Track third-party data sources
   - Check: External data sources have vendor_risk_rating tag

❌ Cannot Implement:

• Anomaly detection (requires monitoring tools)
• Incident response execution (security operations)
• Recovery testing (operational)

---

14. FedRAMP (US Government Cloud)

✅ Implementable Checks:

1. Least Privilege Verification
   - Ensure minimal access grants
   - Check: Federal data tables have access justifications
2. Audit Log Protection
   - Verify audit settings
   - Check: Federal data has TAG('audit_immutable') = 'true'
3. Separation of Duties
   - Detect SoD violations
   - Check: Conflicting access combinations on federal data
4. Security Assessment Documentation
   - Track assessment dates
   - Check: Federal catalogs have last_security_assessment tag

❌ Cannot Implement:

• Continuous monitoring (requires SIEM)
• Boundary protection (network level)
• Multi-factor authentication (auth system)

---

Cross-Cutting Checks (Universal)

Access Management

1. ✅ Role-based access verification
2. ✅ Access grant justification requirements
3. ✅ Time-bound access (expiration dates)
4. ✅ Access revocation tracking
5. ✅ Least privilege verification
6. ✅ Privileged access documentation
7. ✅ Emergency access procedures documented
8. ✅ Regular access reviews/recertification tracking

Audit & Compliance

9. ✅ Audit logging enabled tags
10. ✅ Audit log retention period definition
11. ✅ Access attempt logging tags

Data Governance

12. ✅ Data ownership requirements
13. ✅ Data stewardship assignment
14. ✅ Retention policy definition
15. ✅ Data lineage documentation
16. ✅ Data quality metrics tracking
17. ✅ Metadata completeness (descriptions/comments)
18. ✅ Data catalog completeness

Data Protection

19. ✅ Data classification tagging
20. ✅ Encryption tags (documenting encryption status)
21. ✅ Masking/anonymization tags
22. ✅ Sensitive data identification

Vendor & Third-Party

23. ✅ Third-party access tracking
24. ✅ Data processing agreements documented
25. ✅ Vendor risk assessment tags
26. ✅ Subprocessor documentation

Incident Response

27. ✅ Incident detection capability tags
28. ✅ Breach notification workflow tags

---

Implementation Priority

Tier 1 (Universal - High Impact)

1. Data classification and sensitive data identification
2. Access grant expiration dates
3. Data owner assignment
4. Retention policy definition
5. Access justification requirements

Tier 2 (Regulation-Specific - High Compliance Value)

6. GDPR: Lawful basis + purpose limitation
7. HIPAA: Minimum necessary + PHI audit trails
8. SOX: Segregation of duties
9. PCI DSS: CDE identification + quarterly reviews
10. CCPA: Sale/share tracking

Tier 3 (Enhanced Governance)

11. Data lineage documentation
12. Data quality metrics
13. Third-party disclosure tracking
14. Privacy impact assessments
15. Change management documentation

Additional Context

No response