Compliance Checklists

Version: 1.0
Last Updated: April 2026
Target Audience: Compliance Officers, Security Teams, Auditors

SOC 2 Compliance
GDPR Compliance
HIPAA Compliance
Compliance Monitoring
Audit Preparation

SOC 2 Compliance

Overview

SOC 2 (Service Organization Control 2) compliance ensures that ThemisDB manages data securely based on five Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Security Criteria

CC1: Control Environment

CC2: Communication and Information

CC2.1 - Security policies communicated to relevant parties
- All employees acknowledge security policy annually
- Contractors sign security agreements
- Evidence: Signed acknowledgments, NDAs
CC2.2 - Information systems support objectives
- Systems documented with data flow diagrams
- Security controls mapped to systems
- Evidence: System documentation, data flow diagrams

CC3: Risk Assessment

CC3.1 - Risk assessment process defined
- Annual risk assessment performed
- Risk register maintained and reviewed quarterly
- Risk mitigation plans for critical risks
- Evidence: Risk assessment reports, risk register
CC3.2 - Fraud risk assessment
- Fraud scenarios identified and assessed
- Anti-fraud controls implemented
- Evidence: Fraud risk assessment, control documentation

CC4: Monitoring Activities

CC4.1 - Ongoing monitoring procedures established
- Security metrics tracked continuously
- Dashboards for real-time monitoring
- Automated alerting configured
- Evidence: Monitoring logs, alert configurations
CC4.2 - Internal audit program
- Annual internal security audit
- Quarterly control testing
- Remediation tracking
- Evidence: Audit reports, remediation logs

CC5: Control Activities

CC5.1 - Logical access controls
- Multi-factor authentication enforced
- Role-based access control implemented
- Access reviews performed quarterly
- Privileged access monitored and logged
- Evidence: Access logs, review reports

# Verify MFA enforcement
themisdb-cli security audit-mfa --all-users

# Review access permissions
themisdb-cli security access-review --output /tmp/access-review-$(date +%Y%m%d).csv

CC5.2 - Physical access controls
- Data center access restricted and logged
- Visitor logs maintained
- Security cameras monitoring critical areas
- Evidence: Access logs, visitor logs, camera footage
CC5.3 - Change management controls
- Change approval process documented
- All changes tracked in ticketing system
- Emergency change procedures defined
- Evidence: Change tickets, approval records

# Review recent changes
themisdb-cli audit query --type change --last 30d

CC6: Logical and Physical Access Controls

CC6.1 - User access provisioning/deprovisioning
- Automated onboarding/offboarding procedures
- Access granted based on least privilege
- Terminated user access revoked within 24 hours
- Evidence: Access logs, HR integration logs
CC6.2 - Authentication mechanisms
- Strong password policy enforced (12+ chars, complexity)
- MFA required for all access
- Failed login attempts monitored
- Evidence: Policy documentation, MFA logs

# Password policy configuration
password_policy:
  min_length: 12
  require_uppercase: true
  require_lowercase: true
  require_numbers: true
  require_special_chars: true
  max_age_days: 90
  prevent_reuse: 12

CC6.3 - Authorization
- RBAC implemented with defined roles
- Segregation of duties enforced
- Elevated privileges require approval
- Evidence: Role definitions, approval logs

CC7: System Operations

# Verify backup status
themisdb-cli backup status --detailed

# Test backup integrity
themisdb-cli backup verify --latest --full-check

CC8: Change Management

CC8.1 - Change approval and testing
- All production changes require approval
- Changes tested in non-production first
- Rollback procedures documented
- Evidence: Change tickets, test results

Availability Criteria

Processing Integrity Criteria

PI1.1 - Processing objectives defined
- Data processing flows documented
- Input validation controls implemented
- Output verification procedures defined
- Evidence: Process documentation, validation logs

Confidentiality Criteria

C1.1 - Data classification policy
- Data classified by sensitivity
- Encryption requirements per classification
- Handling procedures documented
- Evidence: Classification policy, encryption configs
C1.2 - Encryption controls
- Data encrypted at rest (AES-256)
- Data encrypted in transit (TLS 1.3)
- Key management procedures documented
- Evidence: Encryption configs, key rotation logs

Privacy Criteria

P1.1 - Privacy notice provided
- Privacy policy published and accessible
- Users notified of data collection practices
- Evidence: Privacy policy, consent records
P1.2 - Data subject rights
- Procedures for access requests
- Data deletion capabilities
- Data portability supported
- Evidence: Request handling logs

GDPR Compliance

General Data Protection Regulation (EU)

Lawful Basis for Processing (Article 6)

Consent
- Explicit consent obtained for data processing
- Consent records maintained
- Easy withdrawal mechanism provided
- Evidence: Consent logs, withdrawal requests
Legitimate Interest
- Legitimate interest assessment documented
- Balancing test performed
- Evidence: LIA documentation

Data Subject Rights (Articles 15-22)

Right to Access (Article 15)
- Data subject access request (DSAR) procedure
- Response within 30 days
- Data provided in machine-readable format
- Evidence: DSAR logs, response records

# Handle data access request
themisdb-cli gdpr access-request \
  --subject-id user@example.com \
  --output /tmp/dsar-$(date +%s).json

Right to Rectification (Article 16)
- Data correction procedures implemented
- Updates propagated to all systems
- Evidence: Correction logs
Right to Erasure (Article 17)
- Data deletion capabilities implemented
- Deletion verified across all systems
- Retention periods respected
- Evidence: Deletion logs, verification reports

# Process deletion request
themisdb-cli gdpr delete-request \
  --subject-id user@example.com \
  --verify \
  --generate-certificate

Right to Data Portability (Article 20)
- Export in common format (JSON, CSV)
- Complete data package provided
- Evidence: Export logs
Right to Object (Article 21)
- Objection handling procedures
- Processing stopped when objection valid
- Evidence: Objection logs

Security of Processing (Article 32)

Data Breach Notification (Articles 33-34)

Internal Procedures
- Breach detection mechanisms in place
- Breach response plan documented
- Incident response team trained
- Evidence: Response plan, training records
Notification Requirements
- Supervisory authority notification within 72 hours
- Data subject notification without undue delay
- Breach register maintained
- Evidence: Breach notifications, breach register

Data Protection Impact Assessment (Article 35)

DPIA Process
- DPIA template and procedure defined
- High-risk processing assessed
- Mitigation measures implemented
- Evidence: DPIA documents, risk assessments

Records of Processing Activities (Article 30)

Processing Register
- All processing activities documented
- Register maintained and current
- Categories of data subjects documented
- Evidence: Processing register

HIPAA Compliance

Health Insurance Portability and Accountability Act (US)

Administrative Safeguards

Physical Safeguards

Technical Safeguards

Access Control (§164.312(a)(1))
- Unique user identification
- Emergency access procedures
- Automatic logoff (15 min idle)
- Encryption and decryption
- Evidence: Access configs, encryption settings

# Session timeout configuration
session:
  timeout_minutes: 15
  require_reauth: true
  lock_on_idle: true

Audit Controls (§164.312(b))
- Hardware, software, and procedural mechanisms
- Record and examine activity in systems with PHI
- Audit logs retained for 6 years
- Evidence: Audit logs, log retention policy

# Review audit logs
themisdb-cli audit query --type access --phi true --last 90d

Integrity (§164.312(c)(1))
- Mechanisms to ensure data not improperly altered/destroyed
- Checksums and digital signatures
- Evidence: Integrity verification logs
Person or Entity Authentication (§164.312(d))
- Verify person/entity is who they claim
- MFA required
- Evidence: Authentication logs
Transmission Security (§164.312(e)(1))
- Integrity controls for transmitted PHI
- Encryption of PHI in transmission (TLS 1.3)
- Evidence: Network configs, encryption logs

Compliance Monitoring

Automated Compliance Checks

# Run SOC 2 compliance check
themisdb-cli compliance check --standard soc2 --output /tmp/soc2-check.json

# Run GDPR compliance check
themisdb-cli compliance check --standard gdpr --output /tmp/gdpr-check.json

# Run HIPAA compliance check
themisdb-cli compliance check --standard hipaa --output /tmp/hipaa-check.json

# Generate compliance dashboard
themisdb-cli compliance dashboard --all-standards

Continuous Compliance Monitoring

# /etc/themisdb/compliance-monitoring.yaml
monitoring:
  enabled: true
  
  checks:
    - standard: soc2
      frequency: daily
      alert_on_failure: true
      
    - standard: gdpr
      frequency: daily
      alert_on_failure: true
      
    - standard: hipaa
      frequency: daily
      alert_on_failure: true
  
  reporting:
    monthly_report: true
    recipients:
      - compliance-team@example.com
      - security-team@example.com

Compliance Metrics

Track these metrics continuously:

Access control violations
Encryption failures
Backup success rate
Incident response time
Security training completion rate
Patch management compliance
Data retention policy compliance

Audit Preparation

Pre-Audit Checklist

4 Weeks Before Audit:

Review all compliance checklists
Run automated compliance checks
Remediate any identified gaps
Update all documentation
Prepare evidence collection

2 Weeks Before Audit:

Schedule audit kick-off meeting
Provide auditors with requested documentation
Set up audit war room
Brief team on audit process

1 Week Before Audit:

Final compliance check
Verify all evidence is accessible
Review findings from previous audit
Prepare remediation status updates

Evidence Collection

# Collect all compliance evidence
themisdb-cli compliance collect-evidence \
  --standard all \
  --output /audit/evidence-$(date +%Y%m%d).tar.gz

# Generate compliance report
themisdb-cli compliance report \
  --standard all \
  --format pdf \
  --output /audit/compliance-report-$(date +%Y%m%d).pdf

Post-Audit Actions

Address all audit findings
Create remediation plan with timelines
Update policies and procedures
Implement recommended controls
Schedule follow-up audit

FilesExpand file tree

compliance.md

Latest commit

History