azure-compliance

Azure Compliance

Translate policy and regulatory requirements into implementable Azure controls and audit evidence. Map frameworks (ISO 27001, SOC2, HIPAA, PCI-DSS) to Azure services and configurations.

Use This Skill When

• The user needs compliance alignment (ISO, SOC2, HIPAA, PCI-DSS, or custom)
• The user asks for policy enforcement, audit logging, or data protection controls
• The user needs a remediation plan for compliance gaps
• The user is preparing for a security audit or certification

Context: Compliance Maturity

Immature: No compliance framework, ad hoc security, no audit trail
Developing: Framework chosen, basic controls, manual evidence collection
Managed: Controls automated with Azure Policy, audit logging centralized → Target
Optimized: Continuous compliance monitoring, real-time dashboards, attestation automated

Required Inputs

• Applicable frameworks: ISO 27001, SOC2 Type II, HIPAA, PCI-DSS, or custom?
• Data classification: Public, internal, confidential, secret (PII, PHI, payment data)?
• Current architecture: Existing controls, gaps identified?
• Audit scope: What resources/processes in scope?
• Evidence requirements: Reports, logs, attestations needed for certification?
• Risk tolerance: What's acceptable? What's not?

Decision Tree

Which compliance framework applies?
├─ ISO 27001 → Identity (4.6), Access (6.2, 6.6), Encryption (10.2), Audit (12.4)
├─ SOC2 Type II → Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, Privacy
├─ HIPAA → Technical safeguards: Access, encryption, audit, integrity
├─ PCI-DSS → Network, access, encryption, logging, incident response (for payment processing)
└─ Custom → Map control names to Azure services

Is data sensitive (PII, PHI, payment)?
├─ Yes → Encryption (at-rest + in-transit), MFA, audit logging, DLP
└─ No → Basic controls sufficient

Do you process across regions/countries?
├─ Yes → Data residency compliance (GDPR, CCPA, regional data localization)
└─ No → Single-region controls

Do you process continuously or in batches?
├─ Continuous → Real-time monitoring, alerts, anomaly detection
└─ Batch → Periodic reviews, manual attestation

Who audits you (internal, external, customer)?
├─ Internal only → Simplified documentation
├─ External audit → Formal evidence packages, reports
└─ Customer audit → On-demand access, dashboards