compliance-engineering

Compliance Engineering

Framework Overview

SOC 2 Controls in Code

Audit Logging

interface AuditEvent {
  timestamp: string;
  actor: { id: string; role: string; ip: string };
  action: string;
  resource: { type: string; id: string };
  outcome: 'success' | 'failure';
  metadata: Record<string, unknown>;
}

async function auditLog(event: AuditEvent): Promise<void> {
  // Write-once, append-only storage (immutable)
  await auditStore.append({
    ...event,
    timestamp: new Date().toISOString(),
    hash: computeChainHash(event), // tamper detection
  });
}

Access Control

// RBAC with principle of least privilege
const permissions = {
  admin: ['read', 'write', 'delete', 'manage_users'],
  editor: ['read', 'write'],
  viewer: ['read'],
} as const;

function authorize(user: User, action: string, resource: Resource): boolean {
  const allowed = permissions[user.role];
  if (!allowed?.includes(action)) {
    auditLog({ action, outcome: 'failure', actor: user, resource });
    return false;
  }
  return true;
}

HIPAA Technical Safeguards

• Encryption at rest: AES-256 for PHI storage, AWS KMS / GCP KMS for key management
• Encryption in transit: TLS 1.2+ mandatory, certificate pinning for mobile
• Access controls: Unique user IDs, automatic logoff, MFA required
• Audit controls: Log all PHI access, retain logs 6+ years, tamper-evident
• Data backup: Encrypted backups, tested restore procedures, geographic redundancy