Compliance Overview

Infracast provides continuous compliance monitoring against industry frameworks, government standards, and security benchmarks — 1,241 automated rules across 35 YAML packs, all hot-reloadable without redeployment.

Supported Frameworks

US Federal & DoD

Framework	Rules	Description
NIST 800-53 Rev 5	94	Federal security standard — comprehensive technical & operational controls
NIST 800-171 r2	114	CUI protection for DoD contractors — all 110 requirements across 14 families
DFARS 252.204-7012	19	Safeguarding Covered Defense Information and cyber incident reporting (72-hour DoD notification)
FAR 52.204-21/23/25/27	30	Federal Acquisition Regulation baseline safeguarding — applies to ALL federal contractors handling FCI
FedRAMP Moderate	34	Cloud services for federal agencies — moderate baseline
FedRAMP High	32	Cloud services for federal agencies — high baseline
CMMC Level 2	32	DoD supply chain cybersecurity — 110 practices

DISA STIGs

STIG	Rules
RHEL 9	61
Windows Server 2022	60
Ubuntu 22.04	33
AWS	39
Windows 10	29
PostgreSQL	25
SQL Server	22
STIG Total	269

Industry Standards

Framework	Rules	Description
ISO 27001:2022	41	Information security management — Annex A controls
PCI-DSS v4.0	32	Payment card industry — all 12 requirements
HIPAA	28	Healthcare data protection — Security Rule
SOC 2	26	Service organization controls — Trust Service Criteria

CIS Benchmarks

Benchmark	Rules
AWS Foundations	53
Azure	52
GCP	50
Kubernetes	34
Microsoft 365	23
CIS Total	212

International & Sector-Specific

Framework	Rules	Description
GDPR	38	EU General Data Protection Regulation
NIS2	28	EU Network & Information Security Directive
IRAP	29	Australian Information Security Registered Assessors Program
CSA CCM v4	29	Cloud Security Alliance Cloud Controls Matrix
NIST CSF 2.0	27	NIST Cybersecurity Framework — Identify through Recover
DORA	26	EU Digital Operational Resilience Act
NERC CIP	28	Critical infrastructure protection — energy sector
SOX IT	22	Sarbanes-Oxley — IT general controls
UK Cyber Essentials	22	UK government baseline security standard
LGPD	20	Brazil Lei Geral de Proteção de Dados
PIPEDA	18	Canada Personal Information Protection

Total: 1,241+ rules across 35 YAML packs — all hot-reloadable · 23+ compliance frameworks incl. 11 international

Dynamic Rule Management

All compliance rules are defined in YAML and can be updated without redeployment:

# Example: rules/nist-800-53/ac-3.yaml
id: NIST-AC-3
framework: nist-800-53
title: "Access Enforcement"
severity: HIGH
node_types:
  - aws.s3.bucket
condition: "public_access_block.enabled == true"
remediation: "Enable S3 Block Public Access settings at the bucket and account level"
mappings:
  - framework: cis-aws
    control: "2.1.5"
  - framework: pci-dss-v4
    control: "1.3.1"
  - framework: soc2
    control: "CC6.1"

Hot-Reload

Push rule updates without downtime:

# Reload all rule packs immediately
POST /api/v1/rules/reload

# Response
{
  "status": "ok",
  "packs_reloaded": 35,
  "rules_loaded": 1241,
  "duration_ms": 142
}

Per-Tenant Rule Overrides

Each tenant can customize rules independently:

Override Type	Description
Disable	Turn off a rule that doesn't apply to this tenant
Severity Change	Promote or demote severity (e.g. MEDIUM → HIGH)
Timed Suppression	Suppress findings for a set window (e.g. maintenance, remediation sprint)

# Tenant override example
tenant: acme-corp
overrides:
  - rule_id: CIS-AWS-5.2
    action: suppress
    reason: "Legacy network migration in progress"
    expires: 2026-06-30
    approved_by: ciso@acme-corp.com
  - rule_id: NIST-SC-7
    action: severity_change
    severity: CRITICAL
    reason: "Internal policy — border protection is critical"

How It Works

Rule Evaluation

Each compliance rule is a check against your infrastructure graph:

// Example rule: CIS AWS 5.2 — No security groups allow 0.0.0.0/0 to SSH
rule := Rule{
    ID:          "CIS-AWS-5.2",
    Framework:   "CIS AWS Foundations",
    Severity:    "HIGH",
    NodeTypes:   []string{"aws.ec2.security_group"},
    Condition:   "ingress_rules contains (port=22, cidr='0.0.0.0/0')",
    Remediation: "Restrict SSH access to known CIDR ranges",
}

Evaluation Pipeline

┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│ Discovery    │───▶│ Rule Engine  │───▶│ Findings     │
│ (nodes)      │    │ (1,094 rules)│    │ (violations) │
└──────────────┘    └──────────────┘    └──────────────┘
                           │
                    ┌──────▼──────┐
                    │  Control    │
                    │  Mappings   │
                    │ NIST→CIS→PCI│
                    └─────────────┘

Control Inheritance

Many rules map to multiple frameworks:

Rule: "S3 bucket public access blocked"
  ├── NIST 800-53 AC-3 (Access Enforcement)
  ├── CIS AWS 2.1.5 (S3 Block Public Access)
  ├── PCI-DSS 1.3.1 (Network Segmentation)
  └── SOC 2 CC6.1 (Logical Access)

One finding can satisfy (or fail) multiple framework controls.

Assessment & Questionnaire System

For controls requiring human input, Infracast ships a full Assessment & Questionnaire System with 20 pre-built questionnaire templates across 4 languages:

Language	Templates
English (EN)	All 20
German (DE)	All 20
French (FR)	All 20
Portuguese (PT)	All 20

Templates cover common attested controls: security awareness training, incident response testing, vendor risk reviews, business continuity testing, and more. Templates are customizable per tenant and can be versioned in git.

Attestations

Not all controls can be automated. Some require human attestation:

Automated vs Attested

Type	Example	How Assessed
Automated	S3 encryption enabled	Rule checks node property
Attested	Security training completed	Human uploads evidence
Hybrid	Incident response tested	Rule + evidence upload

Managing Attestations

Navigate to Compliance → Attestations
Filter by framework or control
Upload evidence (PDFs, screenshots, policies)
Set expiration date for periodic review

┌─────────────────────────────────────────────────────────────┐
│  Control: NIST 800-53 AT-2 (Security Awareness Training)   │
├─────────────────────────────────────────────────────────────┤
│  Status: ✅ Attested                                        │
│  Evidence: training-completion-report-2025.pdf             │
│  Attested By: security-admin@company.com                   │
│  Date: 2025-01-15                                          │
│  Expires: 2026-01-15                                        │
└─────────────────────────────────────────────────────────────┘

Compliance Scores

Calculation

Overall Score = (Passing Automated + Passing Attested) / Total Applicable × 100

By Category

Controls are grouped into families/domains:

NIST Family	Controls	Passing	Score
Access Control (AC)	25	22	88%
Audit (AU)	16	14	87%
Configuration (CM)	14	10	71%
Identification (IA)	12	12	100%
System Protection (SC)	22	18	82%

Trends

Track improvement over time:

Weekly compliance snapshots
30/60/90 day trends
Regression detection (score dropped)

Exemptions & Risk Acceptance

Creating an Exemption

When a control doesn't apply or risk is accepted:

Navigate to the finding
Click Accept Risk or Mark Exempt
Provide justification
Set review date

Exemption Workflow

Finding Detected → Review Required → Approved → Exempted
                        ↓
                    Rejected → Must Remediate

Auditor Visibility

Exemptions are clearly marked in reports:

Control: CIS-AWS-5.2
Status: EXEMPTED
Justification: "Legacy system scheduled for decommission Q2 2026"
Approved By: ciso@company.com
Review Date: 2026-06-30

Reports

Available Report Types

Report	Description	Audience
Executive Summary	High-level posture, trends, top risks	Leadership
Framework Report	Detailed control-by-control status	Auditors
Gap Analysis	What's failing and why	Security team
Remediation Plan	Prioritized fix list	Engineering
POA&M	Plan of Action & Milestones	Federal compliance
SSP	System Security Plan (auto-generated)	FedRAMP/FISMA
FAR 52.204-21 Report	Basic safeguarding attestation for federal contractors	Contracting Officers, Federal Primes
DFARS 252.204-7012 Report	CDI safeguarding + SPRS score for DoD contractors	DoD Contracting, DCSA

Export Formats

PDF — Formatted for printing/sharing
Excel — For analysis and manipulation
JSON — For API/automation
Word — For SSP editing

Scheduling

Automate report delivery:

schedule:
  frequency: weekly
  day: monday
  time: "08:00"
  recipients:
    - security-team@company.com
    - compliance@company.com
  reports:
    - executive-summary
    - framework-detail

Continuous Monitoring

Real-Time Detection

Findings appear within minutes of discovery:

Discovery job runs (scheduled or triggered)
New/changed nodes evaluated against rules
Findings created/resolved
Alerts sent (Slack, email, webhook)

ConMon for FedRAMP

FedRAMP requires continuous monitoring. Infracast provides:

Automated monthly scans
Deviation tracking
POA&M generation
Significant change detection

See FedRAMP Guide for details.

API Access

Query compliance data programmatically:

# Get compliance summary
curl -H "Authorization: Bearer $TOKEN" \
  "$API_URL/api/v1/tenants/$TENANT/compliance/summary"

# Get findings for a framework
curl -H "Authorization: Bearer $TOKEN" \
  "$API_URL/api/v1/tenants/$TENANT/findings?framework=nist-800-53"

# Export report
curl -H "Authorization: Bearer $TOKEN" \
  "$API_URL/api/v1/tenants/$TENANT/reports/generate" \
  -d '{"type":"framework","framework":"nist-800-53","format":"pdf"}'

# Hot-reload rule packs (no restart required)
curl -X POST -H "Authorization: Bearer $TOKEN" \
  "$API_URL/api/v1/rules/reload"

Next Steps

NIST 800-53 Guide — Deep dive into federal controls
FedRAMP Guide — FedRAMP Moderate & High baselines
CMMC Guide — Defense contractor requirements
CIS Benchmarks — Practical hardening
DISA STIGs — DoD hardening guides

Supported Frameworks​

US Federal & DoD​

DISA STIGs​

Industry Standards​

CIS Benchmarks​

International & Sector-Specific​

Dynamic Rule Management​

Hot-Reload​

Per-Tenant Rule Overrides​

How It Works​

Rule Evaluation​

Evaluation Pipeline​

Control Inheritance​

Assessment & Questionnaire System​

Attestations​

Automated vs Attested​

Managing Attestations​

Compliance Scores​

Calculation​

By Category​

Trends​

Exemptions & Risk Acceptance​

Creating an Exemption​

Exemption Workflow​

Auditor Visibility​

Reports​

Available Report Types​

Export Formats​

Scheduling​

Continuous Monitoring​

Real-Time Detection​

ConMon for FedRAMP​

API Access​

Next Steps​