Compliance Overview

Infracast provides continuous compliance monitoring against industry frameworks, government standards, and security benchmarks.

Supported Frameworks

Framework	Controls	Coverage	Description
NIST 800-53 Rev 5	94 rules	Technical controls	Federal security standard
CMMC 2.0	67 rules	L1-L3 practices	DoD supply chain cybersecurity
FedRAMP	89 rules	High baseline	Cloud services for federal
PCI-DSS v4.0	78 rules	All 12 requirements	Payment card industry
SOC 2	52 rules	Trust criteria	Service organization controls
HIPAA	45 rules	Security Rule	Healthcare data protection
CIS Benchmarks	189 rules	AWS, Azure, GCP	Hardening best practices
STIGs	259 rules	Multiple products	DoD hardening guides
ISO 27001	38 rules	Annex A controls	Information security management
CSA CCM	27 rules	Cloud controls	Cloud security alliance

Total: 776+ automated compliance rules

How It Works

Rule Evaluation

Each compliance rule is a check against your infrastructure graph:

// Example rule: CIS AWS 5.2 — No security groups allow 0.0.0.0/0 to SSH
rule := Rule{
    ID:          "CIS-AWS-5.2",
    Framework:   "CIS AWS Foundations",
    Severity:    "HIGH",
    NodeTypes:   []string{"aws.ec2.security_group"},
    Condition:   "ingress_rules contains (port=22, cidr='0.0.0.0/0')",
    Remediation: "Restrict SSH access to known CIDR ranges",
}

Evaluation Pipeline

┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│ Discovery    │───▶│ Rule Engine  │───▶│ Findings     │
│ (nodes)      │    │ (776 rules)  │    │ (violations) │
└──────────────┘    └──────────────┘    └──────────────┘
                           │
                    ┌──────▼──────┐
                    │  Control    │
                    │  Mappings   │
                    │ NIST→CIS→PCI│
                    └─────────────┘

Control Inheritance

Many rules map to multiple frameworks:

Rule: "S3 bucket public access blocked"
  ├── NIST 800-53 AC-3 (Access Enforcement)
  ├── CIS AWS 2.1.5 (S3 Block Public Access)
  ├── PCI-DSS 1.3.1 (Network Segmentation)
  └── SOC 2 CC6.1 (Logical Access)

One finding can satisfy (or fail) multiple framework controls.

Attestations

Not all controls can be automated. Some require human attestation:

Automated vs Attested

Type	Example	How Assessed
Automated	S3 encryption enabled	Rule checks node property
Attested	Security training completed	Human uploads evidence
Hybrid	Incident response tested	Rule + evidence upload

Managing Attestations

1. Navigate to Compliance → Attestations
2. Filter by framework or control
3. Upload evidence (PDFs, screenshots, policies)
4. Set expiration date for periodic review

┌─────────────────────────────────────────────────────────────┐
│  Control: NIST 800-53 AT-2 (Security Awareness Training)   │
├─────────────────────────────────────────────────────────────┤
│  Status: ✅ Attested                                        │
│  Evidence: training-completion-report-2024.pdf             │
│  Attested By: security-admin@company.com                   │
│  Date: 2024-01-15                                          │
│  Expires: 2025-01-15                                        │
└─────────────────────────────────────────────────────────────┘

Compliance Scores

Calculation

Overall Score = (Passing Automated + Passing Attested) / Total Applicable × 100

By Category

Controls are grouped into families/domains:

NIST Family	Controls	Passing	Score
Access Control (AC)	25	22	88%
Audit (AU)	16	14	87%
Configuration (CM)	14	10	71%
Identification (IA)	12	12	100%
System Protection (SC)	22	18	82%

Trends

Track improvement over time:

• Weekly compliance snapshots
• 30/60/90 day trends
• Regression detection (score dropped)

Exemptions & Risk Acceptance

Creating an Exemption

When a control doesn't apply or risk is accepted:

1. Navigate to the finding
2. Click Accept Risk or Mark Exempt
3. Provide justification
4. Set review date

Exemption Workflow

Finding Detected → Review Required → Approved → Exempted
                        ↓
                    Rejected → Must Remediate

Auditor Visibility

Exemptions are clearly marked in reports:

Control: CIS-AWS-5.2
Status: EXEMPTED
Justification: "Legacy system scheduled for decommission Q2 2024"
Approved By: ciso@company.com
Review Date: 2024-06-30

Reports

Available Report Types

Report	Description	Audience
Executive Summary	High-level posture, trends, top risks	Leadership
Framework Report	Detailed control-by-control status	Auditors
Gap Analysis	What's failing and why	Security team
Remediation Plan	Prioritized fix list	Engineering
POA&M	Plan of Action & Milestones	Federal compliance
SSP	System Security Plan (auto-generated)	FedRAMP/FISMA

Export Formats

• PDF — Formatted for printing/sharing
• Excel — For analysis and manipulation
• JSON — For API/automation
• Word — For SSP editing

Scheduling

Automate report delivery:

schedule:
  frequency: weekly
  day: monday
  time: "08:00"
  recipients:
    - security-team@company.com
    - compliance@company.com
  reports:
    - executive-summary
    - framework-detail

Continuous Monitoring

Real-Time Detection

Findings appear within minutes of discovery:

1. Discovery job runs (scheduled or triggered)
2. New/changed nodes evaluated against rules
3. Findings created/resolved
4. Alerts sent (Slack, email, webhook)

ConMon for FedRAMP

FedRAMP requires continuous monitoring. Infracast provides:

• Automated monthly scans
• Deviation tracking
• POA&M generation
• Significant change detection

See FedRAMP Guide for details.

API Access

Query compliance data programmatically:

# Get compliance summary
curl -H "Authorization: Bearer $TOKEN" \
  "$API_URL/api/v1/tenants/$TENANT/compliance/summary"

# Get findings for a framework
curl -H "Authorization: Bearer $TOKEN" \
  "$API_URL/api/v1/tenants/$TENANT/findings?framework=nist-800-53"

# Export report
curl -H "Authorization: Bearer $TOKEN" \
  "$API_URL/api/v1/tenants/$TENANT/reports/generate" \
  -d '{"type":"framework","framework":"nist-800-53","format":"pdf"}'

Next Steps

• NIST 800-53 Guide — Deep dive into federal controls
• CMMC Guide — Defense contractor requirements
• CIS Benchmarks — Practical hardening