Compliance Frameworks

QBITEL Bridge provides automated compliance assessment, continuous monitoring, and report generation for major regulatory frameworks.

Supported Frameworks

Framework Coverage Status
SOC 2 Type II Trust Services Criteria Full automation
GDPR Data protection, right to erasure, DPIAs Full automation
HIPAA PHI handling, access controls, audit trails Full automation
PCI DSS Cardholder data protection Full automation
NIST 800-53 Federal security controls Full automation
ISO 27001 Information security management Full automation
FedRAMP Federal cloud security Supported
CIS Benchmarks System hardening Supported
NIST CSF 2.0 Cybersecurity framework Supported

Assessment Engine

The compliance assessment engine continuously evaluates your deployment against framework requirements:

  • Automated control testing -- verify technical controls are functioning
  • Evidence collection -- automatically gather audit evidence
  • Gap analysis -- identify compliance gaps with remediation recommendations
  • Continuous monitoring -- real-time compliance status tracking

Generate Compliance Reports

# Generate a SOC 2 compliance report
curl -X POST http://localhost:8000/api/v1/compliance/report \
  -H "X-API-Key: your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "framework": "soc2",
    "report_type": "type_ii",
    "period_start": "2025-01-01",
    "period_end": "2025-12-31"
  }'

# Generate a GDPR DPIA report
curl -X POST http://localhost:8000/api/v1/compliance/report \
  -H "X-API-Key: your_api_key" \
  -d '{"framework": "gdpr", "report_type": "dpia"}'

Audit Trail

QBITEL Bridge maintains a comprehensive audit trail for compliance purposes:

  • All API requests are logged with timestamps, user identity, and action
  • Security decisions are recorded with confidence scores and reasoning
  • Configuration changes are tracked with before/after values
  • Data access events are logged for GDPR and HIPAA compliance
  • Audit logs are tamper-evident with cryptographic signatures

Data Retention

Configure data retention policies per compliance framework:

# config/compliance.yaml
data_retention:
  audit_logs:
    retention_days: 365
    encryption: AES-256-GCM
  security_events:
    retention_days: 90
  personal_data:
    retention_days: 30
    anonymization: true
  compliance_reports:
    retention_days: 2555  # 7 years for SOC 2

GDPR-Specific Features

  • Right to erasure -- automated data deletion workflows
  • Data portability -- export personal data in machine-readable format
  • Consent management -- track and enforce consent policies
  • DPIA generation -- automated Data Protection Impact Assessments
  • Cross-border transfer -- validate data residency requirements

SOC 2 Control Mapping

QBITEL Bridge maps its security controls to SOC 2 Trust Services Criteria:

Criteria QBITEL Bridge Controls
Security PQC-TLS, mTLS, admission webhooks, OPA policies
Availability HA deployment, health checks, auto-scaling
Processing Integrity Input validation, checksums, audit trail
Confidentiality Encryption at rest and in transit, field-level encryption
Privacy Data retention, anonymization, consent tracking

Software Bill of Materials (SBOM)

Generate and manage SBOMs for supply chain compliance:

# Generate SBOM
curl http://localhost:8000/api/v1/sbom/generate

# Verify SBOM signature
./scripts/verify_sbom_signature.sh

# Upload to Dependency-Track
./scripts/upload_sbom_to_dependency_track.sh

Next Steps