compliance-tracking

Supports tracking compliance requirements, preparing for audits, and maintaining regulatory readiness across common frameworks. It is triggered by terms such as compliance, audit prep, SOC 2, ISO 27001, GDPR, and regulatory requirement, or whenever a user needs help tracking, preparing for, or documenting compliance activities. The orientation is practical: organize what controls exist, what evidence proves them, and where the gaps are.

It summarizes several widely used frameworks and their focus areas, including SOC 2 (security, availability, processing integrity, confidentiality, and privacy for service organizations), ISO 27001 (risk assessment, security controls, and continuous improvement for information security), GDPR (consent, data rights, breach notification, and DPO for EU data privacy), HIPAA (PHI protection, access controls, and audit trails for US healthcare data), and PCI DSS (encryption, access control, and vulnerability management for payment card data). This gives a quick reference for the key requirements associated with each.

The tracking approach is organized around four components. A control inventory maps controls to framework requirements and documents owners, evidence, and effectiveness. An audit calendar captures upcoming audit dates, evidence collection timelines, and remediation deadlines. Evidence management records what evidence each control needs, where it is stored, and when it was last collected. Gap analysis compares requirements against the current state to produce a prioritized remediation plan and a timeline to compliance. The expected outputs are compliance status dashboards, gap analyses, audit prep checklists, and evidence collection plans, making it suited to ongoing readiness work as well as focused preparation ahead of a specific audit.