Compliance Documentation

Not legal advice

This page describes technical features that can support your compliance work. It is not legal advice, and it does not establish that any system is compliant with any law, regulation or standard. You remain responsible for your own compliance assessment, independent testing and validation, and review by qualified legal and compliance professionals. See the Compliance Disclaimer.

Excalibur provides comprehensive compliance features for enterprise regulatory requirements including FedRAMP, GDPR, SOC 2, and HIPAA.

Quick Navigation

🚀 Getting Started

New to compliance? Start with the Quick Start Guide - a 30-minute walkthrough covering installation, configuration, and verification.

Visual learner? Check out the Navigation Guide with flowcharts, diagrams, and timelines for all frameworks.

Certification Checklists

Step-by-step guides for achieving compliance certification:

Framework	When to Use	Checklist	Certification Time
FedRAMP	Selling to US federal government	NIST 800-53 (14 controls mapped; 4 satisfied, 10 partial)	6-12 months
GDPR	Processing EU resident data	Articles 17, 17(3), 25, 30, 32	3-6 months
SOC 2	SaaS, cloud, MSP businesses	Trust Services Criteria	3-18 months
HIPAA	Healthcare data (PHI)	Security + Privacy Rules	6-12 months

Framework Features

Core compliance capabilities provided by Excalibur.Dispatch:

Feature	Documentation	FedRAMP	GDPR	SOC 2	HIPAA
Access Control	Security Guide	AC-3, AC-6	Art 32	CC5, CC6	§164.312(a)
Audit Logging	Audit Logging	AU-2, AU-3, AU-9	Art 32	CC4, CC7	§164.312(b)
Encryption	Encryption Architecture	SC-28	Art 25, 32	C2	§164.312(a)(2)(iv)
Data Masking	Data Masking	N/A	Art 32	C2	§164.312
GDPR Erasure	GDPR Erasure	N/A	Art 17	C3	Disposal

FedRAMP control status

Fourteen NIST 800-53 Rev 5 controls are mapped. Four are satisfied by the framework (AC-3, AC-6, AU-3, SC-13); the other ten are partial — the framework supplies a mechanism and you supply the rest. A mechanism is not the control, so your SSP must describe both halves. The FedRAMP checklist is the single place this project asserts control status, and it states the consumer action each partial control requires.

• FedRAMP Overview - Supporting detail and the evidence package
• CM-8 SBOM - Software Bill of Materials (CycloneDX)

Compliance Overview

Quick Start

Install Packages

All frameworks require the core security packages:

# Core domain capabilities (required for all)
dotnet add package Excalibur.Domain

# Compliance features (GDPR erasure, SOC 2 validation)
dotnet add package Excalibur.Compliance

# Audit logging
dotnet add package Excalibur.AuditLogging

# For production audit persistence (SQL Server)
dotnet add package Excalibur.AuditLogging.SqlServer

# For production erasure/legal hold persistence (SQL Server)
dotnet add package Excalibur.Compliance.SqlServer

Basic Configuration

using Excalibur.Compliance;

var builder = WebApplication.CreateBuilder(args);

// 1. Access Control (All frameworks)
builder.Services.AddAuthorization();

// 2. Encryption (FedRAMP, GDPR, SOC 2, HIPAA)
builder.Services.AddEncryption(encryption => encryption
    .UseKeyManagement<AesGcmEncryptionProvider>("aes-gcm-primary")
    .ConfigureOptions(options => options.DefaultPurpose = "field-encryption"));

// 3. Audit Logging (All frameworks)
builder.Services.AddSqlServerAuditStore(options =>
{
    options.ConnectionString = builder.Configuration.GetConnectionString("Compliance")!;
    options.SchemaName = "audit";
    options.EnableHashChain = true;
});

// 4. GDPR Erasure (GDPR + optional for others)
builder.Services.AddGdprErasure(options =>
{
    options.DefaultGracePeriod = TimeSpan.FromHours(72);
    options.RequireVerification = true;
});

Usage Example

using Excalibur.Compliance;

// 1. Annotate personal data for encryption, and classify sensitive data
public class Patient
{
    public Guid Id { get; set; }

    [PersonalData]  // encrypted ONLY on a record that also carries [DataSubjectId],
                    // and only once crypto-shredding is registered
    public string FirstName { get; set; }

    [PersonalData]
    [Sensitive]  // in every released version: classification + log masking only. Encryption of this
                 // field comes from [PersonalData] above.
    public string SSN { get; set; }
}

// 2. Audit access using IAuditStore
public class PatientService
{
    private readonly IAuditStore _auditStore;

    public async Task<Patient> GetPatientAsync(Guid patientId, CancellationToken ct)
    {
        var patient = await _repository.GetAsync(patientId, ct);

        await _auditStore.StoreAsync(new AuditEvent
        {
            EventId = Guid.NewGuid().ToString(),
            EventType = AuditEventType.DataAccess,
            Action = "Patient.Read",
            ActorId = _currentUser.Id,
            ResourceId = patientId.ToString(),
            ResourceType = "Patient",
            Outcome = AuditOutcome.Success,
            Timestamp = DateTimeOffset.UtcNow
        }, ct);

        return patient;
    }
}

Framework Capabilities vs Consumer Responsibilities

What Excalibur Provides ✅

• Technical Controls: Encryption, audit logging, access control, erasure
• Conformance Kits: four provider kits (Audit, Erasure, LegalHold, DataInventory). Every arm is virtual and carries no test attribute, so nothing runs until you declare an attributed wrapper — wrap the arms your controls need, and your own run is the evidence. See Quick Start.
• Evidence Collection: Automated scripts for CI/CD artifacts
• SBOM Generation: CycloneDX format with 90-day retention
• Security Scanning: SAST (CodeQL), secrets (Gitleaks), dependency vulnerability scanning

What Consumers Must Implement ⚠️

• Organizational Policies: Risk assessments, security policies, privacy policies
• Business Processes: Consent management, incident response, breach notification
• Training: Annual security awareness, HIPAA training, GDPR training
• Documentation: System Security Plans (SSP), Records of Processing Activities (RoPA)
• Infrastructure: TLS configuration, key management, backup/recovery

Evidence Automation

Automated scripts for collecting compliance evidence from CI/CD pipelines:

Available Scripts

Script	Purpose	Platform
collect-evidence.ps1	Collect CI/CD evidence	PowerShell/Windows
collect-evidence.sh	Collect CI/CD evidence	Bash/Linux/macOS
generate-evidence-package.ps1	Create ZIP archive	PowerShell/Windows
export-audit-samples.sh	Export audit logs	Bash/Linux/macOS
generate-ropa-template.sh	Generate RoPA template	Bash/Linux/macOS

Location: eng/compliance/ in the framework repository

Evidence Types Collected

• Test Results: JUnit XML, code coverage (enforced regression floor of 44%; CI fails below it)
• Security Scans: SAST (CodeQL), secrets (Gitleaks), dependency vulnerability scanning. No DAST and no container scanning run in this pipeline.
• SBOM: CycloneDX JSON/XML (90-day retention)
• Audit Logs: Sample templates (anonymized)
• Requirements Traceability: RTM validation results

What the Manifest Asserts

MANIFEST.json states only what the package can substantiate. Its control figures are counted from the files collected into that package; they are not fixed totals, and a package that collected nothing reports zero controls documented.

• ControlsDocumented counts in-scope controls whose every mapped evidence category has at least one collected file. Expect it to be well below ControlsInScope: many controls are satisfied by documentation, configuration or a business process that no pipeline produces, and those are mapped so they can never be counted from a download. A shortfall here is not a finding against you — it tells you which controls you evidence by other means.
• ControlsDocumentedIds names them, so the count can be checked rather than taken on trust.
• ControlCoverage.Source names the file the control identifiers and their evidence categories are read from. Editing that file changes the reported figures.
• ManifestStatus and RefusalReasons — read these before submitting a package. REFUSED means at least one figure could not be derived (typically a missing evidence directory), and the collector exits with status 2. A category the collector could not measure is null, never 0: "we found none" and "we never looked" are different facts.

Placeholder templates the script writes for you (*.template.json) are excluded from every count, so a blank form never counts as evidence.

PowerShell collector

collect-evidence.ps1 still emits fixed control totals rather than derived ones. Prefer collect-evidence.sh for any package you intend to hand to an auditor.

Certification Roadmap

Typical timelines for achieving compliance certification:

Framework	Type	Duration	Key Milestones
FedRAMP	Moderate	6-12 months	Risk assessment → SSP → 3PAO → PMO review
GDPR	Full Compliance	3-6 months	Risk assessment → Policies → DPIA → Audit
SOC 2 Type I	Point-in-time	3-6 months	Scope → Implementation → Readiness → Audit
SOC 2 Type II	6-12 month period	12-18 months	Type I + observation + audit
HIPAA	Compliance	6-12 months	Risk assessment → Policies → Training → Audit

Legacy Features

The following features were part of the original compliance module and remain available:

Data Masking

Protect sensitive data (PII/PHI) in logs, responses, and error messages.

Learn more about Data Masking →

GDPR Erasure

Basic GDPR erasure implementation with crypto-shredding.

Learn more about GDPR Erasure →

Audit Logging

Tamper-evident logging with hash chain integrity.

Learn more about Audit Logging →

Recommendation

For new implementations, use the comprehensive compliance capabilities described in the Quick Start Guide and certification checklists rather than the legacy features.

Next Steps

1. Choose Your Framework: Review the Quick Start Guide decision tree
2. Follow the Checklist: Select from FedRAMP, GDPR, SOC 2, or HIPAA
3. Collect Evidence: Use the evidence automation scripts in the framework repository
4. Engage Auditor: 3PAO (FedRAMP), CPA (SOC 2), DPO (GDPR), or HIPAA specialist

Support

Questions:

• Product Manager: Compliance scope, legal basis, privacy policies
• Software Architect: Technical implementation, architecture decisions
• Project Manager: Evidence packages, audit coordination

Escalation:

• Security incidents: Follow breach notification procedures
• Compliance gaps: Create GitHub issue with compliance label
• Audit requests: Contact Project Manager for evidence package

---

See Also

• Quick Start - 30-minute compliance setup guide
• Audit Logging - Tamper-evident audit logging with hash chain integrity
• GDPR Erasure - Right to be forgotten with cryptographic deletion
• Compliance Checklists - FedRAMP, SOC 2, GDPR, and HIPAA checklists

---

Framework Version: Excalibur 10.0.0 prerelease Last Updated: 2026-09-12 Status: Technical controls implemented for FedRAMP, GDPR, SOC 2, HIPAA. Full certification requires organizational policies, processes, and external audit.