Compliance Documentation

Excalibur provides comprehensive compliance features for enterprise regulatory requirements including FedRAMP, GDPR, SOC 2, and HIPAA.

Quick Navigation

🚀 Getting Started

New to compliance? Start with the Quick Start Guide - a 30-minute walkthrough covering installation, configuration, and verification.

Visual learner? Check out the Navigation Guide with flowcharts, diagrams, and timelines for all frameworks.

Certification Checklists

Step-by-step guides for achieving compliance certification:

Framework	When to Use	Checklist	Certification Time
FedRAMP	Selling to US federal government	NIST 800-53 (14/14 controls)	6-12 months
GDPR	Processing EU resident data	Articles 17, 30, 32	3-6 months
SOC 2	SaaS, cloud, MSP businesses	Trust Services Criteria	3-18 months
HIPAA	Healthcare data (PHI)	Security + Privacy Rules	6-12 months

Framework Features

Core compliance capabilities provided by Excalibur.Dispatch:

Feature	Documentation	FedRAMP	GDPR	SOC 2	HIPAA
Access Control	Security Guide	AC-3, AC-6	Art 32	CC5, CC6	§164.312(a)
Audit Logging	Audit Logging	AU-2, AU-3, AU-9	Art 32	CC4, CC7	§164.312(b)
Encryption	Encryption Architecture	SC-28	Art 25, 32	C2	§164.312(a)(2)(iv)
Data Masking	Data Masking	N/A	Art 32	C2	§164.312
GDPR Erasure	GDPR Erasure	N/A	Art 17	C3	Disposal

📊 FedRAMP Epic Closure

Status: ✅ 14/14 NIST 800-53 controls SATISFIED (100% complete)

The FedRAMP compliance epic has been successfully completed:

• FedRAMP Overview - Complete 14/14 control implementation
• CM-8 SBOM - Software Bill of Materials (CycloneDX)

Compliance Overview

Quick Start

Install Packages

All frameworks require the core security packages:

# Core domain capabilities (required for all)
dotnet add package Excalibur.Domain

# Compliance features (GDPR erasure, SOC 2 validation)
dotnet add package Excalibur.Compliance

# Audit logging
dotnet add package Excalibur.AuditLogging

# For production audit persistence (SQL Server)
dotnet add package Excalibur.AuditLogging.SqlServer

# For production erasure/legal hold persistence (SQL Server)
dotnet add package Excalibur.Compliance.SqlServer

Basic Configuration

using Excalibur.Compliance;

var builder = WebApplication.CreateBuilder(args);

// 1. Access Control (All frameworks)
builder.Services.AddAuthorization();

// 2. Encryption (FedRAMP, GDPR, SOC 2, HIPAA)
builder.Services.AddEncryption(encryption => encryption
    .UseKeyManagement<AesGcmEncryptionProvider>("aes-gcm-primary")
    .ConfigureOptions(options => options.DefaultPurpose = "field-encryption"));

// 3. Audit Logging (All frameworks)
builder.Services.AddSqlServerAuditStore(options =>
{
    options.ConnectionString = builder.Configuration.GetConnectionString("Compliance")!;
    options.SchemaName = "audit";
    options.EnableHashChain = true;
});

// 4. GDPR Erasure (GDPR + optional for others)
builder.Services.AddGdprErasure(options =>
{
    options.DefaultGracePeriod = TimeSpan.FromHours(72);
    options.RequireVerification = true;
});

Usage Example

using Excalibur.Compliance;

// 1. Annotate sensitive data for automatic encryption
public class Patient
{
    public Guid Id { get; set; }

    [PersonalData]  // Automatically encrypted at rest
    public string FirstName { get; set; }

    [PersonalData]
    [Sensitive]
    public string SSN { get; set; }
}

// 2. Audit access using IAuditStore
public class PatientService
{
    private readonly IAuditStore _auditStore;

    public async Task<Patient> GetPatientAsync(Guid patientId, CancellationToken ct)
    {
        var patient = await _repository.GetAsync(patientId, ct);

        await _auditStore.StoreAsync(new AuditEvent
        {
            EventId = Guid.NewGuid().ToString(),
            EventType = AuditEventType.DataAccess,
            Action = "Patient.Read",
            ActorId = _currentUser.Id,
            ResourceId = patientId.ToString(),
            ResourceType = "Patient",
            Outcome = AuditOutcome.Success,
            Timestamp = DateTimeOffset.UtcNow
        }, ct);

        return patient;
    }
}

Framework Capabilities vs Consumer Responsibilities

What Excalibur Provides ✅

• Technical Controls: Encryption, audit logging, access control, erasure
• Conformance Tests: 80 automated tests (Audit, Erasure, LegalHold, DataInventory)
• Evidence Collection: Automated scripts for CI/CD artifacts
• SBOM Generation: CycloneDX format with 90-day retention
• Security Scanning: SAST, DAST, container, secrets scanning

What Consumers Must Implement ⚠️

• Organizational Policies: Risk assessments, security policies, privacy policies
• Business Processes: Consent management, incident response, breach notification
• Training: Annual security awareness, HIPAA training, GDPR training
• Documentation: System Security Plans (SSP), Records of Processing Activities (RoPA)
• Infrastructure: TLS configuration, key management, backup/recovery

Evidence Automation

Automated scripts for collecting compliance evidence from CI/CD pipelines:

Available Scripts

Script	Purpose	Platform
collect-evidence.ps1	Collect CI/CD evidence	PowerShell/Windows
collect-evidence.sh	Collect CI/CD evidence	Bash/Linux/macOS
generate-evidence-package.ps1	Create ZIP archive	PowerShell/Windows
export-audit-samples.sh	Export audit logs	Bash/Linux/macOS
generate-ropa-template.sh	Generate RoPA template	Bash/Linux/macOS

Location: eng/compliance/ in repository root

Evidence Types Collected

• Test Results: JUnit XML, code coverage (≥60% enforced)
• Security Scans: SAST (CodeQL), DAST (OWASP ZAP), container (Trivy), secrets (Gitleaks)
• SBOM: CycloneDX JSON/XML (90-day retention)
• Audit Logs: Sample templates (anonymized)
• Requirements Traceability: RTM validation results

What the Manifest Asserts

MANIFEST.json states only what the package can substantiate. Its control figures are counted from the files collected into that package; they are not fixed totals, and a package that collected nothing reports zero controls documented.

• ControlsDocumented counts in-scope controls whose every mapped evidence category has at least one collected file. Expect it to be well below ControlsInScope: many controls are satisfied by documentation, configuration or a business process that no pipeline produces, and those are mapped so they can never be counted from a download. A shortfall here is not a finding against you — it tells you which controls you evidence by other means.
• ControlsDocumentedIds names them, so the count can be checked rather than taken on trust.
• ControlCoverage.Source names the file the control identifiers and their evidence categories are read from. Editing that file changes the reported figures.
• ManifestStatus and RefusalReasons — read these before submitting a package. REFUSED means at least one figure could not be derived (typically a missing evidence directory), and the collector exits with status 2. A category the collector could not measure is null, never 0: "we found none" and "we never looked" are different facts.

Placeholder templates the script writes for you (*.template.json) are excluded from every count, so a blank form never counts as evidence.

PowerShell collector

collect-evidence.ps1 still emits fixed control totals rather than derived ones. Prefer collect-evidence.sh for any package you intend to hand to an auditor.

Certification Roadmap

Typical timelines for achieving compliance certification:

Framework	Type	Duration	Key Milestones
FedRAMP	Moderate	6-12 months	Risk assessment → SSP → 3PAO → PMO review
GDPR	Full Compliance	3-6 months	Risk assessment → Policies → DPIA → Audit
SOC 2 Type I	Point-in-time	3-6 months	Scope → Implementation → Readiness → Audit
SOC 2 Type II	6-12 month period	12-18 months	Type I + observation + audit
HIPAA	Compliance	6-12 months	Risk assessment → Policies → Training → Audit

Legacy Features

The following features were part of the original compliance module and remain available:

Data Masking

Protect sensitive data (PII/PHI) in logs, responses, and error messages.

Learn more about Data Masking →

GDPR Erasure

Basic GDPR erasure implementation with crypto-shredding.

Learn more about GDPR Erasure →

Audit Logging

Tamper-evident logging with hash chain integrity.

Learn more about Audit Logging →

Recommendation

For new implementations, use the comprehensive compliance capabilities described in the Quick Start Guide and certification checklists rather than the legacy features.

Next Steps

1. Choose Your Framework: Review the Quick Start Guide decision tree
2. Follow the Checklist: Select from FedRAMP, GDPR, SOC 2, or HIPAA
3. Collect Evidence: Use automated scripts in eng/compliance/
4. Engage Auditor: 3PAO (FedRAMP), CPA (SOC 2), DPO (GDPR), or HIPAA specialist

Support

Questions:

• Product Manager: Compliance scope, legal basis, privacy policies
• Software Architect: Technical implementation, architecture decisions
• Project Manager: Evidence packages, audit coordination

Escalation:

• Security incidents: Follow breach notification procedures
• Compliance gaps: Create GitHub issue with compliance label
• Audit requests: Contact Project Manager for evidence package

---

See Also

• Quick Start - 30-minute compliance setup guide
• Audit Logging - Tamper-evident audit logging with hash chain integrity
• GDPR Erasure - Right to be forgotten with cryptographic deletion
• Compliance Checklists - FedRAMP, SOC 2, GDPR, and HIPAA checklists

---

Framework Version: Excalibur 1.0.0 Last Updated: 2026-02-09 Status: Technical controls implemented for FedRAMP, GDPR, SOC 2, HIPAA. Full certification requires organizational policies, processes, and external audit.