Compliance Documentation Navigation Guide

Not legal advice

This page describes technical features that can support your compliance work. It is not legal advice, and it does not establish that any system is compliant with any law, regulation or standard. You remain responsible for your own compliance assessment, independent testing and validation, and review by qualified legal and compliance professionals. See the Compliance Disclaimer.

Framework: Excalibur Purpose: Visual navigation for compliance documentation Last Updated: 2026-09-12

---

Overview

This guide provides visual diagrams to help you navigate the compliance documentation and understand the implementation workflow.

Diagrams:

1. User Journey - Choosing Your Path
2. Documentation Structure
3. Implementation Workflow
4. Evidence Collection Pipeline
5. Certification Timeline

---

1. User Journey - Choosing Your Path

---

2. Documentation Structure

---

3. Implementation Workflow

---

4. Evidence Collection Pipeline

---

5. Certification Timeline

FedRAMP Timeline

FedRAMP Moderate Certification — all offsets are relative to the day you start; no calendar dates are implied.

Phase	Activity	Starts (day)	Duration
Preparation	Risk Assessment	0	60 days
	SSP Development	59	60 days
Implementation	Install Framework	120	14 days
	Configure Controls	134	63 days
	Evidence Collection	181	30 days
Assessment	3PAO Engagement	212	90 days
	Remediation	304	30 days
Authorization	PMO Review	334	90 days
	ATO Issuance	424	milestone

Total elapsed: 425 days (~14 months) from start to the final milestone, summed from the table above rather than quoted.

GDPR Timeline

GDPR Compliance — all offsets are relative to the day you start; no calendar dates are implied.

Phase	Activity	Starts (day)	Duration
Preparation	Scope Assessment	0	30 days
	Risk Assessment	31	30 days
Implementation	Install Framework	59	14 days
	Configure Erasure	73	21 days
	Configure RoPA	94	14 days
	Policy Development	108	30 days
Verification	Conformance Testing	138	14 days
	Training	152	30 days
Audit	External Audit (Optional)	182	30 days
	Certification	212	milestone

Total elapsed: 213 days (~7 months) from start to the final milestone, summed from the table above rather than quoted.

SOC 2 Type I Timeline

SOC 2 Type I Certification — all offsets are relative to the day you start; no calendar dates are implied.

Phase	Activity	Starts (day)	Duration
Preparation	Scope Definition	0	30 days
Implementation	Install Framework	31	14 days
	Configure Controls	45	60 days
	Automated Validators	105	14 days
	Readiness Assessment	119	30 days
Audit	CPA Engagement	149	60 days
	Type I Report	209	milestone

Total elapsed: 210 days (~7 months) from start to the final milestone, summed from the table above rather than quoted.

SOC 2 Type II Timeline

SOC 2 Type II Certification — all offsets are relative to the day you start; no calendar dates are implied.

Phase	Activity	Starts (day)	Duration
Type I	Type I Certification	0	180 days
Observation Period	6-Month Operation	181	180 days
	12-Month Operation	181	365 days
Type II Audit	CPA Engagement	361	60 days
	Type II Report	421	milestone

Total elapsed: 546 days (~18 months) from start to the final milestone, summed from the table above rather than quoted.

HIPAA Timeline

HIPAA Compliance — all offsets are relative to the day you start; no calendar dates are implied.

Phase	Activity	Starts (day)	Duration
Preparation	Engage Specialist	0	14 days
	Risk Assessment	14	60 days
Policy Development	Security Policies	74	60 days
	Privacy Policies	74	60 days
Implementation	Install Framework	134	14 days
	Configure Tech Safeguards	148	60 days
	Workforce Training	208	60 days
Verification	Internal Audit	268	60 days
	External Audit	328	60 days
	Certification	388	milestone

Total elapsed: 389 days (~13 months) from start to the final milestone, summed from the table above rather than quoted.

---

Quick Reference Table

Step	FedRAMP	GDPR	SOC 2 Type I	SOC 2 Type II	HIPAA
1. Preparation	Risk assessment, scope	DPIA, scope	Scope definition	Type I complete	Engage specialist
2. Install	2 weeks	2 weeks	2 weeks	N/A	2 weeks
3. Implement	9 weeks (14 controls)	7 weeks (Articles 17, 17(3), 25, 30, 32)	6 weeks of control phases (CC1-CC9, A1-A3, PI1-PI3, C1-C3)	N/A	7 weeks (§164.308, §164.310, §164.312)
4. Policies	SSP, SAR	Privacy policy, RoPA	System description	N/A	Security + Privacy policies
5. Tests	Opt-in conformance arms	Opt-in conformance arms	Automated validators	N/A	Opt-in conformance arms
6. Evidence	SBOM, scans, audit logs	Erasure certs, RoPA	Reports, logs	Continuous	Audit logs, BAAs
7. Audit	3PAO (3 months)	External DPO (1 month)	CPA (2 months)	CPA (2 months)	External (2 months)
8. Timeline	6-12 months	3-6 months	3-6 months	12-18 months	6-12 months

---

Navigation Shortcuts

By Role

Developers:

1. Start: Quick Start Guide
2. Reference: Framework Capabilities
3. Code Examples: Individual checklists (fedramp.md, gdpr.md, soc2.md, hipaa.md)

Compliance Officers:

1. Start: Compliance Checklists
2. Evidence: Evidence Automation
3. Timeline: Certification Roadmap

Auditors:

1. Evidence: Evidence Automation — eng/compliance/collect-evidence.* in the framework repository
2. Conformance: the arms you wrapped and ran (Audit, Erasure, LegalHold, DataInventory)
3. Reports: Type I/II generation (SOC 2), SBOM artifacts (FedRAMP)

Management:

1. Overview: index.md
2. Timeline: Certification Roadmap
3. Costs: External audit fees + training + policies

By Task

"I need to get started" → Quick Start Guide

"I need FedRAMP certification" → checklists/fedramp.md

"I need GDPR compliance" → checklists/gdpr.md

"I need SOC 2 certification" → checklists/soc2.md

"I need HIPAA compliance" → checklists/hipaa.md

"I need to collect evidence" → Evidence Automation → eng/compliance/collect-evidence.* in the framework repository

"I need to understand what the framework provides" → Framework Capabilities

"I need help choosing" → User Journey Diagram

"I need to know the timeline" → Certification Timeline

---

Related Documentation

Within Compliance:

• index.md - Main compliance index
• quick-start.md - 30-minute getting started
• checklists/ - 4 detailed certification checklists
• fedramp/ - FedRAMP-specific documentation

Framework Documentation:

• ../security/ - Security implementation guides
• ../advanced/ - Advanced topics (deployment, testing, performance)
• ../../eng/compliance/ - Evidence automation scripts

External Standards:

• FedRAMP Program
• NIST SP 800-53 Rev 5
• GDPR Official Text
• AICPA Trust Services Criteria
• HHS HIPAA

---

Last Updated: 2026-09-12 Framework: Excalibur 10.0.0 prerelease

See Also

• Compliance Overview — Main compliance documentation index with framework capabilities and evidence automation
• Quick Start Guide — Get baseline compliance capabilities running in 30 minutes
• Audit Logging — Configure and use audit logging for compliance evidence collection