Compliance Tracking

Track control implementation, evidence collection, and audit readiness across regulatory frameworks. Provide a consolidated compliance posture view with gap remediation.

Workflow

Step 1: Define Scope

Establish frameworks (SOC 2, ISO 27001, GDPR, HIPAA, PCI-DSS), scope boundaries (systems, processes, data), audit timeline, prior findings, and control owners.

Step 2: Map Controls

Map requirements to specific controls. Identify shared controls across frameworks (e.g., access management satisfies SOC 2 CC6.1, ISO A.9, and GDPR Art. 32). Document type (preventive/detective/corrective), frequency, and manual vs. automated.

Step 3: Assess Status

For each control: Implemented, Partially implemented, Not implemented, or N/A. For implemented controls assess effectiveness: Effective, Partially effective, or Ineffective.

Step 4: Track Evidence

For each control: evidence type (policy, config, logs, reports), collection status (collected/in-progress/not-started/blocked), owner, period covered, and quality check.

Step 5: Generate Readiness Report

Output Format

## Compliance Tracking Report
**Framework**: [SOC 2 / ISO 27001 / etc.] | **Audit Date**: [YYYY-MM-DD]
**Status**: [ON TRACK / AT RISK / NOT READY]

### Readiness Summary
| Domain | Controls | Implemented | Evidence Ready | Gaps |
|--------|----------|-------------|----------------|------|
| Access Mgmt | 8 | 8 | 6 | 2 |
| Change Mgmt | 6 | 5 | 4 | 2 |
| **Total** | **26** | **24** | **18** | **8** |

### Overall Readiness: 69% evidence collected

### Gap Analysis
| # | Control | Requirement | Status | Gap | Owner | Due |
|---|---------|-------------|--------|-----|-------|-----|
| 1 | CC6.3 | Quarterly access review | Partial | Q3 not documented | [Name] | [Date] |

### Action Items
1. [Action] -- Owner: [Name] -- Due: [Date] -- Priority: [HIGH/MEDIUM/LOW]

Examples

User: "Where are we on SOC 2 readiness? Audit is in 6 weeks." Action: Assess evidence collection for each control, identify gaps, produce readiness report with prioritized remediation for the 6-week window.

User: "Track GDPR compliance for our new EU data processing" Action: Map GDPR requirements to existing controls, identify gaps (DPIA, DPO, transfer mechanism), create tracker with remediation timeline.

Best Practices

• Start evidence collection at least 90 days before the audit.
• Map controls across frameworks to avoid duplicate work.
• Automate evidence collection wherever possible -- manual screenshots are fragile.
• SOC 2 Type II requires evidence of consistent operation over the entire period.
• Address prior audit findings before the next audit -- repeat findings are viewed negatively.
• Assign a single owner to each control. Shared ownership leads to gaps.
• Review evidence quality, not just existence.