Package com.cloudforgeci.api.core.rules

Class ComplianceMatrix

java.lang.Object

com.cloudforgeci.api.core.rules.ComplianceMatrix

public final class ComplianceMatrix
extends Object

Multi-framework compliance control mapping matrix. Maps CloudForge CI security controls to requirements across multiple compliance frameworks: - PCI-DSS v3.2.1 - HIPAA Security Rule - SOC 2 Trust Services Criteria - GDPR (General Data Protection Regulation) - NIST SP 800-53 - FedRamp Moderate/High This matrix helps organizations understand which infrastructure controls satisfy requirements across multiple frameworks, reducing audit burden and demonstrating comprehensive security coverage.

Each control maps to framework requirements with enforcement levels:

• REQUIRED - Must be implemented for framework compliance
• ADVISORY - Recommended but alternative controls acceptable
• NOT_APPLICABLE - Not relevant to this framework

Validation behavior depends on complianceMode:

• ENFORCE - REQUIRED controls block deployment, ADVISORY controls warn
• ADVISORY - All violations logged as warnings only
• DISABLED - No validation performed

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	ComplianceMatrix.FrameworkRequirement	Framework-specific requirement with enforcement level.
static enum	ComplianceMatrix.RequirementLevel	Requirement enforcement level for a control within a compliance framework.
static enum	ComplianceMatrix.SecurityControl	Security control definitions mapped to framework requirements.
static enum	ComplianceMatrix.ValidationResult	Validation result for a control check.

Method Summary

Modifier and Type	Method	Description
static String	generateDeploymentReport(SystemContext ctx)	Generate a deployment-specific compliance report showing which controls are enabled.
static String	generateFrameworkChecklist(String framework)	Generate a framework-specific requirements checklist.
static String	generateMatrixReport()	Generate a comprehensive compliance matrix report showing all controls and their mappings across frameworks.
static List<String>	getSatisfiedFrameworks(SystemContext ctx)	Get frameworks satisfied by current deployment configuration.
static boolean	isControlRequired(String frameworksStr, ComplianceMode mode, ComplianceMatrix.SecurityControl control)	Check if a security control should be enforced based on compliance requirements.
static boolean	shouldWarnForControl(String frameworksStr, ComplianceMode mode, ComplianceMatrix.SecurityControl control, boolean isEnabled)	Check if warnings should be logged for a disabled control.
static ComplianceMatrix.ValidationResult	validateControl(ComplianceMatrix.SecurityControl control, String framework, boolean isEnabled, ComplianceMode complianceMode)	Validates a control against framework requirements with complianceMode consideration.
static ComplianceMatrix.ValidationResult	validateControlMultiFramework(ComplianceMatrix.SecurityControl control, String frameworksStr, boolean isEnabled, ComplianceMode complianceMode)	Validates multiple frameworks against a control.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

generateMatrixReport

public static String generateMatrixReport()

Generate a comprehensive compliance matrix report showing all controls and their mappings across frameworks.

generateFrameworkChecklist

public static String generateFrameworkChecklist(String framework)

Generate a framework-specific requirements checklist.

validateControl

public static ComplianceMatrix.ValidationResult validateControl(ComplianceMatrix.SecurityControl control,
 String framework,
 boolean isEnabled,
 ComplianceMode complianceMode)

Validates a control against framework requirements with complianceMode consideration.

Parameters:

control - Security control to validate

framework - Compliance framework (e.g., "SOC2", "PCI-DSS")

isEnabled - Whether the control is currently enabled

complianceMode - Compliance enforcement mode

Returns:

Validation result (PASS, FAIL, or WARN)

validateControlMultiFramework

public static ComplianceMatrix.ValidationResult validateControlMultiFramework(ComplianceMatrix.SecurityControl control,
 String frameworksStr,
 boolean isEnabled,
 ComplianceMode complianceMode)

Validates multiple frameworks against a control.

Parameters:

control - Security control to validate

frameworksStr - Comma-separated list of frameworks (e.g., "SOC2,PCI-DSS")

isEnabled - Whether the control is currently enabled

complianceMode - Compliance enforcement mode

Returns:

Worst validation result across all frameworks (FAIL > WARN > PASS)

generateDeploymentReport

public static String generateDeploymentReport(SystemContext ctx)

Generate a deployment-specific compliance report showing which controls are enabled.

getSatisfiedFrameworks

public static List<String> getSatisfiedFrameworks(SystemContext ctx)

Get frameworks satisfied by current deployment configuration.

isControlRequired

public static boolean isControlRequired(String frameworksStr,
 ComplianceMode mode,
 ComplianceMatrix.SecurityControl control)

Check if a security control should be enforced based on compliance requirements.

This method determines whether a control must be enabled based on:

• The selected compliance frameworks (e.g., "PCI-DSS,HIPAA")
• The compliance mode (ENFORCE, ADVISORY, DISABLED)
• The requirement level of the control in each framework

Enforcement logic:

• ENFORCE mode + control is REQUIRED in any framework → enforce (return true)
• ENFORCE mode + control is only ADVISORY → don't enforce (return false)
• ADVISORY mode → never enforce (return false, but may warn)
• DISABLED mode → never enforce (return false)
• No frameworks selected → never enforce (return false)

Parameters:

frameworksStr - Comma-separated list of frameworks (e.g., "PCI-DSS,HIPAA,SOC2")

mode - Compliance mode (ENFORCE, ADVISORY, or DISABLED)

control - Security control to check

Returns:

true if the control should be enforced (must be enabled)

shouldWarnForControl

public static boolean shouldWarnForControl(String frameworksStr,
 ComplianceMode mode,
 ComplianceMatrix.SecurityControl control,
 boolean isEnabled)

Check if warnings should be logged for a disabled control.

Warnings are generated when:

• Control is disabled (isEnabled = false)
• Mode is ADVISORY or ENFORCE
• At least one framework has requirements (REQUIRED or ADVISORY)

Parameters:

frameworksStr - Comma-separated list of frameworks

mode - Compliance mode

control - Security control to check

isEnabled - Whether the control is currently enabled

Returns:

true if warnings should be logged