Class ComplianceMatrix

java.lang.Object
com.cloudforgeci.api.core.rules.ComplianceMatrix
public final class ComplianceMatrix extends Object
Multi-framework compliance control mapping matrix. Maps CloudForge CI security controls to requirements across multiple compliance frameworks: - PCI-DSS v3.2.1 - HIPAA Security Rule - SOC 2 Trust Services Criteria - GDPR (General Data Protection Regulation) - NIST SP 800-53 - FedRamp Moderate/High This matrix helps organizations understand which infrastructure controls satisfy requirements across multiple frameworks and identify the controls mapped to each framework.

Each control maps to framework requirements with enforcement levels:

  • REQUIRED - Must be implemented for framework compliance
  • ADVISORY - Recommended but alternative controls acceptable
  • NOT_APPLICABLE - Not relevant to this framework

Validation behavior depends on complianceMode:

  • ENFORCE - REQUIRED controls block deployment, ADVISORY controls warn
  • ADVISORY - All violations logged as warnings only
  • DISABLED - No validation performed

  • Method Details

    • generateMatrixReport

      public static String generateMatrixReport()
      Generate a compliance matrix report showing every defined control and its mappings across frameworks.

    • generateFrameworkChecklist

      public static String generateFrameworkChecklist(String framework)
      Generate a framework-specific requirements checklist.

    • validateControl

      public static ComplianceMatrix.ValidationResult validateControl(ComplianceMatrix.SecurityControl control, String framework, boolean isEnabled, ComplianceMode complianceMode)
      Validates a control against framework requirements with complianceMode consideration.
      Parameters:
      control - Security control to validate
      framework - Compliance framework (e.g., "SOC2", "PCI-DSS")
      isEnabled - Whether the control is currently enabled
      complianceMode - Compliance enforcement mode
      Returns:
      Validation result (PASS, FAIL, or WARN)

    • validateControlMultiFramework

      public static ComplianceMatrix.ValidationResult validateControlMultiFramework(ComplianceMatrix.SecurityControl control, String frameworksStr, boolean isEnabled, ComplianceMode complianceMode)
      Validates multiple frameworks against a control.
      Parameters:
      control - Security control to validate
      frameworksStr - Comma-separated list of frameworks (e.g., "SOC2,PCI-DSS")
      isEnabled - Whether the control is currently enabled
      complianceMode - Compliance enforcement mode
      Returns:
      Worst validation result across all frameworks (FAIL > WARN > PASS)

    • generateDeploymentReport

      public static String generateDeploymentReport(SystemContext ctx)
      Generate a deployment-specific compliance report showing which controls are enabled.

    • getSatisfiedFrameworks

      public static List<String> getSatisfiedFrameworks(SystemContext ctx)
      Get frameworks satisfied by current deployment configuration.

    • isControlRequired

      public static boolean isControlRequired(String frameworksStr, ComplianceMode mode, ComplianceMatrix.SecurityControl control)
      Check if a security control should be enforced based on compliance requirements.

      This method determines whether a control must be enabled based on:

      • The selected compliance frameworks (e.g., "PCI-DSS,HIPAA")
      • The compliance mode (ENFORCE, ADVISORY, DISABLED)
      • The requirement level of the control in each framework

      Enforcement logic:

      • DISABLED mode → never require (return false)
      • ENFORCE or ADVISORY mode + control is REQUIRED in any framework → require (return true)
      • ENFORCE or ADVISORY mode + control is only ADVISORY → don't require (return false)
      • No frameworks selected → never require (return false)

      ADVISORY vs ENFORCE affects validation blocking and warnings, not whether framework-required controls are provisioned in infrastructure.

      Parameters:
      frameworksStr - Comma-separated list of frameworks (e.g., "PCI-DSS,HIPAA,SOC2")
      mode - Compliance mode (ENFORCE, ADVISORY, or DISABLED)
      control - Security control to check
      Returns:
      true if the control should be enforced (must be enabled)

    • shouldWarnForControl

      public static boolean shouldWarnForControl(String frameworksStr, ComplianceMode mode, ComplianceMatrix.SecurityControl control, boolean isEnabled)
      Check if warnings should be logged for a disabled control.

      Warnings are generated when:

      • Control is disabled (isEnabled = false)
      • Mode is ADVISORY or ENFORCE
      • At least one framework has requirements (REQUIRED or ADVISORY)
      Parameters:
      frameworksStr - Comma-separated list of frameworks
      mode - Compliance mode
      control - Security control to check
      isEnabled - Whether the control is currently enabled
      Returns:
      true if warnings should be logged