undefined

undefined

Control:
  ID: AC-001
  Title: Access Control Policy
  Framework: SOC 2, ISO 27001
  Category: Security

Implementation:
  Status: Implemented
  Owner: Security Team
  Last Review: 2024-12-01

Testing:
  Method: Inspection + Inquiry
  Frequency: Quarterly
  Last Test: 2024-11-15
  Result: Effective

Evidence:
  - Policy document v2.3
  - Access review logs
  - Training completion records

Gaps:
  - None identified

Recommendations:
  - Automate quarterly access reviews

undefined

undefined

Article 30 - Records of Processing:
  - [ ] Processing purposes documented
  - [ ] Data categories listed
  - [ ] Recipient categories identified
  - [ ] Transfer safeguards documented
  - [ ] Retention periods defined
  - [ ] Security measures described

Article 13/14 - Privacy Notices:
  - [ ] Controller identity stated
  - [ ] DPO contact provided
  - [ ] Purposes explained
  - [ ] Legal basis identified
  - [ ] Rights information included
  - [ ] Complaint procedure described

Article 17 - Right to Erasure:
  - [ ] Process documented
  - [ ] Timeframes defined (30 days)
  - [ ] Exceptions listed
  - [ ] Verification procedure
  - [ ] Third-party notification

Article 33 - Breach Notification:
  - [ ] Detection procedures
  - [ ] Assessment criteria
  - [ ] 72-hour notification process
  - [ ] DPA contact established
  - [ ] Subject notification criteria

const riskMatrix = {
  likelihood: {
    rare: 1,      // < 5%
    unlikely: 2,  // 5-25%
    possible: 3,  // 25-50%
    likely: 4,    // 50-75%
    certain: 5    // > 75%
  },

  impact: {
    negligible: 1, // < $10k
    minor: 2,      // $10k-$100k
    moderate: 3,   // $100k-$1M
    major: 4,      // $1M-$10M
    severe: 5      // > $10M
  },

  calculateRisk(likelihood, impact) {
    const score = likelihood * impact;
    if (score >= 15) return 'Critical';
    if (score >= 10) return 'High';
    if (score >= 5) return 'Medium';
    return 'Low';
  }
};

Critical:
  Response: 24-48 hours
  Escalation: Executive + Board
  Examples:
    - Active data breach
    - Regulatory violation with penalties
    - System-wide security failure

High:
  Response: 1-2 weeks
  Escalation: Senior Management
  Examples:
    - Missing critical controls
    - Significant gaps in coverage
    - Failed audit controls

Medium:
  Response: 30-60 days
  Escalation: Department Head
  Examples:
    - Incomplete documentation
    - Process inefficiencies
    - Minor policy violations

Low:
  Response: 90 days
  Escalation: Control Owner
  Examples:
    - Optimization opportunities
    - Documentation updates
    - Training gaps

undefined

undefined

def calculate_sample_size(population: int, confidence: float = 0.95,
                         margin_error: float = 0.05) -> int:
    """
    Calculate statistical sample size for audit testing.

    Args:
        population: Total population size
        confidence: Confidence level (default 95%)
        margin_error: Acceptable margin of error (default 5%)

    Returns:
        Required sample size
    """
    import math

    # Z-score for confidence level
    z_scores = {0.90: 1.645, 0.95: 1.96, 0.99: 2.576}
    z = z_scores.get(confidence, 1.96)

    # Assume 50% response distribution for max sample
    p = 0.5

    # Sample size formula
    n = (z**2 * p * (1-p)) / (margin_error**2)

    # Finite population correction
    if population < 10000:
        n = n / (1 + (n - 1) / population)

    return math.ceil(n)

undefined

Real-time Dashboards:
  - Control effectiveness scores
  - Compliance coverage %
  - Open findings count
  - Risk heat map

Automated Alerts:
  Critical:
    - Failed security controls
    - Unauthorized access attempts
    - Data breach indicators

  Warning:
    - Controls approaching expiry
    - Overdue remediations
    - Anomaly detection triggers

Reporting Cadence:
  Daily: Critical events
  Weekly: Status summary
  Monthly: Detailed report
  Quarterly: Executive review
  Annually: Full assessment

undefined

undefined