Cloud + AI Compliance Encyclopedia
Attribute-level compliance scoring across AWS, GCP, Azure, and Kubernetes — including the industry-first productized AI Workload Compliance framework mapping NIST AI-RMF + EU AI Act + ISO/IEC 42001 + MITRE ATLAS to your live K8s AI/ML inventory. Live re-scoring within 30 seconds of every cloud change.
AI Workload Compliance — built for the EU AI Act
EU AI Act enforcement starts February 2026 with €35M / 7% global-turnover penalties for high-risk AI systems lacking risk-management evidence. EchelonGraph's Tier 3 K8s watcher catches shadow AI workloads (KServe · Kubeflow · Argo Rollouts · KubeRay · Seldon · Run:ai) the moment they hit your cluster, then auto-maps them to NIST AI-RMF, EU AI Act Articles 9/15/16/17, ISO/IEC 42001, and MITRE ATLAS. No CSV exports. No quarterly snapshots. No competitor ships this productized today.
Every cloud or Kubernetes change fires a signed webhook that triggers an immediate re-score. Compare to traditional CSPM tools running 24-hour crons — EchelonGraph re-scores 4,800× more frequently. Compliance evidence stays accurate between audits, not just on audit day.
AI Governance
NIST AI-RMF
18 controlsNational Institute of Standards and Technology Artificial Intelligence Risk Management Framework (NIST AI-RMF 1.0). Four functions — Govern, Map, Measure, Manage — providing voluntary guidance for trustworthy AI development and deployment. The de-facto reference standard cited by US federal AI Executive Order 14110 and state-level AI laws.
EU AI Act
18 controlsThe world's first comprehensive AI regulation. High-risk AI system obligations under Articles 9-17 begin enforcement on August 2, 2026. Penalties up to €35M or 7% of global annual revenue — more punitive than GDPR. Extraterritorial reach: applies to any provider, deployer, importer, or distributor whose AI output reaches the EU market.
ISO/IEC 42001
15 controlsThe first international management-system standard for artificial intelligence. Provides certifiable framework for organisations developing, providing, or using AI systems. Modelled on ISO/IEC 27001's structure (Clauses 4-10) so organisations with mature ISMS can extend to AI management system with familiar PDCA + continual improvement cadence.
AI Threat Modelling
AI Application Security
Cloud Security
CIS GCP
24 controlsCenter for Internet Security benchmark for Google Cloud Platform. 130+ controls covering IAM, networking, logging, storage, databases, and compute security.
CIS AWS
35 controlsCenter for Internet Security benchmark for Amazon Web Services. 140+ controls covering IAM, storage, logging, monitoring, and networking.
CIS Azure
10 controlsCenter for Internet Security benchmark for Microsoft Azure. 120+ controls covering identity, networking, storage, databases, and logging.
CIS Kubernetes
26 controlsCenter for Internet Security benchmark for Kubernetes Pod Security, RBAC, and NetworkPolicy. EchelonGraph evaluates against the live cluster topology emitted by the Tier 3 K8s watcher (Pods, RBAC, NetworkPolicy CRDs).
Pod Security Standards
10 controlsKubernetes-native policy tiers replacing PodSecurityPolicy. EchelonGraph scores against the live Pod inventory + securityContext attributes captured by the Tier 3 watcher to verify which Pods meet Baseline vs Restricted profiles.
Audit Framework
International Standard
Industry Regulation
HIPAA
21 controlsUS federal law that establishes national standards to protect electronic personal health information (ePHI). Covers administrative, physical, and technical safeguards.
PCI DSS
27 controlsGlobal standard for organizations that handle cardholder data. 12 requirements covering network security, data protection, access control, and monitoring.
Privacy Regulation
GDPR
23 controlsEuropean Union regulation on data protection and privacy. Applies to all organizations processing personal data of EU residents, regardless of where the organization is located.
AI Workload Compliance
9 controlsIndustry-first productized AI governance framework. Maps NIST AI-RMF, EU AI Act Articles 9/15/16/17, ISO/IEC 42001, and MITRE ATLAS to the live Kubernetes AI/ML workload inventory captured by the Tier 3 watcher (KServe InferenceService, Kubeflow Notebook, Argo Rollouts, KubeRay RayCluster, Seldon SeldonDeployment, Run:ai RunaiJob).
DPDP Act
20 controlsIndia's comprehensive data-protection regulation, enacted August 2023. Applies to processing of digital personal data within India + cross-border processing of data principals in India. Penalty up to ₹250 crore per violation. The dominant privacy regulation for the world's most populous market.
ISMS-P
22 controlsKorea's combined information security + privacy certification managed by KISA (Korea Internet & Security Agency). Mandatory for many Korean industries; voluntary for others. Penalty: up to 3% of annual revenue (proposed amendments to 10% to align with GDPR).
Government Standard
What's Inside Each Control Page
Every control in this encyclopedia goes far beyond documentation. Each page is a complete security reference designed for security engineers, compliance managers, and auditors.
Real-World Attack Scenarios
Detailed narratives of how each control has been exploited in real breaches — Capital One, SolarWinds, Uber, Anthem, and more. Understand the exact attack chain so you can prioritize remediation.
Cost of Non-Compliance
Dollar-figure consequences with real case studies: GDPR fines (Amazon €746M, British Airways £20M), HIPAA settlements (Anthem $16M), PCI penalties ($5K–$500K/month), and average breach costs per control category.
Terraform & IaC Fixes
Copy-paste Terraform code blocks for every CIS Benchmark control. Includes resource configurations for GCP, AWS, and Azure with security best practices baked in — not just documentation, but deployable infrastructure.
MITRE ATT&CK Mapping
Every control maps to specific MITRE ATT&CK techniques (T1078, T1190, T1530, etc.) enabling threat-informed defense. Use these mappings to connect compliance requirements to your threat model.
Auditor Questions
The exact questions SOC 2 auditors, ISO 27001 certification bodies, PCI QSAs, and HIPAA OCR investigators will ask. Prepare evidence before the audit, not during it.
Effort Estimates
Side-by-side comparison of manual remediation effort vs. automated detection with EchelonGraph. Typical savings: 40+ hours of manual IAM review reduced to 60-second automated scan.
Control Severity Breakdown
Framework Coverage
| Framework | Controls | Clouds | Key Areas |
|---|---|---|---|
| 🔷 CIS GCP | 24 | GCP | IAM, networking, logging, storage, databases, compute, GKE, Cloud Run, KMS |
| 🟠 CIS AWS | 35 | AWS | Root MFA, S3 public access, CloudTrail, Security Groups, RDS, IMDSv2 |
| 🔵 CIS Azure | 10 | Azure | Azure AD MFA, NSG rules, Blob Storage, SQL encryption, AKS RBAC |
| ☸️ CIS Kubernetes | 26 | Kubernetes (any cloud) | 5.1.1 Cluster-admin, 5.1.5 Default SA tokens, 5.2.1 Privileged, 5.2.4 hostNetwork, 5.3.2 NetworkPolicy, 5.7.3 runAsNonRoot |
| 🛡️ SOC 2 | 33 | AWS · GCP · Azure | CC6.1 Access, CC6.6 Network, CC7.2 Monitoring, CC7.5 Recovery |
| 📋 ISO 27001 | 36 | AWS · GCP · Azure | A.5.1 Policies, A.8.2 Privileged Access, A.8.24 Cryptography, A.8.25 Secure SDLC |
| 🏥 HIPAA | 21 | AWS · GCP · Azure | §164.312 Access, Encryption, Audit Controls, Authentication, Transmission Security |
| 💳 PCI DSS | 27 | AWS · GCP · Azure | CDE segmentation, Default creds, PAN encryption, TLS, MFA, Audit trails |
| 🇪🇺 GDPR | 23 | AWS · GCP · Azure | Art 5 Principles, Art 25 Privacy by Design, Art 32 Security, Art 33 Breach Notification |
| 🏛️ NIST 800-53 | 41 | AWS · GCP · Azure | AC-2 Accounts, AC-6 Least Privilege, CM-6 Configuration, SC-7 Boundary, SI-4 Monitoring |
| 🔒 Pod Security Standards | 10 | Kubernetes (any cloud) | Privileged · Baseline · Restricted profile compliance against live Pod posture flags |
| 🤖 AI Workload Compliance | 9 | AWS · GCP · Azure · Kubernetes | NIST AI-RMF · EU AI Act Art 9/15/16/17 · ISO 42001 · MITRE ATLAS shadow AI detection |
| 🇮🇳 DPDP Act | 20 | All | India's comprehensive data-protection regulation, enacted August 2023. Applies to processing of digital personal data within India + cross-border processing of data principals in India. Penalty up to ₹250 crore per violation. The dominant privacy regulation for the world's most populous market. |
| 🇰🇷 ISMS-P | 22 | All | Korea's combined information security + privacy certification managed by KISA (Korea Internet & Security Agency). Mandatory for many Korean industries; voluntary for others. Penalty: up to 3% of annual revenue (proposed amendments to 10% to align with GDPR). |
| 🤖 NIST AI-RMF | 18 | All | National Institute of Standards and Technology Artificial Intelligence Risk Management Framework (NIST AI-RMF 1.0). Four functions — Govern, Map, Measure, Manage — providing voluntary guidance for trustworthy AI development and deployment. The de-facto reference standard cited by US federal AI Executive Order 14110 and state-level AI laws. |
| 🇪🇺 EU AI Act | 18 | All | The world's first comprehensive AI regulation. High-risk AI system obligations under Articles 9-17 begin enforcement on August 2, 2026. Penalties up to €35M or 7% of global annual revenue — more punitive than GDPR. Extraterritorial reach: applies to any provider, deployer, importer, or distributor whose AI output reaches the EU market. |
| 📐 ISO/IEC 42001 | 15 | All | The first international management-system standard for artificial intelligence. Provides certifiable framework for organisations developing, providing, or using AI systems. Modelled on ISO/IEC 27001's structure (Clauses 4-10) so organisations with mature ISMS can extend to AI management system with familiar PDCA + continual improvement cadence. |
| 🎯 MITRE ATLAS | 12 | All | MITRE ATLAS catalogues adversarial tactics, techniques, and case studies specific to AI/ML systems. The AI counterpart to MITRE ATT&CK, ATLAS provides the structured taxonomy security teams need to threat-model AI workloads. Used by NIST AI-RMF, EU AI Act guidance, and OWASP LLM Top 10 as the canonical adversarial-ML reference. |
| 🧠 OWASP LLM Top 10 | 12 | All | OWASP's specialised Top 10 for Large Language Model applications. The de-facto checklist for any product team shipping LLM-backed features. Maps to EU AI Act Article 15 cybersecurity requirements + MITRE ATLAS adversarial techniques + NIST AI-RMF MEASURE controls. Updated quarterly by the OWASP GenAI Project working group. |
How We Score Compliance
Every compliance score in EchelonGraph is derived from real infrastructure signals — not questionnaires or self-assessments. Our scoring engine runs pure-function evaluators against your actual cloud state on every scan cycle. Below is the exact mapping of every control to its automated check.
Scoring Formula
Score % = (Pass + Partial × 0.5) ÷ Total Controls × 100Each control produces one of four verdicts: Pass (1.0), Fail (0.0), Partial (0.5), or N/A (excluded from denominator). Scores are computed independently per cloud provider.
SOC 2 Type II
17 controls · 7 infra checks · 9 maturity-based| Control | What It Checks | Infrastructure Signal | Verdict Logic |
|---|---|---|---|
| CC1.1 Ethics & Code of Conduct | 📋 Maturity | Organisational governance control | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| CC1.2 Board Independence | 📋 Maturity | Organisational governance control | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| CC2.1 Security Policy Library | 📋 Maturity | Organisational governance control | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| CC3.1 Risk Assessment | 🔧 Infrastructure | Checks total asset count > 0 | Assets under scanNo cloud accounts connected |
| CC4.1 Continuous Monitoring | 🔧 Infrastructure | Checks total asset count > 0 | Assets under scanNo cloud accounts connected |
| CC5.1 Network Segmentation | 🔧 Infrastructure | VPC count + firewall rule count | VPC + firewall both presentMissing VPC or firewall |
| CC5.2 Segregation of Duties | 📋 Maturity | IaC + PR review workflow | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| CC6.1 MFA & Authentication | 🔑 IAM & Access | IAM user + service account count | IAM users found — verify MFANo IAM identities |
| CC6.2 Access Provisioning | 📋 Maturity | Onboarding workflow | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| CC6.3 Access Removal | 📋 Maturity | Offboarding workflow | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| CC6.6 Firewall Posture | 🔧 Infrastructure | Scans for 0.0.0.0/0 ingress rules | No broad rulesOver-permissive rules detected |
| CC6.7 TLS Enforcement | 🔧 Infrastructure | LB, DB, compute TLS posture | TLS enforced across servicesTLS not verified |
| CC6.8 Threat Detection | 🔧 Infrastructure | GuardDuty / SCC / Defender presence | Threat detection activeNot detected |
| CC7.1 Audit Logging | 🔧 Infrastructure | CloudTrail / Audit Logs / Activity Log | Audit logging enabledAudit logging not verified |
| CC7.2 Incident Response | 📋 Maturity | IR runbook existence | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| CC8.1 Change Management | 📋 Maturity | CI/CD + PR review pipeline | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| CC9.1 Vendor Risk | 📋 Maturity | Vendor risk register | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
GDPR
12 controls · 2 infra checks · 9 maturity-based| Control | What It Checks | Infrastructure Signal | Verdict Logic |
|---|---|---|---|
| Art5 Lawful Basis | 📋 Maturity | Records of Processing Activities (RoPA) | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| Art6 Lawful Basis Mapping | 📋 Maturity | Article 6 legal basis per processing activity | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| Art7 Consent Management | 📋 Maturity | Consent UI + withdrawal records | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| Art12 Privacy Notice | 📋 Maturity | Public privacy notice + DSAR procedure | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| Art15 DSAR Procedure | 📋 Maturity | Subject access request portal, 30-day SLA | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| Art17 Right to Erasure | 📋 Maturity | Cascading delete + backup retention policy | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| Art25 Privacy by Design | 🔧 Infrastructure | Has object_storage or managed_database with encryption | Encryption at rest verifiedNo storage resources |
| Art30 Records of Processing | 📋 Maturity | RoPA register maintained | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| Art32 Security of Processing | 🔧 Infrastructure | Has object_storage or managed_database with encryption | Encryption at rest verifiedNo storage resources |
| Art33 Breach Notification | 📋 Maturity | 72-hour notification runbook | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| Art35 DPIA Template | 📋 Maturity | Data Protection Impact Assessment template | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| Art44 Cross-Border Transfers | ⚡ Custom Logic | Cloud region metadata | Region known — verify adequacyRegion info unavailable |
ISO 27001:2022
14 controls · 3 infra checks · 7 maturity-based| Control | What It Checks | Infrastructure Signal | Verdict Logic |
|---|---|---|---|
| A5.1 Info Security Policy | 📋 Maturity | Organisational governance | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| A5.2 Roles & Responsibilities | 📋 Maturity | Documented security roles | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| A6.1 Background Checks | 📋 Maturity | HR security control | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| A6.2 Employment Terms | 📋 Maturity | HR security control | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| A7.1 Physical Security | 📋 Maturity | Inherited from cloud provider attestations | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| A7.2 Physical Entry Controls | 📋 Maturity | Inherited from cloud provider attestations | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| A8.1 Endpoint Management | ⚡ Custom Logic | compute_instance + serverless_function count | Managed compute inventoriedNo managed compute |
| A8.2 Privileged Access | 🔑 IAM & Access | IAM principal analysis for over-privilege | No broad IAMOver-privileged accountsNo IAM |
| A8.3 Access Restriction | 🔑 IAM & Access | IAM principal analysis | No broad IAMOver-privileged accountsNo IAM |
| A8.4 Source Code Access | 📋 Maturity | IdP-federated git host | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| A8.5 Secure Authentication | 🔑 IAM & Access | IAM user + service account count | IAM users found — verify MFANo IAM identities |
| A8.9 Configuration Mgmt | 🔧 Infrastructure | Checks for default/unhardened firewall rules | No default rules remainDefault vendor configs detectedNo firewall rules |
| A8.20 Network Security | 🔧 Infrastructure | VPC + firewall rule presence | Network segmentedSegmentation gap |
| A8.24 Cryptography | 🔧 Infrastructure | KMS keys, encryption + TLS posture | KMS or default encryption activeManual review needed |
HIPAA Security Rule
5 controls · 1 infra checks · 1 maturity-based| Control | What It Checks | Infrastructure Signal | Verdict Logic |
|---|---|---|---|
| 164.312(a) ePHI Access Control | ⚡ Custom Logic | managed_database behind VPC + firewall | DB isolated in VPCDB without network isolationNo databases |
| 164.312(c) ePHI Integrity | ⚡ Custom Logic | managed_database with point-in-time recovery | Integrity controls presentNo databases |
| 164.312(d) Person Authentication | 🔑 IAM & Access | IAM user + service account count | IAM users found — verify MFANo IAM identities |
| 164.312(e) Transmission Security | 🔧 Infrastructure | LB, DB, compute TLS enforcement | TLS enforcedTLS not verified |
| 164.308(a)(1) Risk Analysis | 📋 Maturity | Annual ePHI risk analysis | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
PCI DSS 4.0
12 controls · 6 infra checks · 4 maturity-based| Control | What It Checks | Infrastructure Signal | Verdict Logic |
|---|---|---|---|
| Req1 Network Segmentation | 🔧 Infrastructure | VPC + firewall rule presence | CDE segmentedSegmentation gap |
| Req2 Default Configs | 🔧 Infrastructure | Checks for unhardened default firewall rules | No defaults remainDefault vendor configsNo firewall rules |
| Req3 Stored Data Protection | 🔧 Infrastructure | Storage/DB encryption-at-rest posture | Encryption verifiedNo storage |
| Req4 Transit Encryption | 🔧 Infrastructure | LB, DB, compute TLS enforcement | TLS enforcedTLS not verified |
| Req5 Malware Protection | 🔧 Infrastructure | GuardDuty / SCC / Defender presence | ActiveNot detected |
| Req6 Secure Development | 📋 Maturity | SAST + dependency scanning pipeline | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| Req7 Access Restriction | 🔑 IAM & Access | IAM privilege analysis | No broad IAMOver-privilegedNo IAM |
| Req8 Authentication | 🔑 IAM & Access | IAM user + service account count | Verify MFANo IAM |
| Req9 Physical Access | 📋 Maturity | Inherited from cloud provider | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| Req10 Audit Trails | 🔧 Infrastructure | CloudTrail / Audit Logs / Activity Log | Logging enabledLogging not verified |
| Req11 Vulnerability Testing | 📋 Maturity | Quarterly ASV + annual pen-test | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| Req12 Security Policy | 📋 Maturity | Information security policy document | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
NIST CSF 2.0
21 controls · 5 infra checks · 11 maturity-based| Control | What It Checks | Infrastructure Signal | Verdict Logic |
|---|---|---|---|
| GV.OC-01 Organisational Context | 📋 Maturity | Governance framework | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| GV.RM-01 Risk Strategy | 📋 Maturity | Risk management programme | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| GV.SC-01 Supply Chain Risk | 📋 Maturity | Third-party risk programme | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| ID.AM-01 Hardware Inventory | ⚡ Custom Logic | Total asset count across all types | Assets inventoriedNo assets connected |
| ID.AM-02 Software Inventory | ⚡ Custom Logic | compute + serverless + k8s count | Software platforms inventoriedNo platforms detected |
| ID.RA-01 Vulnerability Scanning | ⚡ Custom Logic | Total asset count under CVE matching | Under continuous scanNo assets to scan |
| ID.RA-02 Threat Intelligence | 📋 Maturity | NVD + MITRE ATT&CK feed subscription | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| PR.AA-01 Identity Management | 🔑 IAM & Access | IAM privilege analysis | No broad IAMOver-privilegedNo IAM |
| PR.AA-03 MFA | 🔑 IAM & Access | IAM user + service account count | Verify MFANo IAM |
| PR.DS-01 Data-at-Rest | 🔧 Infrastructure | Storage/DB encryption posture | EncryptedNo storage |
| PR.DS-02 Data-in-Transit | 🔧 Infrastructure | TLS enforcement across services | TLS enforcedTLS not verified |
| PR.PS-01 Config Management | 🔧 Infrastructure | Default firewall rule detection | HardenedDefault configsNo rules |
| PR.IR-01 Incident Response Plan | 📋 Maturity | IR plan document | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| DE.CM-01 Network Monitoring | 🔧 Infrastructure | Audit logging posture | Logging onNot verified |
| DE.CM-06 Activity Monitoring | 🔧 Infrastructure | Audit logging posture | Logging onNot verified |
| DE.AE-02 Anomaly Analysis | 📋 Maturity | Anomaly playbooks | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| RS.MA-01 Incident Management | 📋 Maturity | Incident workflow | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| RS.CO-02 Regulatory Notification | 📋 Maturity | Notification templates | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| RS.MI-01 Containment | 📋 Maturity | Containment playbooks | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| RC.RP-01 Recovery Planning | 📋 Maturity | Backup + restore drill cadence | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| RC.CO-01 Recovery Comms | 📋 Maturity | Recovery communication templates | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
DPDP Act (India)
10 controls · 0 infra checks · 8 maturity-based| Control | What It Checks | Infrastructure Signal | Verdict Logic |
|---|---|---|---|
| DPDP-1 Lawful Purpose | 📋 Maturity | Records of Processing Activities | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| DPDP-2 Privacy Notice | 📋 Maturity | Public privacy notice | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| DPDP-3 Consent Management | 📋 Maturity | Consent platform | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| DPDP-4 Data Accuracy | 📋 Maturity | Reconciliation jobs | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| DPDP-5 Data Retention | 📋 Maturity | Lifecycle + retention policy | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| DPDP-6 Security Safeguards | ⚡ Custom Logic | Encryption-at-rest + TLS-in-transit posture | Both verifiedIncomplete safeguards |
| DPDP-7 Breach Response | 📋 Maturity | DPB notification runbook | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| DPDP-8 Data Principal Rights | 📋 Maturity | Self-service rights portal | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| DPDP-9 Cross-Border Transfer | ⚡ Custom Logic | Cloud region metadata | Region knownRegion unavailable |
| DPDP-10 Children's Data | 📋 Maturity | Age-gating + parental consent | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
CIS Kubernetes Benchmark v1.9
7 controls · 5 infra checks · 0 maturity-based| Control | What It Checks | Infrastructure Signal | Verdict Logic |
|---|---|---|---|
| CIS-K8S-5.1.1 Cluster-admin minimised | 🔑 IAM & Access | ClusterRoleBinding subjects + non_system_subject_count attributes from live watcher | No non-system subject bound to cluster-adminBroad CRBs detectedNo K8s cluster |
| CIS-K8S-5.1.5 Default SA tokens not auto-mounted | 🔑 IAM & Access | ServiceAccount.AutomountServiceAccountToken posture attribute | default SA tokens disabledDefault SAs auto-mount tokensNo K8s cluster |
| CIS-K8S-5.2.1 Privileged containers minimised | 🔧 Infrastructure | Pod priv_count attribute (containers[].securityContext.privileged) | No privileged PodsPrivileged Pods detectedNo K8s cluster |
| CIS-K8S-5.2.4 hostNetwork minimised | 🔧 Infrastructure | Pod host_network posture attribute | No hostNetwork PodshostNetwork Pods detectedNo K8s cluster |
| CIS-K8S-5.2.5 hostPID minimised | 🔧 Infrastructure | Pod host_pid posture attribute | No hostPID PodshostPID Pods detectedNo K8s cluster |
| CIS-K8S-5.3.2 NetworkPolicy on every namespace | 🔧 Infrastructure | Live correlation of K8S_NAMESPACE × K8S_NETWORKPOLICY assets | Every namespace coveredNamespaces without NetPol detectedNo K8s cluster |
| CIS-K8S-5.7.3 runAsNonRoot enforced | 🔧 Infrastructure | Pod runasnonroot_count vs container_count posture | runAsNonRoot on every containerContainers running as rootNo K8s cluster |
Pod Security Standards
3 controls · 0 infra checks · 0 maturity-based| Control | What It Checks | Infrastructure Signal | Verdict Logic |
|---|---|---|---|
| PSS-Privileged Privileged tier | ⚡ Custom Logic | Always informational — unrestricted policy in effect | Privileged tier acknowledged (low severity)No K8s cluster |
| PSS-Baseline Baseline tier | ⚡ Custom Logic | Aggregate priv_count + host_network + host_pid violations | Baseline policies satisfiedBaseline violations: priv/hostNet/hostPIDNo K8s cluster |
| PSS-Restricted Restricted tier | ⚡ Custom Logic | Aggregate Baseline checks + runasnonroot + default-SA automount | Restricted policies satisfiedRestricted violations detectedNo K8s cluster |
AI Workload Compliance
12 controls · 1 infra checks · 3 maturity-based| Control | What It Checks | Infrastructure Signal | Verdict Logic |
|---|---|---|---|
| AIRMF-MAP-1.1 AI System Inventory | ⚡ Custom Logic | Live CRD watch on KServe / Kubeflow / Argo / Ray / Seldon / Run:ai | AI workloads inventoriedNo AI/ML workloads detected |
| AIRMF-MEASURE-2.7 AI Continuous Monitoring | ⚡ Custom Logic | Same inventory signal + ≤30s notify webhook re-scoring SLA | Continuous monitoring activeNo AI/ML workloads detected |
| AIRMF-MANAGE-1.4 AI Cybersecurity Controls | ⚡ Custom Logic | Strict-ZK Secret inventory + customer-managed encryption posture | Strict-ZK Secret scan + BYOK activeNo K8s cluster |
| AIRMF-GOVERN-1.4 AI Acceptable Use Policy | 📋 Maturity | AI usage policy + guardrails (organisational) | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| EU-AIACT-ART9 AI Risk Management | ⚡ Custom Logic | Live AI workload inventory + risk classification | AI risk-mgmt evidence capturedNo AI/ML workloads detected |
| EU-AIACT-ART15 AI Cybersecurity Resilience | ⚡ Custom Logic | Strict-ZK Secret inventory + secret rotation evidence | Cybersecurity controls verifiedNo K8s cluster |
| EU-AIACT-ART16 AI Access Control | 🔑 IAM & Access | K8s broad-CRB detection scoped to AI namespaces | Least-privilege RBAC verifiedBroad CRBs on AI namespaceNo K8s cluster |
| EU-AIACT-ART17 AI Audit Logging | 🔧 Infrastructure | Cloud audit-log presence on AI workload's host cloud | Audit logging enabledAudit logging gapsNo AI workloads or no cloud audit_log asset |
| ISO42001-7.4 AI Management System Documentation | 📋 Maturity | Documented AI management system per ISO/IEC 42001:2023 | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| ISO42001-8.2 AI Workload RBAC | 🔑 IAM & Access | Same K8s broad-RBAC signal — adds ISO 42001 framework dimension | Least-privilege RBACBroad CRBsNo K8s cluster |
| ISO42001-8.4 AI Image Registry Policy | 📋 Maturity | AI workload container images sourced from approved registries | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| MITRE-ATLAS-AML.T0011 Shadow AI Detection | ⚡ Custom Logic | Live CRD watch flags unauthorised KServe / Kubeflow / Ray / Seldon CRDs | AI workloads detected and auditedNo AI/ML workloads detected |
ISMS-P (Korea)
16 controls · 2 infra checks · 11 maturity-based| Control | What It Checks | Infrastructure Signal | Verdict Logic |
|---|---|---|---|
| ISMS-1.1 ISMS Scope & Policy | 📋 Maturity | ISMS scope definition | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| ISMS-1.2 Risk Assessment | 📋 Maturity | Annual risk assessment | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| ISMS-2.1 Security Policy | 📋 Maturity | Information security policy | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| ISMS-2.2 Security Org | 📋 Maturity | Security organisation chart | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| ISMS-2.3 HR Security | 📋 Maturity | Background checks + training | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| ISMS-2.4 Asset Management | ⚡ Custom Logic | Total asset count + type diversity | Assets classifiedNo assets identified |
| ISMS-2.5 Access Control | 🔑 IAM & Access | IAM user + service account count | Verify MFANo IAM |
| ISMS-2.6 Cryptography | 🔧 Infrastructure | KMS, encryption, TLS posture | Crypto controls activeManual review needed |
| ISMS-2.7 Physical Security | 📋 Maturity | Inherited from cloud provider | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| ISMS-2.8 Operations | 📋 Maturity | Operations runbooks | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| ISMS-2.9 Network Security | 🔧 Infrastructure | VPC + firewall rule presence | SegmentedGap detected |
| ISMS-2.10 Secure SDLC | 📋 Maturity | Secure development lifecycle | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| ISMS-P.1 PI Protection Policy | 📋 Maturity | Personal information protection | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| ISMS-P.2 Consent Mgmt | 📋 Maturity | Consent platform | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| ISMS-P.3 Data Lifecycle | 📋 Maturity | Retention + disposal | ≥50 assets + ≥6 types<50 assets or <6 types0 assets |
| ISMS-P.4 Cross-Border Transfer | ⚡ Custom Logic | Cloud region metadata | Region knownRegion unavailable |
📋 How Procedural / Maturity Scoring Works
Organisational controls (code of conduct, incident response, consent management) cannot be fully validated by infrastructure scans alone. Instead, we use your cloud infrastructure footprint as a maturity proxy:
Beyond Documentation — Automated Compliance
EchelonGraph automatically detects compliance violations across your entire cloud infrastructure. 440+ rules running continuously — not just documentation.