Continuous Compliance

┌─────────────────────────────────────────────────────┐
│                 LAYER 3: REPORTING                   │
│  Executive Dashboards │ Regulatory Reports │ Alerts  │
├─────────────────────────────────────────────────────┤
│               LAYER 2: ANALYSIS                      │
│  Control Scoring │ Trend Analysis │ Risk Correlation │
├─────────────────────────────────────────────────────┤
│             LAYER 1: DATA COLLECTION                 │
│  Automated Tests │ Evidence Harvest │ External Feeds │
└─────────────────────────────────────────────────────┘

control_id: PCC-DSAR-001
control_name: DSAR Response Timeliness
regulation_mapping:
  - GDPR Art. 12(3)
  - CCPA Section 1798.130(a)(2)
  - LGPD Art. 18
domain: Data Subject Rights
test_definition:
  test_type: data_query
  data_source: dsar_management_system
  query: |
    SELECT request_id, received_date, response_date,
           DATEDIFF(day, received_date, COALESCE(response_date, GETDATE())) as days_elapsed,
           jurisdiction, status
    FROM dsar_requests
    WHERE status IN ('open', 'in_progress', 'completed')
      AND received_date >= DATEADD(day, -90, GETDATE())
  pass_criteria:
    - field: days_elapsed
      condition: less_than_or_equal
      value: 30
      filter: "jurisdiction = 'GDPR' AND status != 'completed'"
    - field: days_elapsed
      condition: less_than_or_equal
      value: 45
      filter: "jurisdiction = 'CCPA' AND status != 'completed'"
    - field: days_elapsed
      condition: less_than_or_equal
      value: 30
      filter: "status = 'completed'"
      threshold: 0.95  # 95% of completed requests must meet deadline
  frequency: daily
  alert_threshold: 0.90  # Alert if pass rate drops below 90%
  alert_recipients:
    - privacy-operations@sentinelcompliance.com
    - dpo@sentinelcompliance.com
  evidence_collection:
    - type: query_result
      description: Full DSAR status report with elapsed days
    - type: screenshot
      description: DSAR dashboard showing current queue status

control_id: PCC-ENC-001
control_name: Database Encryption at Rest
test_type: api_check
data_source: aws_rds_api
check:
  api_call: describe_db_instances
  assertion: StorageEncrypted == true
  scope: all_instances
frequency: daily
remediation_automation:
  enabled: true
  action: create_jira_ticket
  priority: high
  assignee: database-team

control_id: PCC-DPA-001
control_name: DPA Currency
test_type: data_query
data_source: contract_management_system
query: |
  SELECT vendor_name, dpa_expiry_date,
         DATEDIFF(day, GETDATE(), dpa_expiry_date) as days_until_expiry
  FROM vendor_contracts
  WHERE contract_type = 'DPA' AND status = 'active'
pass_criteria:
  - field: days_until_expiry
    condition: greater_than
    value: 0
    description: No expired DPAs
alert_rules:
  - condition: days_until_expiry <= 30
    severity: warning
    message: "DPA for {vendor_name} expires in {days_until_expiry} days"
  - condition: days_until_expiry <= 0
    severity: critical
    message: "DPA for {vendor_name} has expired"
frequency: daily

control_id: PCC-TRN-001
control_name: Privacy Training Completion
test_type: api_check
data_source: lms_api
check:
  api_call: get_course_completion
  course_id: PRIV-001-ANNUAL
  assertion: completion_rate >= 0.95
  scope: all_active_employees
frequency: weekly
alert_threshold: 0.90
escalation:
  - level: 1
    condition: completion_rate < 0.95
    action: notify_manager
  - level: 2
    condition: completion_rate < 0.90
    action: notify_cpo
  - level: 3
    condition: completion_rate < 0.80
    action: notify_audit_committee

Alert Triggered
  ↓
Auto-Triage (severity classification, deduplication, correlation)
  ↓
Alert Assigned to Control Owner
  ↓
Control Owner Acknowledges (within SLA)
  ↓
Root Cause Analysis
  ↓
Remediation Plan Documented
  ↓
Remediation Executed
  ↓
Automated Re-Test
  ↓
Pass? → Alert Closed → Evidence Archived
  ↓
Fail? → Escalate → Revised Remediation Plan