Compliance audit trail automation.

Every captured event mapped to the controls it serves as evidence for — a single event often serves multiple controls across multiple frameworks. A laptop encryption check serves SOC 2 CC6.7 (logical access), ISO 27001 A.8.24 (use of cryptography), HIPAA §164.312(a)(2)(iv) (encryption), and GDPR Art 32 (security of processing). One captured event becomes evidence for all four. Mapping table version-controlled and reviewed quarterly; framework updates propagate without re-instrumenting capture.

Trust Services Criteria — Security (CC), Availability (A), Confidentiality (C), Processing Integrity (PI), Privacy (P). Each criterion has multiple controls; each control needs continuous evidence across the audit period (typically 12 months for Type II). Access reviews, change management, incident response, vendor management, employee onboarding/offboarding all generate the recurring evidence types. Continuous capture means Type II evidence is already collected when audit begins, not constructed retroactively.

Auditor-facing portal where the audit firm pulls sampled evidence directly. Auditor requests 'show me 25 production access provisioning events with approval evidence from Q2' — system returns 25 randomly-sampled events with the underlying ticket, approver email, and access grant log already attached. Replaces the typical email-thread-and-screenshot-collection scramble. Sampling methodology documented; auditor confirms randomness; the integrity of the audit isn't compromised by the automation.

Information Security Management System (ISMS) requires documented evidence of management commitment, risk assessment cycles, control selection rationale, and continuous improvement. Annex A's 93 controls (post-2022 update) cross-walk significantly with SOC 2 — the same captured events serve both. ISO-specific evidence: management review minutes, internal audit reports, corrective action tracking, statement of applicability with rationale per control. Continuous capture means recertification audits don't require re-running the entire ISMS from scratch.

3-year certification cycle with annual surveillance audits. System auto-generates surveillance audit packs — control-by-control evidence for the past year, management review records, internal audit reports, corrective actions. Recertification (year 3) gets the full ISMS evidence pack. Pre-audit gap analysis runs continuously: every control has a freshness indicator showing when it was last evidenced; controls without recent evidence flag for review before the auditor finds them.

Healthcare workloads require evidence of HIPAA Privacy Rule (acceptable use of PHI), Security Rule (administrative + physical + technical safeguards), and Breach Notification Rule. Business Associate Agreements with every vendor touching PHI tracked + their compliance attestations stored. PHI access logging mandatory — every read of a record with PHI logged with actor + purpose + timestamp. Risk analysis documented + updated annually + after material system changes. Penalties for HIPAA gaps are severe; continuous evidence is the only defensible posture.

Breach detection + notification workflow auto-instrumented. Suspected breach event triggers: severity classification per HIPAA criteria, notification timer (60 days to affected individuals + HHS for breaches affecting 500+), forensic evidence capture, BAA partner notification, communication template generation. The first 4 hours of a breach matter; automation handles the documentation while humans handle the decisions. Audit trail of every breach decision documented for OCR review (HHS Office for Civil Rights, the audit body).

Privacy regulations (GDPR, CCPA, state laws) require evidence of: lawful basis per processing activity (Records of Processing Activities — ROPA), Data Processing Agreements with every processor, data subject access rights handling (DSAR — access, deletion, portability, correction), data transfer mechanisms for cross-border (Standard Contractual Clauses, adequacy decisions), Data Protection Impact Assessments for high-risk processing. Each captured at the operational layer where decisions get made, not retroactively reconstructed.

Data subject requests (DSARs) have hard SLAs — 30 days under GDPR, 45 under CCPA, with extensions only in narrow circumstances. Automated DSAR pipeline: identity verification, scope definition (which data systems contain this person's data), extraction across systems, redaction of third-party data, delivery in machine-readable format. Audit trail of every DSAR documented — request received, identity verified, systems queried, data exported, delivered. Regulator audits look at DSAR handling specifically; automated handling produces defensible records.

Every framework's controls have current evidence. Pre-audit dashboard shows green across the control matrix; compliance team enters audit prep mode (calendar coordination, auditor onboarding, scope confirmation) instead of evidence-collection scramble mode. Customer security questionnaires answered from the evidence vault directly — 'are you SOC 2 Type II certified?' returns the current attestation with the audit period and clean status. Sales team responds to security questionnaires in hours instead of weeks.

Gap detected — control without recent evidence, BAA expired, DSAR overdue, access review missed, vendor missing SOC 2 attestation, etc. Surfaced with specific control + framework + remediation action + named owner + SLA. Compliance team triages; gap routed to the team that owns the underlying control (engineering for technical controls, HR for training controls, procurement for vendor controls). Remediation tracked through completion; closure logged with new evidence captured.

Gap patterns aggregated to the risk register. Recurring gaps in the same control = control design issue, not execution issue; needs redesign rather than more reminders. Quarterly review with security + compliance + executive: which controls keep failing? What's the structural fix? Risk register feeds the annual control-program planning cycle. Trend data (gap rate by control over 12 months) is the strongest signal for which controls warrant investment.