compliance_matrix View

The compliance_matrix view provides end-to-end audit traceability from governing corporate policies and regulatory mandates down to technical standards and implementing controls.

---

Visual Projection

Compliance Matrix View detailing regulatory policies, technical standards, controls, and audit compliance statuses

---

Purpose & Target Audience

• Target Audience: Compliance Officers, Internal/External Auditors, Legal & Privacy Teams, GRC Analysts.
• Primary Use Cases:
  • Demonstrating regulatory compliance for SOC 2, ISO 27001, PCI DSS, GDPR, and HIPAA.
  • Tracking control implementation status (Implemented, In Progress, Planned).
  • Identifying unaddressed policy mandates where technical controls are missing.
  • Preparing structured audit evidence for external assessors.

---

Supported Entity Types

Entity Type	Role in Compliance Matrix	Description
policy	Top-Level Mandate	Corporate charters, privacy mandates, and regulatory rules.
standard	Technical Baseline	Industry baselines (NIST, CIS, OWASP, OpenAPI standards).
control	Implemented Safeguard	Technical, physical, and administrative security safeguards.
system, app	In-Scope Workload	Workloads and environments subject to the compliance scope.
environment	In-Scope Enclave	Cloud accounts, VPCs, and physical data centers.

---

Supported Relationships & Verbs

Relationship Verb	Source Entity	Target Entity	Typical Representation
governed_by	All entities	policy, standard	Governance traceability edge
mitigates	control	threat, risk_scenario	Safeguard mitigation link
protects	control	system, app, infra	Safeguard protection link

---

Filtering & Layout Recommendations

• Recommended Layout: Tabular / Matrix or Hierarchical tree.
• Common Predicates:
  • include policy where policy_type == "Privacy": Scope to GDPR/CCPA privacy compliance.
  • include control where implementation_status == "In Progress": Audit gap analysis.

---

Complete DSL Example

views {
    compliance_matrix v_pci_soc2_traceability "PCI DSS & SOC 2 Compliance Matrix" {
        # Select all governance policies, standards, and controls
        include policy where enforcement == "Mandatory"
        include standard
        include control

        # Trace governance links
        include_verb governed_by
        include_verb protects

        # Highlight controls under implementation
        style control where implementation_status == "In Progress" {
            css_class "control-progress-amber"
        }
    }
}