novahiz 0.1.0 → 0.2.2

package/skills/senior-secops/scripts/compliance_checker.py

@@ -1,1107 +0,0 @@
-#!/usr/bin/env python3
-"""
-Compliance Checker - Verify security compliance against SOC 2, PCI-DSS, HIPAA, GDPR.
-
-Table of Contents:
-    ComplianceChecker - Main class for compliance verification
-        __init__         - Initialize with target path and framework
-        check()          - Run compliance checks for selected framework
-        check_soc2()     - Check SOC 2 Type II controls
-        check_pci_dss()  - Check PCI-DSS v4.0 requirements
-        check_hipaa()    - Check HIPAA security rule requirements
-        check_gdpr()     - Check GDPR data protection requirements
-        _check_encryption_at_rest() - Verify data encryption
-        _check_access_controls() - Verify access control implementation
-        _check_logging()  - Verify audit logging
-        _check_secrets_management() - Verify secrets handling
-        _calculate_compliance_score() - Calculate overall compliance score
-    main() - CLI entry point
-
-Usage:
-    python compliance_checker.py /path/to/project
-    python compliance_checker.py /path/to/project --framework soc2
-    python compliance_checker.py /path/to/project --framework pci-dss --output report.json
-"""
-
-import os
-import sys
-import json
-import re
-import argparse
-from pathlib import Path
-from typing import Dict, List, Optional, Tuple
-from dataclasses import dataclass, asdict
-from datetime import datetime
-
-
-@dataclass
-class ComplianceControl:
-    """Represents a compliance control check result."""
-    control_id: str
-    framework: str
-    category: str
-    title: str
-    description: str
-    status: str  # passed, failed, warning, not_applicable
-    evidence: List[str]
-    recommendation: str
-    severity: str  # critical, high, medium, low
-
-
-class ComplianceChecker:
-    """Verify security compliance against industry frameworks."""
-
-    FRAMEWORKS = ['soc2', 'pci-dss', 'hipaa', 'gdpr', 'all']
-
-    def __init__(
-        self,
-        target_path: str,
-        framework: str = "all",
-        verbose: bool = False
-    ):
-        """
-        Initialize the compliance checker.
-
-        Args:
-            target_path: Directory to scan
-            framework: Compliance framework to check (soc2, pci-dss, hipaa, gdpr, all)
-            verbose: Enable verbose output
-        """
-        self.target_path = Path(target_path)
-        self.framework = framework.lower()
-        self.verbose = verbose
-        self.controls: List[ComplianceControl] = []
-        self.files_scanned = 0
-
-    def check(self) -> Dict:
-        """
-        Run compliance checks for selected framework.
-
-        Returns:
-            Dict with compliance results
-        """
-        print(f"Compliance Checker - Scanning: {self.target_path}")
-        print(f"Framework: {self.framework.upper()}")
-        print()
-
-        if not self.target_path.exists():
-            return {"status": "error", "message": f"Path not found: {self.target_path}"}
-
-        start_time = datetime.now()
-
-        # Run framework-specific checks
-        if self.framework in ('soc2', 'all'):
-            self.check_soc2()
-        if self.framework in ('pci-dss', 'all'):
-            self.check_pci_dss()
-        if self.framework in ('hipaa', 'all'):
-            self.check_hipaa()
-        if self.framework in ('gdpr', 'all'):
-            self.check_gdpr()
-
-        end_time = datetime.now()
-        scan_duration = (end_time - start_time).total_seconds()
-
-        # Calculate statistics
-        passed = len([c for c in self.controls if c.status == 'passed'])
-        failed = len([c for c in self.controls if c.status == 'failed'])
-        warnings = len([c for c in self.controls if c.status == 'warning'])
-        na = len([c for c in self.controls if c.status == 'not_applicable'])
-
-        compliance_score = self._calculate_compliance_score()
-
-        result = {
-            "status": "completed",
-            "target": str(self.target_path),
-            "framework": self.framework,
-            "scan_duration_seconds": round(scan_duration, 2),
-            "compliance_score": compliance_score,
-            "compliance_level": self._get_compliance_level(compliance_score),
-            "summary": {
-                "passed": passed,
-                "failed": failed,
-                "warnings": warnings,
-                "not_applicable": na,
-                "total": len(self.controls)
-            },
-            "controls": [asdict(c) for c in self.controls]
-        }
-
-        self._print_summary(result)
-
-        return result
-
-    def check_soc2(self):
-        """Check SOC 2 Type II controls."""
-        if self.verbose:
-            print("  Checking SOC 2 Type II controls...")
-
-        # CC1: Control Environment - Access Controls
-        self._check_access_controls_soc2()
-
-        # CC2: Communication and Information
-        self._check_documentation()
-
-        # CC3: Risk Assessment
-        self._check_risk_assessment()
-
-        # CC6: Logical and Physical Access Controls
-        self._check_authentication()
-
-        # CC7: System Operations
-        self._check_logging()
-
-        # CC8: Change Management
-        self._check_change_management()
-
-    def check_pci_dss(self):
-        """Check PCI-DSS v4.0 requirements."""
-        if self.verbose:
-            print("  Checking PCI-DSS v4.0 requirements...")
-
-        # Requirement 3: Protect stored cardholder data
-        self._check_data_encryption()
-
-        # Requirement 4: Encrypt transmission of cardholder data
-        self._check_transmission_encryption()
-
-        # Requirement 6: Develop and maintain secure systems
-        self._check_secure_development()
-
-        # Requirement 8: Identify users and authenticate access
-        self._check_strong_authentication()
-
-        # Requirement 10: Log and monitor all access
-        self._check_audit_logging()
-
-        # Requirement 11: Test security of systems regularly
-        self._check_security_testing()
-
-    def check_hipaa(self):
-        """Check HIPAA security rule requirements."""
-        if self.verbose:
-            print("  Checking HIPAA Security Rule requirements...")
-
-        # 164.312(a)(1): Access Control
-        self._check_hipaa_access_control()
-
-        # 164.312(b): Audit Controls
-        self._check_hipaa_audit()
-
-        # 164.312(c)(1): Integrity Controls
-        self._check_hipaa_integrity()
-
-        # 164.312(d): Person or Entity Authentication
-        self._check_hipaa_authentication()
-
-        # 164.312(e)(1): Transmission Security
-        self._check_hipaa_transmission()
-
-    def check_gdpr(self):
-        """Check GDPR data protection requirements."""
-        if self.verbose:
-            print("  Checking GDPR requirements...")
-
-        # Article 25: Data protection by design
-        self._check_privacy_by_design()
-
-        # Article 32: Security of processing
-        self._check_gdpr_security()
-
-        # Article 33/34: Breach notification
-        self._check_breach_notification()
-
-        # Article 17: Right to erasure
-        self._check_data_deletion()
-
-        # Article 20: Data portability
-        self._check_data_export()
-
-    def _check_access_controls_soc2(self):
-        """SOC 2 CC1/CC6: Check access control implementation."""
-        evidence = []
-        status = 'failed'
-
-        # Look for authentication middleware
-        auth_patterns = [
-            r'authMiddleware',
-            r'requireAuth',
-            r'isAuthenticated',
-            r'@login_required',
-            r'@authenticated',
-            r'passport\.authenticate',
-            r'jwt\.verify',
-            r'verifyToken'
-        ]
-
-        for pattern in auth_patterns:
-            files = self._search_files(pattern)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        # Check for RBAC implementation
-        rbac_patterns = [r'role', r'permission', r'authorize', r'can\(', r'hasRole']
-        for pattern in rbac_patterns:
-            files = self._search_files(pattern)
-            if files:
-                evidence.extend(files[:2])
-                if status == 'failed':
-                    status = 'warning'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='SOC2-CC6.1',
-            framework='SOC 2',
-            category='Logical Access Controls',
-            title='Access Control Implementation',
-            description='Verify authentication and authorization controls are implemented',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Implement authentication middleware and role-based access control (RBAC)',
-            severity='high' if status == 'failed' else 'low'
-        ))
-
-    def _check_documentation(self):
-        """SOC 2 CC2: Check security documentation."""
-        evidence = []
-        status = 'failed'
-
-        doc_files = [
-            'SECURITY.md',
-            'docs/security.md',
-            'CONTRIBUTING.md',
-            'docs/security-policy.md',
-            '.github/SECURITY.md'
-        ]
-
-        for doc in doc_files:
-            doc_path = self.target_path / doc
-            if doc_path.exists():
-                evidence.append(str(doc))
-                status = 'passed' if 'security' in doc.lower() else 'warning'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='SOC2-CC2.1',
-            framework='SOC 2',
-            category='Communication and Information',
-            title='Security Documentation',
-            description='Verify security policies and procedures are documented',
-            status=status,
-            evidence=evidence,
-            recommendation='Create SECURITY.md documenting security policies, incident response, and vulnerability reporting',
-            severity='medium' if status == 'failed' else 'low'
-        ))
-
-    def _check_risk_assessment(self):
-        """SOC 2 CC3: Check risk assessment artifacts."""
-        evidence = []
-        status = 'failed'
-
-        # Look for security scanning configuration
-        scan_configs = [
-            '.snyk',
-            '.github/workflows/security.yml',
-            '.github/workflows/codeql.yml',
-            'trivy.yaml',
-            '.semgrep.yml',
-            'sonar-project.properties'
-        ]
-
-        for config in scan_configs:
-            config_path = self.target_path / config
-            if config_path.exists():
-                evidence.append(str(config))
-                status = 'passed'
-                break
-
-        # Check for dependabot/renovate
-        dep_configs = [
-            '.github/dependabot.yml',
-            'renovate.json',
-            '.github/renovate.json'
-        ]
-
-        for config in dep_configs:
-            config_path = self.target_path / config
-            if config_path.exists():
-                evidence.append(str(config))
-                if status == 'failed':
-                    status = 'warning'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='SOC2-CC3.1',
-            framework='SOC 2',
-            category='Risk Assessment',
-            title='Automated Security Scanning',
-            description='Verify automated vulnerability scanning is configured',
-            status=status,
-            evidence=evidence,
-            recommendation='Configure automated security scanning (Snyk, CodeQL, Trivy) and dependency updates (Dependabot)',
-            severity='high' if status == 'failed' else 'low'
-        ))
-
-    def _check_authentication(self):
-        """SOC 2 CC6: Check authentication strength."""
-        evidence = []
-        status = 'failed'
-
-        # Check for MFA/2FA
-        mfa_patterns = [r'mfa', r'2fa', r'totp', r'authenticator', r'twoFactor']
-        for pattern in mfa_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:2])
-                status = 'passed'
-                break
-
-        # Check for password hashing
-        hash_patterns = [r'bcrypt', r'argon2', r'scrypt', r'pbkdf2']
-        for pattern in hash_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:2])
-                if status == 'failed':
-                    status = 'warning'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='SOC2-CC6.2',
-            framework='SOC 2',
-            category='Authentication',
-            title='Strong Authentication',
-            description='Verify multi-factor authentication and secure password storage',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Implement MFA/2FA and use bcrypt/argon2 for password hashing',
-            severity='critical' if status == 'failed' else 'low'
-        ))
-
-    def _check_logging(self):
-        """SOC 2 CC7: Check audit logging implementation."""
-        evidence = []
-        status = 'failed'
-
-        # Check for logging configuration
-        log_patterns = [
-            r'winston',
-            r'pino',
-            r'bunyan',
-            r'logging\.getLogger',
-            r'log\.info',
-            r'logger\.',
-            r'audit.*log'
-        ]
-
-        for pattern in log_patterns:
-            files = self._search_files(pattern)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        # Check for structured logging
-        struct_patterns = [r'json.*log', r'structured.*log', r'log.*format']
-        for pattern in struct_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:2])
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='SOC2-CC7.1',
-            framework='SOC 2',
-            category='System Operations',
-            title='Audit Logging',
-            description='Verify comprehensive audit logging is implemented',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Implement structured audit logging with security events (auth, access, changes)',
-            severity='high' if status == 'failed' else 'low'
-        ))
-
-    def _check_change_management(self):
-        """SOC 2 CC8: Check change management controls."""
-        evidence = []
-        status = 'failed'
-
-        # Check for CI/CD configuration
-        ci_configs = [
-            '.github/workflows',
-            '.gitlab-ci.yml',
-            'Jenkinsfile',
-            '.circleci/config.yml',
-            'azure-pipelines.yml'
-        ]
-
-        for config in ci_configs:
-            config_path = self.target_path / config
-            if config_path.exists():
-                evidence.append(str(config))
-                status = 'passed'
-                break
-
-        # Check for branch protection indicators
-        branch_patterns = [r'protected.*branch', r'require.*review', r'pull.*request']
-        for pattern in branch_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:2])
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='SOC2-CC8.1',
-            framework='SOC 2',
-            category='Change Management',
-            title='CI/CD and Code Review',
-            description='Verify automated deployment pipeline and code review process',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Implement CI/CD pipeline with required code reviews and branch protection',
-            severity='medium' if status == 'failed' else 'low'
-        ))
-
-    def _check_data_encryption(self):
-        """PCI-DSS Req 3: Check encryption at rest."""
-        evidence = []
-        status = 'failed'
-
-        encryption_patterns = [
-            r'AES',
-            r'encrypt',
-            r'crypto\.createCipher',
-            r'Fernet',
-            r'KMS',
-            r'encryptedField'
-        ]
-
-        for pattern in encryption_patterns:
-            files = self._search_files(pattern)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='PCI-DSS-3.5',
-            framework='PCI-DSS',
-            category='Protect Stored Data',
-            title='Encryption at Rest',
-            description='Verify sensitive data is encrypted at rest',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Implement AES-256 encryption for sensitive data storage using approved libraries',
-            severity='critical' if status == 'failed' else 'low'
-        ))
-
-    def _check_transmission_encryption(self):
-        """PCI-DSS Req 4: Check encryption in transit."""
-        evidence = []
-        status = 'failed'
-
-        tls_patterns = [
-            r'https://',
-            r'TLS',
-            r'SSL',
-            r'secure.*cookie',
-            r'HSTS'
-        ]
-
-        for pattern in tls_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='PCI-DSS-4.1',
-            framework='PCI-DSS',
-            category='Encrypt Transmissions',
-            title='TLS/HTTPS Enforcement',
-            description='Verify TLS 1.2+ is enforced for all transmissions',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Enforce HTTPS with TLS 1.2+, enable HSTS, use secure cookies',
-            severity='critical' if status == 'failed' else 'low'
-        ))
-
-    def _check_secure_development(self):
-        """PCI-DSS Req 6: Check secure development practices."""
-        evidence = []
-        status = 'failed'
-
-        # Check for input validation
-        validation_patterns = [
-            r'validator',
-            r'sanitize',
-            r'escape',
-            r'zod',
-            r'yup',
-            r'joi'
-        ]
-
-        for pattern in validation_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='PCI-DSS-6.5',
-            framework='PCI-DSS',
-            category='Secure Development',
-            title='Input Validation',
-            description='Verify input validation and sanitization is implemented',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Use validation libraries (Joi, Zod, validator.js) for all user input',
-            severity='high' if status == 'failed' else 'low'
-        ))
-
-    def _check_strong_authentication(self):
-        """PCI-DSS Req 8: Check authentication requirements."""
-        evidence = []
-        status = 'failed'
-
-        # Check for session management
-        session_patterns = [
-            r'session.*timeout',
-            r'maxAge',
-            r'expiresIn',
-            r'session.*expire'
-        ]
-
-        for pattern in session_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='PCI-DSS-8.6',
-            framework='PCI-DSS',
-            category='Authentication',
-            title='Session Management',
-            description='Verify session timeout and management controls',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Implement 15-minute session timeout, secure session tokens, and session invalidation on logout',
-            severity='high' if status == 'failed' else 'low'
-        ))
-
-    def _check_audit_logging(self):
-        """PCI-DSS Req 10: Check audit logging."""
-        # Reuse SOC 2 logging check logic
-        evidence = []
-        status = 'failed'
-
-        log_patterns = [r'audit', r'log.*event', r'security.*log']
-        for pattern in log_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='PCI-DSS-10.2',
-            framework='PCI-DSS',
-            category='Logging and Monitoring',
-            title='Security Event Logging',
-            description='Verify security events are logged with sufficient detail',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Log all authentication events, access to cardholder data, and administrative actions',
-            severity='high' if status == 'failed' else 'low'
-        ))
-
-    def _check_security_testing(self):
-        """PCI-DSS Req 11: Check security testing."""
-        evidence = []
-        status = 'failed'
-
-        # Check for test configuration
-        test_patterns = [
-            r'security.*test',
-            r'penetration.*test',
-            r'vulnerability.*scan'
-        ]
-
-        for pattern in test_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        # Check for SAST/DAST configuration
-        sast_configs = ['.snyk', '.semgrep.yml', 'sonar-project.properties']
-        for config in sast_configs:
-            if (self.target_path / config).exists():
-                evidence.append(config)
-                if status == 'failed':
-                    status = 'warning'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='PCI-DSS-11.3',
-            framework='PCI-DSS',
-            category='Security Testing',
-            title='Vulnerability Assessment',
-            description='Verify regular security testing is performed',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Configure SAST/DAST scanning and schedule quarterly penetration tests',
-            severity='high' if status == 'failed' else 'low'
-        ))
-
-    def _check_hipaa_access_control(self):
-        """HIPAA 164.312(a)(1): Access Control."""
-        evidence = []
-        status = 'failed'
-
-        # Check for user identification
-        auth_patterns = [r'user.*id', r'authentication', r'identity']
-        for pattern in auth_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='HIPAA-164.312(a)(1)',
-            framework='HIPAA',
-            category='Access Control',
-            title='Unique User Identification',
-            description='Verify unique user identification for accessing PHI',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Implement unique user accounts with individual credentials for all PHI access',
-            severity='critical' if status == 'failed' else 'low'
-        ))
-
-    def _check_hipaa_audit(self):
-        """HIPAA 164.312(b): Audit Controls."""
-        evidence = []
-        status = 'failed'
-
-        audit_patterns = [r'audit.*trail', r'access.*log', r'phi.*log']
-        for pattern in audit_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='HIPAA-164.312(b)',
-            framework='HIPAA',
-            category='Audit Controls',
-            title='PHI Access Audit Trail',
-            description='Verify audit trails for PHI access are maintained',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Implement comprehensive audit logging for all PHI access with who/what/when/where',
-            severity='critical' if status == 'failed' else 'low'
-        ))
-
-    def _check_hipaa_integrity(self):
-        """HIPAA 164.312(c)(1): Integrity Controls."""
-        evidence = []
-        status = 'failed'
-
-        integrity_patterns = [r'checksum', r'hash', r'signature', r'integrity']
-        for pattern in integrity_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='HIPAA-164.312(c)(1)',
-            framework='HIPAA',
-            category='Integrity',
-            title='Data Integrity Controls',
-            description='Verify mechanisms to protect PHI from improper alteration',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Implement checksums, digital signatures, or hashing for PHI integrity verification',
-            severity='high' if status == 'failed' else 'low'
-        ))
-
-    def _check_hipaa_authentication(self):
-        """HIPAA 164.312(d): Authentication."""
-        evidence = []
-        status = 'failed'
-
-        auth_patterns = [r'mfa', r'two.*factor', r'biometric', r'token.*auth']
-        for pattern in auth_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='HIPAA-164.312(d)',
-            framework='HIPAA',
-            category='Authentication',
-            title='Person Authentication',
-            description='Verify mechanisms to authenticate person or entity accessing PHI',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Implement multi-factor authentication for all PHI access',
-            severity='critical' if status == 'failed' else 'low'
-        ))
-
-    def _check_hipaa_transmission(self):
-        """HIPAA 164.312(e)(1): Transmission Security."""
-        evidence = []
-        status = 'failed'
-
-        transmission_patterns = [r'tls', r'ssl', r'https', r'encrypt.*transit']
-        for pattern in transmission_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='HIPAA-164.312(e)(1)',
-            framework='HIPAA',
-            category='Transmission Security',
-            title='PHI Transmission Encryption',
-            description='Verify PHI is encrypted during transmission',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Enforce TLS 1.2+ for all PHI transmissions, implement end-to-end encryption',
-            severity='critical' if status == 'failed' else 'low'
-        ))
-
-    def _check_privacy_by_design(self):
-        """GDPR Article 25: Privacy by design."""
-        evidence = []
-        status = 'failed'
-
-        privacy_patterns = [
-            r'data.*minimization',
-            r'privacy.*config',
-            r'consent',
-            r'gdpr'
-        ]
-
-        for pattern in privacy_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='GDPR-25',
-            framework='GDPR',
-            category='Privacy by Design',
-            title='Data Minimization',
-            description='Verify data collection is limited to necessary purposes',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Implement data minimization, purpose limitation, and privacy-by-default configurations',
-            severity='high' if status == 'failed' else 'low'
-        ))
-
-    def _check_gdpr_security(self):
-        """GDPR Article 32: Security of processing."""
-        evidence = []
-        status = 'failed'
-
-        security_patterns = [r'encrypt', r'pseudonymization', r'anonymization']
-        for pattern in security_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='GDPR-32',
-            framework='GDPR',
-            category='Security',
-            title='Pseudonymization and Encryption',
-            description='Verify appropriate security measures for personal data',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Implement encryption and pseudonymization for personal data processing',
-            severity='high' if status == 'failed' else 'low'
-        ))
-
-    def _check_breach_notification(self):
-        """GDPR Article 33/34: Breach notification."""
-        evidence = []
-        status = 'failed'
-
-        breach_patterns = [
-            r'breach.*notification',
-            r'incident.*response',
-            r'security.*incident'
-        ]
-
-        for pattern in breach_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        # Check for incident response documentation
-        incident_docs = ['SECURITY.md', 'docs/incident-response.md', '.github/SECURITY.md']
-        for doc in incident_docs:
-            if (self.target_path / doc).exists():
-                evidence.append(doc)
-                if status == 'failed':
-                    status = 'warning'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='GDPR-33',
-            framework='GDPR',
-            category='Breach Notification',
-            title='Incident Response Procedure',
-            description='Verify breach notification procedures are documented',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Document incident response procedures with 72-hour notification capability',
-            severity='high' if status == 'failed' else 'low'
-        ))
-
-    def _check_data_deletion(self):
-        """GDPR Article 17: Right to erasure."""
-        evidence = []
-        status = 'failed'
-
-        deletion_patterns = [
-            r'delete.*user',
-            r'erasure',
-            r'right.*forgotten',
-            r'data.*deletion',
-            r'gdpr.*delete'
-        ]
-
-        for pattern in deletion_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='GDPR-17',
-            framework='GDPR',
-            category='Data Subject Rights',
-            title='Right to Erasure',
-            description='Verify data deletion capability is implemented',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Implement complete user data deletion including all backups and third-party systems',
-            severity='high' if status == 'failed' else 'low'
-        ))
-
-    def _check_data_export(self):
-        """GDPR Article 20: Data portability."""
-        evidence = []
-        status = 'failed'
-
-        export_patterns = [
-            r'export.*data',
-            r'data.*portability',
-            r'download.*data',
-            r'gdpr.*export'
-        ]
-
-        for pattern in export_patterns:
-            files = self._search_files(pattern, case_sensitive=False)
-            if files:
-                evidence.extend(files[:3])
-                status = 'passed'
-                break
-
-        self.controls.append(ComplianceControl(
-            control_id='GDPR-20',
-            framework='GDPR',
-            category='Data Subject Rights',
-            title='Data Portability',
-            description='Verify data export capability is implemented',
-            status=status,
-            evidence=evidence[:5],
-            recommendation='Implement data export in machine-readable format (JSON, CSV)',
-            severity='medium' if status == 'failed' else 'low'
-        ))
-
-    def _search_files(self, pattern: str, case_sensitive: bool = True) -> List[str]:
-        """Search files for pattern matches."""
-        matches = []
-        flags = 0 if case_sensitive else re.IGNORECASE
-
-        try:
-            for root, dirs, files in os.walk(self.target_path):
-                # Skip common non-relevant directories
-                dirs[:] = [d for d in dirs if d not in {
-                    'node_modules', '.git', '__pycache__', 'venv', '.venv',
-                    'dist', 'build', 'coverage', '.next'
-                }]
-
-                for filename in files:
-                    if filename.endswith(('.js', '.ts', '.py', '.go', '.java', '.md', '.yml', '.yaml', '.json')):
-                        file_path = Path(root) / filename
-                        try:
-                            content = file_path.read_text(encoding='utf-8', errors='ignore')
-                            if re.search(pattern, content, flags):
-                                rel_path = str(file_path.relative_to(self.target_path))
-                                matches.append(rel_path)
-                                self.files_scanned += 1
-                        except Exception:
-                            pass
-        except Exception:
-            pass
-
-        return matches[:10]  # Limit results
-
-    def _calculate_compliance_score(self) -> float:
-        """Calculate overall compliance score (0-100)."""
-        if not self.controls:
-            return 0.0
-
-        # Weight by severity
-        severity_weights = {'critical': 4.0, 'high': 3.0, 'medium': 2.0, 'low': 1.0}
-        status_scores = {'passed': 1.0, 'warning': 0.5, 'failed': 0.0, 'not_applicable': None}
-
-        total_weight = 0.0
-        total_score = 0.0
-
-        for control in self.controls:
-            score = status_scores.get(control.status)
-            if score is not None:  # Skip N/A
-                weight = severity_weights.get(control.severity, 1.0)
-                total_weight += weight
-                total_score += score * weight
-
-        return round((total_score / total_weight) * 100, 1) if total_weight > 0 else 0.0
-
-    def _get_compliance_level(self, score: float) -> str:
-        """Get compliance level from score."""
-        if score >= 90:
-            return "COMPLIANT"
-        elif score >= 70:
-            return "PARTIALLY_COMPLIANT"
-        elif score >= 50:
-            return "NON_COMPLIANT"
-        return "CRITICAL_GAPS"
-
-    def _print_summary(self, result: Dict):
-        """Print compliance summary."""
-        print("\n" + "=" * 60)
-        print("COMPLIANCE CHECK SUMMARY")
-        print("=" * 60)
-        print(f"Target: {result['target']}")
-        print(f"Framework: {result['framework'].upper()}")
-        print(f"Scan duration: {result['scan_duration_seconds']}s")
-        print(f"Compliance score: {result['compliance_score']}% ({result['compliance_level']})")
-        print()
-
-        summary = result['summary']
-        print(f"Controls checked: {summary['total']}")
-        print(f"  Passed:  {summary['passed']}")
-        print(f"  Failed:  {summary['failed']}")
-        print(f"  Warning: {summary['warnings']}")
-        print(f"  N/A:     {summary['not_applicable']}")
-        print("=" * 60)
-
-        # Show failed controls
-        failed = [c for c in result['controls'] if c['status'] == 'failed']
-        if failed:
-            print("\nFailed controls requiring remediation:")
-            for control in failed[:5]:
-                print(f"\n  [{control['severity'].upper()}] {control['control_id']}")
-                print(f"  {control['title']}")
-                print(f"  Recommendation: {control['recommendation']}")
-
-
-def main():
-    """Main entry point for CLI."""
-    parser = argparse.ArgumentParser(
-        description="Check compliance against SOC 2, PCI-DSS, HIPAA, GDPR",
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-        epilog="""
-Examples:
-  %(prog)s /path/to/project
-  %(prog)s /path/to/project --framework soc2
-  %(prog)s /path/to/project --framework pci-dss --output report.json
-  %(prog)s . --framework all --verbose
-        """
-    )
-
-    parser.add_argument(
-        "target",
-        help="Directory to check for compliance"
-    )
-    parser.add_argument(
-        "--framework", "-f",
-        choices=["soc2", "pci-dss", "hipaa", "gdpr", "all"],
-        default="all",
-        help="Compliance framework to check (default: all)"
-    )
-    parser.add_argument(
-        "--verbose", "-v",
-        action="store_true",
-        help="Enable verbose output"
-    )
-    parser.add_argument(
-        "--json",
-        action="store_true",
-        help="Output results as JSON"
-    )
-    parser.add_argument(
-        "--output", "-o",
-        help="Output file path"
-    )
-
-    args = parser.parse_args()
-
-    checker = ComplianceChecker(
-        target_path=args.target,
-        framework=args.framework,
-        verbose=args.verbose
-    )
-
-    result = checker.check()
-
-    if args.json:
-        output = json.dumps(result, indent=2)
-        if args.output:
-            with open(args.output, 'w') as f:
-                f.write(output)
-            print(f"\nResults written to {args.output}")
-        else:
-            print(output)
-    elif args.output:
-        with open(args.output, 'w') as f:
-            json.dump(result, f, indent=2)
-        print(f"\nResults written to {args.output}")
-
-    # Exit with error code based on compliance level
-    if result.get('compliance_level') == 'CRITICAL_GAPS':
-        sys.exit(2)
-    if result.get('compliance_level') == 'NON_COMPLIANT':
-        sys.exit(1)
-
-
-if __name__ == "__main__":
-    main()