novahiz 0.1.0

package/skills/senior-secops/scripts/compliance_checker.py

@@ -0,0 +1,1107 @@
+#!/usr/bin/env python3
+"""
+Compliance Checker - Verify security compliance against SOC 2, PCI-DSS, HIPAA, GDPR.
+
+Table of Contents:
+    ComplianceChecker - Main class for compliance verification
+        __init__         - Initialize with target path and framework
+        check()          - Run compliance checks for selected framework
+        check_soc2()     - Check SOC 2 Type II controls
+        check_pci_dss()  - Check PCI-DSS v4.0 requirements
+        check_hipaa()    - Check HIPAA security rule requirements
+        check_gdpr()     - Check GDPR data protection requirements
+        _check_encryption_at_rest() - Verify data encryption
+        _check_access_controls() - Verify access control implementation
+        _check_logging()  - Verify audit logging
+        _check_secrets_management() - Verify secrets handling
+        _calculate_compliance_score() - Calculate overall compliance score
+    main() - CLI entry point
+
+Usage:
+    python compliance_checker.py /path/to/project
+    python compliance_checker.py /path/to/project --framework soc2
+    python compliance_checker.py /path/to/project --framework pci-dss --output report.json
+"""
+
+import os
+import sys
+import json
+import re
+import argparse
+from pathlib import Path
+from typing import Dict, List, Optional, Tuple
+from dataclasses import dataclass, asdict
+from datetime import datetime
+
+
+@dataclass
+class ComplianceControl:
+    """Represents a compliance control check result."""
+    control_id: str
+    framework: str
+    category: str
+    title: str
+    description: str
+    status: str  # passed, failed, warning, not_applicable
+    evidence: List[str]
+    recommendation: str
+    severity: str  # critical, high, medium, low
+
+
+class ComplianceChecker:
+    """Verify security compliance against industry frameworks."""
+
+    FRAMEWORKS = ['soc2', 'pci-dss', 'hipaa', 'gdpr', 'all']
+
+    def __init__(
+        self,
+        target_path: str,
+        framework: str = "all",
+        verbose: bool = False
+    ):
+        """
+        Initialize the compliance checker.
+
+        Args:
+            target_path: Directory to scan
+            framework: Compliance framework to check (soc2, pci-dss, hipaa, gdpr, all)
+            verbose: Enable verbose output
+        """
+        self.target_path = Path(target_path)
+        self.framework = framework.lower()
+        self.verbose = verbose
+        self.controls: List[ComplianceControl] = []
+        self.files_scanned = 0
+
+    def check(self) -> Dict:
+        """
+        Run compliance checks for selected framework.
+
+        Returns:
+            Dict with compliance results
+        """
+        print(f"Compliance Checker - Scanning: {self.target_path}")
+        print(f"Framework: {self.framework.upper()}")
+        print()
+
+        if not self.target_path.exists():
+            return {"status": "error", "message": f"Path not found: {self.target_path}"}
+
+        start_time = datetime.now()
+
+        # Run framework-specific checks
+        if self.framework in ('soc2', 'all'):
+            self.check_soc2()
+        if self.framework in ('pci-dss', 'all'):
+            self.check_pci_dss()
+        if self.framework in ('hipaa', 'all'):
+            self.check_hipaa()
+        if self.framework in ('gdpr', 'all'):
+            self.check_gdpr()
+
+        end_time = datetime.now()
+        scan_duration = (end_time - start_time).total_seconds()
+
+        # Calculate statistics
+        passed = len([c for c in self.controls if c.status == 'passed'])
+        failed = len([c for c in self.controls if c.status == 'failed'])
+        warnings = len([c for c in self.controls if c.status == 'warning'])
+        na = len([c for c in self.controls if c.status == 'not_applicable'])
+
+        compliance_score = self._calculate_compliance_score()
+
+        result = {
+            "status": "completed",
+            "target": str(self.target_path),
+            "framework": self.framework,
+            "scan_duration_seconds": round(scan_duration, 2),
+            "compliance_score": compliance_score,
+            "compliance_level": self._get_compliance_level(compliance_score),
+            "summary": {
+                "passed": passed,
+                "failed": failed,
+                "warnings": warnings,
+                "not_applicable": na,
+                "total": len(self.controls)
+            },
+            "controls": [asdict(c) for c in self.controls]
+        }
+
+        self._print_summary(result)
+
+        return result
+
+    def check_soc2(self):
+        """Check SOC 2 Type II controls."""
+        if self.verbose:
+            print("  Checking SOC 2 Type II controls...")
+
+        # CC1: Control Environment - Access Controls
+        self._check_access_controls_soc2()
+
+        # CC2: Communication and Information
+        self._check_documentation()
+
+        # CC3: Risk Assessment
+        self._check_risk_assessment()
+
+        # CC6: Logical and Physical Access Controls
+        self._check_authentication()
+
+        # CC7: System Operations
+        self._check_logging()
+
+        # CC8: Change Management
+        self._check_change_management()
+
+    def check_pci_dss(self):
+        """Check PCI-DSS v4.0 requirements."""
+        if self.verbose:
+            print("  Checking PCI-DSS v4.0 requirements...")
+
+        # Requirement 3: Protect stored cardholder data
+        self._check_data_encryption()
+
+        # Requirement 4: Encrypt transmission of cardholder data
+        self._check_transmission_encryption()
+
+        # Requirement 6: Develop and maintain secure systems
+        self._check_secure_development()
+
+        # Requirement 8: Identify users and authenticate access
+        self._check_strong_authentication()
+
+        # Requirement 10: Log and monitor all access
+        self._check_audit_logging()
+
+        # Requirement 11: Test security of systems regularly
+        self._check_security_testing()
+
+    def check_hipaa(self):
+        """Check HIPAA security rule requirements."""
+        if self.verbose:
+            print("  Checking HIPAA Security Rule requirements...")
+
+        # 164.312(a)(1): Access Control
+        self._check_hipaa_access_control()
+
+        # 164.312(b): Audit Controls
+        self._check_hipaa_audit()
+
+        # 164.312(c)(1): Integrity Controls
+        self._check_hipaa_integrity()
+
+        # 164.312(d): Person or Entity Authentication
+        self._check_hipaa_authentication()
+
+        # 164.312(e)(1): Transmission Security
+        self._check_hipaa_transmission()
+
+    def check_gdpr(self):
+        """Check GDPR data protection requirements."""
+        if self.verbose:
+            print("  Checking GDPR requirements...")
+
+        # Article 25: Data protection by design
+        self._check_privacy_by_design()
+
+        # Article 32: Security of processing
+        self._check_gdpr_security()
+
+        # Article 33/34: Breach notification
+        self._check_breach_notification()
+
+        # Article 17: Right to erasure
+        self._check_data_deletion()
+
+        # Article 20: Data portability
+        self._check_data_export()
+
+    def _check_access_controls_soc2(self):
+        """SOC 2 CC1/CC6: Check access control implementation."""
+        evidence = []
+        status = 'failed'
+
+        # Look for authentication middleware
+        auth_patterns = [
+            r'authMiddleware',
+            r'requireAuth',
+            r'isAuthenticated',
+            r'@login_required',
+            r'@authenticated',
+            r'passport\.authenticate',
+            r'jwt\.verify',
+            r'verifyToken'
+        ]
+
+        for pattern in auth_patterns:
+            files = self._search_files(pattern)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        # Check for RBAC implementation
+        rbac_patterns = [r'role', r'permission', r'authorize', r'can\(', r'hasRole']
+        for pattern in rbac_patterns:
+            files = self._search_files(pattern)
+            if files:
+                evidence.extend(files[:2])
+                if status == 'failed':
+                    status = 'warning'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='SOC2-CC6.1',
+            framework='SOC 2',
+            category='Logical Access Controls',
+            title='Access Control Implementation',
+            description='Verify authentication and authorization controls are implemented',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Implement authentication middleware and role-based access control (RBAC)',
+            severity='high' if status == 'failed' else 'low'
+        ))
+
+    def _check_documentation(self):
+        """SOC 2 CC2: Check security documentation."""
+        evidence = []
+        status = 'failed'
+
+        doc_files = [
+            'SECURITY.md',
+            'docs/security.md',
+            'CONTRIBUTING.md',
+            'docs/security-policy.md',
+            '.github/SECURITY.md'
+        ]
+
+        for doc in doc_files:
+            doc_path = self.target_path / doc
+            if doc_path.exists():
+                evidence.append(str(doc))
+                status = 'passed' if 'security' in doc.lower() else 'warning'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='SOC2-CC2.1',
+            framework='SOC 2',
+            category='Communication and Information',
+            title='Security Documentation',
+            description='Verify security policies and procedures are documented',
+            status=status,
+            evidence=evidence,
+            recommendation='Create SECURITY.md documenting security policies, incident response, and vulnerability reporting',
+            severity='medium' if status == 'failed' else 'low'
+        ))
+
+    def _check_risk_assessment(self):
+        """SOC 2 CC3: Check risk assessment artifacts."""
+        evidence = []
+        status = 'failed'
+
+        # Look for security scanning configuration
+        scan_configs = [
+            '.snyk',
+            '.github/workflows/security.yml',
+            '.github/workflows/codeql.yml',
+            'trivy.yaml',
+            '.semgrep.yml',
+            'sonar-project.properties'
+        ]
+
+        for config in scan_configs:
+            config_path = self.target_path / config
+            if config_path.exists():
+                evidence.append(str(config))
+                status = 'passed'
+                break
+
+        # Check for dependabot/renovate
+        dep_configs = [
+            '.github/dependabot.yml',
+            'renovate.json',
+            '.github/renovate.json'
+        ]
+
+        for config in dep_configs:
+            config_path = self.target_path / config
+            if config_path.exists():
+                evidence.append(str(config))
+                if status == 'failed':
+                    status = 'warning'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='SOC2-CC3.1',
+            framework='SOC 2',
+            category='Risk Assessment',
+            title='Automated Security Scanning',
+            description='Verify automated vulnerability scanning is configured',
+            status=status,
+            evidence=evidence,
+            recommendation='Configure automated security scanning (Snyk, CodeQL, Trivy) and dependency updates (Dependabot)',
+            severity='high' if status == 'failed' else 'low'
+        ))
+
+    def _check_authentication(self):
+        """SOC 2 CC6: Check authentication strength."""
+        evidence = []
+        status = 'failed'
+
+        # Check for MFA/2FA
+        mfa_patterns = [r'mfa', r'2fa', r'totp', r'authenticator', r'twoFactor']
+        for pattern in mfa_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:2])
+                status = 'passed'
+                break
+
+        # Check for password hashing
+        hash_patterns = [r'bcrypt', r'argon2', r'scrypt', r'pbkdf2']
+        for pattern in hash_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:2])
+                if status == 'failed':
+                    status = 'warning'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='SOC2-CC6.2',
+            framework='SOC 2',
+            category='Authentication',
+            title='Strong Authentication',
+            description='Verify multi-factor authentication and secure password storage',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Implement MFA/2FA and use bcrypt/argon2 for password hashing',
+            severity='critical' if status == 'failed' else 'low'
+        ))
+
+    def _check_logging(self):
+        """SOC 2 CC7: Check audit logging implementation."""
+        evidence = []
+        status = 'failed'
+
+        # Check for logging configuration
+        log_patterns = [
+            r'winston',
+            r'pino',
+            r'bunyan',
+            r'logging\.getLogger',
+            r'log\.info',
+            r'logger\.',
+            r'audit.*log'
+        ]
+
+        for pattern in log_patterns:
+            files = self._search_files(pattern)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        # Check for structured logging
+        struct_patterns = [r'json.*log', r'structured.*log', r'log.*format']
+        for pattern in struct_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:2])
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='SOC2-CC7.1',
+            framework='SOC 2',
+            category='System Operations',
+            title='Audit Logging',
+            description='Verify comprehensive audit logging is implemented',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Implement structured audit logging with security events (auth, access, changes)',
+            severity='high' if status == 'failed' else 'low'
+        ))
+
+    def _check_change_management(self):
+        """SOC 2 CC8: Check change management controls."""
+        evidence = []
+        status = 'failed'
+
+        # Check for CI/CD configuration
+        ci_configs = [
+            '.github/workflows',
+            '.gitlab-ci.yml',
+            'Jenkinsfile',
+            '.circleci/config.yml',
+            'azure-pipelines.yml'
+        ]
+
+        for config in ci_configs:
+            config_path = self.target_path / config
+            if config_path.exists():
+                evidence.append(str(config))
+                status = 'passed'
+                break
+
+        # Check for branch protection indicators
+        branch_patterns = [r'protected.*branch', r'require.*review', r'pull.*request']
+        for pattern in branch_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:2])
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='SOC2-CC8.1',
+            framework='SOC 2',
+            category='Change Management',
+            title='CI/CD and Code Review',
+            description='Verify automated deployment pipeline and code review process',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Implement CI/CD pipeline with required code reviews and branch protection',
+            severity='medium' if status == 'failed' else 'low'
+        ))
+
+    def _check_data_encryption(self):
+        """PCI-DSS Req 3: Check encryption at rest."""
+        evidence = []
+        status = 'failed'
+
+        encryption_patterns = [
+            r'AES',
+            r'encrypt',
+            r'crypto\.createCipher',
+            r'Fernet',
+            r'KMS',
+            r'encryptedField'
+        ]
+
+        for pattern in encryption_patterns:
+            files = self._search_files(pattern)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='PCI-DSS-3.5',
+            framework='PCI-DSS',
+            category='Protect Stored Data',
+            title='Encryption at Rest',
+            description='Verify sensitive data is encrypted at rest',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Implement AES-256 encryption for sensitive data storage using approved libraries',
+            severity='critical' if status == 'failed' else 'low'
+        ))
+
+    def _check_transmission_encryption(self):
+        """PCI-DSS Req 4: Check encryption in transit."""
+        evidence = []
+        status = 'failed'
+
+        tls_patterns = [
+            r'https://',
+            r'TLS',
+            r'SSL',
+            r'secure.*cookie',
+            r'HSTS'
+        ]
+
+        for pattern in tls_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='PCI-DSS-4.1',
+            framework='PCI-DSS',
+            category='Encrypt Transmissions',
+            title='TLS/HTTPS Enforcement',
+            description='Verify TLS 1.2+ is enforced for all transmissions',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Enforce HTTPS with TLS 1.2+, enable HSTS, use secure cookies',
+            severity='critical' if status == 'failed' else 'low'
+        ))
+
+    def _check_secure_development(self):
+        """PCI-DSS Req 6: Check secure development practices."""
+        evidence = []
+        status = 'failed'
+
+        # Check for input validation
+        validation_patterns = [
+            r'validator',
+            r'sanitize',
+            r'escape',
+            r'zod',
+            r'yup',
+            r'joi'
+        ]
+
+        for pattern in validation_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='PCI-DSS-6.5',
+            framework='PCI-DSS',
+            category='Secure Development',
+            title='Input Validation',
+            description='Verify input validation and sanitization is implemented',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Use validation libraries (Joi, Zod, validator.js) for all user input',
+            severity='high' if status == 'failed' else 'low'
+        ))
+
+    def _check_strong_authentication(self):
+        """PCI-DSS Req 8: Check authentication requirements."""
+        evidence = []
+        status = 'failed'
+
+        # Check for session management
+        session_patterns = [
+            r'session.*timeout',
+            r'maxAge',
+            r'expiresIn',
+            r'session.*expire'
+        ]
+
+        for pattern in session_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='PCI-DSS-8.6',
+            framework='PCI-DSS',
+            category='Authentication',
+            title='Session Management',
+            description='Verify session timeout and management controls',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Implement 15-minute session timeout, secure session tokens, and session invalidation on logout',
+            severity='high' if status == 'failed' else 'low'
+        ))
+
+    def _check_audit_logging(self):
+        """PCI-DSS Req 10: Check audit logging."""
+        # Reuse SOC 2 logging check logic
+        evidence = []
+        status = 'failed'
+
+        log_patterns = [r'audit', r'log.*event', r'security.*log']
+        for pattern in log_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='PCI-DSS-10.2',
+            framework='PCI-DSS',
+            category='Logging and Monitoring',
+            title='Security Event Logging',
+            description='Verify security events are logged with sufficient detail',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Log all authentication events, access to cardholder data, and administrative actions',
+            severity='high' if status == 'failed' else 'low'
+        ))
+
+    def _check_security_testing(self):
+        """PCI-DSS Req 11: Check security testing."""
+        evidence = []
+        status = 'failed'
+
+        # Check for test configuration
+        test_patterns = [
+            r'security.*test',
+            r'penetration.*test',
+            r'vulnerability.*scan'
+        ]
+
+        for pattern in test_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        # Check for SAST/DAST configuration
+        sast_configs = ['.snyk', '.semgrep.yml', 'sonar-project.properties']
+        for config in sast_configs:
+            if (self.target_path / config).exists():
+                evidence.append(config)
+                if status == 'failed':
+                    status = 'warning'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='PCI-DSS-11.3',
+            framework='PCI-DSS',
+            category='Security Testing',
+            title='Vulnerability Assessment',
+            description='Verify regular security testing is performed',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Configure SAST/DAST scanning and schedule quarterly penetration tests',
+            severity='high' if status == 'failed' else 'low'
+        ))
+
+    def _check_hipaa_access_control(self):
+        """HIPAA 164.312(a)(1): Access Control."""
+        evidence = []
+        status = 'failed'
+
+        # Check for user identification
+        auth_patterns = [r'user.*id', r'authentication', r'identity']
+        for pattern in auth_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='HIPAA-164.312(a)(1)',
+            framework='HIPAA',
+            category='Access Control',
+            title='Unique User Identification',
+            description='Verify unique user identification for accessing PHI',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Implement unique user accounts with individual credentials for all PHI access',
+            severity='critical' if status == 'failed' else 'low'
+        ))
+
+    def _check_hipaa_audit(self):
+        """HIPAA 164.312(b): Audit Controls."""
+        evidence = []
+        status = 'failed'
+
+        audit_patterns = [r'audit.*trail', r'access.*log', r'phi.*log']
+        for pattern in audit_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='HIPAA-164.312(b)',
+            framework='HIPAA',
+            category='Audit Controls',
+            title='PHI Access Audit Trail',
+            description='Verify audit trails for PHI access are maintained',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Implement comprehensive audit logging for all PHI access with who/what/when/where',
+            severity='critical' if status == 'failed' else 'low'
+        ))
+
+    def _check_hipaa_integrity(self):
+        """HIPAA 164.312(c)(1): Integrity Controls."""
+        evidence = []
+        status = 'failed'
+
+        integrity_patterns = [r'checksum', r'hash', r'signature', r'integrity']
+        for pattern in integrity_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='HIPAA-164.312(c)(1)',
+            framework='HIPAA',
+            category='Integrity',
+            title='Data Integrity Controls',
+            description='Verify mechanisms to protect PHI from improper alteration',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Implement checksums, digital signatures, or hashing for PHI integrity verification',
+            severity='high' if status == 'failed' else 'low'
+        ))
+
+    def _check_hipaa_authentication(self):
+        """HIPAA 164.312(d): Authentication."""
+        evidence = []
+        status = 'failed'
+
+        auth_patterns = [r'mfa', r'two.*factor', r'biometric', r'token.*auth']
+        for pattern in auth_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='HIPAA-164.312(d)',
+            framework='HIPAA',
+            category='Authentication',
+            title='Person Authentication',
+            description='Verify mechanisms to authenticate person or entity accessing PHI',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Implement multi-factor authentication for all PHI access',
+            severity='critical' if status == 'failed' else 'low'
+        ))
+
+    def _check_hipaa_transmission(self):
+        """HIPAA 164.312(e)(1): Transmission Security."""
+        evidence = []
+        status = 'failed'
+
+        transmission_patterns = [r'tls', r'ssl', r'https', r'encrypt.*transit']
+        for pattern in transmission_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='HIPAA-164.312(e)(1)',
+            framework='HIPAA',
+            category='Transmission Security',
+            title='PHI Transmission Encryption',
+            description='Verify PHI is encrypted during transmission',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Enforce TLS 1.2+ for all PHI transmissions, implement end-to-end encryption',
+            severity='critical' if status == 'failed' else 'low'
+        ))
+
+    def _check_privacy_by_design(self):
+        """GDPR Article 25: Privacy by design."""
+        evidence = []
+        status = 'failed'
+
+        privacy_patterns = [
+            r'data.*minimization',
+            r'privacy.*config',
+            r'consent',
+            r'gdpr'
+        ]
+
+        for pattern in privacy_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='GDPR-25',
+            framework='GDPR',
+            category='Privacy by Design',
+            title='Data Minimization',
+            description='Verify data collection is limited to necessary purposes',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Implement data minimization, purpose limitation, and privacy-by-default configurations',
+            severity='high' if status == 'failed' else 'low'
+        ))
+
+    def _check_gdpr_security(self):
+        """GDPR Article 32: Security of processing."""
+        evidence = []
+        status = 'failed'
+
+        security_patterns = [r'encrypt', r'pseudonymization', r'anonymization']
+        for pattern in security_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='GDPR-32',
+            framework='GDPR',
+            category='Security',
+            title='Pseudonymization and Encryption',
+            description='Verify appropriate security measures for personal data',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Implement encryption and pseudonymization for personal data processing',
+            severity='high' if status == 'failed' else 'low'
+        ))
+
+    def _check_breach_notification(self):
+        """GDPR Article 33/34: Breach notification."""
+        evidence = []
+        status = 'failed'
+
+        breach_patterns = [
+            r'breach.*notification',
+            r'incident.*response',
+            r'security.*incident'
+        ]
+
+        for pattern in breach_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        # Check for incident response documentation
+        incident_docs = ['SECURITY.md', 'docs/incident-response.md', '.github/SECURITY.md']
+        for doc in incident_docs:
+            if (self.target_path / doc).exists():
+                evidence.append(doc)
+                if status == 'failed':
+                    status = 'warning'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='GDPR-33',
+            framework='GDPR',
+            category='Breach Notification',
+            title='Incident Response Procedure',
+            description='Verify breach notification procedures are documented',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Document incident response procedures with 72-hour notification capability',
+            severity='high' if status == 'failed' else 'low'
+        ))
+
+    def _check_data_deletion(self):
+        """GDPR Article 17: Right to erasure."""
+        evidence = []
+        status = 'failed'
+
+        deletion_patterns = [
+            r'delete.*user',
+            r'erasure',
+            r'right.*forgotten',
+            r'data.*deletion',
+            r'gdpr.*delete'
+        ]
+
+        for pattern in deletion_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='GDPR-17',
+            framework='GDPR',
+            category='Data Subject Rights',
+            title='Right to Erasure',
+            description='Verify data deletion capability is implemented',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Implement complete user data deletion including all backups and third-party systems',
+            severity='high' if status == 'failed' else 'low'
+        ))
+
+    def _check_data_export(self):
+        """GDPR Article 20: Data portability."""
+        evidence = []
+        status = 'failed'
+
+        export_patterns = [
+            r'export.*data',
+            r'data.*portability',
+            r'download.*data',
+            r'gdpr.*export'
+        ]
+
+        for pattern in export_patterns:
+            files = self._search_files(pattern, case_sensitive=False)
+            if files:
+                evidence.extend(files[:3])
+                status = 'passed'
+                break
+
+        self.controls.append(ComplianceControl(
+            control_id='GDPR-20',
+            framework='GDPR',
+            category='Data Subject Rights',
+            title='Data Portability',
+            description='Verify data export capability is implemented',
+            status=status,
+            evidence=evidence[:5],
+            recommendation='Implement data export in machine-readable format (JSON, CSV)',
+            severity='medium' if status == 'failed' else 'low'
+        ))
+
+    def _search_files(self, pattern: str, case_sensitive: bool = True) -> List[str]:
+        """Search files for pattern matches."""
+        matches = []
+        flags = 0 if case_sensitive else re.IGNORECASE
+
+        try:
+            for root, dirs, files in os.walk(self.target_path):
+                # Skip common non-relevant directories
+                dirs[:] = [d for d in dirs if d not in {
+                    'node_modules', '.git', '__pycache__', 'venv', '.venv',
+                    'dist', 'build', 'coverage', '.next'
+                }]
+
+                for filename in files:
+                    if filename.endswith(('.js', '.ts', '.py', '.go', '.java', '.md', '.yml', '.yaml', '.json')):
+                        file_path = Path(root) / filename
+                        try:
+                            content = file_path.read_text(encoding='utf-8', errors='ignore')
+                            if re.search(pattern, content, flags):
+                                rel_path = str(file_path.relative_to(self.target_path))
+                                matches.append(rel_path)
+                                self.files_scanned += 1
+                        except Exception:
+                            pass
+        except Exception:
+            pass
+
+        return matches[:10]  # Limit results
+
+    def _calculate_compliance_score(self) -> float:
+        """Calculate overall compliance score (0-100)."""
+        if not self.controls:
+            return 0.0
+
+        # Weight by severity
+        severity_weights = {'critical': 4.0, 'high': 3.0, 'medium': 2.0, 'low': 1.0}
+        status_scores = {'passed': 1.0, 'warning': 0.5, 'failed': 0.0, 'not_applicable': None}
+
+        total_weight = 0.0
+        total_score = 0.0
+
+        for control in self.controls:
+            score = status_scores.get(control.status)
+            if score is not None:  # Skip N/A
+                weight = severity_weights.get(control.severity, 1.0)
+                total_weight += weight
+                total_score += score * weight
+
+        return round((total_score / total_weight) * 100, 1) if total_weight > 0 else 0.0
+
+    def _get_compliance_level(self, score: float) -> str:
+        """Get compliance level from score."""
+        if score >= 90:
+            return "COMPLIANT"
+        elif score >= 70:
+            return "PARTIALLY_COMPLIANT"
+        elif score >= 50:
+            return "NON_COMPLIANT"
+        return "CRITICAL_GAPS"
+
+    def _print_summary(self, result: Dict):
+        """Print compliance summary."""
+        print("\n" + "=" * 60)
+        print("COMPLIANCE CHECK SUMMARY")
+        print("=" * 60)
+        print(f"Target: {result['target']}")
+        print(f"Framework: {result['framework'].upper()}")
+        print(f"Scan duration: {result['scan_duration_seconds']}s")
+        print(f"Compliance score: {result['compliance_score']}% ({result['compliance_level']})")
+        print()
+
+        summary = result['summary']
+        print(f"Controls checked: {summary['total']}")
+        print(f"  Passed:  {summary['passed']}")
+        print(f"  Failed:  {summary['failed']}")
+        print(f"  Warning: {summary['warnings']}")
+        print(f"  N/A:     {summary['not_applicable']}")
+        print("=" * 60)
+
+        # Show failed controls
+        failed = [c for c in result['controls'] if c['status'] == 'failed']
+        if failed:
+            print("\nFailed controls requiring remediation:")
+            for control in failed[:5]:
+                print(f"\n  [{control['severity'].upper()}] {control['control_id']}")
+                print(f"  {control['title']}")
+                print(f"  Recommendation: {control['recommendation']}")
+
+
+def main():
+    """Main entry point for CLI."""
+    parser = argparse.ArgumentParser(
+        description="Check compliance against SOC 2, PCI-DSS, HIPAA, GDPR",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""
+Examples:
+  %(prog)s /path/to/project
+  %(prog)s /path/to/project --framework soc2
+  %(prog)s /path/to/project --framework pci-dss --output report.json
+  %(prog)s . --framework all --verbose
+        """
+    )
+
+    parser.add_argument(
+        "target",
+        help="Directory to check for compliance"
+    )
+    parser.add_argument(
+        "--framework", "-f",
+        choices=["soc2", "pci-dss", "hipaa", "gdpr", "all"],
+        default="all",
+        help="Compliance framework to check (default: all)"
+    )
+    parser.add_argument(
+        "--verbose", "-v",
+        action="store_true",
+        help="Enable verbose output"
+    )
+    parser.add_argument(
+        "--json",
+        action="store_true",
+        help="Output results as JSON"
+    )
+    parser.add_argument(
+        "--output", "-o",
+        help="Output file path"
+    )
+
+    args = parser.parse_args()
+
+    checker = ComplianceChecker(
+        target_path=args.target,
+        framework=args.framework,
+        verbose=args.verbose
+    )
+
+    result = checker.check()
+
+    if args.json:
+        output = json.dumps(result, indent=2)
+        if args.output:
+            with open(args.output, 'w') as f:
+                f.write(output)
+            print(f"\nResults written to {args.output}")
+        else:
+            print(output)
+    elif args.output:
+        with open(args.output, 'w') as f:
+            json.dump(result, f, indent=2)
+        print(f"\nResults written to {args.output}")
+
+    # Exit with error code based on compliance level
+    if result.get('compliance_level') == 'CRITICAL_GAPS':
+        sys.exit(2)
+    if result.get('compliance_level') == 'NON_COMPLIANT':
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()