Compliance & Attestation¶

CyberArmor maps enforceable controls to established regulatory frameworks and preserves tenant-scoped assessment evidence in PostgreSQL — evidence bound to the control decision that produced it, not gathered after the fact.

Framework policy packs¶

The compliance engine ships 17 framework policy packs:

Category	Frameworks
AI governance	ISO/IEC 42001, NIST AI RMF
Financial regulators	SEC Cyber, FINRA Cyber, NYDFS 500
Security & privacy	SOC 2, ISO 27001, PCI DSS, HIPAA Security Rule, GDPR, CCPA
Government / controls	NIST CSF, NIST 800-53, CMMC L3, CIS Controls, CSA CCM
Application security	OWASP

An eighteenth framework, SANS/CWE Top 25, ships its controls and assessment but deliberately has no policy pack. Its controls are secure-coding practices in the customer's own SDLC — memory safety, SAST configuration, parameterised queries — which this product cannot observe in AI traffic. It is satisfied by uploaded attestation documents rather than by an enforced policy, and is counted separately for that reason.

Each pack provides enforceable control templates that map compliance requirements to runtime policy — controls that become executable decisions, not documents.

Evidence & assessments¶

Evidence and assessment reports are DB-backed and tenant-scoped:

per-request evidence submission and retrieval
per-framework assessment reports, scored and stored
evidence tied to the enforcement decision (actor, request, policy, response)

Endpoint	Purpose
`GET /frameworks`	list available frameworks
`GET /frameworks/{id}/policy-pack`	control templates for a framework
`GET /frameworks/{id}/controls`	controls with evidence keys
submit / get evidence per request	attach and retrieve request-scoped evidence

Validation checklist¶

GET /frameworks returns 17 frameworks including iso42001, sec-cyber, and finra-cyber
GET /frameworks/iso42001/policy-pack returns enforceable control templates
submitted evidence for a request is retrievable and persists across a service restart