Prismatic Compliance

Abstract

Prismatic Compliance provides automated compliance assessment against major European regulatory frameworks: the NIS2 Directive (EU 2022/2555), GDPR (EU 2016/679), and the Czech ZKB (Zakon o kyberneticke bezpecnosti, 264/2025 Sb.). The system evaluates organizations against 100+ regulatory controls across these frameworks, collecting evidence automatically from platform intelligence sources -- OSINT scans, security ratings, audit logs, and configuration assessments -- and generating compliance reports with gap analysis, remediation tracking, and deadline management. Compliance assessment results integrate directly into Prismatic Perimeter security ratings, ensuring that compliance gaps influence security scores. The architecture separates framework definitions (control catalogs with requirement mappings), assessment engines (individual control evaluation with scoring), evidence collection (automated gathering from 15+ platform sources), and reporting (PDF, HTML, and JSON output with remediation recommendations).

1. Introduction

1.1 Problem Statement

European organizations face overlapping regulatory requirements from NIS2, GDPR, and national implementations like the Czech ZKB. Compliance assessment traditionally involves manual audits, spreadsheet-based evidence tracking, and consultant-dependent gap analysis. This approach is expensive, infrequent, and often outdated by the time reports are delivered. For a security intelligence platform that continuously monitors organizations, compliance assessment can be automated by mapping security findings to regulatory controls.

Prismatic Compliance closes this gap by continuously evaluating compliance posture using the same intelligence data that drives security ratings, producing always-current compliance assessments with evidence traced to their sources.

1.2 Design Goals

1. Multi-framework support -- NIS2, ZKB, and GDPR assessed through a unified engine with framework-specific control catalogs.
2. Automated evidence collection -- evidence gathered from OSINT scans, security assessments, audit logs, and configuration data without manual intervention.
3. Continuous assessment -- compliance posture updated in real time as new intelligence becomes available.
4. Evidence provenance -- every assessment is traceable to specific evidence sources with collection timestamps.
5. Remediation tracking -- gap analysis with prioritized remediation items, progress tracking, and deadline management.
6. Report generation -- compliance reports in PDF, HTML, and JSON formats for different stakeholder audiences.

1.3 Scope

Prismatic Compliance covers compliance assessment and reporting. It does not implement the security controls themselves (which are assessed through platform intelligence) or provide legal advice on regulatory interpretation.

2. Architecture

2.1 System Design

Intelligence Sources
  (OSINT, Security Scans, Audit Logs, Config)
       |
  Evidence Collector (automated gathering)
       |
  +----+----+----+----+
  |    |    |    |    |
  NIS2   ZKB   GDPR  Custom
  Engine Engine Engine Engine
       |
  Control Assessment (per-control scoring)
       |
  Gap Analysis (non-compliant controls identified)
       |
  +----+----+
  |         |
  Reports   Remediation Tracker
  (PDF/HTML/JSON) (prioritized items)
       |
  Perimeter Security Rating Integration

2.2 Core Components

2.3 Process Topology

PrismaticCompliance.Application (Supervisor, :one_for_one)
+-- PrismaticCompliance.Evidence.Collector (GenServer)
|     Scheduled evidence collection from platform sources
+-- PrismaticCompliance.Remediation.Tracker (GenServer)
|     Remediation item tracking and deadline monitoring
+-- Task.Supervisor
      Parallel assessment execution

2.4 Data Flow

Evidence is collected from platform intelligence sources (OSINT scan results, security ratings, audit logs, configuration data). The ControlEngine evaluates each control against available evidence, producing per-control compliance status (compliant, partially_compliant, non_compliant). The Scorer aggregates control results into framework-level scores. GapAnalysis identifies non-compliant controls and generates prioritized remediation items. Reports are generated from assessment results with evidence references.

3. Implementation

3.1 Key Algorithms

Control Assessment. Each control in the catalog defines required evidence types and assessment criteria. The ControlEngine evaluates whether collected evidence satisfies the criteria, producing a compliance status and confidence score. Controls with insufficient evidence are marked as unassessable rather than non-compliant.

Framework Scoring. Framework-level scores are computed as weighted averages of control scores, with weights reflecting control criticality. Critical controls (incident handling, access control) carry higher weights than administrative controls.

3.2 Data Structures

defmodule PrismaticCompliance.Assessment do
  @type t :: %__MODULE__{
    framework: atom(),
    target: String.t(),
    overall_score: 0..100,
    status: :compliant | :partially_compliant | :non_compliant,
    controls: %{String.t() => ControlResult.t()},
    evidence: [Evidence.t()],
    remediation_items: [RemediationItem.t()],
    assessed_at: DateTime.t()
  }
end

3.3 API Surface

# Assess compliance
@spec assess(atom(), String.t(), keyword()) :: {:ok, Assessment.t()} | {:error, term()}
PrismaticCompliance.assess(:nis2, "example.com", entity_type: :essential)

# Collect evidence
@spec collect_evidence(atom(), String.t()) :: {:ok, [Evidence.t()]}
PrismaticCompliance.collect_evidence(:nis2, "example.com")

# Generate report
@spec generate_report(String.t(), keyword()) :: {:ok, Report.t()}
PrismaticCompliance.generate_report("example.com",
  frameworks: [:nis2, :zkb, :gdpr], format: :pdf)

# Track remediation
@spec remediation_progress(String.t(), atom()) :: {:ok, Progress.t()}
PrismaticCompliance.remediation_progress("example.com", :nis2)

3.4 Configuration

config :prismatic_compliance,
  frameworks: [:nis2, :zkb, :gdpr],
  evidence_collection_interval: :timer.hours(24),
  assessment_cache_ttl: :timer.hours(6),
  report_formats: [:pdf, :html, :json],
  remediation_reminder_days: [30, 14, 7, 1]

4. Integration

4.1 Dependencies

4.2 Dependents

4.3 Inter-Process Communication

Evidence collection runs as scheduled tasks. Assessment execution is parallelized via Task.Supervisor. Results are published via PubSub for dashboard updates.

4.4 External Integrations

No external compliance services. All framework definitions and assessment logic are implemented locally.

5. Performance

5.1 Benchmarks

5.2 Scalability

Control assessments are independent and parallelize linearly. Evidence collection parallelizes across sources.

5.3 Resource Requirements

6. Testing Strategy

6.1 Unit Tests

Control assessment tests verify correct evaluation for known evidence combinations. Framework scoring tests verify weighted aggregation. Gap analysis tests verify correct identification of non-compliant controls.

6.2 Integration Tests

End-to-end tests exercise the full assessment pipeline from evidence collection through control evaluation to report generation.

6.3 Property-Based Testing

StreamData generators produce random evidence sets to verify that assessment scores are always within 0-100 and that compliance status is consistent with control results.

7. Security Considerations

7.1 Threat Model

Manipulated evidence could produce false compliance assessments. Mitigations include evidence provenance tracking, multi-source evidence requirements, and assessment audit trails.

7.2 Access Control

Compliance assessment requires compliance_read permission. Report generation requires report_create permission.

8. Operational Considerations

8.1 Deployment

Deploys as part of the umbrella release. Framework definitions are bundled with the application.

8.2 Monitoring

Telemetry events: [:prismatic, :compliance, :assessed], [:prismatic, :compliance, :evidence_collected], [:prismatic, :compliance, :report_generated].

8.3 Troubleshooting

9. Future Work

Planned enhancements include ISO 27001 framework support, automated regulatory change tracking with impact analysis, compliance benchmarking against industry peers, and integration with external GRC platforms.

References

• NIS2 Directive -- EU cybersecurity directive
• GDPR -- General Data Protection Regulation
• ZKB 264/2025 Sb. -- Czech Cybersecurity Act
• Prismatic Perimeter -- Security rating integration
• Prismatic CER -- Evidence repository

Related Agents

• CER Compliance Commander -- Commands compliance evidence collection and assessment workflows across NIS2, GDPR, and ZKB regulatory frameworks
• Evidence Enforcement Agent -- Enforces evidence quality, completeness, and provenance requirements for regulatory compliance assessments
• GitLab Security Specialist Agent -- Reviews compliance assessment implementation for security and accuracy of regulatory control mappings

Related Capabilities

• NABLA Axioms -- Signal plurality and provenance mandatory axioms ensure compliance assessments are backed by multiple independent evidence sources
• Trinity Gate -- Three-layer verification ensures compliance conclusions pass structural, logical, and formal consistency checks
• Intelligence Synthesis -- Synthesizes evidence from 15+ platform sources into unified compliance posture assessments across frameworks

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

• GitHub | GitLab | LinkedIn | Contact
• Developer Portal | Architecture | Meet the Creator