Compliance & Regulatory

Overview

Compliance & Regulatory is the Prismatic Platform's capability for automated assessment, continuous monitoring, and evidence-based reporting of compliance posture against regulatory frameworks. The platform currently supports three primary frameworks -- NIS2 (EU Network and Information Security Directive 2), GDPR (General Data Protection Regulation), and ZKB (Czech Cybersecurity Decree 264/2025 Sb.) -- with an extensible architecture designed to accommodate additional regulatory regimes as they emerge. Every compliance finding is backed by verifiable evidence, carries confidence scores, and maintains a complete audit trail from assessment to remediation.

Regulatory compliance is not a checkbox exercise. Organizations that treat it as one inevitably discover gaps when regulators, auditors, or adversaries test their actual posture. The Prismatic approach applies the same epistemic rigor to compliance that governs all platform intelligence products: multi-source evidence gathering, contradiction preservation, confidence scoring, and formal verification through Trinity Gate. The result is a compliance posture that is not merely claimed but demonstrably proved.

Regulatory Frameworks

NIS2 Directive (EU 2022/2555)

The Network and Information Security Directive 2 is the European Union's updated cybersecurity framework, significantly expanding the scope and enforcement mechanisms of the original NIS Directive. It applies to essential and important entities across 18 sectors, including energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, and space.

NIS2 Article 21 Deep Assessment

Article 21 mandates specific cybersecurity risk management measures. The platform maps each requirement to testable controls:

GDPR (Regulation EU 2016/679)

The General Data Protection Regulation governs the processing of personal data within the EU and EEA. The platform assesses organizational and technical measures required for GDPR compliance:

ZKB 264/2025 Sb. (Czech Cybersecurity Decree)

The Czech cybersecurity decree (Zakon o kyberneticke bezpecnosti) implements national cybersecurity obligations for operators of essential services and digital service providers within the Czech Republic. The platform provides native support for ZKB assessment through its deep integration with Czech registries:

Automated Assessment Engine

Assessment Pipeline

Regulatory Framework --> Control Mapping --> Evidence Collection --> Gap Analysis --> Scoring --> Report
       |                      |                     |                    |              |           |
    NIS2/GDPR/ZKB       Framework-specific      EASM findings       Control vs.    Weighted    Structured
    rule definitions     control catalogue       Policy documents    evidence gaps   composite   audit-ready
                                                 Registry data                      per-article  document
                                                 Technical scans

Evidence Collection Architecture

The compliance assessment engine collects evidence from multiple platform capabilities and external sources:

Gap Analysis

Gap analysis compares the evidence collected against each regulatory requirement to produce a structured compliance gap report:

# Compliance gap analysis
{:ok, gaps} = PrismaticCompliance.analyze_gaps("target-entity.com", :nis2)
# => %{
#   framework: :nis2,
#   total_controls: 42,
#   compliant: 31,
#   partially_compliant: 7,
#   non_compliant: 4,
#   compliance_score: 82,
#   critical_gaps: [
#     %{
#       article: "21(2)(d)",
#       control: "Supply chain security",
#       status: :non_compliant,
#       finding: "No documented supply chain risk assessment process",
#       remediation: "Implement vendor assessment framework with risk scoring",
#       confidence: 0.91
#     }
#   ],
#   improvement_priority: [
#     %{article: "21(2)(d)", impact: :high, effort: :medium},
#     %{article: "21(2)(f)", impact: :medium, effort: :low}
#   ]
# }

Audit Trails

Immutable Evidence Chain

Every compliance assessment produces an immutable audit trail that satisfies regulatory evidence requirements:

Provenance Compliance

Following the Provenance Mandatory NABLA axiom, every compliance finding is traceable to its original evidence:

Finding: "TLS 1.0 still enabled on subdomain X"
  |
  +-- Evidence: EASM scan result (scan_id: ABC123, timestamp: 2026-02-14T10:30:00Z)
  |     +-- Raw data: TLS handshake response showing TLS 1.0 support
  |     +-- Tool: OpenSSL probe via Prismatic Perimeter scanner
  |
  +-- Control mapping: NIS2 Art. 21(2)(h) -- Cryptography
  |     +-- Requirement: "Use of encryption and, where applicable, up-to-date encryption"
  |
  +-- Risk assessment: HIGH (deprecated protocol, known vulnerabilities)
  |     +-- CVE references: CVE-2014-3566 (POODLE), CVE-2011-3389 (BEAST)
  |
  +-- Remediation: Disable TLS 1.0/1.1, enforce TLS 1.2+ minimum
        +-- Estimated effort: LOW
        +-- Verification: Re-scan after remediation

Policy Enforcement

Continuous Compliance Monitoring

Compliance is not assessed once and forgotten. The platform provides continuous monitoring that detects compliance drift:

Automated Policy Rules

# Define compliance policy rules
policy = %CompliancePolicy{
  framework: :nis2,
  rules: [
    %Rule{
      control: "encryption",
      condition: fn finding -> finding.tls_version >= "1.2" end,
      severity: :critical,
      auto_alert: true
    },
    %Rule{
      control: "mfa",
      condition: fn finding -> finding.mfa_enabled == true end,
      severity: :high,
      auto_alert: true
    }
  ],
  alerting: %{
    channels: [:email, :slack, :dashboard],
    escalation: :compliance_officer
  }
}

Reporting

Regulatory Report Generation

The platform generates audit-ready compliance reports formatted for regulatory submission:

Compliance Dashboard

The LiveView-based compliance dashboard provides real-time visibility into compliance posture:

/perimeter/compliance    -- Full compliance assessment with framework drill-down
/perimeter/compliance/nis2  -- NIS2-specific assessment detail
/perimeter/compliance/gdpr  -- GDPR assessment and data processing inventory
/perimeter/compliance/zkb   -- ZKB assessment with Czech registry integration

Integration

• Powered by External Attack Surface Management for technical evidence collection
• All findings verified through Trinity Gate 4-layer validation
• Governed by NABLA Axioms for evidence-based compliance assessment
• Enforces NO DOUBTS -- every compliance claim backed by traceable evidence
• Quality enforced by NO MERCY zero-tolerance standards
• Intelligence from Intelligence Synthesis feeds regulatory risk assessment
• Monitored through Real-Time Monitoring for compliance drift detection
• Agent operations tracked via Telemetry Integration
• Supports M&A Intelligence with compliance risk domain data
• Automated through AIAD Standard agent orchestration

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

• GitHub | GitLab | LinkedIn | Contact
• Developer Portal | Architecture | Meet the Creator