Compliance Framework

---

Regulatory Mapping

Standard	Scope	Alter Control	Evidence Location
NIST 800-53 Rev.5	AC, AU, CM, SC, SI families	Chamber isolation, audit logging, config mgmt, system comms, integrity	evidence/attestations/, audit-checklist.md
NIST 800-171	CUI Protection	OverlayFS isolation, TPM2 evidence, credential rotation	ADR-001, ADR-004, runbooks/credential-rotation
CMMC 2.0 Level 2	110 practices	All chamber lifecycle controls	This grimoire + artifact repo
ISO 27001:2022	Annex A controls	A.5–A.18 mapped to chamber ops	compliance/iso27001-mapping.xlsx
SOC 2 Type II	Security, Availability, Confidentiality	Immutable infra, DR plan, access controls	dr-plan.md, audit-checklist.md
GDPR Art. 32	Processing Security	Sample PII handling, encryption at rest	runbooks/incident-response.md §PII

---

Control Implementation Status

NIST 800-53 Rev.5 Mapping

Control	Title	Status	Implementation
AC-3	Access Enforcement	✅ Implemented	Chamber RBAC, TPM2-bound keys
AC-6	Least Privilege	✅ Implemented	Chamber pool quotas, namespace isolation
AU-2	Audit Events	✅ Implemented	Tetragon eBPF syscall logging (ADR-002)
AU-3	Audit Content	✅ Implemented	Structured JSON logs + sigstore signing
AU-6	Audit Review	⚠️ Partial	SIEM integration pending (Q4 2026)
CM-2	Baseline Config	✅ Implemented	Nix flakes, gitops, container signing
CM-7	Least Functionality	✅ Implemented	Distroless chambers, seccomp profiles
SC-7	Boundary Protection	✅ Implemented	WireGuard mesh, egress deny-by-default
SC-28	Protection at Rest	✅ Implemented	LUKS2 + TPM2 unsealing, age encryption
SI-3	Malware Protection	✅ Implemented	This Alter’s primary function
SI-4	System Monitoring	✅ Implemented	Tetragon + Prometheus + Alertmanager
SI-7	Software Integrity	✅ Implemented	Cosign/Keyless signing, Rekor transparency

---

Evidence Collection Procedures

Continuous Evidence

Artifact	Frequency	Retention	Storage
Chamber attestation logs	Per detonation	7 years	S3 + Glacier (WORM)
eBPF syscall traces	Continuous	90 days hot / 7 years cold	Loki + S3
Network PCAPs	Per sample	1 year	MinIO (encrypted)
Credential rotation logs	Per rotation	7 years	Git + Vault audit
Config drift reports	Daily	3 years	GitOps diff archive

On-Demand Evidence

# Generate compliance package for auditor
./scripts/compliance-package.sh \
  --standard=nist800-53 \
  --period="2026-01-01/2026-12-31" \
  --output=./compliance-package-2026.tar.age

# Verify evidence integrity
cosign verify-blob \
  --signature evidence/attestations/chamber-<id>.sig \
  --certificate evidence/attestations/chamber-<id>.crt \
  --blob evidence/artifacts/chamber-<id>.tar.zst

---

Audit Readiness Checklist

Pre-Audit (T-30 days)

• All ADRs reviewed and current
• Evidence collection scripts tested
• Chamber fleet attestation current (< 24h)
• Credential rotation completed per schedule
• DR plan exercised within 90 days
• Incident response tabletop completed
• Vulnerability scan of chamber images (< 7 days)
• Dependency audit (cargo audit, osv-scanner)

During Audit

• Designate Alter Keeper as primary liaison
• Provide read-only access to evidence bucket
• Demonstrate live chamber attestation
• Walk through sample detonation flow
• Show credential rotation audit trail
• Present DR failover demonstration

Post-Audit

• Document findings in compliance/findings-<audit-id>.md
• Create remediation tickets with SLAs
• Update control mappings if scope changed
• Schedule next audit cycle

---

Compliance Artifacts Repository

compliance/
├── mappings/
│   ├── nist800-53-controls.csv
│   ├── iso27001-annex-a.csv
│   ├── cmmc-practices.csv
│   └── soc2-criteria.csv
├── evidence/
│   ├── attestation-samples/
│   ├── config-baselines/
│   └── vuln-scan-reports/
├── findings/
│   ├── findings-2026-q1.md
│   └── findings-2026-q2.md
└── packages/
    └── compliance-package-<date>.tar.age

---

Continuous Compliance Automation

.github/workflows/compliance.yml

name: Continuous Compliance
on:
  schedule:
    - cron: '0 2 * * *'  # Daily 02:00 UTC
  workflow_dispatch:

jobs:
  attestation-check:
    runs-on: alter-runner
    steps:
      - uses: actions/checkout@v4
      - name: Verify chamber fleet attestation
        run: |
          ./scripts/verify-fleet-attestation.sh --max-age=24h
      - name: Check credential rotation
        run: |
          ./scripts/check-credential-age.sh --max-days=90
      - name: Scan chamber images
        run: |
          ./scripts/scan-images.sh --severity=HIGH,CRITICAL
      - name: Generate compliance dashboard
        run: |
          ./scripts/compliance-dashboard.sh > compliance/dashboard.html
      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: compliance-report-${{ github.run_id }}
          path: compliance/

---

Exception Management

Exception ID	Control	Justification	Compensating Control	Expiry	Owner
EXC-2026-001	AU-6 (Audit Review)	SIEM integration in progress	Manual weekly review by Alter Keeper	2026-12-31	@alter-keeper
EXC-2026-002	SC-13 (Cryptographic Protection)	Legacy sample format requires weak crypto	Isolated legacy chamber, no network	2027-06-30	@crypto-lead

---

Version History

Version	Date	Author	Changes
1.0	2026-08-31	Syn_OS Research Division	Initial compliance framework

---

This document is controlled. Unauthorized modification breaks the ward.