compliance-docs-generate

name	compliance-docs-generate
description	Generates compliance documentation for HIPAA, GDPR, PCI DSS, and SOC 2
shortcut	cdg
category	security
difficulty	intermediate
estimated_time	15-30 minutes

Compliance Documentation Generator

Automatically generates comprehensive compliance documentation including policies, procedures, data flow diagrams, and audit-ready reports for HIPAA, GDPR, PCI DSS, and SOC 2.

What This Command Does

Instant Compliance Documentation:

• Generates framework-specific policies and procedures
• Creates data flow and network diagrams
• Produces risk assessment templates
• Builds audit-ready documentation packages
• Customizes for your organization

Output: Complete compliance documentation package

Time: 15-30 minutes (vs weeks of manual writing)

---

When to Use This Command

Perfect For:

• Preparing for compliance audit
• Starting compliance program
• Customer compliance questionnaire responses
• RFP security documentation requirements
• Annual compliance documentation updates

Use This When:

• Customer requests security documentation
• Auditor asks for policies and procedures
• Board asks for compliance status
• Building compliance program from scratch
• Updating existing documentation

---

Usage

# Generate HIPAA documentation
/compliance-docs-generate --framework hipaa

# Generate GDPR documentation
/compliance-docs-generate --framework gdpr

# Generate PCI DSS documentation
/compliance-docs-generate --framework pci

# Generate SOC 2 documentation
/compliance-docs-generate --framework soc2

# Generate all frameworks
/compliance-docs-generate --framework all

# Customize with organization details
/compliance-docs-generate --framework hipaa --org "HealthCare Inc"

Shortcut:

/cdg --framework hipaa  # Generate HIPAA docs

---

Generated Documentation

HIPAA Documentation Package

Policies (12 documents):

1. Security Management Process Policy
2. Workforce Security Policy
3. Information Access Management Policy
4. Security Awareness and Training Policy
5. Security Incident Response Policy
6. Contingency Planning Policy
7. Access Control Policy
8. Audit Control Policy
9. Integrity Control Policy
10. Authentication Policy
11. Transmission Security Policy
12. Business Associate Agreement Template

Procedures (8 documents):

1. Risk Assessment Procedure
2. Risk Management Procedure
3. Security Incident Response Procedure
4. Workforce Termination Procedure
5. Emergency Access Procedure
6. Password Management Procedure
7. Data Backup and Recovery Procedure
8. Breach Notification Procedure

Diagrams (3 visualizations):

1. Data Flow Diagram (PHI through systems)
2. Network Architecture Diagram
3. Incident Response Flowchart

Risk Assessment:

1. Risk Analysis Template
2. Risk Register
3. Risk Treatment Plan

Example Output:

# HIPAA Security Management Process Policy

**Document Owner:** Chief Information Security Officer
**Version:** 1.0
**Effective Date:** October 10, 2025
**Review Cycle:** Annual

## 1. Purpose

This policy establishes the framework for identifying, analyzing, and managing risks to the confidentiality, integrity, and availability of electronic Protected Health Information (ePHI) in compliance with HIPAA Security Rule §164.308(a)(1).

## 2. Scope

This policy applies to:
- All workforce members (employees, contractors, volunteers)
- All systems storing, processing, or transmitting ePHI
- All third-party business associates handling ePHI

## 3. Policy Statement

[HealthCare Inc] is committed to implementing and maintaining a comprehensive security management process to:
- Prevent, detect, contain, and correct security violations
- Protect ePHI from unauthorized access, use, disclosure, or destruction
- Ensure compliance with HIPAA Security Rule requirements

## 4. Risk Analysis (Required) - §164.308(a)(1)(ii)(A)

### 4.1 Risk Analysis Frequency
- **Annual Risk Analysis:** Comprehensive risk analysis conducted annually
- **Ongoing Risk Assessment:** Continuous monitoring and assessment of new risks
- **Triggered Risk Analysis:** Conducted after significant system changes or security incidents

### 4.2 Risk Analysis Process
1. **Asset Identification**
   - Identify all systems containing ePHI
   - Document data flows and storage locations
   - Classify asset criticality

2. **Threat Identification**
   - Internal threats (malicious insiders, accidental disclosure)
   - External threats (hackers, malware, natural disasters)
 Technical vulnerabilities (unpatched software, misconfigurations)

 
 Technical vulnerabilities (automated scanning)
 Physical vulnerabilities (facility access)
 Administrative vulnerabilities (policy gaps)

 
 Confidentiality impact (unauthorized disclosure)
 Integrity impact (unauthorized modification)
 Availability impact (system downtime)

 
 Low: Unlikely to occur (< 10% probability)
 Medium: Possible to occur (10-50% probability)
 High: Likely to occur (> 50% probability)

 
   Risk = Likelihood × Impact


All identified risks documented in Risk Register including:
 Risk ID
 Asset affected
 Threat/vulnerability description
 Likelihood rating
 Impact rating
 Risk level (Low/Medium/High/Critical)
 Risk owner
 Current controls
 Recommended controls




  Implement controls to reduce risk
  Document acceptance of residual risk (low-risk items only)
  Use cyber insurance or third-party services
  Eliminate the risky activity



 Unencrypted ePHI storage or transmission
 Missing access controls on ePHI systems
 No backup/disaster recovery capability


 Weak authentication mechanisms
 Missing audit logging
 Incomplete business associate agreements


 Outdated security policies
 Insufficient workforce training
 Missing vulnerability management process


 Documentation gaps
 Process inefficiencies


For each identified risk, document:
 Recommended controls (technical, physical, administrative)
 Implementation timeline
 Responsible party
 Estimated cost
 Residual risk after control implementation




 Unauthorized access to ePHI
 Unauthorized disclosure of ePHI
 Failure to report security incidents
 Violation of HIPAA policies
 Misuse of information systems


  Security team investigates violation
  Management determines if violation occurred
  Appropriate sanction applied
  All sanctions documented



 First-time minor violation
 No patient harm
 Example: Leaving workstation unlocked once


 Repeated minor violations
 Negligent behavior
 Example: Repeated failure to log out


 Serious violation
 Potential patient harm
 Example: Sharing passwords


 Willful violation
 Actual patient harm
 Criminal activity
 Example: Selling patient data


All sanctions documented including:
 Employee name
 Date of violation
 Description of violation
 Investigation findings
 Sanction applied
 Follow-up actions




  Automated monitoring alerts
  Security log review for anomalies
  Access pattern analysis
  Comprehensive system activity review


 System logs (authentication, access, modifications)
 Audit logs (ePHI access events)
 Security alerts (failed logins, unusual activity)
 Vulnerability scan results
 Incident reports


  Gather logs from all systems
  Review for suspicious activity
  Follow up on anomalies
  Document review findings
  Implement corrective actions if needed


 Failed login attempts (track brute force attempts)
 After-hours access (verify legitimate use)
 Bulk data exports (detect potential exfiltration)
 Administrative actions (monitor privileged access)
 System changes (track configuration modifications)




 Overall responsibility for security management process
 Approve risk analysis and risk management plans
 Report security metrics to executive leadership


 Conduct risk analyses
 Implement risk management controls
 Monitor information system activity
 Investigate security incidents


 Ensure HIPAA compliance
 Maintain documentation
 Coordinate with auditors


 Report security concerns
 Follow security policies
 Complete required training



All workforce members receive training on:
 HIPAA Security Rule requirements
 Organization security policies
 Risk reporting procedures
 Incident response procedures


 New Hire: Within 30 days
 Annual Refresher: All staff
 As Needed: After policy updates or incidents




 Review policy effectiveness
 Update based on risk analysis findings
 Incorporate regulatory changes
 Address identified gaps


 After security incidents
 After significant system changes
 After regulatory updates
 As requested by auditors



Violations of this policy may result in disciplinary action up to and including termination of employment and civil or criminal penalties.



 HIPAA Security Rule (45 CFR §164.308)
 Information Access Management Policy
 Security Incident Response Policy
 Risk Assessment Procedure
 Risk Register
 Business Associate Agreement Template

---



_
[Name], Chief Information Security Officer

 October 10, 2025

GDPR Documentation Package

Policies (8 documents):

1. Data Protection Policy
2. Privacy Policy (Public-Facing)
3. Data Retention Policy
4. Data Breach Response Policy
5. Data Subject Rights Policy
6. Consent Management Policy
7. Data Transfer Policy
8. Data Processing Agreement Template

Procedures (6 documents):

1. Data Subject Access Request (DSAR) Procedure
2. Right to Erasure Procedure
3. Data Breach Notification Procedure
4. Data Protection Impact Assessment (DPIA) Procedure
5. Vendor Assessment Procedure
6. Data Inventory Procedure

Registers (3 tracking documents):

1. Data Processing Register (Article 30)
2. Consent Register
3. DSAR Request Log

Example GDPR Document:

# Data Subject Access Request (DSAR) Procedure

## 1. Purpose

To establish a procedure for handling Data Subject Access Requests (DSARs) in compliance with GDPR Article 15 (Right of Access).

## 2. Scope

This procedure applies to all requests from data subjects exercising their right to access personal data held by [Company Name].

## 3. DSAR Receipt

### 3.1 Recognition
DSARs may be received via:
- Email to [e-mail]
- Written mail to registered office
- Through website privacy portal
- Verbal request (must be documented)

### 3.2 Valid DSAR Requirements
A valid DSAR must include:
- Data subject's name
- Contact information
- Description of data requested
- Proof of identity (if data is sensitive)

### 3.3 Identity Verification
Before responding, verify requestor identity:
- Government-issued ID (passport, driver's license)
- For existing customers: Account verification
- For former employees: Employee ID verification

## 4. Response Timeline

**Standard Timeline:** 30 days from receipt

**Extension Allowed:** Additional 60 days if request is complex
- Must notify data subject within 30 days
- Explain reason for extension

**Urgent Processing:** 48 hours for suspected data breach

## 5. Information to Provide

### 5.1 Personal Data Copy
Provide copy of all personal data including:
- Data stored in production databases
- Data in backup systems
- Data in archived records
- Data with third-party processors

### 5.2 Additional Information (Article 15)
Also provide:
- Purposes of processing
- Categories of personal data
- Recipients of personal data
 Retention period
 Rights (rectification, erasure, restriction)
 Right to lodge complaint with supervisory authority
 Source of data (if not collected from data subject)
 Existence of automated decision-making

DSAR Received ↓ Log in DSAR Register ↓ Verify Identity ↓ Search All Systems ↓ Compile Personal Data ↓ Redact Third-Party Data ↓ Legal Review ↓ Generate DSAR Response ↓ Deliver to Data Subject ↓ Update DSAR Register

## 7. System Search

**Systems to Search:**
- Production database
- CRM system
- Email archives
- Support ticket system
- Marketing platform
- Analytics platform
- Third-party processors (AWS, Stripe, SendGrid)

**Search Criteria:**
- Name
- Email address
- Phone number
- User ID
- IP address
- Customer ID

## 8. Data Redaction

Before providing data, redact:
- Personal data of other individuals (third parties)
- Trade secrets
- Legally privileged information
- Information harmful to others

## 9. DSAR Response Format

Provide data in:
- **Structured Format:** JSON, CSV, or Excel
- **Commonly Used Format:** Machine-readable
- **Secure Delivery:** Encrypted email or secure portal

## 10. Exceptions to DSAR

DSAR may be refused or restricted if:
- Identity cannot be verified
- Request is manifestly unfounded or excessive
- Request would adversely affect rights of others
- Legal obligation prevents disclosure

**If refusing:** Provide written explanation within 30 days

## 11. Fees

**No Fee:** For standard DSARs

**Fee Allowed (£10-£25):**
- Manifestly unfounded or excessive requests
- Requests for additional copies

## 12. DSAR Response Example

**Email Template:**

Subject: Your Data Subject Access Request - Reference #DSAR-2025-001

Dear [Data Subject Name],

Thank you for your Data Subject Access Request received on [Date].

We have completed our search and are providing your personal data as requested.

**Attached Documents:**
1. personal_data_export.json - Your personal data in machine-readable format
2. dsar_information_sheet.pdf - Information about your rights and our processing

**Summary of Your Personal Data:**
- Account Information: Name, email, phone number
- Usage Data: Login history, page views
- Communications: Support tickets, email correspondence
- Payment Information: Billing address, payment method (last 4 digits)
- Marketing Preferences: Email subscription status

**Processing Purposes:**
- Service delivery (legal basis: contract)
- Customer support (legal basis: legitimate interest)
- Marketing (legal basis: consent)

**Data Retention:**
Your data will be retained for 2 years from last activity.

**Your Rights:**
- Right to rectification (correct inaccurate data)
- Right to erasure (delete your data)
- Right to restrict processing
- Right to data portability
- Right to object to processing
- Right to withdraw consent

To exercise any of these rights, reply to this email or contact [e-mail].

**Complaint:**
If you are unhappy with how we handled your request, you have the right to lodge a complaint with your national Data Protection Authority.

Kind regards,
Data Protection Officer
[Company Name]

---