Compliance

Kind: constraint

Layer: Security Core

Record: architecture:compliance

Severity: contextual

Scope: system, organization, process

Canonical: Ontology

A rule or precondition that a system implements the controls a regulation or standard requires, and keeps evidence of each one.

Listed in Architecture principles, after Privacy by Design and before Governance.

Requires

• Controls
• Evidence
• Auditability

Reinforces

• Governance
• Risk Management

Enables

• Regulatory Alignment

Conflicts with

• Uncontrolled Change

In tension with

• Delivery Speed

Tensions

• Compliance / Delivery Speed

Violated by

• Point-in-Time Audit Only

Refactored by

• Controls
• Evidence Citation

Severity

• contextual

Category

• Security / Privacy / Compliance / Governance

Enabled by

• Reproducibility

Reinforced by

• Standards Compliance
• Model Governance
• Security by Design
• Privacy by Design
• Policy Enforcement
• Continuous Compliance

Linked from

• Detect, log, fix
• It looked right
• Correctness / Determinism / Verification
• Portability / Infrastructure / Deployment
• Model Architecture
• Observability / Auditability / Traceability
• Security / Privacy / Compliance / Governance
• Core Vocabulary
• Model Architecture
• Security Privacy Compliance
• Severity levels
• The resolutions