Backend Security Compliance — Meeting Security Compliance Standards

// Compliance control checker
class ComplianceManager {
  constructor() {
    this.controls = {
      'SOC2-CC6.1': {
        name: 'Logical Access Controls',
        checks: [
          () => this.checkAuthenticationRequired(),
          () => this.checkAuthorizationEnforced(),
          () => this.checkSessionManagement()
        ]
      },
      'SOC2-CC6.6': {
        name: 'Encryption of Data in Transit',
        checks: [
          () => this.checkTLSEnabled(),
          () => this.checkTLSVersion(),
          () => this.checkCertificateValidity()
        ]
      },
      'SOC2-CC7.2': {
        name: 'Monitoring and Detection',
        checks: [
          () => this.checkLoggingEnabled(),
          () => this.checkAlertingConfigured(),
          () => this.checkIncidentResponsePlan()
        ]
      }
    };
  }

  async runAudit() {
    const results = [];

    for (const [controlId, control] of Object.entries(this.controls)) {
      const controlResults = await Promise.all(
        control.checks.map(check => check().catch(e => ({ passed: false, error: e.message })))
      );

      const passed = controlResults.every(r => r.passed);
      results.push({
        controlId,
        name: control.name,
        passed,
        checks: controlResults,
        timestamp: new Date().toISOString()
      });
    }

    return results;
  }

  async generateEvidenceReport() {
    const audit = await this.runAudit();

    const report = {
      generatedAt: new Date().toISOString(),
      environment: process.env.NODE_ENV,
      service: config.serviceName,
      version: config.version,
      summary: {
        total: audit.length,
        passed: audit.filter(a => a.passed).length,
        failed: audit.filter(a => !a.passed).length
      },
      controls: audit
    };

    // Store evidence
    await s3.putObject({
      Bucket: 'compliance-evidence',
      Key: `audits/${new Date().toISOString().slice(0, 10)}/security-controls.json`,
      Body: JSON.stringify(report, null, 2)
    });

    return report;
  }

  async checkTLSEnabled() {
    // Check if HTTPS is enforced
    return { passed: config.forceHttps !== false, detail: 'HTTPS enforcement: ' + config.forceHttps };
  }

  async checkAuthenticationRequired() {
    return { passed: true, detail: 'Auth middleware present on all routes' };
  }
}

// Scheduled compliance checks
cron.schedule('0 6 * * *', async () => {
  const report = await complianceManager.generateEvidenceReport();
  if (report.summary.failed > 0) {
    await alertService.send({
      severity: 'high',
      title: 'Compliance control failures detected',
      description: `${report.summary.failed} controls failed automated check`
    });
  }
});