> ## Documentation Index
> Fetch the complete documentation index at: https://docs.auditrails.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Compliance Framework Mapping: SOC 2, HIPAA, GDPR, and More
> Map AuditRails events and features to all 18 supported compliance frameworks, including SOC 2, HIPAA, PCI DSS v4.0, GDPR, NIS2, DORA, and more.
AuditRails supports 18 active compliance frameworks out of the box. For each framework, specific event types, storage guarantees, and dashboard features map directly to regulatory controls — so you can demonstrate compliance without manual evidence collection. This guide covers the 10 broadest frameworks in detail, plus a summary of the remaining 8.
## Getting Started
Before mapping events to controls, make sure you're set up correctly.
Navigate to **Settings → Compliance Frameworks** and toggle on the frameworks relevant to your organization. Compliance features require a **Framework or Compliance Trail** — they are not available on Starter Trails.
Open **Dashboard → Compliance** and select your framework. Each checklist item maps to a specific control and shows its current status.
Instrument your application to emit the event types listed for your framework in the sections below. Use the AuditRails SDK or REST API.
Use the auto-verification feature in the compliance dashboard to confirm your hash chain is intact and required event coverage is met.
Monitor the checklist over time. Each control turns green once AuditRails detects the required events and configuration.
***
## Framework Reference
SOC 2 Trust Services Criteria require you to log access events, authentication activity, permission changes, and configuration changes — and to demonstrate that those logs cannot be tampered with.
| Control | Event Types | AuditRails Feature |
| -------------------------- | ------------------------------------------ | ------------------------- |
| CC6.1 — Logical access | `access.granted`, `access.revoked` | Immutable audit trail |
| CC6.2 — Authentication | `auth.login`, `auth.logout` | Immutable audit trail |
| CC6.3 — Permission changes | `permission.granted`, `permission.revoked` | RBAC auditor role |
| CC7.2 — Monitoring | Dashboard search & CSV export | Dashboard + export |
| CC8.1 — Change management | `config.changed`, `deploy.completed` | Immutable audit trail |
| A1.2 — Availability | WORM storage | S3 Object Lock COMPLIANCE |
**Key capabilities:** Immutable audit trail, WORM storage, RBAC auditor role (read-only access for auditors), CSV export for evidence packages.
The RBAC auditor role lets you grant your external auditor read-only access to the compliance dashboard without exposing sensitive configuration settings.
HIPAA Security Rule requirements focus on PHI access logging, integrity controls, and authentication. Retention must be **6 years**, which AuditRails enforces automatically on Framework and Compliance Trails.
| Rule | Event Types | AuditRails Feature |
| ------------------------------ | ---------------------------------------------- | ----------------------- |
| §164.312(b) — Audit controls | `phi.accessed`, `phi.disclosed`, `phi.amended` | Immutable trail |
| §164.312(c) — Integrity | Hash chaining (SHA-256) | Hash chain verification |
| §164.312(d) — Authentication | `auth.login`, `auth.failed` | Immutable trail |
| §164.308(a)(1) — Risk mgmt | Compliance dashboard | Dashboard |
| §164.308(a)(5) — Training | `training.completed` | Immutable trail |
| §164.408 — Breach notification | `breach.detected`, `breach.notified` | Immutable trail |
**Retention:** 6 years on Framework/Compliance Trails (automatic when HIPAA is enabled).
S3 WORM retention is set at write time and cannot be shortened retroactively. If a DSAR deletion request is received, hot-storage records are soft-deleted immediately, but WORM copies are logically excluded from reads and exports under GDPR Art.17(3)(e) until the retention period expires.
ISO 27001:2022 Annex A controls map closely to AuditRails' logging, monitoring, and integrity capabilities.
| Control | Requirement | AuditRails Feature |
| --------------------------- | --------------------------- | ---------------------------------------- |
| A.8.15 — Logging | Comprehensive event logging | Configurable event capture |
| A.8.16 — Monitoring | Continuous monitoring | Dashboard monitoring |
| A.8.17 — Clock sync | UTC timestamps | UTC millisecond timestamps |
| A.5.23 — Cloud security | Data protection | WORM + encryption + tenant isolation |
| A.5.25 — Information review | Auto-verification | Compliance dashboard auto-verification |
| A.5.26 — Incident response | Incident events | `incident.detected`, `incident.resolved` |
Tenant isolation means each customer's hash chain is independent. A breach in one tenant's chain cannot affect another's, satisfying A.5.23 multi-tenancy controls.
GDPR obligations span data processing accountability, consent management, subject rights, and breach notification. See the [GDPR Compliance guide](/guides/gdpr-compliance) for full configuration steps.
| Article | Requirement | AuditRails Feature |
| ---------------------------- | ------------------------------------ | --------------------- |
| Art.5 — Accountability | Processing audit trail | Immutable audit trail |
| Art.6 — Lawful basis | `consent.given`, `consent.withdrawn` | Event capture |
| Art.15–20 — Subject rights | DSAR export/delete | DSAR API + Dashboard |
| Art.30 — Records | Auto-generated processing records | Compliance dashboard |
| Art.33 — Breach notification | `breach.detected`, `breach.notified` | Event capture |
| Art.35 — DPIA | DPIA checklist | Compliance checklist |
PCI DSS v4.0 Requirement 10 mandates detailed audit logs for all access to cardholder data environments, with tamper protection and time-range search.
| Requirement | Event Types / Feature | AuditRails Mapping |
| ---------------------- | --------------------------------------------- | --------------------- |
| 10.2.1 — Log access | `auth.login`, `auth.logout`, `access.granted` | Immutable trail |
| 10.2.2 — Admin actions | All admin events with `actor_id` | actor\_id field |
| 10.3 — Log content | who/what/when/where/outcome | Standard event schema |
| 10.5 — Protect logs | WORM prevents modification | S3 Object Lock |
| 10.6 — Time sync | Time-range search | Dashboard search |
| 10.7 — Retention | Up to 7 years | Plan-based retention |
**Retention:** Up to 7 years (Compliance Trails). PCI DSS requires a minimum of 12 months with 3 months immediately available.
Every event in AuditRails includes `actor_id`, `resource`, `action`, `timestamp`, IP address, and outcome fields by default — satisfying Requirement 10.3's "complete record" mandate without extra configuration.
The EU NIS2 Directive (2022/2555) applies to essential and important entities. It mandates security event logging, access controls, supply chain monitoring, and incident reporting.
| Article | Requirement | AuditRails Feature |
| ---------------------------- | ----------------------------------------------------------------------------- | -------------------- |
| Art.21 — Security measures | Security events, access controls, config changes | Event capture |
| Art.21(2)(d) — Supply chain | Third-party access logging | Event capture |
| Art.21(2)(h) — Cryptography | SHA-256 + WORM + TLS 1.3 + SSE | Hash chain + S3 |
| Art.21(2)(i) — Auth controls | Authentication events | `auth.*` events |
| Art.23 — Incident reporting | `incident.detected`, `incident.notified`, `incident.resolved` with timestamps | Immutable trail |
| Art.20 — Governance | Management oversight dashboard | Compliance dashboard |
**Retention:** 5 years (set automatically when NIS2 is enabled).
The EU Digital Operational Resilience Act (2022/2554) applies to financial entities and their ICT providers. It emphasises operational continuity, incident timelines, and third-party risk.
| Article | Requirement | AuditRails Feature |
| ------------------------------ | --------------------------- | --------------------------- |
| Art.5–9 — ICT risk | Operations audit trail | Immutable trail |
| Art.6 — ICT governance | Hash-chained logging | Hash chain verification |
| Art.17–19 — Incident mgmt | Incident timelines | Timestamped incident events |
| Art.24–27 — Resilience testing | `vulnerability.scan` events | Event capture |
| Art.28–30 — Third-party risk | Third-party access logging | Event capture |
**Reporting deadlines:** 4 hours (initial notification), 72 hours (intermediate report), 1 month (final report). Log `incident.detected` and `incident.notified` events to create a timestamped paper trail for each deadline.
**Retention:** 5 years (set automatically when DORA is enabled).
DORA's Art.6 requirement for hash-chained logging is natively satisfied — every event is chained with SHA-256, and you can verify the chain at any time via the dashboard or API.
California's CCPA and CPRA grant consumers rights over their personal information. AuditRails helps you log data access and deletion events and meet deletion deadlines.
| Section | Event Types | AuditRails Feature |
| ---------------------------- | --------------------------- | ---------------------- |
| §1798.100 — Right to know | `data.accessed` | Immutable trail |
| §1798.105 — Right to delete | `data.deleted` | Immutable trail + DSAR |
| §1798.106 — Right to correct | `data.updated` | Immutable trail |
| §1798.120 — Right to opt out | `consent.withdrawn` | Event capture |
| §1798.121 — Sensitive PI | Sensitive PI classification | Event metadata |
| §1798.150 — Enforcement | Immutable logs | WORM storage |
**Deletion deadline:** 45 days. Use the DSAR workflow to trigger and document deletion within this window.
**Retention:** 3 years (set automatically when CCPA/CPRA is enabled).
FedRAMP (based on NIST 800-53) imposes strict audit logging controls for cloud services used by US federal agencies.
| Control | Requirement | AuditRails Feature |
| ---------------------------- | ------------------------------------------- | ---------------------- |
| AU-2 — Audit events | Configurable event catalog | Configurable events |
| AU-3 — Content | action/timestamp/actor/resource/IP/metadata | Standard event schema |
| AU-8 — Time stamps | UTC millisecond precision | UTC ms timestamps |
| AU-9 — Protection | WORM + hash chaining | S3 Object Lock + chain |
| AU-11 — Retention | Up to 7 years (3yr minimum) | Plan-based retention |
| AC-2/AC-6 — Access control | Access logs | `access.*` events |
| IR-4/5/6 — Incident response | Incident logs | `incident.*` events |
AU-3 requires that every log record contain sufficient information to identify what happened, when, who did it, where, and what the outcome was. AuditRails populates all these fields automatically from the event payload and server-side enrichment.
The Sarbanes-Oxley Act requires publicly traded companies to maintain tamper-proof audit trails supporting ICFR certification and IT General Controls (ITGC).
| Section / Control | Event Types | AuditRails Feature |
| ---------------------------- | ------------------------------------------------------- | ------------------ |
| §302 — CEO/CFO certification | Immutable trail for ICFR | WORM + hash chain |
| §404 — Internal controls | Compliance dashboard + CSV export | Dashboard + export |
| §802 — Record retention | 7-year WORM retention | S3 Object Lock |
| §806 — Whistleblower | `compliance.report` events | Event capture |
| ITGC — Access controls | `access.*` events | Immutable trail |
| ITGC — Segregation of duties | `permission.granted` with role metadata | Role metadata |
| ITGC — Change management | `change.approved`, `config.changed`, `deploy.completed` | Event capture |
**Retention:** Enabling SOX automatically sets your trail retention to **7 years**.
SOX §802 mandates a 7-year retention period. Once records are written to S3 WORM storage, they cannot be deleted or shortened before the retention period expires — this is a legal requirement, not a platform limitation.
***
## Additional Frameworks
Beyond the 10 detailed above, AuditRails also supports:
| Framework | Region | Notes |
| ----------------- | ----------- | ---------------------------------------------------- |
| EU AI Act | EU | Articles 12, 14, 50, 72, 73 — AI system audit trails |
| amm\_sistema | Italy | Italian national framework |
| Cyber Essentials | UK | UK NCSC baseline controls |
| BSI C5 | Germany | Federal Office for Information Security |
| DNB Good Practice | Netherlands | Dutch Central Bank guidelines |
| SecNumCloud | France | ANSSI cloud security qualification |
| UK GDPR | UK | Post-Brexit UK data protection |
| LOPDGDD | Spain | Spanish data protection law |
Enable any of these from **Settings → Compliance Frameworks**.
***
## Multi-Framework Coverage
If your organization must satisfy multiple frameworks simultaneously, AuditRails merges their requirements. A single `auth.login` event, for example, satisfies SOC 2 CC6.2, HIPAA §164.312(d), PCI DSS 10.2.1, NIS2 Art.21(2)(i), and FedRAMP AC-2 at the same time.
Enable all applicable frameworks before you start logging. This ensures the compliance dashboard tracks coverage across all of them from day one and that the correct retention period (the longest of all enabled frameworks) is applied.