Compliance & Risk Management in Cyber Security — Complete Guide

# gdpr_compliance.py — Check GDPR compliance readiness

class GDPRChecklist:
    """GDPR compliance readiness checklist."""

    CHECKS = [
        {
            "id": "GDPR-01",
            "control": "Data Processing Register",
            "question": "Do you maintain a register of all personal data processing activities?",
            "required_by": "Article 30"
        },
        {
            "id": "GDPR-02",
            "control": "Consent Mechanism",
            "question": "Is consent obtained freely, specific, informed, and unambiguous?",
            "required_by": "Article 7"
        },
        {
            "id": "GDPR-03",
            "control": "Breach Notification",
            "question": "Can you notify supervisory authority within 72 hours of breach discovery?",
            "required_by": "Article 33"
        },
        {
            "id": "GDPR-04",
            "control": "Data Protection Impact Assessment",
            "question": "Do you perform DPIAs for high-risk processing activities?",
            "required_by": "Article 35"
        },
        {
            "id": "GDPR-05",
            "control": "Right to Erasure",
            "question": "Can you delete all personal data for a requesting individual within 30 days?",
            "required_by": "Article 17"
        },
        {
            "id": "GDPR-06",
            "control": "Data Processing Agreements",
            "question": "Do you have DPAs with all vendors who process personal data?",
            "required_by": "Article 28"
        }
    ]

    def run_checklist(self, answers: dict[str, bool]) -> list[dict]:
        """Run the checklist and generate a compliance report."""
        results = []
        for check in self.CHECKS:
            answer = answers.get(check["id"], False)
            results.append({
                "control": check["control"],
                "compliant": answer,
                "status": "PASS" if answer else "FAIL",
                "reference": check["required_by"],
                "action": "" if answer else check["question"]
            })
        return results

# Example
checklist = GDPRChecklist()
answers = {
    "GDPR-01": True,  "GDPR-02": True,
    "GDPR-03": False, "GDPR-04": True,
    "GDPR-05": False, "GDPR-06": True
}
results = checklist.run_checklist(answers)

print("=== GDPR Compliance Checklist ===")
for r in results:
    status_icon = "✓" if r["status"] == "PASS" else "✗"
    print(f"{status_icon} {r['control']}: {r['status']}")
    if r["action"]:
        print(f"   Action needed: {r['action']}")
    print(f"   Reference: {r['reference']}")

# risk_assessment.py — FAIR-based risk quantification
import json

class FAIRRiskAssessment:
    """Quantify cyber risk using the FAIR model."""

    def __init__(self, asset_name: str, asset_value: float):
        self.asset_name = asset_name
        self.asset_value = asset_value  # in dollars
        self.loss_events = []

    def add_threat_scenario(self, name: str,
                            threat_frequency: float,   # Times per year
                            vulnerability: float,       # 0.0 to 1.0
                            probable_loss_min: float,   # $ per event
                            probable_loss_max: float):  # $ per event
        """Add a threat scenario with estimates."""
        # Annualized Loss Expectancy (ALE)
        annual_occurrences = threat_frequency * vulnerability
        avg_loss_per_event = (probable_loss_min + probable_loss_max) / 2
        ale = annual_occurrences * avg_loss_per_event

        self.loss_events.append({
            "scenario": name,
            "threat_frequency": threat_frequency,
            "vulnerability": vulnerability,
            "avg_loss_per_event": avg_loss_per_event,
            "annual_occurrences": annual_occurrences,
            "annualized_loss_expectancy": round(ale, 2),
            "risk_level": "HIGH" if ale > asset_value * 0.1 else (
                "MEDIUM" if ale > asset_value * 0.01 else "LOW"
            )
        })

    def report(self) -> dict:
        """Generate risk assessment report."""
        total_ale = sum(e["annualized_loss_expectancy"] for e in self.loss_events)
        return {
            "asset": self.asset_name,
            "asset_value": self.asset_value,
            "scenarios": self.loss_events,
            "total_annualized_loss_expectancy": round(total_ale, 2),
            "risk_to_value_ratio": round(total_ale / self.asset_value * 100, 1)
        }

# Example: Risk assessment for a customer database
risk = FAIRRiskAssessment("Customer Database (50k records)", 500000)

# Scenario 1: Ransomware
risk.add_threat_scenario(
    "Ransomware attack on database server",
    threat_frequency=2,       # 2 attempts per year
    vulnerability=0.15,       # 15% chance of successful encryption
    probable_loss_min=20000,  # $20k minimum loss (downtime + ransom)
    probable_loss_max=150000  # $150k maximum loss
)

# Scenario 2: Data breach via web app
risk.add_threat_scenario(
    "SQL injection exposing customer records",
    threat_frequency=12,       # Monthly scan attempts
    vulnerability=0.05,        # 5% chance of success
    probable_loss_min=50000,
    probable_loss_max=500000   # GDPR fines, notification costs
)

# Scenario 3: Insider threat
risk.add_threat_scenario(
    "Employee exfiltrates customer data",
    threat_frequency=1,        # Rare
    vulnerability=0.1,
    probable_loss_min=10000,
    probable_loss_max=200000
)

report = risk.report()
print(json.dumps(report, indent=2))

{
  "asset": "Customer Database (50k records)",
  "asset_value": 500000,
  "total_annualized_loss_expectancy": 25950.0,
  "risk_to_value_ratio": 5.2
}

# gap_analysis.py — Identify gaps between current and target state

class ComplianceGapAnalysis:
    """Identify gaps between current and target compliance state."""

    def __init__(self, framework: str):
        self.framework = framework
        self.controls = []

    def add_control(self, control_id: str, description: str,
                    implemented: bool, evidence: str = ""):
        """Add a control with its implementation status."""
        self.controls.append({
            "id": control_id,
            "description": description,
            "implemented": implemented,
            "evidence": evidence,
            "status": "Implemented" if implemented else "GAP"
        })

    def report(self) -> dict:
        """Generate gap analysis report."""
        total = len(self.controls)
        implemented = sum(1 for c in self.controls if c["implemented"])
        gaps = total - implemented

        return {
            "framework": self.framework,
            "total_controls": total,
            "implemented": implemented,
            "gaps": gaps,
            "compliance_percentage": round(implemented / total * 100, 1) if total > 0 else 0,
            "gap_details": [c for c in self.controls if not c["implemented"]]
        }

# Example: ISO 27001 gap analysis
gap = ComplianceGapAnalysis("ISO 27001")
gap.add_control("A.9.1.2", "Access to networks and services", True)
gap.add_control("A.9.2.1", "User registration and de-registration", True)
gap.add_control("A.12.6.1", "Management of technical vulnerabilities", False,
                "No automated vulnerability scanning in CI/CD")
gap.add_control("A.16.1.5", "Response to information security incidents", False,
                "Incident response playbooks not documented")
gap.add_control("A.18.1.4", "Privacy and protection of PII", True)

report = gap.report()
print(f"Framework: {report['framework']}")
print(f"Compliance: {report['compliance_percentage']}% ({report['implemented']}/{report['total_controls']})")
print(f"Gaps: {report['gaps']}")
for g in report['gap_details']:
    print(f"  [GAP] {g['id']}: {g['description']} — {g['evidence']}")

# compliance_dashboard.py
# Track compliance status across multiple frameworks
from datetime import datetime
import json

class ComplianceDashboard:
    """Track compliance posture across frameworks."""

    def __init__(self, organization: str):
        self.organization = organization
        self.frameworks = {}

    def add_framework(self, name: str, controls_total: int, controls_passed: int):
        """Add a framework's compliance status."""
        percentage = round(controls_passed / controls_total * 100, 1) if controls_total > 0 else 0
        self.frameworks[name] = {
            "total": controls_total,
            "passed": controls_passed,
            "percentage": percentage,
            "status": "Compliant" if percentage >= 90 else (
                "At Risk" if percentage >= 70 else "Non-Compliant"
            )
        }

    def get_overall(self) -> dict:
        """Calculate overall compliance score."""
        if not self.frameworks:
            return {"overall_percentage": 0, "status": "No frameworks tracked"}

        total = sum(f["passed"] for f in self.frameworks.values())
        max_total = sum(f["total"] for f in self.frameworks.values())
        overall = round(total / max_total * 100, 1)

        return {
            "organization": self.organization,
            "last_updated": datetime.now().isoformat(),
            "overall_percentage": overall,
            "status": "Compliant" if overall >= 90 else (
                "At Risk" if overall >= 70 else "Non-Compliant"
            ),
            "frameworks": self.frameworks
        }

# Example
dashboard = ComplianceDashboard("DodaTech")
dashboard.add_framework("SOC 2", 45, 43)
dashboard.add_framework("ISO 27001", 114, 102)
dashboard.add_framework("GDPR", 15, 14)
dashboard.add_framework("PCI-DSS", 42, 38)

print(json.dumps(dashboard.get_overall(), indent=2))