HLDModulesGovernanceBuilt-in Groups
v1.2 is unreleased — see v1.1 for the current stable release.
Compliance Overview
Regulatory compliance coverage in MCM — GDPR, HIPAA, and SOC 2.
Compliance Overview
MCM provides compliance enforcement and auditing capabilities for three major regulatory frameworks. Compliance controls are implemented primarily through Cloud Custodian (cloud-level configuration policies) and Wazuh (host-level runtime monitoring).
Supported Frameworks
| Framework | Scope | Primary Tool Coverage |
|---|---|---|
| GDPR | EU personal data protection | Cloud Custodian, Wazuh |
| HIPAA | US health information protection | Cloud Custodian, Wazuh |
| SOC 2 | Service organisation security controls | Cloud Custodian, Wazuh |
Coverage Model
What tooling covers: Cloud-level misconfigurations, encryption enforcement, IAM hygiene, logging, host-based security, vulnerability scanning.
What tooling does not cover: Legal workflows, consent management, breach notification processes, training, and documentation requirements — these require organisational processes.