Security & Compliance Workflows
Version: 1.0.0 Status: Production Last Updated: December 28, 2025 Category: Security & Compliance
Workflow Overview
This document provides a comprehensive library of security and compliance H.P.006-WORKFLOWS for the CODITECT platform. These H.P.006-WORKFLOWS cover vulnerability scanning, incident response, compliance auditing, access management, and security automation. Each workflow includes detailed phase breakdowns, inputs/outputs, and success criteria to ensure robust security operations.
Inputs
| Input | Type | Required | Description |
|---|---|---|---|
scan_scope | object | Yes | Systems and assets to scan/audit |
compliance_framework | string | Yes | Target framework (SOC2, GDPR, HIPAA, PCI-DSS) |
severity_threshold | string | No | Minimum severity to report (low, medium, high, critical) |
notification_H.P.009-CONFIG | object | No | Alert and escalation H.P.009-CONFIGuration |
evidence_requirements | array | No | Required evidence for compliance |
incident_context | object | No | Context for incident response H.P.006-WORKFLOWS |
Outputs
| Output | Type | Description |
|---|---|---|
scan_id | string | Unique identifier for security scan |
findings | array | List of security findings with severity |
compliance_score | float | Compliance percentage (0-100) |
remediation_plan | object | Prioritized remediation actions |
incident_report | object | Incident details and timeline |
audit_evidence | array | Collected evidence for compliance |
Phase 1: Detection & Assessment
Initial phase detects and assesses security issues:
- Asset Discovery - Identify systems and assets in scope
- Vulnerability Scanning - Scan for known vulnerabilities
- Configuration Assessment - Check security H.P.009-CONFIGurations
- Risk Scoring - Calculate risk scores for findings
- Priority Assignment - Prioritize based on risk and exposure
Phase 2: Response & Remediation
Core phase responds to findings and implements fixes:
- Finding Triage - Review and validate findings
- Response Planning - Plan remediation or incident response
- Containment - Contain active threats
- Remediation - Apply fixes and patches
- Verification - Verify remediation effectiveness
Phase 3: Compliance & Reporting
Final phase documents compliance and generates reports:
- Evidence Collection - Gather compliance evidence
- Control Mapping - Map controls to framework requirements
- Gap Analysis - Identify compliance gaps
- Report Generation - Generate compliance reports
- Continuous Monitoring - Set up ongoing compliance monitoring
Security & Compliance Workflow Library
1. vulnerability-scanning-workflow
- Description: Automated vulnerability scanning with prioritized remediation
- Trigger: Schedule or
/security-scan - Complexity: moderate
- Duration: 15m-2h
- QA Integration: validation: required, review: required
- Dependencies:
- Agents: security-specialist, devops-engineer
- Commands: /security-scan, /vulnerability-report
- Steps:
- Scope definition - security-specialist - Define scan targets
- Scanning - security-specialist - Run vulnerability scanners
- Finding analysis - security-specialist - Analyze and deduplicate
- Risk scoring - security-specialist - Score and prioritize
- Remediation planning - devops-engineer - Create remediation plan
- Tags: [security, vulnerability, scanning, remediation]
2. incident-response-workflow
- Description: Security incident detection, containment, and resolution
- Trigger: Alert or
/incident-response - Complexity: complex
- Duration: 30m-24h
- QA Integration: validation: required, review: required
- Dependencies:
- Agents: security-specialist, incident-responder
- Commands: /incident-response, /contain-threat
- Steps:
- Detection - incident-responder - Identify and confirm incident
- Triage - security-specialist - Assess severity and scope
- Containment - incident-responder - Isolate affected systems
- Eradication - security-specialist - Remove threat
- Recovery - incident-responder - Restore normal operations
- Post-mortem - security-specialist - Document lessons learned
- Tags: [security, incident, response, soc]
3. compliance-audit-workflow
- Description: Compliance audit for SOC2, GDPR, HIPAA, PCI-DSS frameworks
- Trigger: Schedule or
/compliance-audit - Complexity: complex
- Duration: 2h-2d
- QA Integration: validation: required, review: required
- Dependencies:
- Agents: security-specialist, compliance-officer
- Commands: /compliance-audit, /collect-evidence
- Steps:
- Scope definition - compliance-officer - Define audit scope
- Control assessment - security-specialist - Evaluate controls
- Evidence collection - compliance-officer - Gather documentation
- Gap analysis - security-specialist - Identify non-compliance
- Report generation - compliance-officer - Generate audit report
- Tags: [compliance, audit, soc2, gdpr, hipaa]
4. access-review-workflow
- Description: Periodic access review and privilege management
- Trigger: Schedule (quarterly) or
/access-review - Complexity: moderate
- Duration: 1h-1d
- QA Integration: validation: required, review: required
- Dependencies:
- Agents: security-specialist, identity-manager
- Commands: /access-review, /revoke-access
- Steps:
- Access inventory - identity-manager - List all access grants
- Manager review - identity-manager - Send for manager approval
- Anomaly detection - security-specialist - Flag unusual access
- Remediation - identity-manager - Revoke unauthorized access
- Certification - security-specialist - Certify review completion
- Tags: [security, access, iam, review]
5. security-monitoring-workflow
- Description: Continuous security monitoring and threat detection
- Trigger: Continuous
- Complexity: complex
- Duration: Continuous
- QA Integration: validation: required, review: recommended
- Dependencies:
- Agents: security-specialist, soc-analyst
- Commands: /monitor-security, /threat-detect
- Steps:
- Log collection - soc-analyst - Aggregate security logs
- Correlation - soc-analyst - Correlate events across sources
- Threat detection - security-specialist - Apply detection rules
- Alert triage - soc-analyst - Triage and prioritize alerts
- Escalation - security-specialist - Escalate confirmed threats
- Tags: [security, monitoring, siem, soc]
Success Criteria
| Criterion | Target | Measurement |
|---|---|---|
| Vulnerability Detection Rate | >= 95% | Detected / Known vulnerabilities |
| Mean Time to Detect (MTTD) | < 5min | Time from event to detection |
| Mean Time to Respond (MTTR) | < 1h | Time from detection to containment |
| Compliance Score | >= 95% | Controls passing / Total controls |
| False Positive Rate | < 10% | False alerts / Total alerts |
| Patch Compliance | >= 99% | Patched systems / Total systems |
Error Handling
| Error Type | Recovery Strategy | Escalation |
|---|---|---|
| Scanner failure | Retry with different scanner | Alert security team |
| Critical vulnerability | Immediate notification | Page on-call |
| Compliance gap | Document and create remediation task | Alert compliance officer |
| Incident detected | Auto-contain and alert | Page incident response team |
| Access violation | Auto-revoke and log | Alert identity team |
Compliance Framework Mapping
| Framework | Key Controls | Workflows |
|---|---|---|
| SOC2 | Access control, monitoring, incident response | All H.P.006-WORKFLOWS |
| GDPR | Data protection, access rights, breach notification | incident-response, access-review |
| HIPAA | PHI protection, access control, audit logging | compliance-audit, access-review |
| PCI-DSS | Cardholder data, network security, monitoring | vulnerability-scanning, security-monitoring |
Related Resources
- DEVOPS-INFRASTRUCTURE-WORKFLOWS.md - Infrastructure security
- INTELLIGENT-AUTOMATION-WORKFLOWS.md - Automation patterns
- WORKFLOW-LIBRARY-INDEX.md - Complete workflow catalog
Maintainer: CODITECT Core Team Standard: CODITECT-STANDARD-WORKFLOWS v1.0.0