Compliance Readiness Matrix

Status: STUB — This document will be fully developed during Sprints 4-6 (D.2-D.4).

Purpose

Track readiness status across all three regulatory compliance frameworks, providing a single view of:

• Which controls are implemented, tested, and validated
• Which controls are in progress or planned
• Which controls have gaps requiring remediation

Readiness Status Legend

Status	Symbol	Definition
Not Started	-	Control not yet implemented
In Progress	~	Implementation underway
Implemented	+	Code complete, not validated
Validated	V	Tested and validation evidence collected
Compliant	C	Validated and approved by compliance officer

FDA 21 CFR Part 11 Readiness

To be populated during D.2 (Sprint 4-5).

Requirement	Control	Status	Evidence	Sprint
11.10(a) Validation	System validation	-	-	S4
11.10(b) Record generation	Accurate copies	-	-	S4
11.10(c) Record protection	Access controls	-	-	S4
11.10(d) Record access	Authorized access	-	-	S4
11.10(e) Audit trail	Audit logging	-	-	S4
11.50 Signature manifestations	Signature display	-	-	S4
11.70 Signature linking	Record-signature binding	-	-	S4

HIPAA Security Rule Readiness

To be populated during D.3 (Sprint 5).

SOC 2 Trust Service Criteria Readiness

To be populated during D.4 (Sprint 5-6).

Cross-Framework Control Mapping

Maps shared controls across frameworks to avoid duplicate implementation.

Related Documents

• docs/compliance/58-gap-analysis-framework.md — Gap analysis methodology
• docs/compliance/20-regulatory-compliance-matrix.md — Full regulatory requirements
• docs/operations/64-security-architecture.md — Security controls
• docs/operations/70-validation-protocol-templates.md — Validation templates