Security & Compliance Workflows
Version: 1.0.0 Status: Production Last Updated: December 28, 2025 Category: Security & Compliance
Workflow Overview
This document provides a comprehensive library of security and compliance workflows for the CODITECT platform. These workflows cover vulnerability scanning, incident response, compliance auditing, access management, and security automation. Each workflow includes detailed phase breakdowns, inputs/outputs, and success criteria to ensure robust security operations.
Inputs
| Input | Type | Required | Description |
|---|---|---|---|
scan_scope | object | Yes | Systems and assets to scan/audit |
compliance_framework | string | Yes | Target framework (SOC2, GDPR, HIPAA, PCI-DSS) |
severity_threshold | string | No | Minimum severity to report (low, medium, high, critical) |
notification_config | object | No | Alert and escalation configuration |
evidence_requirements | array | No | Required evidence for compliance |
incident_context | object | No | Context for incident response workflows |
Outputs
| Output | Type | Description |
|---|---|---|
scan_id | string | Unique identifier for security scan |
findings | array | List of security findings with severity |
compliance_score | float | Compliance percentage (0-100) |
remediation_plan | object | Prioritized remediation actions |
incident_report | object | Incident details and timeline |
audit_evidence | array | Collected evidence for compliance |
Phase 1: Detection & Assessment
Initial phase detects and assesses security issues:
- Asset Discovery - Identify systems and assets in scope
- Vulnerability Scanning - Scan for known vulnerabilities
- Configuration Assessment - Check security configurations
- Risk Scoring - Calculate risk scores for findings
- Priority Assignment - Prioritize based on risk and exposure
Phase 2: Response & Remediation
Core phase responds to findings and implements fixes:
- Finding Triage - Review and validate findings
- Response Planning - Plan remediation or incident response
- Containment - Contain active threats
- Remediation - Apply fixes and patches
- Verification - Verify remediation effectiveness
Phase 3: Compliance & Reporting
Final phase documents compliance and generates reports:
- Evidence Collection - Gather compliance evidence
- Control Mapping - Map controls to framework requirements
- Gap Analysis - Identify compliance gaps
- Report Generation - Generate compliance reports
- Continuous Monitoring - Set up ongoing compliance monitoring
Security & Compliance Workflow Library
1. vulnerability-scanning-workflow
- Description: Automated vulnerability scanning with prioritized remediation
- Trigger: Schedule or
/security-scan - Complexity: moderate
- Duration: 15m-2h
- QA Integration: validation: required, review: required
- Dependencies:
- Agents: security-specialist, devops-engineer
- Commands: /security-scan, /vulnerability-report
- Steps:
- Scope definition - security-specialist - Define scan targets
- Scanning - security-specialist - Run vulnerability scanners
- Finding analysis - security-specialist - Analyze and deduplicate
- Risk scoring - security-specialist - Score and prioritize
- Remediation planning - devops-engineer - Create remediation plan
- Tags: [security, vulnerability, scanning, remediation]
2. incident-response-workflow
- Description: Security incident detection, containment, and resolution
- Trigger: Alert or
/incident-response - Complexity: complex
- Duration: 30m-24h
- QA Integration: validation: required, review: required
- Dependencies:
- Agents: security-specialist, incident-responder
- Commands: /incident-response, /contain-threat
- Steps:
- Detection - incident-responder - Identify and confirm incident
- Triage - security-specialist - Assess severity and scope
- Containment - incident-responder - Isolate affected systems
- Eradication - security-specialist - Remove threat
- Recovery - incident-responder - Restore normal operations
- Post-mortem - security-specialist - Document lessons learned
- Tags: [security, incident, response, soc]
3. compliance-audit-workflow
- Description: Compliance audit for SOC2, GDPR, HIPAA, PCI-DSS frameworks
- Trigger: Schedule or
/compliance-audit - Complexity: complex
- Duration: 2h-2d
- QA Integration: validation: required, review: required
- Dependencies:
- Agents: security-specialist, compliance-officer
- Commands: /compliance-audit, /collect-evidence
- Steps:
- Scope definition - compliance-officer - Define audit scope
- Control assessment - security-specialist - Evaluate controls
- Evidence collection - compliance-officer - Gather documentation
- Gap analysis - security-specialist - Identify non-compliance
- Report generation - compliance-officer - Generate audit report
- Tags: [compliance, audit, soc2, gdpr, hipaa]
4. access-review-workflow
- Description: Periodic access review and privilege management
- Trigger: Schedule (quarterly) or
/access-review - Complexity: moderate
- Duration: 1h-1d
- QA Integration: validation: required, review: required
- Dependencies:
- Agents: security-specialist, identity-manager
- Commands: /access-review, /revoke-access
- Steps:
- Access inventory - identity-manager - List all access grants
- Manager review - identity-manager - Send for manager approval
- Anomaly detection - security-specialist - Flag unusual access
- Remediation - identity-manager - Revoke unauthorized access
- Certification - security-specialist - Certify review completion
- Tags: [security, access, iam, review]
5. security-monitoring-workflow
- Description: Continuous security monitoring and threat detection
- Trigger: Continuous
- Complexity: complex
- Duration: Continuous
- QA Integration: validation: required, review: recommended
- Dependencies:
- Agents: security-specialist, soc-analyst
- Commands: /monitor-security, /threat-detect
- Steps:
- Log collection - soc-analyst - Aggregate security logs
- Correlation - soc-analyst - Correlate events across sources
- Threat detection - security-specialist - Apply detection rules
- Alert triage - soc-analyst - Triage and prioritize alerts
- Escalation - security-specialist - Escalate confirmed threats
- Tags: [security, monitoring, siem, soc]
Success Criteria
| Criterion | Target | Measurement |
|---|---|---|
| Vulnerability Detection Rate | >= 95% | Detected / Known vulnerabilities |
| Mean Time to Detect (MTTD) | < 5min | Time from event to detection |
| Mean Time to Respond (MTTR) | < 1h | Time from detection to containment |
| Compliance Score | >= 95% | Controls passing / Total controls |
| False Positive Rate | < 10% | False alerts / Total alerts |
| Patch Compliance | >= 99% | Patched systems / Total systems |
Error Handling
| Error Type | Recovery Strategy | Escalation |
|---|---|---|
| Scanner failure | Retry with different scanner | Alert security team |
| Critical vulnerability | Immediate notification | Page on-call |
| Compliance gap | Document and create remediation task | Alert compliance officer |
| Incident detected | Auto-contain and alert | Page incident response team |
| Access violation | Auto-revoke and log | Alert identity team |
Compliance Framework Mapping
| Framework | Key Controls | Workflows |
|---|---|---|
| SOC2 | Access control, monitoring, incident response | All workflows |
| GDPR | Data protection, access rights, breach notification | incident-response, access-review |
| HIPAA | PHI protection, access control, audit logging | compliance-audit, access-review |
| PCI-DSS | Cardholder data, network security, monitoring | vulnerability-scanning, security-monitoring |
Related Resources
- DEVOPS-INFRASTRUCTURE-WORKFLOWS.md - Infrastructure security
- INTELLIGENT-AUTOMATION-WORKFLOWS.md - Automation patterns
- WORKFLOW-LIBRARY-INDEX.md - Complete workflow catalog
Maintainer: CODITECT Core Team Standard: CODITECT-STANDARD-WORKFLOWS v1.0.0