title: Compliance packs description: Select FINTRAC, OSFI, CCCP, NIST AI RMF, HIPAA, and other packs for shadow gap discovery. audience: Compliance officers and control authors timeEstimate: 10 minutes prerequisites:
- Shadow Bouncer deployed
- Traffic fingerprints available (recommended)
Compliance packs
Compliance packs bundle observation Rego and manifest metadata that map shadow traffic to regulatory frameworks. Select packs during onboarding or in the Compliance dashboard.
Available packs (representative)
| Pack ID | Framework | Jurisdiction |
|---|---|---|
fintrac_pcmltfa | FINTRAC PCMLTFA | CA |
osfi_b13 | OSFI B-13 | CA |
osfi_e21_e23 | OSFI E-21 / E-23 | CA |
cccp_level_1 / cccp_level_2 | CCCP | CA |
pipeda_bill_c27 | PIPEDA / Bill C-27 | CA |
phipa_ontario | PHIPA | CA |
nist_ai_rmf | NIST AI RMF | US |
nist_sp_800_53 | NIST SP 800-53 | US |
hipaa_security_rule | HIPAA Security Rule | US |
soc2_tsc | SOC 2 TSC | Global |
pci_dss_v4 | PCI DSS v4 | Global |
iso_27001_2022 | ISO 27001:2022 | Global |
How relevance scoring works
Each manifest declares relevance_signals (path tokens, request/response field names). The Control Plane compares signals to observed fingerprints and recommends packs above the confidence threshold.
Packs may declare controls with pip_required: false (assessable from traffic alone) or pip_required: true (needs PIP — may show CANNOT_ASSESS until connected).
Select packs in the UI
- Complete the Getting Started wizard step Select compliance frameworks, or
- Open Compliance & Gaps and filter by pack.
Troubleshooting: If a pack never appears, check fingerprint coverage for its signal tokens (e.g. FINTRAC expects
transaction,payment,kyc). See Gap report.
Framework capability matrix
How shadow discovery → gap report → enforce maps to common frameworks. Use this when selecting packs and writing evidence narratives.
| Framework | Shadow telemetry | Fingerprints / packs | PIP-enriched controls | Enforce evidence |
|---|---|---|---|---|
| SOC 2 CC6 (logical access) | SHADOW_WOULD_DENY on privileged paths | soc2_tsc observations | IdP / HR PIPs for joiner-mover-leaver | Live DENY/mask + audit export |
| Law 25 §12 (accountability) | Would-deny/allow with control ids | PIPEDA / Law 25 pack rows | Residency + purpose attributes | PDF clause mapping + change records |
| PIPEDA (safeguards 4.7) | Shadow on PII routes | pipeda_bill_c27 | Consent / classification PIPs | Mask obligations + access logs |
| CCCP L2 / L3 | Identity & compartment gaps | cccp_level_1 / cccp_level_2 (+ L3 controls) | Clearance / compartment PIPs | Enforce + OPAL sync proof |
| OSFI B-13 | Wire / privileged / AI prompt gaps | osfi_b13, osfi_e21_e23 | Workday certs, model risk register | Promote playbook + post-enforce verify |
| NIST AI RMF | Prompt/tool shadow events | nist_ai_rmf | Clearance + AI attestation PIPs | Guardrail decisions in audit |
CANNOT_ASSESS means the pack control needs PIP data not yet connected — continue discovery and track in the compliance report.
Next steps: Gap report