Compliance packs

Compliance packs bundle observation Rego and manifest metadata that map shadow traffic to regulatory frameworks. Select packs during onboarding or in the Compliance dashboard.

Available packs (representative)

Pack ID	Framework	Jurisdiction
`fintrac_pcmltfa`	FINTRAC PCMLTFA	CA
`fincen_bsa`	FinCEN Bank Secrecy Act (BSA/AML)	US
`osfi_b13`	OSFI B-13	CA
`osfi_e21_e23`	OSFI E-21 / E-23	CA
`osfi_e23_b10`	OSFI E-23 / B-10 (tech & cyber)	CA
`cccp_level_1` / `cccp_level_2`	CCCP	CA
`pipeda_bill_c27`	PIPEDA / Bill C-27	CA
`bill_c27_aida`	Bill C-27 / AIDA (AI & Data Act)	CA
`phipa_ontario`	PHIPA	CA
`nist_ai_rmf`	NIST AI RMF (v1)	US
`nist_ai_rmf_v2`	NIST AI RMF v2	US
`sec_cyber_disclosure`	SEC cyber disclosure rules	US
`nist_sp_800_53`	NIST SP 800-53	US
`hipaa_security_rule`	HIPAA Security Rule	US
`soc2_tsc`	SOC 2 TSC	Global
`pci_dss_v4`	PCI DSS v4	Global
`iso_27001_2022`	ISO 27001:2022	Global

How relevance scoring works

Each manifest declares relevance_signals (path tokens, request/response field names). The Control Plane compares signals to observed fingerprints and recommends packs above the confidence threshold.

Packs may declare controls with pip_required: false (assessable from traffic alone) or pip_required: true (needs PIP — may show CANNOT_ASSESS until connected).

Select packs in the UI

Complete the Getting Started wizard step Select compliance frameworks, or
Open Compliance & Gaps and filter by pack.

Troubleshooting: If a pack never appears, check fingerprint coverage for its signal tokens (e.g. FINTRAC expects transaction, payment, kyc). See Gap report.

Framework capability matrix

How shadow discovery → gap report → enforce maps to common frameworks. Use this when selecting packs and writing evidence narratives.

Framework	Shadow telemetry	Fingerprints / packs	PIP-enriched controls	Enforce evidence
SOC 2 CC6 (logical access)	`SHADOW_WOULD_DENY` on privileged paths	`soc2_tsc` observations	IdP / HR PIPs for joiner-mover-leaver	Live DENY/mask + audit export
Law 25 §12 (accountability)	Would-deny/allow with control ids	PIPEDA / Law 25 pack rows	Residency + purpose attributes	PDF clause mapping + change records
PIPEDA (safeguards 4.7)	Shadow on PII routes	`pipeda_bill_c27`	Consent / classification PIPs	Mask obligations + access logs
CCCP L2 / L3	Identity & compartment gaps	`cccp_level_1` / `cccp_level_2` (+ L3 controls)	Clearance / compartment PIPs	Enforce + Policy Bridge sync proof
OSFI B-13	Wire / privileged / AI prompt gaps	`osfi_b13`, `osfi_e21_e23`, `osfi_e23_b10`	Workday certs, model risk register	Promote playbook + post-enforce verify
Bill C-27 / AIDA	AI system & automated decision gaps	`bill_c27_aida`, `pipeda_bill_c27`	Consent / AI impact PIPs	Mask + purpose limitation in audit
SEC cyber disclosure	Material incident & risk gaps	`sec_cyber_disclosure`	GRC / incident PIPs	Enforce + executive report export
FinCEN BSA	AML / funds transfer gaps	`fincen_bsa`, `fintrac_pcmltfa`	KYC / transaction PIPs	Live deny on flagged flows
NIST AI RMF	Prompt/tool shadow events	`nist_ai_rmf`, `nist_ai_rmf_v2`	Clearance + AI attestation PIPs	Guardrail decisions in audit

CANNOT_ASSESS means the pack control needs PIP data not yet connected — continue discovery and track in the compliance report.

Next steps: Gap report