Compliance Frameworks
Beak maps platform controls and capabilities to major regulatory and industry frameworks. This page details how each framework's requirements are addressed across the platform.
SOC 2
SOC 2 Type II compliance is supported across all five Trust Services Criteria:
| Criteria | Beak Coverage |
|---|---|
| Security | RBAC, SSO/MFA, vulnerability scanning, patch management, AI guardrails |
| Availability | Uptime monitoring, SLA tracking, failover, incident response |
| Processing Integrity | Data validation, audit trails, change management |
| Confidentiality | Encryption at rest/transit, data classification, access controls |
| Privacy | PII handling, data retention, consent management, data residency |
Evidence Collection
Beak automatically collects SOC 2 evidence including:
- Access control change logs
- Vulnerability scan reports
- Patch compliance reports
- Uptime and SLA reports
- Data access audit trails
ISO 27001
Beak supports ISO 27001 Annex A controls:
| Control Domain | Beak Capabilities |
|---|---|
| A.5 Information Security Policies | Policy management, enforcement, and audit logging |
| A.6 Organization of IS | RBAC, tenant isolation, separation of duties |
| A.8 Asset Management | ITAM inventory, classification, lifecycle management |
| A.9 Access Control | SSO, MFA, RBAC, session management, API key governance |
| A.12 Operations Security | Change management, capacity monitoring, log management |
| A.13 Communications Security | Encryption in transit, network monitoring |
| A.14 System Acquisition | Vulnerability scanning, patch management, secure deployment |
| A.16 IS Incident Management | Incident detection, response, escalation, post-mortem |
| A.18 Compliance | Compliance reporting, audit trails, evidence collection |
NIST 800-53
Beak addresses NIST 800-53 control families:
| Control Family | Key Controls Addressed |
|---|---|
| AC (Access Control) | RBAC, MFA, session controls, least privilege |
| AU (Audit) | Immutable audit logs, log retention, log review |
| CM (Configuration Management) | Asset baselines, configuration scanning, change tracking |
| IA (Identification & Auth) | SSO, MFA, credential management, session tokens |
| IR (Incident Response) | AI triage, automated response, escalation workflows |
| RA (Risk Assessment) | Vulnerability scanning, risk prioritization (CVSS+) |
| SC (System & Communications) | Encryption, network monitoring, data flow controls |
| SI (System & Information Integrity) | Patch management, malware protection, integrity monitoring |
CIS Benchmarks
Beak Security supports CIS Benchmark scanning for:
- CIS Windows Benchmarks — Configuration assessment for Windows endpoints
- CIS Linux Benchmarks — Configuration assessment for Linux servers
- CIS Cloud Benchmarks — AWS, Azure, and GCP configuration audits
- CIS Microsoft 365 Benchmarks — M365 tenant configuration review
Scan results map directly to CIS control IDs with remediation guidance.
HIPAA / HITRUST
For healthcare organizations, Beak addresses:
| HIPAA Requirement | Beak Capability |
|---|---|
| Access Controls (§164.312(a)) | RBAC, MFA, session management |
| Audit Controls (§164.312(b)) | Comprehensive audit logging, tamper-proof trails |
| Integrity (§164.312(c)) | Data validation, integrity monitoring |
| Transmission Security (§164.312(e)) | TLS encryption, secure API communication |
| Breach Notification | Security event detection, automated alerting |
HITRUST CSF control mapping is available for organizations pursuing HITRUST certification.
GDPR
For organizations handling EU personal data:
| GDPR Article | Beak Capability |
|---|---|
| Art. 5 (Data Principles) | Data minimization, purpose limitation, storage limitation |
| Art. 25 (Privacy by Design) | Built-in data protection, default privacy settings |
| Art. 30 (Records of Processing) | Audit trails documenting all data processing activities |
| Art. 32 (Security of Processing) | Encryption, access controls, regular security testing |
| Art. 33 (Breach Notification) | Security event detection, automated alerting workflows |
| Art. 35 (Impact Assessments) | Risk scoring, compliance reporting |
Data Subject Rights
Beak supports data subject rights through:
- Right to Access — Export all data associated with a user
- Right to Erasure — Delete user data across all products
- Right to Portability — Export data in standard formats (CSV, JSON)
- Right to Rectification — Edit user data through the admin interface
Custom Framework Mapping
Organizations with custom compliance requirements can create custom framework mappings:
- Navigate to Compliance & Audit > Frameworks > Custom
- Define control categories and individual controls
- Map Beak capabilities to each control
- Generate compliance reports against your custom framework
Related
- Audit Logging — Detailed audit trail documentation
- Data Privacy — Data protection and privacy controls
- Compliance Reporting — Automated report generation