Compliance matrix

This is the canonical reference for which Vigo configcrates and Connwaer trait checks satisfy which controls in which frameworks. Use it to answer "what do I tag this configcrate with?" and "what's left to satisfy framework X?"

For how to tag configcrates and run reports, see howto/compliance-reporting.md. For per-framework regulatory checklists (HIPAA, SOC 2, PCI-DSS, NY DFS Cyber, decommissioning, incident response), see the appendix on that same page.

How to read this

Every row is a Vigo capability — a thing one or more configcrates can do, or a thing Connwaer can verify. Columns are frameworks. A cell holds the control IDs that capability satisfies in that framework. Empty cell means the capability doesn't map to that framework (or hasn't been mapped yet — file an issue).

Frameworks tracked. The version label is the currently-mapped baseline — i.e., the revision Vigo's control IDs are aligned to. The labels below are the authoritative source: they live in server/frameworks/frameworks.go (var All, the single source of truth) and the /platform/compliance page renders the same string. If you're auditing against a different revision than what's listed, cross-check the control IDs in your auditor's authoritative copy.

• HIPAA — Security Rule (45 CFR §164.302–318)
• SOC 2 — Trust Services Criteria 2017 (Security, Availability, Confidentiality)
• PCI DSS — v4.0
• NIST 800-53 — Rev. 5
• ISO/IEC 27001 — :2022 Annex A
• CIS Ubuntu — 22.04 Benchmark v2.0.0 (L1 Server profile)
• CIS Windows Server 2022 — v3.0.0 Benchmark (L1 Member Server)
• CIS RHEL — 9 Benchmark v2.0.0 (L1 Server profile)
• HITRUST CSF — v11.x
• GDPR — technical & organizational measures
• NERC CIP — v6 (electric power utilities)
• IEC 62443 — industrial control systems
• Cyber Essentials Plus — UK government scheme
• NY DFS Cyber — 23 NYCRR 500
• MiFID II — RTS 7 (trading-venue organisational requirements) + RTS 25 (clock synchronisation)
• FINRA / SEC 17a-4 — broker-dealer recordkeeping
• CCSS — Cryptocurrency Security Standard
• FDA 21 CFR Part 11 — electronic records and signatures
• SOX — public-company financial controls
• UK Gambling Commission — Remote Technical Standards
• Nevada Gaming Control Board — Reg 14 Technical Standards
• Malta Gaming Authority — Technical Infrastructure

For frameworks not listed (FedRAMP, CMMC, etc.), map them yourself using the underlying capability column — the capabilities are framework-agnostic. When a framework publishes a new revision, this list updates only after the control mappings are reviewed against the new revision; the label is the version-of-record.

Capability × framework table

Connwaer trait additions

Connwaer is a separate Alexander4 compliance-verification agent. Its docs are currently archived ahead of a dedicated location; once Connwaer ships independently, the canonical reference will live there. Connwaer adds trait-driven escalation: a control that a Vigo configcrate can't directly enforce gets satisfied if Connwaer's runtime check confirms it. Examples:

• connwaer.app-allowlisting — verifies application-allowlist enforcement (only approved binaries can execute). Satisfies NIST CM-7(5), CIS 2.5.x, HIPAA 164.312(a)(2)(ii).
• connwaer.backup-restore — verifies the restore half of backup discipline by exercising it on a schedule (a backup that can't be restored isn't a backup). Satisfies NIST CP-9(1) / CP-10, ISO A.8.13, HIPAA 164.308(a)(7)(ii)(B).
• connwaer.bcp-test — verifies business-continuity-plan exercises happened on schedule with documented outcomes. Satisfies NIST CP-4, ISO A.5.30, HITRUST 12.b.
• connwaer.capacity-monitor — verifies capacity headroom against declared thresholds (disk, memory, file descriptors). Satisfies SOC 2 A1.1, NIST CP-2(2), ISO A.8.6.
• connwaer.encryption-at-rest — verifies encryption-at-rest is actually engaged (LUKS, ZFS-native, dm-crypt, BitLocker) and the keys are managed per policy. Satisfies HIPAA 164.312(a)(2)(iv), PCI-DSS 3.4 / 3.5, NIST SC-28 / SC-28(1).
• connwaer.fim — runtime file-integrity monitoring beyond aide. Satisfies PCI-DSS 11.5, NIST SI-7 / SI-7(1) / SI-7(7).
• connwaer.hsm-lifecycle — verifies HSM key-lifecycle handling (generation, rotation, retirement, destruction). Satisfies CCSS-9.1, PCI-DSS 3.5 / 3.6, NIST SC-12 / SC-12(2).
• connwaer.integrity-monitoring — broader integrity surface than connwaer.fim: kernel modules, boot chain, service unit files. Satisfies NIST SI-7, ISO A.8.34.
• connwaer.kill-switch — verifies sub-millisecond trading-system kill switch (financial-services). Satisfies MiFID II RTS 7 Art 14, SEC Rule 15c3-5.
• connwaer.log-review — verifies logs are reviewed on a defined cadence with documented outcomes. Satisfies PCI-DSS 10.4, NIST AU-6 / AU-6(1), ISO A.8.15 / A.8.16.
• connwaer.network-segmentation — verifies segmentation between fleet partitions (CDE vs non-CDE, prod vs dev, tenant boundaries). Satisfies PCI-DSS 1.2 / 1.3, NIST SC-7, ISO A.8.22.
• connwaer.password-policy — verifies password-complexity, history, and lockout policy enforcement. Satisfies NIST IA-5 / IA-5(1), CIS 5.4.x, HIPAA 164.308(a)(5)(ii)(D).
• connwaer.privilege-escalation — verifies sudo / SeDebug / setuid policy and auditing. Satisfies NIST AC-6 / AC-6(1) / AC-6(2), PCI-DSS 7.2.1, CIS 5.2.x.
• connwaer.rng-validation — validates FIPS-approved RNG sources. Satisfies FIPS 140-3, NIST SP 800-90B.
• connwaer.sandboxing — verifies process sandboxing (systemd hardening directives, AppArmor / SELinux profiles in enforce mode, Windows sandbox). Satisfies NIST SC-39, CIS 1.x.
• connwaer.session-timeout — verifies idle-session and absolute-session timeouts on interactive shells. Satisfies HIPAA 164.312(a)(2)(iii), PCI-DSS 8.2.8, NIST AC-12.
• connwaer.snmp-collector — collects SNMP traits from network devices and tagged hosts for compliance evidence. Satisfies operational visibility requirements under most frameworks.
• connwaer.time-sync — verifies NTP/chrony health, peer reachability, drift bounds. Satisfies PCI-DSS 10.4, NIST AU-8 / AU-8(1), ISO A.12.4.4.
• connwaer.worm-verify — verifies WORM storage (immutable backups, tamper-evident archives) is actually immutable. Satisfies HIPAA 164.312(c)(1), NIST AU-9 / AU-9(2), FINRA SEC-17a-4.

Connwaer's trait outputs feed Vigo's compliance index via the same compliance: mechanism configcrates use — to an auditor reading the framework report, a control satisfied by a Vigo configcrate and a control satisfied by a Connwaer trait check are indistinguishable.

What's deliberately not claimed

Vigo's reports state what enforcement and trait collection can prove. The following classes of control are not claimed by Vigo and need external evidence:

• Process controls — business-associate agreements, vendor due-diligence, third-party risk management, incident-response playbooks (Vigo's notify actions support the IRP, they don't replace it), security awareness training, BCP exercises.
• Physical-security controls — DC physical access, environmental controls, media destruction. Map to your DC provider's SOC 2 or to your physical-security policy.
• Organizational controls — code-of-conduct, conflict-of-interest, segregation of duties at the org level.
• Sub-millisecond enforcement — controls requiring sub-millisecond response (financial-services kill switches) need Connwaer or a dedicated runtime; Vigo's check-in interval bottom is ~15 seconds.
• WORM archival of arbitrary data — Vigo's audit log is hash-chained and tamper-evident, but it isn't a WORM storage system. Pair with Connwaer's WORM verification or an external WORM store.

Honest reporting is a feature. Auditors prefer "Vigo enforces X, we attest Y separately" over "Vigo claims everything."

Confidential — Alexander4, LLC. Not for redistribution. See ../legal/license.md.