vulkro-sf compliance

Turns a scan into the compliance deliverables a team hands to an auditor or regulator. Each subcommand scans the path itself, except attest, which works on a file you already generated.

vulkro-sf compliance bundle soc2 . -o soc2-bundle.md
vulkro-sf compliance report --framework gdpr . --format markdown -o gdpr.md
vulkro-sf compliance attest soc2-bundle.md --submitter "Security team"

Subcommand	What it produces
bundle <soc2|hipaa|pci> [PATH]	Auditor package mapping findings to the framework's control families, with per-control evidence.
report --framework <sox|pci|hipaa|gdpr> [PATH]	One regulation's control report. Formats table, json, markdown.
ropa [PATH]	GDPR Article 30 Record of Processing Activities, seeded from the personal data the scan found.
hipaa-matrix [PATH]	HIPAA Security Rule safeguard matrix (45 CFR 164.308 and 164.312).
kpi [PATH]	Executive summary: health score, findings by severity, SOC 2, HIPAA and PCI control rollups.
evidence-export [PATH]	One timestamped JSON file (findings, control mappings, scan metadata) for SOC 2, ISO or FedRAMP pipelines.
attest <FILE>	SHA-256 attestation of a file, appended to ~/.vulkro-sf/attestations.log. --against <json> verifies one.
baa-verify [PATH]	Flags integrations that send data to a vendor with no recorded BAA or DPA (SF-COMPLIANCE-BAA-001).

bundle, ropa, hipaa-matrix and kpi write markdown by default (--format json for JSON). Every generator takes -o, --output <file>; otherwise it writes to stdout.

BAA registry

baa-verify reads the project's Named Credentials, connected apps and hardcoded Apex endpoints and checks each against .vulkro-sf/data-agreements.yaml (or --registry <path>):

vendors:
  - vendor: Acme Claims
    agreement: BAA
    hosts: [api.acmeclaims.example]
    components: [Acme_Claims_NC]

An integration is covered when its host contains one of the vendor's hosts, or its component name is listed.

Exit codes

Code	Meaning
0	Generated, no failing control (for attest: attested or verified).
1	At least one failing control, open risk or uncovered integration (for attest --against: hash mismatch).
2	Error (unscannable path, output not writable, bad arguments).

See also: Compliance mapping