docs(compliance): advance control statuses and add operations cadence

Author: hans-esquivel

security-compliance/controls/IPOC_HIPAA_HITRUST_Applicability.md

@@ -10,14 +10,14 @@ Status legend: `Implemented`, `Partial`, `Planned`, `Not Applicable`.
 
 | Domain | Applies to IPOC | Status | Current Evidence in Code/Config | Next Action |
 |---|---|---|---|---|
-| Identity & Access Management | Yes | Partial | AuthN/AuthZ required on APIs, role/scope policies, new privileged MFA gate | Enforce MFA in non-dev and validate token claim behavior in Entra |
+| Identity & Access Management | Yes | Implemented | AuthN/AuthZ required on APIs, role/scope policies, new privileged MFA gate + production guardrail prevents privileged MFA disablement | Maintain Entra claim mapping validation and periodic privileged-role access review evidence |
 | Audit Controls | Yes | Partial | Audit event writer + audit endpoints + sensitive request logging + `security-compliance/standards/audit-log-retention-standard.md` | Implement immutable storage configuration in hosting platform and capture evidence |
 | Transmission Security | Yes | Implemented | HTTPS redirection, HSTS, security headers | Add automated TLS posture verification evidence |
 | Data at Rest Encryption | Yes | Partial | Encrypted SQL connection settings in config | Document and verify DB/storage/backups encryption settings as evidence |
 | Minimum Necessary / Data Minimization | Yes | Implemented | User DTOs intentionally omit sensitive fields, redaction helpers for exports + endpoint-level evidence lifecycle fully executed (120/120 closed, 120/120 evidence approved, 0 open gaps) | Run scheduled drift-detection cycle for net-new or changed endpoints and retain release artifacts |
 | Integrity Controls | Yes | Partial | Parameterized SQL usage patterns and controlled update paths | Add tamper-evident logging strategy and integrity test cases |
 | Incident Response | Yes | Planned | Baseline roadmap exists | Add IR runbook + tabletop exercise evidence |
-| Vulnerability Management | Yes | Partial | Security CI gates workflow added (`.github/workflows/security-compliance-gates.yml`) with enforced .NET severity gate (`scripts/compliance/check-dotnet-vulnerabilities.ps1`) + initialized remediation SLA tracker (`security-compliance/controls/vulnerability-remediation-sla.csv`) | Remediate open npm high findings and record closure evidence |
+| Vulnerability Management | Yes | Implemented | Security CI gates workflow with enforced .NET severity gate (`scripts/compliance/check-dotnet-vulnerabilities.ps1`) + npm audit high gate + lockfile remediation + scheduled/manual drift checks | Continue dependency maintenance cadence and retain vulnerability closure evidence in baseline packages |
 | Vendor / Third-Party Risk | Yes | Planned | External provider telemetry exists | Add supplier risk register and annual review process |
 | Physical Safeguards | Shared Responsibility | Partial | Cloud-hosted assumptions | Track provider attestations and internal endpoint/device policy |
 | Breach Notification Readiness | Yes | Planned | Operational telemetry and audit foundations | Add breach workflow, legal escalation matrix, and drill cadence |
@@ -60,6 +60,7 @@ Status legend: `Implemented`, `Partial`, `Planned`, `Not Applicable`.
 33. Added drift response operations runbook: `security-compliance/operations/drift-failure-runbook.md` with SLA, owner routing, and recovery criteria.
 34. Added branch protection manual checklist for private repository enforcement parity: `security-compliance/operations/branch-protection-manual-checklist.md`.
 35. Added monthly compliance baseline packaging workflow `.github/workflows/compliance-baseline-package.yml` (scheduled + manual) with drift gate precondition and artifact upload.
+36. Added recurring operations cadence playbook: `security-compliance/operations/compliance-operations-cadence.md`.
 
 ## Current Endpoint Review Backlog Snapshot
 

security-compliance/operations/compliance-operations-cadence.md

@@ -0,0 +1,37 @@
+# Compliance Operations Cadence
+
+## Purpose
+
+Define recurring operational tasks to maintain HIPAA/HITRUST control posture after baseline completion.
+
+## Weekly (Every Monday)
+
+1. Review latest `security-compliance-gates` workflow run results.
+2. Verify drift gate status remains green:
+   - `Closed == Total`
+   - `EvidenceGaps == 0`
+   - `Overdue == 0`
+3. Review uploaded CI artifacts:
+   - `endpoint-compliance-executive-summary.md`
+   - `endpoint-compliance-trend.md`
+   - `endpoint-remediation-kpi.md`
+4. If drift detected, execute `security-compliance/operations/drift-failure-runbook.md`.
+
+## Monthly (1st of Month)
+
+1. Ensure `compliance-baseline-package` workflow ran successfully.
+2. Archive baseline package ZIP + manifest from workflow artifacts/releases.
+3. Confirm `security-compliance/controls/IPOC_HIPAA_HITRUST_Applicability.md` still reflects current measured state.
+
+## Per Pull Request
+
+1. Ensure `security-compliance-gates` passes prior to merge.
+2. For endpoint changes, ensure compliance cycle output remains green.
+3. If new endpoints are introduced, verify they are represented in endpoint matrix/ledger artifacts.
+
+## Ownership
+
+- Security Engineering: drift gate oversight and IAM/security controls.
+- Platform Engineering: import/streaming/resource endpoint evidence maintenance.
+- Compliance Engineering: artifact retention, evidence packaging, and periodic review logging.
+- Application Engineering: UI/API endpoint behavior changes and accompanying evidence updates.