Compliance Docs Generate

Automatically generates comprehensive compliance documentation including policies, procedures, data flow diagrams, and audit-ready reports for HIPAA, GDPR, PCI DSS, and SOC 2.

What This Command Does

Instant Compliance Documentation:

• Generates framework-specific policies and procedures
• Creates data flow and network diagrams
• Produces risk assessment templates
• Builds audit-ready documentation packages
• Customizes for your organization

Output: Complete compliance documentation package

Time: 15-30 minutes (vs weeks of manual writing)

When to Use This Command

Perfect For:

• Preparing for compliance audit
• Starting compliance program
• Customer compliance questionnaire responses
• RFP security documentation requirements
• Annual compliance documentation updates

Use This When:

• Customer requests security documentation
• Auditor asks for policies and procedures
• Board asks for compliance status
• Building compliance program from scratch
• Updating existing documentation

Usage

# Generate HIPAA documentation
/compliance-docs-generate --framework hipaa

# Generate GDPR documentation
/compliance-docs-generate --framework gdpr

# Generate PCI DSS documentation
/compliance-docs-generate --framework pci

# Generate SOC 2 documentation
/compliance-docs-generate --framework soc2

# Generate all frameworks
/compliance-docs-generate --framework all

# Customize with organization details
/compliance-docs-generate --framework hipaa --org "HealthCare Inc"

Shortcut:

/cdg --framework hipaa  # Generate HIPAA docs

Generated Documentation

HIPAA Documentation Package

Policies (12 documents):

1. Security Management Process Policy
2. Workforce Security Policy
3. Information Access Management Policy
4. Security Awareness and Training Policy
5. Security Incident Response Policy
6. Contingency Planning Policy
7. Access Control Policy
8. Audit Control Policy
9. Integrity Control Policy
10. Authentication Policy
11. Transmission Security Policy
12. Business Associate Agreement Template

Procedures (8 documents):

1. Risk Assessment Procedure
2. Risk Management Procedure
3. Security Incident Response Procedure
4. Workforce Termination Procedure
5. Emergency Access Procedure
6. Password Management Procedure
7. Data Backup and Recovery Procedure
8. Breach Notification Procedure

Diagrams (3 visualizations):

1. Data Flow Diagram (PHI through systems)
2. Network Architecture Diagram
3. Incident Response Flowchart

Risk Assessment:

1. Risk Analysis Template
2. Risk Register
3. Risk Treatment Plan

Example Output:

# HIPAA Security Management Process Policy

**Document Owner:** Chief Information Security Officer
**Version:** 1.0
**Effective Date:** October 10, 2025
**Review Cycle:** Annual

## 1. Purpose

This policy establishes the framework for identifying, analyzing, and managing risks to the confidentiality, integrity, and availability of electronic Protected Health Information (ePHI) in compliance with HIPAA Security Rule §164.308(a)(1).

## 2. Scope

This policy applies to:
- All workforce members (employees, contractors, volunteers)
- All systems storing, processing, or transmitting ePHI
- All third-party business associates handling ePHI
…

GDPR Documentation Package

Policies (8 documents):

1. Data Protection Policy
2. Privacy Policy (Public-Facing)
3. Data Retention Policy
4. Data Breach Response Policy
5. Data Subject Rights Policy
6. Consent Management Policy
7. Data Transfer Policy
8. Data Processing Agreement Template

Procedures (6 documents):

1. Data Subject Access Request (DSAR) Procedure
2. Right to Erasure Procedure
3. Data Breach Notification Procedure
4. Data Protection Impact Assessment (DPIA) Procedure
5. Vendor Assessment Procedure
6. Data Inventory Procedure

Registers (3 tracking documents):

1. Data Processing Register (Article 30)
2. Consent Register
3. DSAR Request Log

Example GDPR Document:

# Data Subject Access Request (DSAR) Procedure

## 1. Purpose

To establish a procedure for handling Data Subject Access Requests (DSARs) in compliance with GDPR Article 15 (Right of Access).

## 2. Scope

This procedure applies to all requests from data subjects exercising their right to access personal data held by [Company Name].

## 3. DSAR Receipt

### 3.1 Recognition
DSARs may be received via:
- Email to [email protected]
- Written mail to registered office
- Through website privacy portal
- Verbal request (must be documented)
…

DSAR Received ↓ Log in DSAR Register ↓ Verify Identity ↓ Search All Systems ↓ Compile Personal Data ↓ Redact Third-Party Data ↓ Legal Review ↓ Generate DSAR Response ↓ Deliver to Data Subject ↓ Update DSAR Register

## 7. System Search

**Systems to Search:**
- Production database
- CRM system
- Email archives
- Support ticket system
- Marketing platform
- Analytics platform
- Third-party processors (AWS, Stripe, SendGrid)

**Search Criteria:**
- Name
- Email address
- Phone number
- User ID
- IP address
…