Skip to content
SARC

Compliance frameworks

SARC ships with 48 pre-loaded controls across 7 frameworks, seeded globally so every freshly-installed tenant has them on day one. Customers can also add tenant-specific overrides for any control.

Shipped frameworks

Section titled “Shipped frameworks”
FrameworkSourceControls in seedNotes
SOXSarbanes-Oxley ITGC6US-focused; baseline change-management controls
PCI-DSSPCI-DSS v4.07Payment Card Industry data security
PSD2EU 2015/2366 + RTS on SCA & CSC7Banking + payment-services-specific (Banking pack)
DORAEU 2022/25547EU operational resilience for financial sector
ISO 27001ISO 27001:20227International information security baseline
NIST 800-53NIST SP 800-53 Rev 57US Federal information systems baseline
SOC 2Trust Service Criteria (CC + A)7Vendor-side baseline for SaaS providers (Banking pack)

PSD2 + SOC 2 were added in #415 as part of the banking industry pack.

Control structure

Section titled “Control structure”

Each control is a row in ComplianceControl:

{
  id:           string   // cuid
  tenantId:     string | null   // null = global; set = tenant-specific override
  framework:    string   // one of: SOX | PCI_DSS | PSD2 | DORA | ISO27001 | NIST_800_53 | SOC2
  controlId:    string   // e.g. "SOX-CM-3", "PCI-6.3.3", "DORA-Art9-1", "PSD2-Art97-1", "SOC2-CC6.1"
  controlName:  string   // human-readable name
  description:  string   // what the control requires
  pipelineGate: string   // sast_scan | peer_review | cr_approved | dast_scan | sca_scan | secret_scan | iac_scan | container_scan | sbom_generated | audit_logged | rollback_plan | sod_check
  evidence:     string   // human-readable description of evidence produced
  mandatory:    boolean  // false for "should" controls (e.g. recovery testing)
}

The pipelineGate field is the binding between a control and the customer’s CI pipeline. When SARC computes per-framework compliance status, it looks up each control’s gate, finds the corresponding scan stage in the customer’s pipeline, and reports pass / fail / unknown.

Adding a new framework

Section titled “Adding a new framework”

The framework field is a free-form string but conventional valid values are listed in:

  • karc-portal/prisma/schema.prisma — comment on ComplianceControl.framework
  • karc-portal/src/lib/compliance/framework-meta.ts — FRAMEWORK_META + FRAMEWORK_ORDER
  • karc-portal/src/lib/compliance/status.ts — KNOWN_FRAMEWORKS

All three should agree. To add a new framework:

  1. Add to KNOWN_FRAMEWORKS
  2. Add entry to FRAMEWORK_META (label + colour) + FRAMEWORK_ORDER
  3. Add controls to karc-portal/prisma/seed-controls.ts
  4. Run the seed: cd karc-portal && npx prisma db seed

Adding tenant-specific controls

Section titled “Adding tenant-specific controls”

Tenant-specific controls are upserts with tenantId set. They override global controls with the same (framework, controlId) or add net-new controls for that tenant only. UI to manage these is on the roadmap (not yet shipped); for now they’re inserted via the seed-controls.ts pattern.

See also

Section titled “See also”