/optimize-multi-framework

description: Optimize implementation across multiple compliance frameworks

Optimize Multi-Framework

Analyzes multiple compliance frameworks to identify "implement once, satisfy many" opportunities and provides an optimized implementation roadmap.

Usage

/grc-engineer:optimize-multi-framework <frameworks> [output-format]

Arguments

• `$1` - Comma-separated list of frameworks (e.g., "SOC2,PCI-DSS,NIST,ISO")
• `$2` - Output format (optional): "roadmap", "matrix", "summary" (default: "roadmap")

Framework Codes

• `SOC2` - SOC 2 Trust Service Criteria
• `NIST` - NIST 800-53
• `ISO` - ISO 27001
• `PCI` or `PCI-DSS` - PCI DSS v4.0.1
• `CIS` - CIS Controls v8
• `CMMC` - CMMC 2.0
• `FedRAMP` - FedRAMP (uses NIST 800-53)
• `HITRUST` - HITRUST CSF
• `GDPR` - GDPR
• `HIPAA` - HIPAA

Examples

# Optimize for SOC2 + PCI-DSS
/grc-engineer:optimize-multi-framework SOC2,PCI-DSS

# Detailed roadmap for 4 frameworks
/grc-engineer:optimize-multi-framework SOC2,PCI-DSS,NIST,ISO roadmap

# Control implementation matrix
/grc-engineer:optimize-multi-framework SOC2,PCI-DSS,NIST matrix

# Quick summary
/grc-engineer:optimize-multi-framework SOC2,PCI-DSS,NIST summary

Output Formats

Roadmap (default)

Provides a phased implementation plan prioritized by ROI

Matrix

Shows control-by-control mapping across all frameworks

Summary

High-level statistics and optimization potential

Example Output (Roadmap Format)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
MULTI-FRAMEWORK OPTIMIZATION ANALYSIS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Target Frameworks: SOC2, PCI-DSS, NIST 800-53, ISO 27001
Analysis Date: 2025-01-15

FRAMEWORK DETAILS:
  ✓ SOC 2:        68 applicable controls (Trust Service Criteria)
  ✓ PCI-DSS:      329 requirements (v4.0.1)
  ✓ NIST 800-53:  325 controls (Moderate baseline)
  ✓ ISO 27001:    93 controls (Annex A)

Total Controls: 815 (if implemented separately)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
OPTIMIZATION RESULTS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Overlapping Controls Identified: 300 (83% of unique controls)
Unique Implementations Required: 362
Framework-Specific Controls: 62 (17%)

EFFORT REDUCTION:
  ❌ Without Optimization: 815 controls × 8 hours = 6,520 hours
  ✅ With Optimization:    362 controls × 8 hours = 2,896 hours

  💰 SAVINGS: 3,624 hours (56% reduction)
             ~$543,600 at $150/hour
             ~18 person-months

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
TIER 1: IMPLEMENT ONCE, SATISFY 4 FRAMEWORKS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

87 controls in this tier (40% framework coverage)
Estimated effort: 696 hours (87 × 8 hours)
ROI: 4× (implement 1, satisfy 4)

Priority: HIGHEST - Start here for maximum impact

CONTROL #1: Access Control - Account Management
  Satisfies:
    ✓ NIST AC-2 (Account Management)
    ✓ ISO A.9.2.1, A.9.2.2 (User access)
    ✓ SOC2 CC6.1 (Logical access controls)
    ✓ PCI 8.1 (User identification)

  Implementation:
    - AWS IAM with automated lifecycle
    - Quarterly access reviews (90 days)
    - Automated inactive user detection (90 days)
    - Audit logging with CloudTrail

  Effort: 40 hours
  Value: 4 frameworks × 26 total controls = 104 control-implementations

  Next steps:
    /grc-engineer:generate-implementation access_control_account_management aws

CONTROL #2: Encryption at Rest
  Satisfies:
    ✓ NIST SC-28 (Protection of information at rest)
    ✓ ISO A.10.1.1, A.10.1.2 (Cryptographic controls)
    ✓ SOC2 CC6.7 (Encryption)
    ✓ PCI 3.4, 3.5 (PAN encryption)

  Implementation:
    - AWS KMS customer-managed keys
    - AES-256 encryption
    - FIPS 140-2 Level 3 validation
    - Automated key rotation (annual)

  Effort: 24 hours
  Value: 4 frameworks × 8 controls = 32 control-implementations

  Next steps:
    /grc-engineer:generate-implementation encryption_at_rest aws

CONTROL #3: Security Logging and Monitoring
  Satisfies:
    ✓ NIST AU-2, AU-3, AU-6, AU-11 (Audit logging)
    ✓ ISO A.12.4.1-4 (Event logging)
    ✓ SOC2 CC7.2, CC7.3 (System monitoring)
    ✓ PCI 10.1-10.7 (Audit trails)

  Implementation:
    - CloudTrail (all regions, all accounts)
    - VPC Flow Logs
    - CloudWatch Logs aggregation
    - 6 months online + 6 months archived (1 year total)
    - S3 object lock for tamper-proofing

  Effort: 60 hours
  Value: 4 frameworks × 18 controls = 72 control-implementations

  Next steps:
    /grc-engineer:generate-implementation logging_and_monitoring aws

CONTROL #4: Vulnerability Management
  Satisfies:
    ✓ NIST RA-5, SI-2 (Vulnerability scanning, patching)
    ✓ ISO A.12.6.1 (Technical vulnerabilities)
    ✓ SOC2 CC7.1 (Anomaly detection)
    ✓ PCI 5.2, 6.2, 11.3 (Anti-malware, patching, scanning)

  Implementation:
    - AWS Inspector for vulnerability scanning
    - Systems Manager Patch Manager
    - Monthly internal scans
    - Quarterly external scans by ASV (PCI requirement)
    - Critical patches: 15 days, High: 30 days

  Effort: 80 hours
  Value: 4 frameworks × 12 controls = 48 control-implementations

CONTROL #5: Network Security and Segmentation
  Satisfies:
    ✓ NIST SC-7 (Boundary protection)
    ✓ ISO A.13.1.1-3 (Network controls, segregation)
    ✓ SOC2 CC6.6 (Logical access)
    ✓ PCI 1.2, 1.3 (Firewall configuration, segmentation)

  Implementation:
    - VPC with public/private subnets
    - Security Groups (deny by default)
    - Network ACLs for subnet-level filtering
    - VPC Flow Logs for monitoring
    - Semi-annual firewall rule reviews (PCI requirement)

  Effort: 50 hours
  Value: 4 frameworks × 15 controls = 60 control-implementations

... (82 more Tier 1 controls)

TIER 1 SUMMARY:
  Controls: 87
  Effort: 696 hours
  Value: 348 control-implementations
  ROI: 4.0× (implement once, satisfy 4 frameworks)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
TIER 2: IMPLEMENT ONCE, SATISFY 3 FRAMEWORKS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━