Regulatory Frameworks

​

Overview

​

Supported Frameworks

​

GDPR (General Data Protection Regulation)

​

Key Requirements Monitored

• Continum’s Guardian detects PII before it reaches LLMs
• Automatic redaction of personal data
• Privacy-by-default monitoring

• Continuous security monitoring
• Detection of data breaches
• Cryptographic integrity verification

• Risk level assessment for all interactions
• Automated impact analysis
• Compliance evidence generation

​

Continum Coverage

curl "https://api.continum.co/evidence/attestations/coverage?framework=GDPR" \
  -H "x-continum-key: co_your_api_key_here"

• Which GDPR articles are actively monitored
• Coverage percentage
• Recommended monitoring configurations

​

SOC 2 (Service Organization Control 2)

​

Key Requirements Monitored

• Monitoring of unauthorized access attempts
• Detection of privilege escalation
• Access pattern analysis

• Continuous monitoring of all AI interactions
• Real-time violation detection
• Incident tracking and resolution

• Monitoring of system behavior changes
• Detection of unexpected outputs
• Configuration drift detection

​

Continum Coverage

• Continuous monitoring over audit period
• Incident response documentation
• Cryptographic audit trails
• Coverage analysis reports

​

ISO 27001 (Information Security Management)

​

Key Requirements Monitored

• Detection of security vulnerabilities in outputs
• Code injection monitoring
• Secret leak detection

• Security-by-design monitoring
• Threat detection in AI outputs
• Security policy enforcement

• Automated risk assessment
• Incident classification
• Impact analysis

​

Continum Coverage

• Continuous security monitoring
• Vulnerability detection
• Incident management
• Evidence packages for auditors

​

HIPAA (Health Insurance Portability and Accountability Act)

​

Key Requirements Monitored

• Access controls and monitoring
• Incident response procedures
• Security awareness and training evidence

• Audit controls and logging
• Integrity verification
• Transmission security monitoring

• Complaint and sanction tracking
• Mitigation documentation
• Compliance evidence

​

Continum Coverage

• PHI detection and protection
• Audit trail generation
• Incident documentation
• Business Associate Agreement (BAA) support

​

CCPA (California Consumer Privacy Act)

​

Key Requirements Monitored

• Tracking of personal information processing
• Data collection monitoring
• Purpose limitation verification

• Data retention policy enforcement
• Deletion verification
• Retention compliance

• Consent verification
• Opt-out compliance monitoring
• Data sharing detection

​

EU AI Act

​

Key Requirements Monitored

• Bias detection and monitoring
• Transparency requirements
• Human oversight verification

• Manipulation detection
• Subliminal techniques monitoring
• Social scoring prevention

• AI interaction disclosure
• Deepfake detection
• Automated decision documentation

​

PCI DSS (Payment Card Industry Data Security Standard)

​

Key Requirements Monitored

• Credit card number detection
• CVV detection
• Cardholder data protection

• Comprehensive audit logging
• Access monitoring
• Incident tracking

• Continuous security testing
• Vulnerability detection
• Security monitoring

​

Framework Comparison

​

Using Framework Attestations

​

View Attestations

curl "https://api.continum.co/evidence/attestations?framework=SOC2" \
  -H "x-continum-key: co_your_api_key_here"

{
  "framework": "SOC2",
  "attestations": [
    {
      "signalId": "sig_123",
      "requirementId": "CC6.1",
      "requirementClause": "CC6.1 - Logical and physical access controls",
      "sandboxType": "SECURITY_AUDIT",
      "timestamp": "2024-03-15T10:30:00Z"
    },
    {
      "signalId": "sig_124",
      "requirementId": "CC7.2",
      "requirementClause": "CC7.2 - System monitoring",
      "sandboxType": "AGENT_SAFETY",
      "timestamp": "2024-03-15T11:00:00Z"
    }
  ]
}

​

Coverage Analysis

curl "https://api.continum.co/evidence/attestations/coverage?framework=GDPR" \
  -H "x-continum-key: co_your_api_key_here"

{
  "framework": "GDPR",
  "totalRequirements": 42,
  "coveredRequirements": 38,
  "coveragePercentage": 90.5,
  "uncoveredRequirements": [
    {
      "requirementId": "Art33",
      "clause": "Article 33 - Notification of personal data breach",
      "recommendation": "Enable incident notification webhooks"
    }
  ],
  "activeSandboxTypes": ["PII_DETECTION", "SECURITY_AUDIT"],
  "recommendedSandboxTypes": ["BIAS_DETECTION"]
}

​

Evidence Package Generation

curl -X POST "https://api.continum.co/evidence/packages" \
  -H "x-continum-key: co_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "framework": "SOC2",
    "startDate": "2024-01-01T00:00:00Z",
    "endDate": "2024-12-31T23:59:59Z",
    "includeIncidents": true,
    "includeHashChain": true
  }'

• Executive summary
• Requirement coverage analysis
• Compliance attestations
• Incident reports
• Hash chain verification
• Recommendations

​

Multi-Framework Compliance

const continum = new Continum({
  continumKey: process.env.CONTINUM_KEY,
  apiKeys: { openai: process.env.OPENAI_API_KEY }
});

// Create sandbox with multiple frameworks
await fetch('https://api.continum.co/sandboxes', {
  method: 'POST',
  headers: {
    'x-continum-key': process.env.CONTINUM_KEY,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: 'Multi-Framework Compliance',
    slug: 'multi-compliance',
    sandboxType: 'FULL_SPECTRUM',
    regulations: ['GDPR', 'SOC2', 'HIPAA', 'ISO27001']
  })
});

​

Compliance Policies

curl -X POST "https://api.continum.co/evidence/policies" \
  -H "x-continum-key: co_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "GDPR Article 32 Compliance",
    "description": "Enforce security of processing requirements",
    "detectionCriteria": {
      "violationTypes": ["PII_EXPOSURE", "SECURITY_VULNERABILITY"],
      "riskLevels": ["HIGH", "CRITICAL"],
      "regulations": ["GDPR"]
    },
    "active": true
  }'

​

Auditor Access

# Create auditor token with specific permissions
curl -X POST "https://api.continum.co/auditor/tokens" \
  -H "x-continum-key: co_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "auditorEmail": "auditor@firm.com",
    "permissions": ["READ_SIGNALS", "READ_ATTESTATIONS", "DOWNLOAD_PACKAGES"],
    "frameworks": ["SOC2"],
    "expiresAt": "2024-12-31T23:59:59Z"
  }'

​

Best Practices

​

Framework Selection

• SaaS Companies: SOC 2, GDPR, ISO 27001
• Healthcare: HIPAA, GDPR, ISO 27001
• E-commerce: PCI DSS, GDPR, CCPA
• Financial Services: SOC 2, ISO 27001, PCI DSS
• EU Operations: GDPR, EU AI Act, ISO 27001

​

Coverage Monitoring

1. Review coverage reports monthly
2. Address gaps in monitoring
3. Update sandbox configurations
4. Validate regulatory mappings

​

Evidence Generation

• Quarterly for internal reviews
• Annually for compliance audits
• On-demand for regulatory submissions
• Before certification assessments

​

Continuous Compliance

• Real-time monitoring
• Automated attestations
• Incident tracking
• Regular verification

​

Compliance Roadmap

​

Current Support

• GDPR (Full)
• SOC 2 (Full)
• ISO 27001 (Full)
• HIPAA (Full)
• CCPA (Full)
• EU AI Act (Full)
• PCI DSS (Full)

​

Coming Soon

• NIST Cybersecurity Framework
• FedRAMP
• CMMC (Cybersecurity Maturity Model Certification)
• PIPEDA (Canada)
• LGPD (Brazil)

​

Next Steps