compliance-atoms

SOC2, HIPAA, ISO27001, PCI, GDPR mapped once with shared control families, evidence types, audit requirements, and cross-framework equivalence — ending the industry-wide redundancy of duplicate control mappings.

compliance-atoms is a *-Atoms catalog in the Convergent Systems ecosystem. It defines what exists in its domain — typed, versioned, machine-readable, composable, and open — so runtimes (and humans) can stand on shared infrastructure instead of reinventing it.

Structure

compliance-atoms/
├── ATOMS.yml              # Catalog manifest
├── atoms/                 # Reusable building blocks
├── frameworks/        # Compositions assembled from atoms
├── rules/                 # Typed constraint vocabulary
├── schemas/               # Catalog-specific JSON Schemas
├── exports/               # CI-generated machine-readable exports
└── docs/                  # Human-readable documentation

Atom types

• control-family
• control
• evidence-type
• audit-requirement

Rule types

• framework-requirement
• evidence-sufficiency
• cross-framework-equivalence

Runtime consumers

olympus, aish

How to consume

Machine-readable exports are published in exports/ on every release:

• exports/manifest.json — lightweight discovery (name, version, counts)
• exports/catalog.json — full catalog dump (every atom, composition, rule)

Exports are deterministic, signed, and versioned. See ATOMS.yml for the manifest and the conformance spec.

How to contribute

1. Read ATOMS.yml to understand the catalog's atom types, compositions, and rules.
2. Add a new atom under atoms/<type>/ or a composition under frameworks/<name>/.
3. Open a PR. CI validates the schema, references, and exports.
4. Larger structural changes go through the XAIP process.

Ecosystem

• Federation: xdao.co · github.com/convergent-systems-co/xdao
• Spec: github.com/convergent-systems-co/atoms-spec
• Tools: github.com/convergent-systems-co/atoms-tools
• Umbrella: github.com/convergent-systems-co/atoms — all catalogs as submodules
• Other catalogs: brand-atoms, service-atoms, prompt-atoms, policy-atoms, identity-atoms, compliance-atoms, workflow-atoms, agent-atoms, knowledge-atoms, event-atoms, plugin-atoms

License

Apache-2.0 — see LICENSE.