adpa-enterprise-framework-automation
Version:
Modular, standards-compliant Node.js/TypeScript automation framework for enterprise requirements, project, and data management. Provides CLI and API for BABOK v3, PMBOK 7th Edition, and DMBOK 2.0 (in progress). Production-ready Express.js API with TypeSpe
623 lines • 26.4 kB
JavaScript
/**
* Compliance Validation Service
*
* Comprehensive service for validating documents against compliance considerations
* and enterprise governance policies to ensure regulatory requirements are met.
*/
import { logger } from '../utils/logger.js';
import { StandardsComplianceAnalysisEngine } from '../modules/standardsCompliance/StandardsComplianceEngine.js';
import { PMBOKValidator } from '../modules/pmbokValidation/PMBOKValidator.js';
import { ISO15408Validator } from '../modules/standardsCompliance/ISO15408Validator.js';
/**
* Comprehensive Compliance Validation Service
*/
export class ComplianceValidationService {
standardsEngine;
pmbokValidator;
iso15408Validator;
config;
constructor(config) {
this.config = config;
// Initialize standards compliance engine
const standardsConfig = {
enabledStandards: config.enabledStandards.filter((s) => ["BABOK_V3", "PMBOK_7", "DMBOK_2", "ISO_15408"].includes(s)),
analysisDepth: 'COMPREHENSIVE',
generateExecutiveSummary: true,
intelligentDeviationThreshold: 0.7,
riskToleranceLevel: 'MEDIUM',
includeRecommendations: true,
outputFormat: 'JSON'
};
this.standardsEngine = new StandardsComplianceAnalysisEngine(standardsConfig);
this.pmbokValidator = new PMBOKValidator('generated-documents');
this.iso15408Validator = new ISO15408Validator('generated-documents');
logger.info('🔒 Compliance Validation Service initialized');
}
/**
* Validate document compliance against all configured standards and policies
*/
async validateDocumentCompliance(documentId, documentType, content, projectData) {
logger.info(`🔍 Starting compliance validation for document: ${documentId}`);
try {
// Perform governance policy validation
const governancePolicyCompliance = await this.validateGovernancePolicies(content, documentType);
// Perform regulatory compliance validation
const regulatoryCompliance = await this.validateRegulatoryCompliance(content, documentType, projectData);
// Perform enterprise standards validation
const enterpriseStandardsCompliance = await this.validateEnterpriseStandards(content, documentType);
// Calculate overall compliance score
const complianceScore = this.calculateOverallComplianceScore(governancePolicyCompliance, regulatoryCompliance, enterpriseStandardsCompliance);
// Determine compliance status
const complianceStatus = this.determineComplianceStatus(complianceScore);
// Generate issues and recommendations
const { issues, recommendations } = this.generateComplianceFindings(governancePolicyCompliance, regulatoryCompliance, enterpriseStandardsCompliance);
const validation = {
documentId,
documentType,
content,
complianceScore,
complianceStatus,
validationDate: new Date(),
issues,
recommendations,
governancePolicyCompliance,
regulatoryCompliance,
enterpriseStandardsCompliance
};
logger.info(`✅ Compliance validation completed for ${documentId}. Score: ${complianceScore}%`);
return validation;
}
catch (error) {
logger.error(`❌ Compliance validation failed for ${documentId}:`, error);
throw new Error(`Compliance validation failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
}
}
/**
* Validate governance policies compliance
*/
async validateGovernancePolicies(content, documentType) {
const policyChecks = [];
const missingPolicies = [];
const policyViolations = [];
// Get applicable policies for document type
const applicablePolicies = this.config.governancePolicies.filter(policy => this.isPolicyApplicable(policy, documentType));
for (const policy of applicablePolicies) {
const check = await this.validatePolicy(policy, content);
policyChecks.push(check);
if (!check.compliant) {
if (policy.mandatory) {
policyViolations.push({
violationId: `violation-${policy.policyId}-${Date.now()}`,
policyId: policy.policyId,
severity: 'HIGH',
description: `Mandatory policy '${policy.name}' not satisfied`,
impact: 'MAJOR',
remediation: `Ensure document includes required elements: ${policy.requirements.join(', ')}`
});
}
else {
missingPolicies.push(policy.name);
}
}
}
const overallCompliance = policyViolations.length === 0;
return {
overallCompliance,
policyChecks,
missingPolicies,
policyViolations
};
}
/**
* Validate regulatory compliance
*/
async validateRegulatoryCompliance(content, documentType, projectData) {
const applicableRegulations = [];
const complianceGaps = [];
// Get applicable regulatory frameworks
const frameworks = this.getApplicableRegulatoryFrameworks(projectData);
for (const framework of frameworks) {
const regulation = await this.validateRegulation(framework, content, documentType);
applicableRegulations.push(regulation);
// Identify compliance gaps
for (const requirement of regulation.requirements) {
if (!requirement.compliant) {
complianceGaps.push({
gapId: `gap-${framework.frameworkId}-${requirement.requirementId}`,
regulationId: framework.frameworkId,
description: `Non-compliance with ${framework.name}: ${requirement.description}`,
severity: 'HIGH',
impact: 'MAJOR',
remediation: `Address requirement: ${requirement.description}`,
timeline: '30 days'
});
}
}
}
// Perform risk assessment
const riskAssessment = this.assessRegulatoryRisk(complianceGaps);
const overallCompliance = complianceGaps.length === 0;
return {
overallCompliance,
applicableRegulations,
complianceGaps,
riskAssessment
};
}
/**
* Validate enterprise standards compliance
*/
async validateEnterpriseStandards(content, documentType) {
const standardsChecks = [];
const deviations = [];
const improvementAreas = [];
// Get applicable enterprise standards
const applicableStandards = this.config.enterpriseStandards.filter(standard => this.isStandardApplicable(standard, documentType));
for (const standard of applicableStandards) {
const check = await this.validateEnterpriseStandard(standard, content);
standardsChecks.push(check);
// Identify deviations
for (const requirement of check.requirements) {
if (!requirement.compliant) {
deviations.push({
deviationId: `dev-${standard.standardId}-${requirement.requirementId}`,
standardId: standard.standardId,
description: `Non-compliance with ${standard.name}: ${requirement.description}`,
severity: 'MEDIUM',
justification: 'Document does not meet standard requirement',
approved: false
});
}
}
// Identify improvement areas
if (check.score < 80) {
improvementAreas.push({
areaId: `improve-${standard.standardId}`,
description: `Improve compliance with ${standard.name}`,
priority: 'HIGH',
recommendations: [
`Review and update document to meet ${standard.name} requirements`,
'Implement quality assurance processes',
'Provide training on enterprise standards'
],
estimatedEffort: '2-4 weeks'
});
}
}
const overallCompliance = deviations.length === 0;
return {
overallCompliance,
standardsChecks,
deviations,
improvementAreas
};
}
/**
* Calculate overall compliance score
*/
calculateOverallComplianceScore(governance, regulatory, enterprise) {
const governanceScore = governance.overallCompliance ? 100 :
Math.max(0, 100 - (governance.policyViolations.length * 20));
const regulatoryScore = regulatory.overallCompliance ? 100 :
Math.max(0, 100 - (regulatory.complianceGaps.length * 15));
const enterpriseScore = enterprise.overallCompliance ? 100 :
enterprise.standardsChecks.reduce((sum, check) => sum + check.score, 0) /
Math.max(1, enterprise.standardsChecks.length);
// Weighted average: governance 40%, regulatory 40%, enterprise 20%
return Math.round((governanceScore * 0.4) + (regulatoryScore * 0.4) + (enterpriseScore * 0.2));
}
/**
* Determine compliance status based on score
*/
determineComplianceStatus(score) {
if (score >= 95)
return 'FULLY_COMPLIANT';
if (score >= 85)
return 'MOSTLY_COMPLIANT';
if (score >= 70)
return 'PARTIALLY_COMPLIANT';
return 'NON_COMPLIANT';
}
/**
* Generate compliance findings (issues and recommendations)
*/
generateComplianceFindings(governance, regulatory, enterprise) {
const issues = [];
const recommendations = [];
// Generate issues from governance violations
governance.policyViolations.forEach(violation => {
issues.push({
id: violation.violationId,
severity: violation.severity,
category: 'GOVERNANCE',
description: violation.description,
requirement: 'Enterprise Governance Policy',
currentState: 'Non-compliant',
expectedState: 'Compliant',
impact: violation.impact,
recommendation: violation.remediation,
effort: {
hours: 8,
cost: 1000,
resources: [{ type: 'PERSONNEL', skill: 'Compliance Officer', quantity: 1, duration: '1 week' }],
duration: '1 week',
complexity: 'MEDIUM'
}
});
});
// Generate issues from regulatory gaps
regulatory.complianceGaps.forEach(gap => {
issues.push({
id: gap.gapId,
severity: gap.severity,
category: 'REGULATORY',
description: gap.description,
requirement: 'Regulatory Compliance',
currentState: 'Non-compliant',
expectedState: 'Compliant',
impact: gap.impact,
recommendation: gap.remediation,
effort: {
hours: 16,
cost: 2000,
resources: [{ type: 'PERSONNEL', skill: 'Legal Counsel', quantity: 1, duration: gap.timeline }],
duration: gap.timeline,
complexity: 'HIGH'
}
});
});
// Generate recommendations from improvement areas
enterprise.improvementAreas.forEach(area => {
recommendations.push({
id: area.areaId,
priority: area.priority,
category: 'ENTERPRISE_STANDARDS',
description: area.description,
rationale: 'Improve enterprise standards compliance',
implementation: area.recommendations,
benefits: ['Improved compliance', 'Reduced risk', 'Better quality'],
risks: ['Resource constraints', 'Timeline pressure'],
effort: {
hours: 40,
cost: 5000,
resources: [{ type: 'PERSONNEL', skill: 'Standards Team', quantity: 2, duration: area.estimatedEffort }],
duration: area.estimatedEffort,
complexity: 'MEDIUM'
},
timeline: area.estimatedEffort
});
});
return { issues, recommendations };
}
// Helper methods for validation logic
isPolicyApplicable(policy, documentType) {
// Logic to determine if a policy applies to a specific document type
const applicableCategories = ['ALL', documentType.toUpperCase()];
return applicableCategories.includes(policy.category.toUpperCase());
}
async validatePolicy(policy, content) {
const evidence = [];
let compliant = true;
// Check each requirement
for (const requirement of policy.requirements) {
if (!this.contentContainsRequirement(content, requirement)) {
compliant = false;
}
else {
evidence.push(`Found evidence of: ${requirement}`);
}
}
return {
policyId: policy.policyId,
policyName: policy.name,
compliant,
severity: policy.mandatory ? 'HIGH' : 'MEDIUM',
description: `Validation of ${policy.name} policy`,
evidence
};
}
getApplicableRegulatoryFrameworks(projectData) {
if (!projectData) {
return this.config.regulatoryFrameworks;
}
return this.config.regulatoryFrameworks.filter(framework => framework.applicableIndustries.includes(projectData.industry) ||
framework.applicableIndustries.includes('ALL'));
}
async validateRegulation(framework, content, documentType) {
const requirements = [];
for (const req of framework.requirements) {
const compliant = this.contentContainsRequirement(content, req.description);
const evidence = compliant ? [`Found compliance evidence for: ${req.description}`] : [];
const gaps = compliant ? [] : [`Missing: ${req.description}`];
requirements.push({
requirementId: req.requirementId,
description: req.description,
compliant,
evidence,
gaps
});
}
const compliant = requirements.every(req => req.compliant);
return {
regulationId: framework.frameworkId,
name: framework.name,
jurisdiction: framework.jurisdiction,
compliant,
requirements
};
}
assessRegulatoryRisk(gaps) {
const riskFactors = gaps.map(gap => ({
factorId: gap.gapId,
description: gap.description,
probability: 0.7, // 70% probability of regulatory action
impact: gap.impact,
riskLevel: gap.severity === 'CRITICAL' ? 'VERY_HIGH' :
gap.severity === 'HIGH' ? 'HIGH' : 'MEDIUM'
}));
const overallRisk = gaps.length === 0 ? 'VERY_LOW' :
gaps.some(g => g.severity === 'CRITICAL') ? 'VERY_HIGH' :
gaps.some(g => g.severity === 'HIGH') ? 'HIGH' : 'MEDIUM';
const mitigationStrategies = [
{
strategyId: 'legal-review',
description: 'Conduct comprehensive legal review',
effectiveness: 0.9,
implementationCost: 10000,
timeline: '2-4 weeks'
},
{
strategyId: 'compliance-training',
description: 'Implement compliance training program',
effectiveness: 0.8,
implementationCost: 5000,
timeline: '4-6 weeks'
}
];
return {
overallRisk,
riskFactors,
mitigationStrategies
};
}
isStandardApplicable(standard, documentType) {
// Logic to determine if a standard applies to a specific document type
const applicableCategories = ['ALL', documentType.toUpperCase()];
return applicableCategories.includes(standard.category.toUpperCase());
}
async validateEnterpriseStandard(standard, content) {
const requirements = [];
let totalScore = 0;
for (const req of standard.requirements) {
const compliant = this.contentContainsRequirement(content, req.description);
const evidence = compliant ? [`Found compliance evidence for: ${req.description}`] : [];
requirements.push({
requirementId: req.requirementId,
description: req.description,
compliant,
evidence
});
if (compliant)
totalScore += 100;
}
const score = requirements.length > 0 ? totalScore / requirements.length : 0;
const compliant = requirements.every(req => req.compliant);
return {
standardId: standard.standardId,
standardName: standard.name,
category: standard.category,
compliant,
score,
requirements
};
}
contentContainsRequirement(content, requirement) {
// Simple keyword-based validation - can be enhanced with NLP
const keywords = requirement.toLowerCase().split(' ').filter(word => word.length > 3);
const contentLower = content.toLowerCase();
// Require at least 70% of keywords to be present
const foundKeywords = keywords.filter(keyword => contentLower.includes(keyword));
return foundKeywords.length >= (keywords.length * 0.7);
}
/**
* Get default compliance validation configuration
*/
static getDefaultConfig() {
return {
enabledStandards: ['BABOK_V3', 'PMBOK_7', 'DMBOK_2', 'ISO_15408'],
governancePolicies: [
{
policyId: 'GOV-001',
name: 'Document Quality Standards',
category: 'ALL',
mandatory: true,
requirements: [
'Executive summary',
'Clear objectives',
'Risk assessment',
'Stakeholder analysis',
'Approval process'
],
validationCriteria: [
'Document structure follows template',
'All required sections present',
'Content quality meets standards'
]
},
{
policyId: 'GOV-002',
name: 'Data Governance Policy',
category: 'DATA',
mandatory: true,
requirements: [
'Data classification',
'Privacy considerations',
'Data retention policy',
'Access controls',
'Data quality standards'
],
validationCriteria: [
'Data handling procedures defined',
'Privacy impact assessment included',
'Compliance with data protection regulations'
]
},
{
policyId: 'GOV-003',
name: 'Security Governance Policy',
category: 'SECURITY',
mandatory: true,
requirements: [
'Security requirements',
'Threat assessment',
'Security controls',
'Incident response',
'Security monitoring'
],
validationCriteria: [
'Security framework alignment',
'Risk-based security approach',
'Compliance with security standards'
]
}
],
regulatoryFrameworks: [
{
frameworkId: 'GDPR',
name: 'General Data Protection Regulation',
jurisdiction: 'EU',
applicableIndustries: ['ALL'],
requirements: [
{
requirementId: 'GDPR-001',
description: 'Data protection by design and by default',
compliant: false,
evidence: [],
gaps: []
},
{
requirementId: 'GDPR-002',
description: 'Privacy impact assessment',
compliant: false,
evidence: [],
gaps: []
},
{
requirementId: 'GDPR-003',
description: 'Data subject rights',
compliant: false,
evidence: [],
gaps: []
}
]
},
{
frameworkId: 'SOX',
name: 'Sarbanes-Oxley Act',
jurisdiction: 'US',
applicableIndustries: ['FINANCIAL_SERVICES'],
requirements: [
{
requirementId: 'SOX-001',
description: 'Internal controls over financial reporting',
compliant: false,
evidence: [],
gaps: []
},
{
requirementId: 'SOX-002',
description: 'Management assessment of controls',
compliant: false,
evidence: [],
gaps: []
}
]
}
],
enterpriseStandards: [
{
standardId: 'ENT-001',
name: 'Enterprise Architecture Standards',
category: 'TECHNICAL',
version: '1.0',
requirements: [
{
requirementId: 'ENT-001-001',
description: 'Architecture documentation standards',
compliant: false,
evidence: []
},
{
requirementId: 'ENT-001-002',
description: 'Technology stack compliance',
compliant: false,
evidence: []
}
]
},
{
standardId: 'ENT-002',
name: 'Project Management Standards',
category: 'PROJECT',
version: '2.0',
requirements: [
{
requirementId: 'ENT-002-001',
description: 'Project charter requirements',
compliant: false,
evidence: []
},
{
requirementId: 'ENT-002-002',
description: 'Stakeholder engagement standards',
compliant: false,
evidence: []
}
]
}
],
validationRules: [
{
ruleId: 'RULE-001',
name: 'Mandatory Sections Check',
category: 'STRUCTURE',
severity: 'HIGH',
condition: 'Document must contain all mandatory sections',
action: 'Flag as non-compliant if missing mandatory sections'
},
{
ruleId: 'RULE-002',
name: 'Quality Threshold Check',
category: 'QUALITY',
severity: 'MEDIUM',
condition: 'Document quality score must be above 70%',
action: 'Recommend improvements if below threshold'
}
],
riskThresholds: [
{
category: 'GOVERNANCE',
low: 20,
medium: 50,
high: 80,
critical: 95
},
{
category: 'REGULATORY',
low: 15,
medium: 40,
high: 70,
critical: 90
},
{
category: 'ENTERPRISE',
low: 25,
medium: 55,
high: 85,
critical: 95
}
]
};
}
}
//# sourceMappingURL=ComplianceValidationService.js.map