Compliance Framework Compatibility Matrix

1. Scope

This document maps HATS (H33 Attestation and Trustworthiness Standard) capabilities to nine regulatory and compliance frameworks. The mapping identifies which HATS features produce evidence relevant to each framework's control objectives.

This matrix is a technical compatibility reference. It does not constitute legal advice, certification, or a compliance guarantee. Organizations should evaluate the applicability of HATS-generated evidence within their specific regulatory context and jurisdictional requirements.

2. HATS Capability Reference

The following HATS capabilities are evaluated against each compliance framework:

Continuous Attestation

Real-time cryptographic attestation of system operations, producing immutable receipts with three post-quantum signatures per attestation event.

Governance Replay

Deterministic reconstruction of governance decisions from the attestation receipt chain. Any decision can be independently replayed from the receipt corpus to verify that it was reached under the stated policy.

Evidence Chains

Cryptographically linked sequences of attestation receipts where each receipt includes the hash of its predecessor, forming a tamper-evident chain.

Independent Verification

Third-party verifiers can validate attestation receipts without access to the attesting system's private keys. Verification requires only the public receipt and the three public keys.

Encrypted Computation

FHE-based processing that operates on encrypted data without decryption. Computation results are attested in their encrypted form.

Agent Attestation

Per-action cryptographic attestation of AI agent operations, including tool invocations, memory access, and output generation.

3. Coverage Designations

Full

HATS capabilities directly address the framework's control objective. Attestation receipts serve as primary evidence artifacts.

Partial

HATS capabilities address a subset of the control objective. Additional organizational controls or evidence sources are required for full compliance.

Indirect

HATS capabilities produce evidence that supports but does not directly satisfy the control objective. The evidence contributes to a broader compliance narrative.

N/A

The framework does not include control objectives addressable by HATS capabilities (e.g., physical security controls).

4. Primary Compatibility Matrix

Framework	Continuous Attestation	Governance Replay	Evidence Chains	Independent Verification	Encrypted Computation	Agent Attestation
SOC 2 Type II	Full	Full	Full	Full	Partial	Full
ISO 27001:2022	Full	Full	Full	Full	Partial	Partial
HIPAA Security Rule	Full	Partial	Full	Full	Full	Partial
GDPR	Partial	Full	Full	Full	Full	Indirect
PCI DSS 4.0	Full	Partial	Full	Full	Full	Indirect
NIST CSF 2.0	Full	Full	Full	Full	Partial	Full
EU AI Act	Full	Full	Full	Full	Indirect	Full
DORA	Full	Full	Full	Full	Partial	Partial
FedRAMP	Full	Partial	Full	Full	Partial	Indirect

5. Framework-Specific Notes

5.1. SOC 2 Type II

HATS attestation receipts map to SOC 2 Trust Service Criteria across all five categories (Security, Availability, Processing Integrity, Confidentiality, Privacy). Continuous attestation directly addresses the "operating effectiveness over a period of time" requirement that distinguishes Type II from Type I. Evidence chains provide the continuous monitoring artifacts that SOC 2 auditors evaluate. See the HATS-SOC 2 Crosswalk for per-criterion mappings.

5.2. ISO 27001:2022

HATS capabilities align with Annex A controls in the areas of cryptography (A.8.24), logging and monitoring (A.8.15, A.8.16), and information security event management (A.5.25). Governance replay supports the management review and continual improvement processes specified in Clauses 9 and 10. Agent attestation coverage is partial because ISO 27001 does not yet include AI-specific controls in the 2022 revision.

5.3. HIPAA Security Rule

Encrypted computation via FHE directly addresses the HIPAA requirement that ePHI be rendered unusable and unreadable during processing (45 CFR 164.312(a)(2)(iv)). Evidence chains satisfy audit control requirements (45 CFR 164.312(b)). HATS attestation receipts serve as the access log artifacts required by the Security Rule's audit provisions.

5.4. GDPR

HATS governance replay provides the decision-traceability required by GDPR Articles 13-15 (right to information about automated decision-making). Encrypted computation supports Article 25 (data protection by design) and Article 32 (security of processing). HATS does not address organizational obligations such as data subject access request (DSAR) workflow or data protection officer (DPO) appointment.

5.5. PCI DSS 4.0

HATS evidence chains satisfy PCI DSS Requirement 10 (log and monitor all access). Encrypted computation addresses Requirement 3 (protect stored account data) when cardholder data is processed under FHE. Continuous attestation supports Requirement 12.4 (formal security awareness program) by providing continuous evidence of control effectiveness.

5.6. NIST CSF 2.0

HATS provides coverage across all six NIST CSF functions (Govern, Identify, Protect, Detect, Respond, Recover). See the HATS-NIST CSF 2.0 Crosswalk for per-category mappings.

5.7. EU AI Act

Agent attestation directly addresses Article 14 (human oversight), Article 12 (record-keeping), and Article 13 (transparency) requirements for high-risk AI systems. Governance replay provides the decision auditability required by Article 9(8). Continuous attestation supports the post-market monitoring obligations in Article 72.

5.8. DORA

HATS evidence chains address DORA Article 12 (ICT-related incident management) by providing tamper-evident records of all system operations. Continuous attestation supports Article 8 (digital operational resilience testing). Governance replay supports Article 6 (ICT risk management framework) by enabling deterministic reconstruction of risk-relevant decisions. See the HATS-DORA Crosswalk.

5.9. FedRAMP

HATS capabilities map to NIST SP 800-53 controls referenced by FedRAMP, particularly AU (Audit and Accountability), SC (System and Communications Protection), and SI (System and Information Integrity) control families. FedRAMP authorization requires additional organizational and operational controls beyond the scope of HATS technical capabilities.