🏰
Regulated Industries Patterns
Patterns for organizations in regulated industries (healthcare, finance, government) with strict compliance requirements.
Compliance Requirements
- Data residency and sovereignty
- Audit trails for all operations
- Strict access controls and data classification
- Industry-specific regulations (HIPAA, PCI-DSS, SOC2)
Recommended Patterns
Security & Compliance
- • The Permission System - Mandatory access controls
- • Authentication and Identity - Multi-factor authentication
- • Sharing and Permissions - Data classification enforcement
Architecture
- • Core Architecture - Compliance-ready foundation
- • Thread Management at Scale - Audit trail preservation
- • Data Residency - Geographic compliance
Operations
- • Observability and Monitoring - Compliance monitoring
- • Deployment Guide - Secure deployment practices
- • Incident Response - Regulatory reporting
Quality & Risk
- • Risk Assessment - Regulatory risk evaluation
- • Quality Assurance - Compliance testing
- • Change Management - Approval workflows
Key Considerations
Data Residency
Ensure data remains in compliant jurisdictions. Implement geographic controls and sovereignty requirements for sensitive data processing.
Audit Everything
Maintain comprehensive logs for all operations. Create immutable audit trails that satisfy regulatory examination requirements.
Zero-Trust Security
Assume breach and minimize blast radius. Implement defense in depth with continuous verification and least-privilege access.
Regular Compliance Audits
Continuous validation of controls with automated compliance monitoring and regular third-party assessments.
Industry-Specific Guidance
⚕️Healthcare (HIPAA)
PHI data classification
Business Associate Agreements
Minimum necessary access
💰Financial Services (PCI-DSS, SOX)
Payment card data isolation
Financial audit trails
Separation of duties
🏦Government (FedRAMP, NIST)
Security control baselines
Continuous monitoring
Incident response procedures
Compliance Implementation Framework
Phase 1: Assessment
Regulatory mapping
Gap analysis
Risk assessment
Legal review
Phase 2: Implementation
Control implementation
Policy documentation
Staff training
System hardening
Phase 3: Monitoring
Continuous monitoring
Audit preparation
Incident response
Compliance reporting