Legal and Compliance Scoping

"""
Legal and Compliance Scoping for Deception Operations.
Generates a tailored compliance checklist based on the
organization's regulatory environment.
"""
from dataclasses import dataclass
from typing import List

@dataclass
class ComplianceRequirement:
    framework: str
    requirement_id: str
    description: str
    deception_impact: str
    action_required: str

def generate_compliance_checklist(
    industries: List[str],
    regions: List[str],
    data_types: List[str],
) -> List[ComplianceRequirement]:
    """Generate deception-specific compliance requirements."""

    requirements = []

    # GDPR applies if operating in EU or handling EU citizen data
    if "europe" in regions or "eu-citizen-data" in data_types:
        requirements.extend([
            ComplianceRequirement(
                framework="GDPR",
                requirement_id="Art. 5(1)(a)",
                description="Lawfulness, fairness, transparency of processing",
                deception_impact="Synthetic data in deception environments "
                "must NOT contain real personal data of EU citizens",
                action_required="Verify all deception data is synthetically "
                "generated with no real PII. Document data generation process.",
            ),
            ComplianceRequirement(
                framework="GDPR",
                requirement_id="Art. 6",
                description="Lawful basis for processing",
                deception_impact="Logging adversary IP addresses and behavior "
                "in deception assets constitutes data processing",
                action_required="Establish legitimate interest (Art. 6(1)(f)) "
                "as lawful basis for processing adversary interaction data. "
                "Document the legitimate interest assessment.",
            ),
        ])

    # PCI DSS applies if handling payment card data
    if "financial-services" in industries or "payment-card" in data_types:
        requirements.extend([
            ComplianceRequirement(
                framework="PCI DSS v4.0",
                requirement_id="Req. 3.4",
                description="Render PAN unreadable anywhere it is stored",
                deception_impact="Decoy databases seeded with fake financial "
                "records must use synthetic card numbers that do NOT pass "
                "Luhn validation to avoid accidental PCI scope inclusion",
                action_required="Use non-Luhn-valid synthetic PANs in all "
                "deception data sets. Document this in the data generation "
                "procedure.",
            ),
        ])

    # HIPAA applies if handling health information
    if "healthcare" in industries or "phi" in data_types:
        requirements.extend([
            ComplianceRequirement(
                framework="HIPAA",
                requirement_id="164.502(a)",
                description="Uses and disclosures of PHI",
                deception_impact="Deception environments must NEVER contain "
                "real PHI. Synthetic health records must not be traceable "
                "to real individuals.",
                action_required="Use fully synthetic patient data. Run "
                "de-identification verification before deployment.",
            ),
        ])

    # General requirements for all deception operations
    requirements.extend([
        ComplianceRequirement(
            framework="Internal Policy",
            requirement_id="DEC-001",
            description="Legitimate user misdirection handling",
            deception_impact="Legitimate users may accidentally interact "
            "with deception assets, triggering false alerts",
            action_required="Document a false-positive handling procedure. "
            "Include user notification and incident closure process.",
        ),
        ComplianceRequirement(
            framework="Internal Policy",
            requirement_id="DEC-002",
            description="Evidence handling and chain of custody",
            deception_impact="Adversary interaction data captured in "
            "deception assets may be needed as legal evidence",
            action_required="Establish evidence handling procedures "
            "consistent with organizational incident response policy. "
            "Ensure log integrity through write-once storage or hashing.",
        ),
    ])

    return requirements

if __name__ == "__main__":
    checklist = generate_compliance_checklist(
        industries=["financial-services"],
        regions=["united-states", "europe"],
        data_types=["payment-card", "eu-citizen-data"],
    )
    for req in checklist:
        print(f"[{req.framework} - {req.requirement_id}]")
        print(f"  Impact:  {req.deception_impact}")
        print(f"  Action:  {req.action_required}")
        print()