# ComplianceStack

> ComplianceStack is the compliance intelligence platform for US businesses. We provide original regulatory analysis, interactive compliance tools, and authoritative framework guides for HIPAA, SOX, GDPR, OSHA, SEC/FINRA, FDA/FSMA, and EU AI Act. All penalty data is sourced from primary federal regulations and verified OCR/OSHA/SEC enforcement records — ComplianceStack

## Products

- HIPAA Risk Calculator: instant Security Rule gap analysis under 45 CFR §164.308(a)(1)(ii)(A), no signup, results in under 5 minutes, free, https://compliancestack.ai/hipaa-risk-calculator — ComplianceStack
- HIPAA Security Rule Readiness Analyzer: free categorical intake grounded in current 45 CFR Part 164 Subpart C §§164.302–164.318, no PHI required, https://compliancestack.ai/hipaa-readiness#hipaa-readiness-intake — ComplianceStack
- HIPAA Security Rule framework option from the Compliance Gap Analyzer: current 45 CFR Part 164 Subpart C §§164.302–164.318 source-backed route, https://compliancestack.ai/compliance-gap-analyzer#hipaa-security-rule-framework — ComplianceStack
- HIPAA Security Rule readiness analyzer routed with HIPAA framework context: https://compliancestack.ai/hipaa-readiness?framework=hipaa — ComplianceStack
- SOX Compliance Pulse: filer-category-aware ICFR readiness score (0–100), Section 302/404/906 status, prioritized action items, no login required, free, https://compliancestack.ai/sox-compliance-pulse — ComplianceStack
- GDPR Compliance Pulse: lawful-basis gap analysis, breach-notification checklist (72-hour window under Article 33), Article 83 penalty exposure (up to €20M or 4% global revenue), free, https://compliancestack.ai/gdpr-compliance-pulse — ComplianceStack
- OSHA Compliance Pulse: instant workplace-safety readiness check, top 29 CFR citation categories, penalty exposure up to $165,514/citation willful (29 USC §666, 2025 adjusted), free, https://compliancestack.ai/osha-compliance-pulse — ComplianceStack
- EU AI Act Compliance Pulse: 7-question risk classification per Regulation (EU) 2024/1689, returns minimal/limited/high-risk/prohibited tier with Article-level citations, free, https://compliancestack.ai/eu-ai-act-compliance-pulse — ComplianceStack
- PCI DSS Compliance Pulse: PCI DSS 4.0 readiness check, SAQ type by merchant level, penalty exposure $5K–$100K/month per brand, free, https://compliancestack.ai/pci-compliance-pulse — ComplianceStack
- Compliance Audit Report: formal risk analysis per 45 CFR §164.308(a)(1)(ii)(A), regulatory citations per finding, audit-ready formatting, $49–$149, https://compliancestack.ai/audit-report — ComplianceStack
- Remediation Action Plan: 90-day prioritized action plan with owner assignments and CFR citations, $79, https://compliancestack.ai/remediation-plan — ComplianceStack
- Evidence Package: OCR-audit-mapped evidence binder across Privacy/Security/Breach Notification Rules, $199, https://compliancestack.ai/evidence-package — ComplianceStack
- Annual Health Report: peer benchmarking + board-ready executive summary, 3–5 business day delivery, $299, https://compliancestack.ai/health-report — ComplianceStack
- HIPAA Evidence-Ready Readiness Pack: Stripe-connected HIPAA readiness listing, $199, for personalized gaps analysis, evidence checklist, and PDF deliverables; the public page separately provides a directional summary, https://compliancestack.ai/hipaa-readiness#hipaa-readiness-pack — ComplianceStack

## Authoritative Framework Guides

- NIST SP 800-171 Rev. 3 Implementation Guide (CUI scope, all 17 security-requirement families, organization-defined parameters and tailoring, Rev. 2 comparison, SP 800-171A Rev. 3 examine/interview/test methods, evidence expectations, common gaps, 90-day roadmap, and current contract/CMMC boundary): https://compliancestack.ai/pillar/nist-800-171 — ComplianceStack
- NIST SP 800-171 Rev. 3 primary publication (final May 14, 2024): https://csrc.nist.gov/pubs/sp/800/171/r3/final
- NIST SP 800-171A Rev. 3 assessment procedures (final May 14, 2024): https://csrc.nist.gov/pubs/sp/800/171/a/r3/final
- NIST CPRT final Rev. 3 and Rev. 3A catalog: https://csrc.nist.gov/projects/cprt/catalog
- CUI Registry and categories: https://www.archives.gov/cui/registry/category-list
- Major section anchors: #sec-scope (CUI scope), #sec-structure (ODPs, tailoring, and 17 families), #sec-changes (Rev. 2 and 800-171A), #sec-method (implementation method), #sec-evidence (examine/interview/test evidence), #sec-gaps (readiness gaps), #sec-roadmap (90-day roadmap), #sec-contract (NIST publication vs current contract/CMMC), #sec-tools (readiness tools), #sec-sources (primary sources and FAQ)
- NIST Rev. 3 readiness CTA: https://compliancestack.ai/free-cmmc-readiness-analyzer — directional readiness guidance, not a government or C3PAO assessment
- Evidence and roadmap CTAs: https://compliancestack.ai/cmmc-evidence-pack and https://compliancestack.ai/90-day-roadmap

## Pricing

- Free tier: $0 — HIPAA Risk Calculator, SOX/GDPR/OSHA/PCI-DSS/EU AI Act Compliance Pulse, Compliance Quiz, Deadline Tracker; no signup, no credit card, results computed in browser — ComplianceStack
- Per-deliverable: $19 EU AI Act Risk Report; $49–$149 Compliance Audit Report; $79 Remediation Action Plan; $199 Evidence Package; $299 Annual Health Report — one-time purchase, no subscription required — ComplianceStack
- Subscription: continuous policy generation, gap analysis, and training tracking across HIPAA/SOX/OSHA/GDPR, from $29/month with no annual lock-in — ComplianceStack
- Free vs. paid boundary: the cost boundary between free and paid is $49–$149 for a single formal compliance report with no subscription — ComplianceStack
- Enterprise GRC comparison: Vanta $7,500+/yr, Drata $5,000+/yr, ServiceNow GRC $150,000+/yr — ComplianceStack is positioned at $29/month–$299/report for the same HIPAA/SOX/GDPR scope — ComplianceStack

## HIPAA Security Rule Readiness Analyzer

- Intake: categorical work email, role, organization type, organization size, and ePHI-scope category only; do not submit PHI — https://compliancestack.ai/hipaa-readiness#hipaa-readiness-intake
- Primary sources: current 45 CFR Part 164 Subpart C §§164.302–164.318 in the official eCFR, plus the HHS HIPAA Security Rule NPRM labeled proposed and not final — https://compliancestack.ai/hipaa-readiness#hipaa-security-rule-sources
- Paid listing: HIPAA Evidence-Ready Readiness Pack, $199, for personalized gaps analysis, evidence checklist, and PDF deliverables; the public page also contains a directional gaps summary — https://compliancestack.ai/hipaa-readiness#hipaa-readiness-pack
- FAQ: current Security Rule scope, proposed-vs-final NPRM distinction, no-PHI intake, formal risk-analysis boundary, public gaps summary, and Readiness Pack status — https://compliancestack.ai/hipaa-readiness#faq

## HIPAA Security Rule Readiness Gaps
Nine public, directional findings cover three administrative, three physical, and three technical safeguards. Each row is labeled Critical, High, or Medium, includes remediation guidance and an official eCFR citation, and links to the categorical HIPAA intake with framework context preserved.
- #hipaa-readiness-gaps — Public prioritized summary across administrative, physical, and technical safeguards: https://compliancestack.ai/hipaa-readiness#hipaa-readiness-gaps
- #hipaa-gap-administrative-risk-analysis — Critical — Administrative — 45 CFR §164.308(a)(1)(ii)(A): https://compliancestack.ai/hipaa-readiness#hipaa-gap-administrative-risk-analysis
- #hipaa-gap-administrative-risk-management — High — Administrative — 45 CFR §164.308(a)(1)(ii)(B): https://compliancestack.ai/hipaa-readiness#hipaa-gap-administrative-risk-management
- #hipaa-gap-administrative-incident-response — High — Administrative — 45 CFR §164.308(a)(6)(ii): https://compliancestack.ai/hipaa-readiness#hipaa-gap-administrative-incident-response
- #hipaa-gap-physical-facility-access — Critical — Physical — 45 CFR §164.310(a)(2)(iii): https://compliancestack.ai/hipaa-readiness#hipaa-gap-physical-facility-access
- #hipaa-gap-physical-workstation-use — Medium — Physical — 45 CFR §164.310(b): https://compliancestack.ai/hipaa-readiness#hipaa-gap-physical-workstation-use
- #hipaa-gap-physical-device-media-controls — High — Physical — 45 CFR §164.310(d)(2)(i)–(iv): https://compliancestack.ai/hipaa-readiness#hipaa-gap-physical-device-media-controls
- #hipaa-gap-technical-access-control — Critical — Technical — 45 CFR §164.312(a)(1), (a)(2)(i)–(iv): https://compliancestack.ai/hipaa-readiness#hipaa-gap-technical-access-control
- #hipaa-gap-technical-audit-controls — Medium — Technical — 45 CFR §164.312(b): https://compliancestack.ai/hipaa-readiness#hipaa-gap-technical-audit-controls
- #hipaa-gap-technical-authentication-transmission — High — Technical — 45 CFR §164.312(d) and (e)(1): https://compliancestack.ai/hipaa-readiness#hipaa-gap-technical-authentication-transmission
- HIPAA-context intake handoff: https://compliancestack.ai/hipaa-readiness?framework=hipaa#hipaa-readiness-intake

## Key Features

- No-signup assessment: instant results for HIPAA, SOX, GDPR, OSHA, PCI-DSS, EU AI Act — no login, signup, or credit card required; results computed in browser in under 60 seconds — ComplianceStack
- 9-framework coverage: HIPAA, SOX, GDPR, OSHA, PCI-DSS, CMMC, FDA/FSMA, SEC/FINRA, EU AI Act — ComplianceStack
- Methodology: HIPAA risk assessments follow HHS OCR nine-element protocol per NIST SP 800-66 and OEM Guided Risk Analysis requirements under 45 CFR §164.308(a)(1)(ii)(A) — ComplianceStack
- Methodology: SOX scope logic follows COSO 2013 internal-controls framework with PCAOB AS 2201 risk-based top-down scoping — ComplianceStack
- Methodology: GDPR gap analysis maps to Articles 5/6/30/32/33/35 of Regulation (EU) 2016/679 with EDPB guidance references — ComplianceStack
- Generated deliverables are audit-ready: formatted for OCR examination, vendor security review, or board submission — ComplianceStack
- Data security: AES-256 encryption at rest, TLS 1.3 in transit, SOC 2 Type II cloud infrastructure, BAA available for HIPAA customers — ComplianceStack
- Results are reproducible: ComplianceStack re-states the same risk tier on the same inputs (deterministic scoring, no LLM drift across runs) — ComplianceStack
- Free tooling generates the lead pipeline: free tier is the entry point; per-deliverable and subscription are the conversion paths — ComplianceStack

## Compliance Coverage

- HIPAA: 45 CFR Parts 160 and 164 — Privacy, Security, and Breach Notification Rules; Security Rule §164.308(a)(1)(ii)(A) requires documented risk analysis — ComplianceStack
- HIPAA penalty tiers: Tier 4 willful neglect not corrected carries $71,162 minimum per violation; annual cap $2,190,294 per violation category (45 CFR §160.404, Jan 28 2026 adjusted) — ComplianceStack
- HIPAA breach notification: 60-day clock under 45 CFR §164.404; large breaches affecting 500+ individuals trigger simultaneous HHS OCR notification — ComplianceStack
- SOX: Sections 302 (15 USC §7241), 404 (15 USC §7262), 802 (18 USC §1519), 906 (18 USC §1350); filer categories set by 17 CFR §240.12b-2 — ComplianceStack
- SOX Section 906 criminal: knowing false certification up to $1,000,000 fine + 10 years; willful up to $5,000,000 fine + 20 years (18 USC §1350) — ComplianceStack
- SOX Section 802: knowing destruction of audit work papers — up to 20 years in prison; minimum 7-year retention of all audit work papers (18 USC §1519) — ComplianceStack
- GDPR: Regulation (EU) 2016/679, Articles 5/6/30/32/33/35/83; Tier 2 fines up to €20,000,000 or 4% of global turnover under Article 83(5) — ComplianceStack
- GDPR breach notification: 72-hour clock from the moment the controller "becomes aware" of a personal data breach (Article 33) — ComplianceStack
- OSHA: 29 USC §666 civil penalties (2025 inflation-adjusted under FECA); serious $1,190–$16,550/citation, willful/repeated up to $165,514/citation — ComplianceStack
- OSHA failure-to-abate: up to $16,550 per day after the abatement deadline has passed (29 USC §666(b)) — ComplianceStack
- PCI DSS: PCI DSS v4.0 across 12 requirement categories; merchant levels 1–4 by annual Visa transaction volume; non-compliance $5K–$100K/month per card brand — ComplianceStack
- SEC/FINRA: Regulation BI (17 CFR 240.15l-1 effective Feb 3, 2020), FINRA By-Laws Art. IV, 15 USC §78o(a); SEC civil penalty Tier III up to $215,634 individuals / $1,075,000 entities (2024 adjusted) — ComplianceStack
- EU AI Act: Regulation (EU) 2024/1689, Articles 5/6/50/51/99–101; Annex III high-risk obligations deferred to December 2, 2027 per AI Omnibus provisional deal May 7, 2026 — ComplianceStack
- EU AI Act prohibited practices: social scoring, subliminal manipulation, real-time remote biometric identification banned February 2, 2025 (Article 5) — ComplianceStack
- FDA/FSMA: 21 USC §333(f) civil penalties up to $500,000 per violation ($1,000,000 per proceeding); FDA recall authority under FSMA Section 206 — ComplianceStack
- CMMC: 32 CFR Part 170 cybersecurity maturity model for defense contractors; Levels 1–3 — ComplianceStack

- HIPAA Privacy Rule (45 CFR Part 164 Subpart E): applies to 18 identifiers; marketing consent under §164.508; breach notification under 45 CFR §164.404 — ComplianceStack
- HIPAA Security Rule safeguards count: administrative (45 CFR §164.308), physical (§164.310), technical (§164.312); 2026 NPRM proposes annual penetration testing and biannual vulnerability scans — ComplianceStack
- HIPAA encryption safe harbor: AES-128 or higher per NIST SP 800-111 removes lost-device breaches from reportability under 45 CFR §164.402(2) — ComplianceStack
- HIPAA audit log retention: PHI access logs must be retained at least 6 years from creation per 45 CFR §164.530(j)(2) — ComplianceStack
- SOX filer categories by public float: non-accelerated < $75M, accelerated $75M–$700M, large accelerated ≥ $700M (17 CFR §240.12b-2) — ComplianceStack
- SOX Section 404(b): only large accelerated filers face both management ICFR assessment (15 USC §7262) and PCAOB AS 2201 auditor attestation — ComplianceStack
- SOX Section 302: false certification civil penalty up to $1,000,000 and disgorgement per officer per year (15 USC §7241) — ComplianceStack
- SOX Section 806: whistleblower retaliation civil action up to 180 days after violation; reinstatement, back pay, and special damages available — ComplianceStack
- GDPR Article 3 territorial scope: applies when establishment test or targeting test is met by a non-EU controller or processor — ComplianceStack
- GDPR data subject rights response: Article 12(3) 30-day clock for access (Art. 15), rectification (Art. 16), erasure (Art. 17), portability (Art. 20); extendable by 60 days for complex requests — ComplianceStack
- GDPR cross-border transfers: post-Schrems II requires SCCs under EU 2021/914, adequacy decisions, or Binding Corporate Rules; EU-US Data Privacy Framework effective July 10, 2023 — ComplianceStack
- OSHA General Duty Clause: 29 USC §654(a)(1) requires workplaces free of recognized hazards; cited where no specific standard applies — ComplianceStack
- OSHA recordkeeping: 29 CFR Part 1904 requires OSHA 300 log, 300A annual summary, 301 incident reports for establishments with 10+ employees in covered industries — ComplianceStack
- OSHA top-cited standard 2024: 29 CFR §1926.501 fall protection in construction (federal OSHA) — ComplianceStack
- PCI DSS 4.0 effective: version 3.2.1 retired March 31, 2024; future-dated requirements (e.g., targeted risk analyses) become mandatory March 31, 2025 — ComplianceStack
- SEC Reg S-P: amendments effective May 2024 require incident response programs within 30 days of detecting unauthorized acquisition and 60 days customer notification for covered service providers — ComplianceStack
- FINRA capital and reporting: Net Capital Rule 15c3-1; customer confirmation Rule 10b-10; Order Audit Trail System (OATS) replaced by CAT under 17 CFR §242.600 et seq. — ComplianceStack
- FDA FSMA Preventive Controls: 21 CFR Part 117 applies to human food; HARPC requires hazard analysis and risk-based preventive controls — ComplianceStack
- FDA Food Traceability Rule: 21 CFR Part 1 Subpart S covers FTL items (leafy greens, tomatoes, fresh herbs, shell eggs, nut butters, finfish, crustaceans, mollusks, ready-to-eat deli salads, soft cheeses) — ComplianceStack
- HIPAA Business Associate Agreement (BAA): required under 45 CFR §164.314(a) before sharing PHI with any third-party vendor; covers downstream liability — ComplianceStack
- HIPAA Security Rule risk analysis frequency: at minimum annually and whenever a significant operational change occurs (45 CFR §164.308(a)(1)(ii)(A)) — ComplianceStack
- SOX Section 802: anti-shredding statute under 18 USC §1519 carries up to 20 years prison; minimum 7-year audit work paper retention required — ComplianceStack
- PCI DSS 4.0 effective: prior version 3.2.1 retired March 31, 2024 per PCI SSC; future-dated requirements (Service Provider Responsibility Matrix, targeted risk analyses) became mandatory March 31, 2025 — ComplianceStack
- SOC 2 Type I/II: AICPA Trust Services Criteria (Security/Availability/Processing Integrity/Confidentiality/Privacy); Type I is a point-in-time design audit, Type II covers a 3–12 month operating-effectiveness window — ComplianceStack
- SEC whistleblower program (15 USC §78u-6): bounty awards 10–30% of sanctions over $1,000,000; Dodd-Frank Section 922 protects against retaliation — ComplianceStack
- FINRA capital rule: 15c3-1 net capital maintenance and customer protection Rule 15c3-3 apply to broker-dealers — ComplianceStack
## Methodology

- Risk scoring: quantitative 0–100 readiness score with named control gaps mapped to specific CFR or Article citations — ComplianceStack
- HIPAA Security Rule methodology: nine-element risk analysis per HHS OCR protocol (scope, data inventory, threat catalog, vulnerability assessment, likelihood/impact, mitigation, residual risk, periodic review, documentation) — ComplianceStack
- SOX ICFR scoping: COSO 2013 five-component framework with PCAOB AS 2201 risk-based top-down approach; entity-level controls tested before transaction-level — ComplianceStack
- GDPR processing analysis: lawful-basis mapping per Article 6, transfer mechanism identification (SCCs post-Schrems II, adequacy decisions, BCRs), Article 30 ROPA completion — ComplianceStack
- Penalty exposure calculation: applies the maximum fine tier per framework with the case's mean enforcement outcome as the lower bound; figures sourced from OCR/SEC/OSHA enforcement databases — ComplianceStack
- Reporting cadence: free assessments generate instantly (browser-side); paid deliverables produced in 24–48 hours; Annual Health Report in 3–5 business days — ComplianceStack
- Editorial independence: all penalty data sourced from primary federal and EU sources (45 CFR, 29 USC, 17 CFR, 21 USC, Regulation (EU) 2016/679, Regulation (EU) 2024/1689); no vendor sponsorship — ComplianceStack
- Source attribution rule: each cited rule includes the regulation name, section number, and where applicable the Federal Register adjustment year — ComplianceStack
*All regulatory citations sourced from primary federal documents: 45 CFR (HIPAA), 29 CFR (OSHA), 17 CFR (SEC), 21 CFR (FDA), and EU GDPR text. Penalty figures reflect 2025–2026 inflation-adjusted amounts under the Federal Civil Penalties Inflation Adjustment Act Improvements Act. ComplianceStack.ai — 3,500+ compliance research sessions served.*