ComplyRim IaC Compliance Validator - SOC 2, HIPAA, FedRAMP, CMMC

Turn IaC Scans Into Audit Evidence - Automatically

Every regulated company using Terraform, CloudFormation, or CDK faces the same problem: free scanners flag misconfigurations, but auditors need control-level evidence - not raw check output. Mapping findings like CKV_AWS_17 to SOC 2 CC6.1, HIPAA 164.312(a)(2)(iv), FedRAMP SC-28, and CMMC SC.L2-3.13.16 by hand takes 20-40 hours per audit cycle. **ComplyRim IaC Compliance Validator does it in 90 seconds.

Four Frameworks. One Scan. Launch Day.

• SOC 2 (AICPA TSC 2017): 12 Trust Service Criteria mapped to infrastructure controls. Your auditor receives a PDF citing CC6.1, CC7.2, and A1.2 directly from your Terraform.
• HIPAA Security Rule (45 CFR Part 164): 8 sections including encryption, audit controls, and transmission security. Every finding cites the exact HIPAA section plus remediation steps.
• FedRAMP Moderate (NIST SP 800-53 Rev 5): 18 controls including AC-3, AU-2, SC-28, SC-12, IA-5, and CM-6. Supports ATO preparation and continuous monitoring evidence requirements.
• CMMC 2.0 Level 2 (NIST SP 800-171 Rev 2): 27 practices across AC, AU, CM, IA, RA, SC, and SI domains. Built for C3PAO assessments. CUI never leaves your account.

What Your Auditor Actually Receives

• Per-framework compliance scores** with percentage of controls passing and trend over time
• Control-level findings showing which control failed, which resource, and the exact IaC file and line number
• Remediation code blocks for Terraform and CloudFormation - copy-paste fixes for every finding
• Executive summary page designed for non-technical stakeholders such as CISOs and board reporting
• JSON export for import into Drata, Vanta, ServiceNow GRC, or any evidence management platform

Your Data Stays in Your Account

The AMI runs entirely within your VPC. No IaC files, no scan results, and no CUI leave your AWS account. This is a hard requirement for FedRAMP continuous monitoring and CMMC assessment environments.

Who Uses ComplyRim IaC Compliance Validator

• FinTech and HealthTech teams generating pre-audit SOC 2 Type II and HIPAA infrastructure evidence without 40 hours of manual control mapping
• DoD contractors and federal agencies producing CMMC Level 2 C3PAO assessment IaC evidence packages and FedRAMP ATO infrastructure evidence
• B2B SaaS companies where SOC 2 Type II is a contract condition required by enterprise customers
• Government contractors preparing for the CMMC Final Rule requiring 80,000 contractors to achieve Level 2 with IaC evidence as a C3PAO requirement
• MSPs delivering per-customer compliance evidence without per-customer licensing overhead

Quick Start

1. Launch the AMI (m5.large recommended) in your VPC. Configure the security group to allow inbound port 8443 from your CI/CD environment.
2. Retrieve your API key from the instance dashboard.
3. Submit a scan via REST API specifying SOC2, HIPAA, FedRAMP, or CMMC frameworks.
4. Download your auditor-ready PDF evidence report.

Instance Sizing: m5.large (2 vCPU, 8 GB) supports up to 10 concurrent scans for projects up to 500 files. m5.xlarge (4 vCPU, 16 GB) handles up to 25 concurrent scans for large monorepos.

Need a free trial? Request a offer at aws@complyrim.com