What compliance looks like inside a pull request.
Most controls in a framework never touch code. A few do, and those are the ones a review can catch. These pages take a framework apart and show the controls that surface in a diff, the change that trips each one, and the exact clause heygrc cites.
One framework at a time, at the grain of a code change.
Nine deep dives are live, from ISO 27001 and SOC 2 to GDPR, DORA, NIS 2, the EU AI Act, PCI DSS, HIPAA, and NIST 800-53. More land over time, one framework at a time.
- ISO 27001
The Annex A controls that surface in a diff: logging, cryptography, access restriction, change management, and the clauses heygrc cites for each.
- SOC 2
How the Trust Services Criteria, especially the CC6 logical-access family, map to auth, IAM, and secrets changes in a pull request.
- GDPR
Where data-protection duties land in code: retention bounds, lawful-basis gates, and personal-data flows a review can catch before they ship.
- DORA
ICT risk and resilience obligations for EU financial entities, and the operational-resilience changes that show up at the PR.
- NIS 2
Baseline security and incident-handling duties for in-scope EU operators, mapped to the configuration and monitoring code that carries them.
- EU AI Act
For high-risk AI systems: the logging, human-oversight, data-governance, and robustness duties that live in the pipeline and break in a diff.
- PCI DSS
Where cardholder-data rules meet code: protecting stored account data, encrypting transmission, and keeping the cardholder data environment from quietly expanding.
- HIPAA
The Security Rule's technical safeguards (45 CFR 164.312): access control, encryption, audit, integrity, authentication, and transmission, as they show up in a change touching ePHI.
- NIST 800-53
The control families that surface in a pull request (AC, AU, IA, SC, SI), the catalog many other frameworks point back to, at the grain of a code change.
the full framework catalog, one reviewer.
A deep dive exists for a few of these today and more land over time. heygrc reviews against whichever frameworks your company must meet.
Frameworks in code, asked directly.
Can a pull request violate ISO 27001 or SOC 2?
Not the certificate, the controls. A diff can delete the audit logging ISO 27001 A.8.15 expects, widen access past what SOC 2 CC6.1 allows, or cut a retention window GDPR Art. 5(1)(e) bounds. Each ships as a working change and surfaces months later as an audit finding, which is why the compliance reading belongs at the pull request.
Which compliance frameworks show up in code?
More than most teams expect. ISO 27001, SOC 2, GDPR, DORA, NIS 2, the EU AI Act, PCI DSS, HIPAA, and NIST 800-53 all contain controls that live in code: logging, access control, cryptography, retention, backups. Most controls in any framework are organisational; the coded minority is what drifts one commit at a time.
What does a compliance review of a pull request check?
It reads the changed lines against the frameworks your company selected and asks whether the change puts a control at risk. A useful finding names the exact clause, for example ISO 27001 A.8.15 for a deleted log line, so the engineer can fix it in the same review, before it ships.