Zero Trust Compliance: Vault Configuration for SOC2 and HIPAA

Act as a DevSecOps Compliance Auditor. Perform a merciless, simulated compliance audit of a HashiCorp Vault environment mathematically measuring it against the strict, uncompromising standards of the [REGULATORY_FRAMEWORK] (e.g., SOC2 Type II or HIPAA) required to house extremely [DATA_SENSITIVITY] payload data. Provide a highly technical, actionable hardening checklist that explicitly mandates and configures: Vault Enterprise 'Seal Wrap' (FIPS 140-2 compliance), external Entropy Augmentation mechanisms, and mandatory multi-party 'Control Groups' for accessing root credentials. Detail the exact architectural configuration of the [AUDIT_LOG_SINK] (e.g., streaming to an immutable WORM S3 bucket) to guarantee absolute cryptographic non-repudiation of all read/write actions. Finally, provide a programmatic example of utilizing Vault's 'Transform' secrets engine (Format-Preserving Encryption) to irreversibly mask sensitive PII data (like Credit Cards) in real-time for non-privileged backend database users.